@@ -22,6 +22,7 @@ import (
22
22
"github.com/prometheus/client_golang/prometheus"
23
23
"github.com/stretchr/testify/assert"
24
24
"github.com/stretchr/testify/require"
25
+ "go.uber.org/atomic"
25
26
"golang.org/x/oauth2"
26
27
"golang.org/x/xerrors"
27
28
@@ -254,37 +255,64 @@ func TestUserOAuth2Github(t *testing.T) {
254
255
})
255
256
t .Run ("BlockSignups" ,func (t * testing.T ) {
256
257
t .Parallel ()
258
+
259
+ db ,ps := dbtestutil .NewDB (t )
260
+
261
+ id := atomic .NewInt64 (100 )
262
+ login := atomic .NewString ("testuser" )
263
+ email := atomic .NewString ("testuser@coder.com" )
264
+
257
265
client := coderdtest .New (t ,& coderdtest.Options {
266
+ Database :db ,
267
+ Pubsub :ps ,
258
268
GithubOAuth2Config :& coderd.GithubOAuth2Config {
259
269
OAuth2Config :& testutil.OAuth2Config {},
260
270
AllowOrganizations : []string {"coder" },
261
- ListOrganizationMemberships :func (ctx context.Context ,client * http.Client ) ([]* github.Membership ,error ) {
271
+ ListOrganizationMemberships :func (_ context.Context ,_ * http.Client ) ([]* github.Membership ,error ) {
262
272
return []* github.Membership {{
263
273
State :& stateActive ,
264
274
Organization :& github.Organization {
265
275
Login :github .String ("coder" ),
266
276
},
267
277
}},nil
268
278
},
269
- AuthenticatedUser :func (ctx context.Context ,client * http.Client ) (* github.User ,error ) {
279
+ AuthenticatedUser :func (_ context.Context ,_ * http.Client ) (* github.User ,error ) {
280
+ id := id .Load ()
281
+ login := login .Load ()
270
282
return & github.User {
271
- ID :github . Int64 ( 100 ) ,
272
- Login :github . String ( "testuser" ) ,
283
+ ID :& id ,
284
+ Login :& login ,
273
285
Name :github .String ("The Right Honorable Sir Test McUser" ),
274
286
},nil
275
287
},
276
- ListEmails :func (ctx context.Context ,client * http.Client ) ([]* github.UserEmail ,error ) {
288
+ ListEmails :func (_ context.Context ,_ * http.Client ) ([]* github.UserEmail ,error ) {
289
+ email := email .Load ()
277
290
return []* github.UserEmail {{
278
- Email :github . String ( "testuser@coder.com" ) ,
291
+ Email :& email ,
279
292
Verified :github .Bool (true ),
280
293
Primary :github .Bool (true ),
281
294
}},nil
282
295
},
283
296
},
284
297
})
285
298
299
+ // The first user in a deployment with signups disabled will be allowed to sign up,
300
+ // but all the other users will not.
286
301
resp := oauth2Callback (t ,client )
302
+ require .Equal (t ,http .StatusTemporaryRedirect ,resp .StatusCode )
303
+
304
+ ctx := testutil .Context (t ,testutil .WaitLong )
305
+
306
+ // nolint:gocritic // Unit test
307
+ count ,err := db .GetUserCount (dbauthz .AsSystemRestricted (ctx ))
308
+ require .NoError (t ,err )
309
+ require .Equal (t ,int64 (1 ),count )
310
+
311
+ id .Store (101 )
312
+ email .Store ("someotheruser@coder.com" )
313
+ login .Store ("someotheruser" )
287
314
315
+ resp = oauth2Callback (t ,client )
288
316
require .Equal (t ,http .StatusForbidden ,resp .StatusCode )
289
317
})
290
318
t .Run ("MultiLoginNotAllowed" ,func (t * testing.T ) {
@@ -988,6 +1016,7 @@ func TestUserOIDC(t *testing.T) {
988
1016
IgnoreEmailVerified bool
989
1017
IgnoreUserInfo bool
990
1018
UseAccessToken bool
1019
+ PrecreateFirstUser bool
991
1020
}{
992
1021
{
993
1022
Name :"NoSub" ,
@@ -1150,7 +1179,17 @@ func TestUserOIDC(t *testing.T) {
1150
1179
"email_verified" :true ,
1151
1180
"sub" :uuid .NewString (),
1152
1181
},
1153
- StatusCode :http .StatusForbidden ,
1182
+ StatusCode :http .StatusForbidden ,
1183
+ PrecreateFirstUser :true ,
1184
+ },
1185
+ {
1186
+ Name :"FirstSignup" ,
1187
+ IDTokenClaims : jwt.MapClaims {
1188
+ "email" :"kyle@kwc.io" ,
1189
+ "email_verified" :true ,
1190
+ "sub" :uuid .NewString (),
1191
+ },
1192
+ StatusCode :http .StatusOK ,
1154
1193
},
1155
1194
{
1156
1195
Name :"UsernameFromEmail" ,
@@ -1443,15 +1482,22 @@ func TestUserOIDC(t *testing.T) {
1443
1482
})
1444
1483
numLogs := len (auditor .AuditLogs ())
1445
1484
1485
+ ctx := testutil .Context (t ,testutil .WaitShort )
1486
+ if tc .PrecreateFirstUser {
1487
+ owner .CreateFirstUser (ctx , codersdk.CreateFirstUserRequest {
1488
+ Email :"precreated@coder.com" ,
1489
+ Username :"precreated" ,
1490
+ Password :"SomeSecurePassword!" ,
1491
+ })
1492
+ }
1493
+
1446
1494
client ,resp := fake .AttemptLogin (t ,owner ,tc .IDTokenClaims )
1447
1495
numLogs ++ // add an audit log for login
1448
1496
require .Equal (t ,tc .StatusCode ,resp .StatusCode )
1449
1497
if tc .AssertResponse != nil {
1450
1498
tc .AssertResponse (t ,resp )
1451
1499
}
1452
1500
1453
- ctx := testutil .Context (t ,testutil .WaitShort )
1454
-
1455
1501
if tc .AssertUser != nil {
1456
1502
user ,err := client .User (ctx ,"me" )
1457
1503
require .NoError (t ,err )