rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add trust center OAuth connect e2e coverage

Browse Source 
Extend test helpers for portal OAuth flows and cover connect,
callback, and NDA signing against the compliance portal API.

Signed-off-by: Bryan Frimin <bryan@probo.com>
This commit is contained in:
Bryan Frimin
2026-07-15 10:59:43 +02:00
parent 27e012e47a
commit de203325d2
5 changed files with 393 additions and 54 deletions
Download Patch File Download Diff File Expand all files Collapse all files

37
e2e/trust/helpers_test.go
View File

@@ -21,6 +21,7 @@
package trust_test
import (
"net/url"
"testing"
"github.com/stretchr/testify/require"
@@ -58,6 +59,42 @@ func lookupTrustCenterID(t *testing.T, owner *testutil.Client) string {
return result.Node.TrustCenter.ID
}
func lookupTrustHost(t *testing.T, owner *testutil.Client, trustCenterID string) string {
t.Helper()
activateTrustCenter(t, owner, trustCenterID)
const query = `
query($organizationId: ID!) {
node(id: $organizationId) {
... on Organization {
trustCenter { publicUrl }
}
}
}
`
var result struct {
Node struct {
TrustCenter struct {
PublicURL string `json:"publicUrl"`
} `json:"trustCenter"`
} `json:"node"`
}
err := owner.Execute(query, map[string]any{
"organizationId": owner.GetOrganizationID().String(),
}, &result)
require.NoError(t, err)
require.NotEmpty(t, result.Node.TrustCenter.PublicURL)
publicURL, err := url.Parse(result.Node.TrustCenter.PublicURL)
require.NoError(t, err)
require.NotEmpty(t, publicURL.Host)
return publicURL.Host
}
// activateTrustCenter flips the trust center to active so its public surface
// (NDA, subprocessors, reports, branding) becomes reachable by visitors.
func activateTrustCenter(t *testing.T, owner *testutil.Client, trustCenterID string) {

20
e2e/trust/trust_center_nda_signature_test.go
View File

@@ -60,12 +60,12 @@ func TestTrustCenter_AcceptElectronicSignature_RejectsForeignSignature(t *testin
trustCenterID := lookupTrustCenterID(t, owner)
uploadTrustCenterNDA(t, owner, trustCenterID)
activateTrustCenter(t, owner, trustCenterID)
trustHost := lookupTrustHost(t, owner, trustCenterID)
victim := testutil.SelfProvisionTrustCenterVisitor(t, trustCenterID)
attacker := testutil.SelfProvisionTrustCenterVisitor(t, trustCenterID)
victim := testutil.SelfProvisionTrustCenterVisitor(t, trustHost)
attacker := testutil.SelfProvisionTrustCenterVisitor(t, trustHost)
victimSignatureID, victimSignatureStatus := viewerSignature(t, victim, trustCenterID)
victimSignatureID, victimSignatureStatus := viewerSignature(t, victim, trustHost)
require.NotEmpty(t, victimSignatureID)
require.Equal(t, "PENDING", victimSignatureStatus)
@@ -77,7 +77,7 @@ func TestTrustCenter_AcceptElectronicSignature_RejectsForeignSignature(t *testin
}
`
err := attacker.ExecuteTrust(trustCenterID, acceptMutation, map[string]any{
err := attacker.ExecuteTrust(trustHost, acceptMutation, map[string]any{
"input": map[string]any{"signatureId": victimSignatureID},
}, nil)
require.Error(t, err, "attacker must not be able to accept another visitor's signature")
@@ -91,7 +91,7 @@ func TestTrustCenter_AcceptElectronicSignature_RejectsForeignSignature(t *testin
}
`
err = attacker.ExecuteTrust(trustCenterID, recordEventMutation, map[string]any{
err = attacker.ExecuteTrust(trustHost, recordEventMutation, map[string]any{
"input": map[string]any{
"signatureId": victimSignatureID,
"eventType": "DOCUMENT_VIEWED",
@@ -100,7 +100,7 @@ func TestTrustCenter_AcceptElectronicSignature_RejectsForeignSignature(t *testin
require.Error(t, err, "attacker must not be able to inject events into another visitor's signature")
assertForbidden(t, err)
_, statusAfterAttack := viewerSignature(t, victim, trustCenterID)
_, statusAfterAttack := viewerSignature(t, victim, trustHost)
assert.Equal(t, "PENDING", statusAfterAttack, "attack attempts must not have mutated the victim's signature")
var acceptResult struct {
@@ -112,7 +112,7 @@ func TestTrustCenter_AcceptElectronicSignature_RejectsForeignSignature(t *testin
} `json:"acceptElectronicSignature"`
}
err = victim.ExecuteTrust(trustCenterID, acceptMutation, map[string]any{
err = victim.ExecuteTrust(trustHost, acceptMutation, map[string]any{
"input": map[string]any{"signatureId": victimSignatureID},
}, &acceptResult)
require.NoError(t, err, "the legitimate signer must still be able to accept their own signature")
@@ -147,7 +147,7 @@ func uploadTrustCenterNDA(t *testing.T, owner *testutil.Client, trustCenterID st
require.NoError(t, err)
}
func viewerSignature(t *testing.T, visitor *testutil.Client, trustCenterID string) (string, string) {
func viewerSignature(t *testing.T, visitor *testutil.Client, trustHost string) (string, string) {
t.Helper()
const query = `
@@ -171,7 +171,7 @@ func viewerSignature(t *testing.T, visitor *testutil.Client, trustCenterID strin
} `json:"currentTrustCenter"`
}
err := visitor.ExecuteTrust(trustCenterID, query, nil, &result)
err := visitor.ExecuteTrust(trustHost, query, nil, &result)
require.NoError(t, err)
sig := result.CurrentTrustCenter.NonDisclosureAgreement.ViewerSignature

134
e2e/trust/trust_center_oauth_connect_test.go Normal file
View File

@@ -0,0 +1,134 @@
// Copyright (c) 2026 Probo Inc <hello@probo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
package trust_test
import (
"encoding/json"
"io"
"net/http"
"net/url"
"testing"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
"go.probo.inc/probo/e2e/internal/testutil"
)
func TestTrustCenter_CIMDMetadataDocument(t *testing.T) {
t.Parallel()
owner := testutil.NewClient(t, testutil.RoleOwner)
trustCenterID := lookupTrustCenterID(t, owner)
trustHost := lookupTrustHost(t, owner, trustCenterID)
testutil.WaitForTrustCenterHTTPS(t, trustHost)
client := testutil.TrustHTTPClient(trustHost)
resp, err := client.Get("https://" + trustHost + "/.well-known/oauth-client-metadata")
require.NoError(t, err)
defer func() { _ = resp.Body.Close() }()
require.Equal(t, http.StatusOK, resp.StatusCode)
body, err := io.ReadAll(resp.Body)
require.NoError(t, err)
var doc struct {
ClientID string `json:"client_id"`
ClientName string `json:"client_name"`
RedirectURIs []string `json:"redirect_uris"`
TokenEndpointAuthMethod string `json:"token_endpoint_auth_method"`
GrantTypes []string `json:"grant_types"`
ResponseTypes []string `json:"response_types"`
}
require.NoError(t, json.Unmarshal(body, &doc))
assert.Equal(
t,
"https://"+trustHost+"/.well-known/oauth-client-metadata",
doc.ClientID,
)
assert.Equal(
t,
[]string{"https://" + trustHost + "/callback"},
doc.RedirectURIs,
)
assert.Equal(t, "none", doc.TokenEndpointAuthMethod)
assert.Contains(t, doc.GrantTypes, "authorization_code")
assert.Equal(t, []string{"code"}, doc.ResponseTypes)
assert.NotEmpty(t, doc.ClientName)
}
func TestTrustCenter_VisitorConnectViaCIMD(t *testing.T) {
t.Parallel()
owner := testutil.NewClient(t, testutil.RoleOwner)
trustCenterID := lookupTrustCenterID(t, owner)
trustHost := lookupTrustHost(t, owner, trustCenterID)
visitor := testutil.SelfProvisionTrustCenterVisitor(t, trustHost)
const query = `
query {
currentTrustCenter {
title
}
}
`
var result struct {
CurrentTrustCenter struct {
Title string `json:"title"`
} `json:"currentTrustCenter"`
}
err := visitor.ExecuteTrust(trustHost, query, nil, &result)
require.NoError(t, err, "visitor session must authenticate trust GraphQL after CIMD connect")
assert.NotEmpty(t, result.CurrentTrustCenter.Title)
}
func TestTrustCenter_UnknownCIMDClientRejected(t *testing.T) {
t.Parallel()
owner := testutil.NewClient(t, testutil.RoleOwner)
_, challenge := testutil.GeneratePKCE()
clientID := "https://unknown-cimd.example.com/.well-known/oauth-client-metadata"
resp, err := testutil.OAuth2Authorize(owner, url.Values{
"client_id": {clientID},
"redirect_uri": {"https://unknown-cimd.example.com/callback"},
"response_type": {"code"},
"scope": {"openid profile email"},
"state": {"rejected"},
"code_challenge": {challenge},
"code_challenge_method": {"S256"},
"nonce": {"test-nonce"},
})
require.NoError(t, err)
require.False(
t,
testutil.IsConsentRedirect(resp),
"unknown CIMD client must not reach consent screen",
)
require.Equal(t, http.StatusUnauthorized, resp.StatusCode)
var oauthErr struct {
Code string `json:"error"`
}
require.NoError(t, json.Unmarshal(resp.Body, &oauthErr))
assert.Equal(t, "invalid_client", oauthErr.Code)
}