Replace the Python/kaya server in server/ with a Rust Cargo workspace of three crates mirroring the old layout: tavolo-platform (lobby API, live-game store, websocket endpoint, deadline scheduler, stats/Elo, OIDC sessions), tavolo-scopone (pure scopone scientifico rules plus the platform adapter) and tavolo-app (composition root and the `tavolo` binary with serve/migrate/backfill-elo). The HTTP and WebSocket contracts, error messages, Redis key layout and Postgres schema are unchanged, so the existing web/ frontend and in-flight games keep working. Notable differences: sessions are JSON under tavolo:session: (Python pickle sessions invalidate once), LOGGING_CONFIG is ignored in favour of RUST_LOG, DATABASE_URL must be Postgres, sqlx migrations replace aerich, and OpenTelemetry exports Rust process metrics instead of CPython gc metrics (no Postgres/Redis client instrumentation). Docker Compose and the Kubernetes manifest now run the single Rust image (embedded migrations, /static and /assets served by the app); the release CI keeps building server/Dockerfile. The full test suite (scopone rules, platform store/deadlines/stats/websockets, OIDC login flow, scopone e2e) is ported and runs with cargo test --workspace; Redis/Postgres integration tests are gated on TEST_REDIS_URL/TEST_DATABASE_URL.
This commit is contained in:
woggioni committed
1 parent
adc3d340b1
commit
7b3b38ccbc
136 files changed
+16821
-11777
No files matched your search
@@ -0,0 +1,319 @@
|
||||
//! End-to-end OIDC login flow against a mock provider.
|
||||
|
||||
use std::net::SocketAddr;
|
||||
use std::sync::Arc;
|
||||
|
||||
use axum::extract::{Query, State};
|
||||
use axum::routing::{get, post};
|
||||
use axum::{Json, Router};
|
||||
use chrono::Utc;
|
||||
use serde_json::{json, Value};
|
||||
use tokio::sync::Mutex;
|
||||
use tower::ServiceExt;
|
||||
|
||||
use tavolo_app::app;
|
||||
use tavolo_app::config::Settings;
|
||||
use tavolo_platform::oidc::OidcProviderConfig;
|
||||
|
||||
const RSA_PEM: &str = r#"-----BEGIN PRIVATE KEY-----
|
||||
MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQCMKcE4AgsStq5u
|
||||
l3Rtg9p2XNN5l5N5z1orqDJmRHAJvSNqhr2BHxu5Q1m3o8prvE+lHRqe1lgJXKi5
|
||||
8aITv6hDKkS9gmp+tvVQ/VJnnKSbgaSJSMEf5P5GoLR43SrsTEtbxlVO03kwCkiH
|
||||
EoOihK0h4GgyIE/3UWkgsJ8eJKi+czBzBffX8+qfR29vJGEk1mhpHIBnHI+19pLV
|
||||
q0GvMcqKA4hnTZwB43/8EI6lZb59r1ZJLvz87AKd/VnXW4zki16PHntkrrRfRl+U
|
||||
Q5k+ErSYp0SXtyh9mONzxGDQ+ra7gIx8itTnSAbYTwi846UzSTltCCYqTwkvi4nm
|
||||
aCmKn3mdAgMBAAECggEARUGKegC0dPo0JWwLuONKSmriiXWmhq04qlKxGIwfagh9
|
||||
W/EY6Ri0a63GQnGZnvNMzVKcqThTBsk0i7BD/Asa+pkDnzo2IceIXozVL2IcicQc
|
||||
x0LePkK5i69zjTcHMvwdzkqpM0pV2rFyFd/FkEOLgq4t/fquWI9u6RqsfMnzYSqx
|
||||
XxS4JsC6dEgNK69lH2OTWvmpgpujrwWAiJVNlKY0Ehh0R8Wruy7iPjo6NLWH8sQq
|
||||
XlCxIoeWCcPgCbtQRmLgNJPdFB8zSTYGFqGJ5lfYq/7qkcQsAEwIUJBF+EMU+yK5
|
||||
y8jxiGF+8wDg4bYovNxs0uxU/HltHPGDfe1Yn2OyNwKBgQDA7GNsj4hxDME0rXnI
|
||||
8SMnSjOVQRsmNTa6Je3XKXuTxzqXwYBndILmTYOmejYnQJ7oToAn1Jiyk9yo+Mzd
|
||||
2sxKU9iHMVABuLiFmbUm269WB2Zh7fQ7ErhIVGTNsPsHv2iuSuOktGQw6Cd+9pBH
|
||||
0H8HCf9dWOzQ01lqdKw60UfH2wKBgQC5/VnnCtQ4n+aAzSYLYgZf97XTTKN2+gGq
|
||||
z2caPga/3yA+1dPx18JjVqlEuAxazXQPxgAL2ZnGHQfLR+M0lInHhljrALKHTzMl
|
||||
MsmLTq+J8DChlGIPJIKc0Uk4vLSJLMkaHBS9gM9z49zdGx2ltI4gGUJIKk4z5gT0
|
||||
iqRFXM1Z5wKBgAuOna4lMxFCqFhVhBQrjeWOpmRskAnL6klgeE0JaSPDLZlluCF6
|
||||
c1UEk7xnWdMkJeDYwwifzb306aUdsngf4VkaiMAgjiBsRnGKcbWwN2K58sIvFRBs
|
||||
4KlElP1VetRN/SFjzxtQyye64JLUhnQm41Uynh+jchxYbOTZtG+Zlek9AoGADPsP
|
||||
sT5iPWl7jvXCd/zpcP065Xpt1jnwr9k12vEFS5LpDzmhRznFyWUc/zzRL+0y8n7h
|
||||
NfKD9v3Ds35a7yqGyzQnNI+h5iuy6B+5TU26lqf63OwcQ+5KZ2N79sfE2eYUSww2
|
||||
rls1H2OB4LSpxwzo9niM1biOKLUfF2otuOGXO3UCgYBIDAvpabTpw6z4IBQGwHKP
|
||||
WOTFrtI/y0Zqf3iNusqb8RdCIokDHvT+fKdvI7VXzaASWt2GajMHArWB6uu/1Xeh
|
||||
nF9SaK1F+mKyGv9a5m5We9VzRNXmaUaQBRLK3XjBr1Co4/UduYRDdqZo/E/5g8gr
|
||||
BMZbIcEMr49N2ns4yHzJ3w==
|
||||
-----END PRIVATE KEY-----
|
||||
"#;
|
||||
|
||||
const JWK: &str = r#"{"kty":"RSA","use":"sig","alg":"RS256","kid":"test-key","n":"jCnBOAILEraubpd0bYPadlzTeZeTec9aK6gyZkRwCb0jaoa9gR8buUNZt6PKa7xPpR0antZYCVyoufGiE7-oQypEvYJqfrb1UP1SZ5ykm4GkiUjBH-T-RqC0eN0q7ExLW8ZVTtN5MApIhxKDooStIeBoMiBP91FpILCfHiSovnMwcwX31_Pqn0dvbyRhJNZoaRyAZxyPtfaS1atBrzHKigOIZ02cAeN__BCOpWW-fa9WSS78_OwCnf1Z11uM5Itejx57ZK60X0ZflEOZPhK0mKdEl7cofZjjc8Rg0Pq2u4CMfIrU50gG2E8IvOOlM0k5bQgmKk8JL4uJ5mgpip95nQ","e":"AQAB"}"#;
|
||||
|
||||
#[derive(Clone, Default)]
|
||||
struct IdpState {
|
||||
issuer: String,
|
||||
nonce: Arc<Mutex<String>>,
|
||||
}
|
||||
|
||||
struct Idp {
|
||||
state: IdpState,
|
||||
addr: SocketAddr,
|
||||
}
|
||||
|
||||
async fn start_idp() -> Idp {
|
||||
let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
|
||||
.await
|
||||
.expect("bind idp");
|
||||
let addr = listener.local_addr().expect("idp addr");
|
||||
let base = format!("http://{addr}");
|
||||
let state = IdpState {
|
||||
issuer: base.clone(),
|
||||
..Default::default()
|
||||
};
|
||||
let router = Router::new()
|
||||
.route(
|
||||
"/.well-known/openid-configuration",
|
||||
get({
|
||||
let base = base.clone();
|
||||
move || async move {
|
||||
Json(json!({
|
||||
"issuer": base,
|
||||
"authorization_endpoint": format!("{base}/authorize"),
|
||||
"token_endpoint": format!("{base}/token"),
|
||||
"userinfo_endpoint": format!("{base}/userinfo"),
|
||||
"jwks_uri": format!("{base}/jwks"),
|
||||
}))
|
||||
}
|
||||
}),
|
||||
)
|
||||
.route(
|
||||
"/authorize",
|
||||
get(
|
||||
|State(state): State<IdpState>,
|
||||
Query(params): Query<std::collections::HashMap<String, String>>| async move {
|
||||
if let Some(nonce) = params.get("nonce") {
|
||||
*state.nonce.lock().await = nonce.clone();
|
||||
}
|
||||
let state_param = params.get("state").cloned().unwrap_or_default();
|
||||
let redirect_uri = params
|
||||
.get("redirect_uri")
|
||||
.cloned()
|
||||
.unwrap_or_else(|| "/".into());
|
||||
let location = format!("{redirect_uri}?code=test-code&state={state_param}");
|
||||
(
|
||||
axum::http::StatusCode::FOUND,
|
||||
[(axum::http::header::LOCATION, location)],
|
||||
)
|
||||
},
|
||||
),
|
||||
)
|
||||
.route(
|
||||
"/token",
|
||||
post(|State(state): State<IdpState>| async move {
|
||||
let nonce = state.nonce.lock().await.clone();
|
||||
let now = Utc::now().timestamp();
|
||||
let claims = json!({
|
||||
"iss": state.issuer,
|
||||
"aud": "tavolo",
|
||||
"sub": "alice",
|
||||
"exp": now + 600,
|
||||
"iat": now,
|
||||
"nonce": nonce,
|
||||
});
|
||||
let token = jsonwebtoken::encode(
|
||||
&jsonwebtoken::Header::new(jsonwebtoken::Algorithm::RS256),
|
||||
&claims,
|
||||
&jsonwebtoken::EncodingKey::from_rsa_pem(RSA_PEM.as_bytes()).unwrap(),
|
||||
)
|
||||
.unwrap();
|
||||
Json(json!({
|
||||
"access_token": "access-token",
|
||||
"token_type": "Bearer",
|
||||
"id_token": token,
|
||||
}))
|
||||
}),
|
||||
)
|
||||
.route(
|
||||
"/userinfo",
|
||||
get(|| async { Json(json!({"sub": "alice", "preferred_username": "Alice"})) }),
|
||||
)
|
||||
.route(
|
||||
"/jwks",
|
||||
get(|| async { Json(json!({"keys": [serde_json::from_str::<Value>(JWK).unwrap()]})) }),
|
||||
)
|
||||
.with_state(state.clone());
|
||||
tokio::spawn(async move {
|
||||
let _ = axum::serve(listener, router).await;
|
||||
});
|
||||
Idp { state, addr }
|
||||
}
|
||||
|
||||
fn test_settings(issuer: &str, redirect_uri: &str) -> Settings {
|
||||
Settings {
|
||||
database_url: "postgres://unused".into(),
|
||||
oidc_providers: vec![OidcProviderConfig {
|
||||
provider: "default".into(),
|
||||
issuer: issuer.into(),
|
||||
client_id: "tavolo".into(),
|
||||
client_secret: Some("dev-secret".into()),
|
||||
redirect_uri: redirect_uri.into(),
|
||||
post_login_redirect: "/".into(),
|
||||
post_logout_redirect: "/".into(),
|
||||
}],
|
||||
app_host: "127.0.0.1".into(),
|
||||
app_port: 0,
|
||||
redis_url: None,
|
||||
game_ttl_seconds: 86400,
|
||||
static_dir: "/nonexistent-web-dist".into(),
|
||||
hand_ack_timeout_seconds: 30,
|
||||
turn_timeout_seconds: 30,
|
||||
deadline_heartbeat_ms: 50,
|
||||
logging_config: None,
|
||||
cors_allow_origins: None,
|
||||
cors_allow_origin_regex: None,
|
||||
cors_allow_methods: None,
|
||||
cors_allow_headers: None,
|
||||
cors_allow_credentials: false,
|
||||
cors_expose_headers: None,
|
||||
cors_max_age: 600,
|
||||
otel_enabled: false,
|
||||
otel_service_name: "tavolo".into(),
|
||||
otel_exporter_endpoint: None,
|
||||
otel_exporter_headers: None,
|
||||
otel_excluded_paths: vec!["/api/health".into()],
|
||||
otel_metric_export_interval_millis: 60000,
|
||||
otel_metrics_poll_interval_seconds: 15,
|
||||
}
|
||||
}
|
||||
|
||||
fn cookie_header(response: &axum::response::Response) -> String {
|
||||
let value = response
|
||||
.headers()
|
||||
.get(axum::http::header::SET_COOKIE)
|
||||
.expect("set-cookie")
|
||||
.to_str()
|
||||
.expect("cookie header");
|
||||
value.split(';').next().expect("cookie pair").to_string()
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn oidc_login_callback_and_logout_flow() {
|
||||
// The mock IdP must know its own issuer before we can start it, so bind
|
||||
// first and rebuild the settings from the recorded address.
|
||||
let idp = start_idp().await;
|
||||
let issuer = format!("http://{}", idp.addr);
|
||||
let callback = "http://localhost:8080/auth/default/callback".to_string();
|
||||
let settings = test_settings(&issuer, &callback);
|
||||
|
||||
let (platform, session_store) = app::in_memory_platform(&settings).expect("platform");
|
||||
let router = app::build_router(platform, session_store.clone(), &settings);
|
||||
|
||||
// 1. Start the login: a 302 to the provider with state/nonce/PKCE and a
|
||||
// fresh session cookie.
|
||||
let response = router
|
||||
.clone()
|
||||
.oneshot(
|
||||
axum::http::Request::builder()
|
||||
.uri("/auth/default/login")
|
||||
.body(axum::body::Body::empty())
|
||||
.unwrap(),
|
||||
)
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(response.status(), 302);
|
||||
let location = response.headers()["location"].to_str().unwrap().to_string();
|
||||
let login_cookie = cookie_header(&response);
|
||||
let url = url::Url::parse(&location).expect("authorization url");
|
||||
let params: std::collections::HashMap<String, String> = url
|
||||
.query_pairs()
|
||||
.map(|(key, value)| (key.into_owned(), value.into_owned()))
|
||||
.collect();
|
||||
assert_eq!(params["client_id"], "tavolo");
|
||||
assert_eq!(params["code_challenge_method"], "S256");
|
||||
assert_eq!(params["scope"], "openid email profile");
|
||||
assert_eq!(
|
||||
params["redirect_uri"],
|
||||
"http://localhost:8080/auth/default/callback"
|
||||
);
|
||||
let state = params["state"].clone();
|
||||
// Simulate the browser visiting the provider: the mock signs the nonce
|
||||
// the client generated.
|
||||
*idp.state.nonce.lock().await = params["nonce"].clone();
|
||||
|
||||
// 2. The provider redirects back with the code and state.
|
||||
let response = router
|
||||
.clone()
|
||||
.oneshot(
|
||||
axum::http::Request::builder()
|
||||
.uri(format!(
|
||||
"/auth/default/callback?code=test-code&state={state}"
|
||||
))
|
||||
.header("cookie", &login_cookie)
|
||||
.body(axum::body::Body::empty())
|
||||
.unwrap(),
|
||||
)
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(response.status(), 302);
|
||||
assert_eq!(response.headers()["location"], "/");
|
||||
let session_cookie = cookie_header(&response);
|
||||
assert_ne!(
|
||||
session_cookie, login_cookie,
|
||||
"session id must rotate on login"
|
||||
);
|
||||
|
||||
// A wrong state is rejected without touching the provider.
|
||||
let response = router
|
||||
.clone()
|
||||
.oneshot(
|
||||
axum::http::Request::builder()
|
||||
.uri("/auth/default/callback?code=test-code&state=wrong")
|
||||
.header("cookie", &login_cookie)
|
||||
.body(axum::body::Body::empty())
|
||||
.unwrap(),
|
||||
)
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(response.status(), 400);
|
||||
|
||||
// 3. The session is authenticated and /api/me reflects the userinfo.
|
||||
let response = router
|
||||
.clone()
|
||||
.oneshot(
|
||||
axum::http::Request::builder()
|
||||
.uri("/api/me")
|
||||
.header("cookie", &session_cookie)
|
||||
.body(axum::body::Body::empty())
|
||||
.unwrap(),
|
||||
)
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(response.status(), 200);
|
||||
let body = axum::body::to_bytes(response.into_body(), usize::MAX)
|
||||
.await
|
||||
.unwrap();
|
||||
let me: Value = serde_json::from_slice(&body).unwrap();
|
||||
assert_eq!(me, json!({"sub": "alice", "name": "Alice"}));
|
||||
|
||||
// 4. Logout clears the session and sends an expired cookie.
|
||||
let response = router
|
||||
.clone()
|
||||
.oneshot(
|
||||
axum::http::Request::builder()
|
||||
.uri("/auth/default/logout")
|
||||
.header("cookie", &session_cookie)
|
||||
.body(axum::body::Body::empty())
|
||||
.unwrap(),
|
||||
)
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(response.status(), 302);
|
||||
let clear_cookie = response
|
||||
.headers()
|
||||
.get(axum::http::header::SET_COOKIE)
|
||||
.unwrap()
|
||||
.to_str()
|
||||
.unwrap();
|
||||
assert!(
|
||||
clear_cookie.contains("Max-Age=0"),
|
||||
"cookie not cleared: {clear_cookie}"
|
||||
);
|
||||
}
|
||||
Reference in new issue
Block a user