authentik.lib.tests.test_config

  1"""Test config loader"""
  2
  3import base64
  4from json import dumps
  5from os import chmod, environ, unlink, write
  6from tempfile import mkstemp
  7from unittest import mock
  8
  9from django.conf import ImproperlyConfigured
 10from django.test import TestCase
 11
 12from authentik.lib.config import (
 13    ENV_PREFIX,
 14    UNSET,
 15    Attr,
 16    AttrEncoder,
 17    ConfigLoader,
 18    django_db_config,
 19)
 20
 21
 22class TestConfig(TestCase):
 23    """Test config loader"""
 24
 25    check_deprecations_env_vars = {
 26        ENV_PREFIX + "_WORKER__CONCURRENCY": "2",
 27    }
 28
 29    @mock.patch.dict(environ, {ENV_PREFIX + "_test__test": "bar"})
 30    def test_env(self):
 31        """Test simple instance"""
 32        config = ConfigLoader()
 33        config.update_from_env()
 34        self.assertEqual(config.get("test.test"), "bar")
 35
 36    def test_patch(self):
 37        """Test patch decorator"""
 38        config = ConfigLoader()
 39        config.set("foo.bar", "bar")
 40        self.assertEqual(config.get("foo.bar"), "bar")
 41        with config.patch("foo.bar", "baz"):
 42            self.assertEqual(config.get("foo.bar"), "baz")
 43        self.assertEqual(config.get("foo.bar"), "bar")
 44
 45    @mock.patch.dict(environ, {"foo": "bar"})
 46    def test_uri_env(self):
 47        """Test URI parsing (environment)"""
 48        config = ConfigLoader()
 49        foo_uri = "env://foo"
 50        foo_parsed = config.parse_uri(foo_uri)
 51        self.assertEqual(foo_parsed.value, "bar")
 52        self.assertEqual(foo_parsed.source_type, Attr.Source.URI)
 53        self.assertEqual(foo_parsed.source, foo_uri)
 54        foo_bar_uri = "env://foo?bar"
 55        foo_bar_parsed = config.parse_uri(foo_bar_uri)
 56        self.assertEqual(foo_bar_parsed.value, "bar")
 57        self.assertEqual(foo_bar_parsed.source_type, Attr.Source.URI)
 58        self.assertEqual(foo_bar_parsed.source, foo_bar_uri)
 59
 60    def test_uri_file(self):
 61        """Test URI parsing (file load)"""
 62        config = ConfigLoader()
 63        file, file_name = mkstemp()
 64        write(file, b"foo")
 65        _, file2_name = mkstemp()
 66        chmod(file2_name, 0o000)  # Remove all permissions so we can't read the file
 67        self.assertEqual(config.parse_uri(f"file://{file_name}").value, "foo")
 68        self.assertEqual(config.parse_uri(f"file://{file2_name}?def").value, "def")
 69        unlink(file_name)
 70        unlink(file2_name)
 71
 72    def test_uri_file_update(self):
 73        """Test URI parsing (file load and update)"""
 74        file, file_name = mkstemp()
 75        write(file, b"foo")
 76        config = ConfigLoader(file_test=f"file://{file_name}")
 77        self.assertEqual(config.get("file_test"), "foo")
 78
 79        # Update config file
 80        write(file, b"bar")
 81        config.refresh("file_test")
 82        self.assertEqual(config.get("file_test"), "foobar")
 83
 84        unlink(file_name)
 85
 86    def test_uri_env_full(self):
 87        """Test URI set as env variable"""
 88        environ["AUTHENTIK_TEST_VAR"] = "file:///foo?bar"
 89        config = ConfigLoader()
 90        self.assertEqual(config.get("test_var"), "bar")
 91
 92    def test_file_update(self):
 93        """Test update_from_file"""
 94        config = ConfigLoader()
 95        file, file_name = mkstemp()
 96        write(file, b"{")
 97        file2, file2_name = mkstemp()
 98        write(file2, b"{")
 99        chmod(file2_name, 0o000)  # Remove all permissions so we can't read the file
100        with self.assertRaises(ImproperlyConfigured):
101            config.update_from_file(file_name)
102        config.update_from_file(file2_name)
103        unlink(file_name)
104        unlink(file2_name)
105
106    def test_get_int(self):
107        """Test get_int"""
108        config = ConfigLoader()
109        config.set("foo", 1234)
110        self.assertEqual(config.get_int("foo"), 1234)
111
112    def test_get_int_invalid(self):
113        """Test get_int"""
114        config = ConfigLoader()
115        config.set("foo", "bar")
116        self.assertEqual(config.get_int("foo", 1234), 1234)
117
118    def test_get_dict_from_b64_json(self):
119        """Test get_dict_from_b64_json"""
120        config = ConfigLoader()
121        test_value = b'  { "foo": "bar"   }   '
122        b64_value = base64.b64encode(test_value)
123        config.set("foo", b64_value)
124        self.assertEqual(config.get_dict_from_b64_json("foo"), {"foo": "bar"})
125
126    def test_get_dict_from_b64_json_missing_brackets(self):
127        """Test get_dict_from_b64_json with missing brackets"""
128        config = ConfigLoader()
129        test_value = b' "foo": "bar"     '
130        b64_value = base64.b64encode(test_value)
131        config.set("foo", b64_value)
132        self.assertEqual(config.get_dict_from_b64_json("foo"), {})
133
134    def test_get_dict_from_b64_json_invalid(self):
135        """Test get_dict_from_b64_json with invalid value"""
136        config = ConfigLoader()
137        config.set("foo", "bar")
138        self.assertEqual(config.get_dict_from_b64_json("foo"), {})
139
140    def test_attr_json_encoder(self):
141        """Test AttrEncoder"""
142        test_attr = Attr("foo", Attr.Source.ENV, "AUTHENTIK_POSTGRESQL__USERNAME")
143        json_attr = dumps(test_attr, indent=4, cls=AttrEncoder)
144        self.assertEqual(json_attr, '"foo"')
145
146    def test_attr_json_encoder_no_attr(self):
147        """Test AttrEncoder if no Attr is passed"""
148
149        class Test:
150            """Non Attr class"""
151
152        with self.assertRaises(TypeError):
153            test_obj = Test()
154            dumps(test_obj, indent=4, cls=AttrEncoder)
155
156    def test_get_optional_int(self):
157        config = ConfigLoader()
158        self.assertEqual(config.get_optional_int("foo", 21), 21)
159        self.assertEqual(config.get_optional_int("foo"), None)
160        config.set("foo", "21")
161        self.assertEqual(config.get_optional_int("foo"), 21)
162        self.assertEqual(config.get_optional_int("foo", 0), 21)
163        self.assertEqual(config.get_optional_int("foo", "null"), 21)
164        config.set("foo", "null")
165        self.assertEqual(config.get_optional_int("foo"), None)
166        self.assertEqual(config.get_optional_int("foo", 21), None)
167
168    @mock.patch.dict(environ, check_deprecations_env_vars)
169    def test_check_deprecations(self):
170        """Test config key re-write for deprecated env vars"""
171        config = ConfigLoader()
172        config.update_from_env()
173        config.check_deprecations()
174        self.assertEqual(config.get("worker.concurrency", UNSET), UNSET)
175        self.assertEqual(config.get("worker.threads"), 2)
176
177    def test_get_keys(self):
178        """Test get_keys"""
179        config = ConfigLoader()
180        config.set("foo.bar", "baz")
181        self.assertEqual(list(config.get_keys("foo")), ["bar"])
182
183    def test_db_default(self):
184        """Test default DB Config"""
185        config = ConfigLoader()
186        config.set("postgresql.host", "foo")
187        config.set("postgresql.name", "foo")
188        config.set("postgresql.user", "foo")
189        config.set("postgresql.password", "foo")
190        config.set("postgresql.port", "foo")
191        config.set("postgresql.sslmode", "foo")
192        config.set("postgresql.sslrootcert", "foo")
193        config.set("postgresql.sslcert", "foo")
194        config.set("postgresql.sslkey", "foo")
195        config.set("postgresql.test.name", "foo")
196        conf = django_db_config(config)
197        self.assertEqual(
198            conf,
199            {
200                "default": {
201                    "ENGINE": "psqlextra.backend",
202                    "HOST": "foo",
203                    "NAME": "foo",
204                    "OPTIONS": {
205                        "pool": False,
206                        "sslcert": "foo",
207                        "sslkey": "foo",
208                        "sslmode": "foo",
209                        "sslrootcert": "foo",
210                    },
211                    "PASSWORD": "foo",
212                    "PORT": "foo",
213                    "TEST": {"NAME": "foo"},
214                    "USER": "foo",
215                    "CONN_MAX_AGE": 0,
216                    "CONN_HEALTH_CHECKS": False,
217                    "DISABLE_SERVER_SIDE_CURSORS": False,
218                }
219            },
220        )
221
222    def test_db_conn_max_age(self):
223        """Test DB conn_max_age Config"""
224        config = ConfigLoader()
225        config.set("postgresql.conn_max_age", "null")
226        conf = django_db_config(config)
227        self.assertEqual(
228            conf["default"]["CONN_MAX_AGE"],
229            None,
230        )
231
232    def test_db_read_replicas(self):
233        """Test read replicas"""
234        config = ConfigLoader()
235        config.set("postgresql.host", "foo")
236        config.set("postgresql.name", "foo")
237        config.set("postgresql.user", "foo")
238        config.set("postgresql.password", "foo")
239        config.set("postgresql.port", "foo")
240        config.set("postgresql.sslmode", "foo")
241        config.set("postgresql.sslrootcert", "foo")
242        config.set("postgresql.sslcert", "foo")
243        config.set("postgresql.sslkey", "foo")
244        config.set("postgresql.test.name", "foo")
245        # Read replica
246        config.set("postgresql.read_replicas.0.host", "bar")
247        conf = django_db_config(config)
248        self.assertEqual(
249            conf,
250            {
251                "default": {
252                    "ENGINE": "psqlextra.backend",
253                    "HOST": "foo",
254                    "NAME": "foo",
255                    "OPTIONS": {
256                        "pool": False,
257                        "sslcert": "foo",
258                        "sslkey": "foo",
259                        "sslmode": "foo",
260                        "sslrootcert": "foo",
261                    },
262                    "PASSWORD": "foo",
263                    "PORT": "foo",
264                    "TEST": {"NAME": "foo"},
265                    "USER": "foo",
266                    "CONN_MAX_AGE": 0,
267                    "CONN_HEALTH_CHECKS": False,
268                    "DISABLE_SERVER_SIDE_CURSORS": False,
269                },
270                "replica_0": {
271                    "ENGINE": "psqlextra.backend",
272                    "HOST": "bar",
273                    "NAME": "foo",
274                    "OPTIONS": {
275                        "pool": False,
276                        "sslcert": "foo",
277                        "sslkey": "foo",
278                        "sslmode": "foo",
279                        "sslrootcert": "foo",
280                    },
281                    "PASSWORD": "foo",
282                    "PORT": "foo",
283                    "TEST": {"NAME": "foo"},
284                    "USER": "foo",
285                    "CONN_MAX_AGE": 0,
286                    "CONN_HEALTH_CHECKS": False,
287                    "DISABLE_SERVER_SIDE_CURSORS": False,
288                },
289            },
290        )
291
292    def test_db_read_replicas_pgbouncer(self):
293        """Test read replicas"""
294        config = ConfigLoader()
295        config.set("postgresql.host", "foo")
296        config.set("postgresql.name", "foo")
297        config.set("postgresql.user", "foo")
298        config.set("postgresql.password", "foo")
299        config.set("postgresql.port", "foo")
300        config.set("postgresql.sslmode", "foo")
301        config.set("postgresql.sslrootcert", "foo")
302        config.set("postgresql.sslcert", "foo")
303        config.set("postgresql.sslkey", "foo")
304        config.set("postgresql.test.name", "foo")
305        config.set("postgresql.use_pgbouncer", True)
306        # Read replica
307        config.set("postgresql.read_replicas.0.host", "bar")
308        # Override conn_max_age
309        config.set("postgresql.read_replicas.0.conn_max_age", 10)
310        # This isn't supported
311        config.set("postgresql.read_replicas.0.use_pgbouncer", False)
312        conf = django_db_config(config)
313        self.assertEqual(
314            conf,
315            {
316                "default": {
317                    "DISABLE_SERVER_SIDE_CURSORS": True,
318                    "CONN_MAX_AGE": None,
319                    "CONN_HEALTH_CHECKS": False,
320                    "ENGINE": "psqlextra.backend",
321                    "HOST": "foo",
322                    "NAME": "foo",
323                    "OPTIONS": {
324                        "pool": False,
325                        "sslcert": "foo",
326                        "sslkey": "foo",
327                        "sslmode": "foo",
328                        "sslrootcert": "foo",
329                    },
330                    "PASSWORD": "foo",
331                    "PORT": "foo",
332                    "TEST": {"NAME": "foo"},
333                    "USER": "foo",
334                },
335                "replica_0": {
336                    "DISABLE_SERVER_SIDE_CURSORS": True,
337                    "CONN_MAX_AGE": 10,
338                    "CONN_HEALTH_CHECKS": False,
339                    "ENGINE": "psqlextra.backend",
340                    "HOST": "bar",
341                    "NAME": "foo",
342                    "OPTIONS": {
343                        "pool": False,
344                        "sslcert": "foo",
345                        "sslkey": "foo",
346                        "sslmode": "foo",
347                        "sslrootcert": "foo",
348                    },
349                    "PASSWORD": "foo",
350                    "PORT": "foo",
351                    "TEST": {"NAME": "foo"},
352                    "USER": "foo",
353                },
354            },
355        )
356
357    def test_db_read_replicas_pgpool(self):
358        """Test read replicas"""
359        config = ConfigLoader()
360        config.set("postgresql.host", "foo")
361        config.set("postgresql.name", "foo")
362        config.set("postgresql.user", "foo")
363        config.set("postgresql.password", "foo")
364        config.set("postgresql.port", "foo")
365        config.set("postgresql.sslmode", "foo")
366        config.set("postgresql.sslrootcert", "foo")
367        config.set("postgresql.sslcert", "foo")
368        config.set("postgresql.sslkey", "foo")
369        config.set("postgresql.test.name", "foo")
370        config.set("postgresql.use_pgpool", True)
371        # Read replica
372        config.set("postgresql.read_replicas.0.host", "bar")
373        # This isn't supported
374        config.set("postgresql.read_replicas.0.use_pgpool", False)
375        conf = django_db_config(config)
376        self.assertEqual(
377            conf,
378            {
379                "default": {
380                    "DISABLE_SERVER_SIDE_CURSORS": True,
381                    "CONN_MAX_AGE": 0,
382                    "CONN_HEALTH_CHECKS": False,
383                    "ENGINE": "psqlextra.backend",
384                    "HOST": "foo",
385                    "NAME": "foo",
386                    "OPTIONS": {
387                        "pool": False,
388                        "sslcert": "foo",
389                        "sslkey": "foo",
390                        "sslmode": "foo",
391                        "sslrootcert": "foo",
392                    },
393                    "PASSWORD": "foo",
394                    "PORT": "foo",
395                    "TEST": {"NAME": "foo"},
396                    "USER": "foo",
397                },
398                "replica_0": {
399                    "DISABLE_SERVER_SIDE_CURSORS": True,
400                    "CONN_MAX_AGE": 0,
401                    "CONN_HEALTH_CHECKS": False,
402                    "ENGINE": "psqlextra.backend",
403                    "HOST": "bar",
404                    "NAME": "foo",
405                    "OPTIONS": {
406                        "pool": False,
407                        "sslcert": "foo",
408                        "sslkey": "foo",
409                        "sslmode": "foo",
410                        "sslrootcert": "foo",
411                    },
412                    "PASSWORD": "foo",
413                    "PORT": "foo",
414                    "TEST": {"NAME": "foo"},
415                    "USER": "foo",
416                },
417            },
418        )
419
420    def test_db_read_replicas_diff_ssl(self):
421        """Test read replicas (with different SSL Settings)"""
422        """Test read replicas"""
423        config = ConfigLoader()
424        config.set("postgresql.host", "foo")
425        config.set("postgresql.name", "foo")
426        config.set("postgresql.user", "foo")
427        config.set("postgresql.password", "foo")
428        config.set("postgresql.port", "foo")
429        config.set("postgresql.sslmode", "foo")
430        config.set("postgresql.sslrootcert", "foo")
431        config.set("postgresql.sslcert", "foo")
432        config.set("postgresql.sslkey", "foo")
433        config.set("postgresql.test.name", "foo")
434        # Read replica
435        config.set("postgresql.read_replicas.0.host", "bar")
436        config.set("postgresql.read_replicas.0.sslcert", "bar")
437        conf = django_db_config(config)
438        self.assertEqual(
439            conf,
440            {
441                "default": {
442                    "ENGINE": "psqlextra.backend",
443                    "HOST": "foo",
444                    "NAME": "foo",
445                    "OPTIONS": {
446                        "pool": False,
447                        "sslcert": "foo",
448                        "sslkey": "foo",
449                        "sslmode": "foo",
450                        "sslrootcert": "foo",
451                    },
452                    "PASSWORD": "foo",
453                    "PORT": "foo",
454                    "TEST": {"NAME": "foo"},
455                    "USER": "foo",
456                    "DISABLE_SERVER_SIDE_CURSORS": False,
457                    "CONN_MAX_AGE": 0,
458                    "CONN_HEALTH_CHECKS": False,
459                },
460                "replica_0": {
461                    "ENGINE": "psqlextra.backend",
462                    "HOST": "bar",
463                    "NAME": "foo",
464                    "OPTIONS": {
465                        "pool": False,
466                        "sslcert": "bar",
467                        "sslkey": "foo",
468                        "sslmode": "foo",
469                        "sslrootcert": "foo",
470                    },
471                    "PASSWORD": "foo",
472                    "PORT": "foo",
473                    "TEST": {"NAME": "foo"},
474                    "USER": "foo",
475                    "DISABLE_SERVER_SIDE_CURSORS": False,
476                    "CONN_MAX_AGE": 0,
477                    "CONN_HEALTH_CHECKS": False,
478                },
479            },
480        )
481
482    def test_db_conn_options(self):
483        config = ConfigLoader()
484        config.set(
485            "postgresql.conn_options",
486            base64.b64encode(
487                dumps(
488                    {
489                        "connect_timeout": "10",
490                    }
491                ).encode()
492            ).decode(),
493        )
494        config.set("postgresql.read_replicas.0.host", "bar")
495
496        conf = django_db_config(config)
497
498        self.assertEqual(
499            conf["default"]["OPTIONS"]["connect_timeout"],
500            "10",
501        )
502        self.assertNotIn("connect_timeout", conf["replica_0"]["OPTIONS"])
503
504    def test_db_conn_options_read_replicas(self):
505        config = ConfigLoader()
506        config.set(
507            "postgresql.replica_conn_options",
508            base64.b64encode(
509                dumps(
510                    {
511                        "connect_timeout": "10",
512                    }
513                ).encode()
514            ).decode(),
515        )
516        config.set("postgresql.read_replicas.0.host", "bar")
517        config.set("postgresql.read_replicas.1.host", "bar")
518        config.set(
519            "postgresql.read_replicas.1.conn_options",
520            base64.b64encode(
521                dumps(
522                    {
523                        "connect_timeout": "20",
524                    }
525                ).encode()
526            ).decode(),
527        )
528
529        conf = django_db_config(config)
530
531        self.assertNotIn("connect_timeout", conf["default"]["OPTIONS"])
532        self.assertEqual(
533            conf["replica_0"]["OPTIONS"]["connect_timeout"],
534            "10",
535        )
536        self.assertEqual(
537            conf["replica_1"]["OPTIONS"]["connect_timeout"],
538            "20",
539        )
540
541    # FIXME: Temporarily force pool to be deactivated.
542    # See https://github.com/goauthentik/authentik/issues/14320
543    # def test_db_pool(self):
544    #     """Test DB Config with pool"""
545    #     config = ConfigLoader()
546    #     config.set("postgresql.host", "foo")
547    #     config.set("postgresql.name", "foo")
548    #     config.set("postgresql.user", "foo")
549    #     config.set("postgresql.password", "foo")
550    #     config.set("postgresql.port", "foo")
551    #     config.set("postgresql.test.name", "foo")
552    #     config.set("postgresql.use_pool", True)
553    #     conf = django_db_config(config)
554    #     self.assertEqual(
555    #         conf,
556    #         {
557    #             "default": {
558    #                 "ENGINE": "psqlextra.backend",
559    #                 "HOST": "foo",
560    #                 "NAME": "foo",
561    #                 "OPTIONS": {
562    #                     "pool": True,
563    #                     "sslcert": None,
564    #                     "sslkey": None,
565    #                     "sslmode": None,
566    #                     "sslrootcert": None,
567    #                 },
568    #                 "PASSWORD": "foo",
569    #                 "PORT": "foo",
570    #                 "TEST": {"NAME": "foo"},
571    #                 "USER": "foo",
572    #                 "CONN_MAX_AGE": 0,
573    #                 "CONN_HEALTH_CHECKS": False,
574    #                 "DISABLE_SERVER_SIDE_CURSORS": False,
575    #             }
576    #         },
577    #     )
578
579    # def test_db_pool_options(self):
580    #     """Test DB Config with pool"""
581    #     config = ConfigLoader()
582    #     config.set("postgresql.host", "foo")
583    #     config.set("postgresql.name", "foo")
584    #     config.set("postgresql.user", "foo")
585    #     config.set("postgresql.password", "foo")
586    #     config.set("postgresql.port", "foo")
587    #     config.set("postgresql.test.name", "foo")
588    #     config.set("postgresql.use_pool", True)
589    #     config.set(
590    #         "postgresql.pool_options",
591    #         base64.b64encode(
592    #             dumps(
593    #                 {
594    #                     "max_size": 15,
595    #                 }
596    #             ).encode()
597    #         ).decode(),
598    #     )
599    #     conf = django_db_config(config)
600    #     self.assertEqual(
601    #         conf,
602    #         {
603    #             "default": {
604    #                 "ENGINE": "psqlextra.backend",
605    #                 "HOST": "foo",
606    #                 "NAME": "foo",
607    #                 "OPTIONS": {
608    #                     "pool": {
609    #                         "max_size": 15,
610    #                     },
611    #                     "sslcert": None,
612    #                     "sslkey": None,
613    #                     "sslmode": None,
614    #                     "sslrootcert": None,
615    #                 },
616    #                 "PASSWORD": "foo",
617    #                 "PORT": "foo",
618    #                 "TEST": {"NAME": "foo"},
619    #                 "USER": "foo",
620    #                 "CONN_MAX_AGE": 0,
621    #                 "CONN_HEALTH_CHECKS": False,
622    #                 "DISABLE_SERVER_SIDE_CURSORS": False,
623    #             }
624    #         },
625    #     )