rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Remove unused SAML auth error code mapper

Browse Source 
All SAML assertion failures now share authentication_failed, so
the dedicated mapper and its tests are no longer needed.

Signed-off-by: Cursor Agent <cursoragent@cursor.com>

Co-authored-by: Bryan FRIMIN <bryan@frimin.fr>
This commit is contained in:
Bryan Frimin
2026-07-24 22:25:29 +00:00
committed by Cursor Agent
parent 981ed91572
commit 15df570ce8
2 changed files with 0 additions and 126 deletions
Download Patch File Download Diff File Expand all files Collapse all files

39
pkg/server/api/connect/v1/auth_error.go
View File

@@ -21,11 +21,8 @@
package connect_v1 package connect_v1
import ( import (
"errors"
"net/http" "net/http"
"net/url" "net/url"
"go.probo.inc/probo/pkg/iam/saml"
) )
const ( const (
@@ -49,39 +46,3 @@ func redirectAuthError(w http.ResponseWriter, r *http.Request, code string) {
http.Redirect(w, r, redirectURL.String(), http.StatusFound) http.Redirect(w, r, redirectURL.String(), http.StatusFound)
} }
func authErrorCodeFromSAML(err error) (string, bool) {
if _, ok := errors.AsType[*saml.ErrSAMLDisabled](err); ok {
return authErrorAuthenticationFailed, true
}
if _, ok := errors.AsType[*saml.ErrSAMLConfigurationNotFound](err); ok {
return authErrorAuthenticationFailed, true
}
if _, ok := errors.AsType[*saml.ErrEmailDomainMismatch](err); ok {
return authErrorAuthenticationFailed, true
}
if _, ok := errors.AsType[*saml.ErrSAMLAutoSignupDisabled](err); ok {
return authErrorAuthenticationFailed, true
}
if _, ok := errors.AsType[*saml.ErrUserInactive](err); ok {
return authErrorAuthenticationFailed, true
}
if _, ok := errors.AsType[*saml.ErrSAMLSubjectAlreadyInUse](err); ok {
return authErrorAuthenticationFailed, true
}
if _, ok := errors.AsType[*saml.ErrInvalidAssertion](err); ok {
return authErrorAuthenticationFailed, true
}
if _, ok := errors.AsType[*saml.ErrReplayAttackDetected](err); ok {
return authErrorAuthenticationFailed, true
}
return "", false
}

87
pkg/server/api/connect/v1/auth_error_test.go
View File

@@ -21,17 +21,12 @@
package connect_v1 package connect_v1
import ( import (
"errors"
"net/http" "net/http"
"net/http/httptest" "net/http/httptest"
"testing" "testing"
"github.com/stretchr/testify/assert" "github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require" "github.com/stretchr/testify/require"
"go.probo.inc/probo/pkg/coredata"
"go.probo.inc/probo/pkg/gid"
"go.probo.inc/probo/pkg/iam/saml"
"go.probo.inc/probo/pkg/mail"
) )
func TestRedirectAuthError(t *testing.T) { func TestRedirectAuthError(t *testing.T) {
@@ -48,85 +43,3 @@ func TestRedirectAuthError(t *testing.T) {
assert.Equal(t, "/auth/error", location.Path) assert.Equal(t, "/auth/error", location.Path)
assert.Equal(t, authErrorPersonalAccountNotAllowed, location.Query().Get("error")) assert.Equal(t, authErrorPersonalAccountNotAllowed, location.Query().Get("error"))
} }
func TestAuthErrorCodeFromSAML(t *testing.T) {
t.Parallel()
configID := gid.New(gid.NewTenantID(), coredata.SAMLConfigurationEntityType)
email, err := mail.ParseAddr("user@example.com")
require.NoError(t, err)
tests := []struct {
name string
err error
code string
ok bool
}{
{
name: "disabled stays generic",
err: saml.NewSAMLDisabledError(),
code: authErrorAuthenticationFailed,
ok: true,
},
{
name: "configuration not found stays generic",
err: saml.NewSAMLConfigurationNotFoundError(configID),
code: authErrorAuthenticationFailed,
ok: true,
},
{
name: "email domain mismatch stays generic",
err: saml.NewEmailDomainMismatchError(email, "acme.com"),
code: authErrorAuthenticationFailed,
ok: true,
},
{
name: "auto signup disabled stays generic",
err: saml.NewSAMLAutoSignupDisabledError(configID),
code: authErrorAuthenticationFailed,
ok: true,
},
{
name: "user inactive stays generic",
err: saml.NewUserInactiveError(configID),
code: authErrorAuthenticationFailed,
ok: true,
},
{
name: "subject already in use stays generic",
err: saml.NewSAMLSubjectAlreadyInUseError("assertion-1"),
code: authErrorAuthenticationFailed,
ok: true,
},
{
name: "invalid assertion stays generic",
err: saml.NewInvalidAssertionError("assertion-1", errors.New("bad signature")),
code: authErrorAuthenticationFailed,
ok: true,
},
{
name: "replay stays generic",
err: saml.NewReplayAttackDetectedError("assertion-1"),
code: authErrorAuthenticationFailed,
ok: true,
},
{
name: "unknown error",
err: errors.New("boom"),
ok: false,
},
}
for _, tt := range tests {
t.Run(
tt.name,
func(t *testing.T) {
t.Parallel()
code, ok := authErrorCodeFromSAML(tt.err)
assert.Equal(t, tt.ok, ok)
assert.Equal(t, tt.code, code)
},
)
}
}