authentik.providers.oauth2.tests.test_device_init

  1"""Device init tests"""
  2
  3from urllib.parse import urlencode
  4
  5from django.urls import reverse
  6from rest_framework.test import APIClient
  7
  8from authentik.core.models import Application, Group
  9from authentik.core.tests.utils import create_test_admin_user, create_test_brand, create_test_flow
 10from authentik.lib.generators import generate_id
 11from authentik.policies.models import PolicyBinding
 12from authentik.providers.oauth2.models import DeviceToken, OAuth2Provider
 13from authentik.providers.oauth2.tests.utils import OAuthTestCase
 14from authentik.providers.oauth2.views.device_init import QS_KEY_CODE
 15
 16
 17class TesOAuth2DeviceInit(OAuthTestCase):
 18    """Test device init"""
 19
 20    def setUp(self) -> None:
 21        self.provider = OAuth2Provider.objects.create(
 22            name=generate_id(),
 23            client_id="test",
 24            authorization_flow=create_test_flow(),
 25        )
 26        self.application = Application.objects.create(
 27            name=generate_id(),
 28            slug=generate_id(),
 29            provider=self.provider,
 30        )
 31        self.user = create_test_admin_user()
 32        self.client.force_login(self.user)
 33        self.device_flow = create_test_flow()
 34        self.brand = create_test_brand()
 35        self.brand.flow_device_code = self.device_flow
 36        self.brand.save()
 37
 38        self.api_client = APIClient()
 39        self.api_client.force_login(self.user)
 40
 41    def test_device_init_get(self):
 42        """Test device init"""
 43        res = self.client.get(reverse("authentik_providers_oauth2_root:device-login"))
 44        self.assertEqual(res.status_code, 302)
 45        self.assertEqual(
 46            res.url,
 47            reverse(
 48                "authentik_core:if-flow",
 49                kwargs={
 50                    "flow_slug": self.device_flow.slug,
 51                },
 52            )
 53            + "?"
 54            + urlencode({"inspector": "available"}),
 55        )
 56
 57    def test_device_init_post(self):
 58        """Test device init"""
 59        res = self.api_client.get(reverse("authentik_providers_oauth2_root:device-login"))
 60        self.assertEqual(res.status_code, 302)
 61        self.assertEqual(
 62            res.url,
 63            reverse(
 64                "authentik_core:if-flow",
 65                kwargs={
 66                    "flow_slug": self.device_flow.slug,
 67                },
 68            )
 69            + "?"
 70            + urlencode({"inspector": "available"}),
 71        )
 72        res = self.api_client.get(
 73            reverse(
 74                "authentik_api:flow-executor",
 75                kwargs={
 76                    "flow_slug": self.device_flow.slug,
 77                },
 78            ),
 79        )
 80        self.assertEqual(res.status_code, 200)
 81        self.assertJSONEqual(
 82            res.content,
 83            {
 84                "component": "ak-provider-oauth2-device-code",
 85                "flow_info": {
 86                    "background": "/static/dist/assets/images/flow_background.jpg",
 87                    "background_themed_urls": None,
 88                    "cancel_url": "/flows/-/cancel/",
 89                    "layout": "stacked",
 90                    "title": self.device_flow.title,
 91                },
 92            },
 93        )
 94
 95        provider = OAuth2Provider.objects.create(
 96            name=generate_id(),
 97            authorization_flow=create_test_flow(),
 98        )
 99        Application.objects.create(name=generate_id(), slug=generate_id(), provider=provider)
100        token = DeviceToken.objects.create(
101            provider=provider,
102        )
103
104        res = self.api_client.post(
105            reverse(
106                "authentik_api:flow-executor",
107                kwargs={
108                    "flow_slug": self.device_flow.slug,
109                },
110            ),
111            data={
112                "component": "ak-provider-oauth2-device-code",
113                "code": token.user_code,
114            },
115        )
116        self.assertEqual(res.status_code, 200)
117        self.assertJSONEqual(
118            res.content,
119            {
120                "component": "xak-flow-redirect",
121                "to": reverse(
122                    "authentik_core:if-flow",
123                    kwargs={
124                        "flow_slug": provider.authorization_flow.slug,
125                    },
126                )
127                + "?"
128                + urlencode({"inspector": "available"}),
129            },
130        )
131
132    def test_no_flow(self):
133        """Test no flow"""
134        self.brand.flow_device_code = None
135        self.brand.save()
136        res = self.client.get(reverse("authentik_providers_oauth2_root:device-login"))
137        self.assertEqual(res.status_code, 404)
138
139    def test_device_init_qs(self):
140        """Test device init"""
141        token = DeviceToken.objects.create(
142            user_code="foo",
143            provider=self.provider,
144        )
145        res = self.client.get(
146            reverse("authentik_providers_oauth2_root:device-login")
147            + "?"
148            + urlencode({QS_KEY_CODE: token.user_code})
149        )
150        self.assertEqual(res.status_code, 302)
151        self.assertEqual(
152            res.url,
153            reverse(
154                "authentik_core:if-flow",
155                kwargs={
156                    "flow_slug": self.provider.authorization_flow.slug,
157                },
158            )
159            + "?"
160            + urlencode({QS_KEY_CODE: token.user_code, "inspector": "available"}),
161        )
162
163    def test_device_init_denied(self):
164        """Test device init"""
165        group = Group.objects.create(name="foo")
166        PolicyBinding.objects.create(
167            group=group,
168            target=self.application,
169            order=0,
170        )
171        token = DeviceToken.objects.create(
172            user_code="foo",
173            provider=self.provider,
174        )
175        res = self.client.get(
176            reverse("authentik_providers_oauth2_root:device-login")
177            + "?"
178            + urlencode({QS_KEY_CODE: token.user_code})
179        )
180        self.assertEqual(res.status_code, 200)
181        self.assertIn(b"Permission denied", res.content)