feat: link local library

2026-06-17 20:43:56 +02:00
parent 9a770a2af0
commit db59882f33
327 changed files with 22274 additions and 1 deletions
@@ -0,0 +1,17 @@
+from django.test import Client
+
+import logging
+
+logger = logging.getLogger(__name__)
+
+
+class OnboardingRegistrationResponse:
+    def __init__(self):
+        self.status_code = 200
+        self.req_counter = 0
+        self.client = Client()
+        self.result = None
+
+    @property
+    def content(self):
+        self.req_counter += 1
@@ -0,0 +1,111 @@
+from django.test import TestCase, Client, override_settings
+from django.urls import reverse
+import json
+
+from spid_cie_oidc.authority.tests.settings import *
+from spid_cie_oidc.entity.models import *
+from spid_cie_oidc.onboarding.urls import *
+from spid_cie_oidc.entity.jwks import serialize_key
+from spid_cie_oidc.entity.jwks import new_rsa_key
+from spid_cie_oidc.entity.tests.settings import *
+
+from spid_cie_oidc.authority.models import *
+from spid_cie_oidc.authority.tests.mocked_responses import *
+from spid_cie_oidc.authority.tests.settings import *
+
+from spid_cie_oidc.onboarding.tests.mocked_responses import *
+
+
+from unittest.mock import patch
+
+
+class OnboardingTest(TestCase):
+    def setUp(self):
+
+        self.rp_conf = FederationEntityConfiguration.objects.create(**rp_conf)
+
+        self.data = {
+            "organization_name": "",
+            "url_entity": "",
+            "authn_buttons_page_url": "",
+            "type":"",
+            "public_jwks": "",
+        }
+
+    @override_settings(HTTP_CLIENT_SYNC=True)
+    @patch("requests.get", return_value=OnboardingRegistrationResponse())
+    def test_onboarding_registration(self, mocked):
+        url = reverse("oidc_onboarding_registration")
+        client = Client()
+        res = client.get(url, self.data)
+        self.assertEqual(res.status_code, 200)
+        res = client.post(url, self.data)
+        self.assertFormError(
+            res, "form", "organization_name", "Enter your organization name"
+        )
+        self.assertFormError(res, "form", "url_entity", 
+            "Enter the entity unique identifier (HTTP URL)"
+        )
+        self.assertFormError(
+            res, "form", "public_jwks", 
+            "Enter the public JWKs published in your Entity Configuration, as double check."
+        )
+        self.assertEqual(res.status_code, 200)
+        self.data["organization_name"] = "test name"
+        self.data["url_entity"] = "http://rp-test/oidc/rp"
+        self.data["type"] = "openid_relying_party"
+        self.data["authn_buttons_page_url"] = "https://authnurl.com"
+        self.data["public_jwks"] = {"key": "ciao"}
+        res = client.post(url, self.data)
+        self.assertContains(res, "Inserisci un JSON valido.")
+        self.assertEqual(res.status_code, 200)
+        jwk = serialize_key(new_rsa_key().pub_key)
+        self.data["public_jwks"] = json.dumps(jwk)
+        # res = client.post(url, self.data)
+        # self.assertEqual(res.status_code, 200)
+        # res = client.get(url)
+        # self.assertEqual(res.status_code, 200)
+        # self.assertIn(self.data["organization_name"], res.content.decode())
+        # self.assertIn("acquired", res.content.decode())
+
+    def test_schema_authorization(self):
+        c = Client()
+        url = reverse("oidc_onboarding_schemas_Authorization")
+        res = c.get(url)
+        self.assertTrue(res.status_code == 200)
+        self.assertIn("Schemas authorization endpoint", res.content.decode())
+
+    def test_schema_introspection(self):
+        c = Client()
+        url = reverse("oidc_onboarding_schemas_introspection")
+        res = c.get(url)
+        self.assertTrue(res.status_code == 200)
+        self.assertIn("Schemas introspection endpoint", res.content.decode())
+
+    def test_schema_metadata(self):
+        c = Client()
+        url = reverse("oidc_onboarding_schemas_metadata")
+        res = c.get(url)
+        self.assertTrue(res.status_code == 200)
+        self.assertIn("Schemas metadata Spid/Cie", res.content.decode())
+
+    def test_schema_revocation(self):
+        c = Client()
+        url = reverse("oidc_onboarding_schemas_revocation")
+        res = c.get(url)
+        self.assertTrue(res.status_code == 200)
+        self.assertIn("Schemas revocation endpoint", res.content.decode())
+
+    def test_schema_token(self):
+        c = Client()
+        url = reverse("oidc_onboarding_schemas_token")
+        res = c.get(url)
+        self.assertTrue(res.status_code == 200)
+        self.assertIn("Schemas token endpoint", res.content.decode())
+        
+    def test_schema_client_assertion(self):
+        c = Client()
+        url = reverse("oidc_onboarding_schemas_jwt_client_assertion")
+        res = c.get(url)
+        self.assertTrue(res.status_code == 200)
+        self.assertIn("Schemas jwt", res.content.decode())
@@ -0,0 +1,252 @@
+import json
+from django.test import TestCase, Client
+from django.urls import reverse
+from copy import deepcopy
+from spid_cie_oidc.entity.jwtse import create_jws
+
+from spid_cie_oidc.onboarding.tests.tools_settings import jwk_priv, jwt, jwe
+from spid_cie_oidc.entity.tests.settings import ta_conf_data
+from spid_cie_oidc.authority.models import (
+    FederationEntityConfiguration,
+    FederationEntityProfile,
+    FederationDescendant,
+    FederationEntityAssignedProfile
+)
+from spid_cie_oidc.authority.tests.settings import (
+    rp_conf,
+    RP_PROFILE,
+    rp_onboarding_data
+)
+
+from spid_cie_oidc.entity.jwks import (
+    private_pem_from_jwk,
+    public_pem_from_jwk
+)
+
+from spid_cie_oidc.entity.tests.op_metadata_settings import OP_METADATA_SPID
+from spid_cie_oidc.entity.tests.rp_metadata_settings import RP_METADATA_CIE
+from spid_cie_oidc.provider.tests.authn_request_settings import AUTHN_REQUEST_SPID
+from spid_cie_oidc.authority.tests.settings import RP_METADATA_JWK1, RP_METADATA_JWK1_pub
+
+class ToolsTests(TestCase):
+
+    def setUp(self):
+
+        self.client = Client()
+        self.ta_conf = FederationEntityConfiguration.objects.create(**ta_conf_data)
+        self.rp_conf = FederationEntityConfiguration.objects.create(**rp_conf)
+
+        self.rp_profile = FederationEntityProfile.objects.create(**RP_PROFILE)
+        self.rp = FederationDescendant.objects.create(**rp_onboarding_data)
+
+        self.rp_assigned_profile = FederationEntityAssignedProfile.objects.create(
+            descendant=self.rp, profile=self.rp_profile, issuer=self.ta_conf
+        )
+
+
+    def test_create_jwk(self):
+        url = reverse("oidc_onboarding_create_jwk")
+        res = self.client.get(url)
+        self.assertEqual(res.status_code, 200)
+        self.assertIsNotNone(res.context['private_jwk'])
+
+    def test_convert_jwk_to_pem(self):
+        url = reverse("oidc_onboarding_convert_jwk")
+        res = self.client.get(url)
+        self.assertEqual(res.status_code, 200)
+
+        #check with jwk error
+        res = self.client.post(url + '?type=private', {'kty': 'RSA'})
+        self.assertEqual(res.status_code, 200)
+        self.assertIn("alert-error", res.content.decode())
+
+        #check with public jwk the function jwk priv to pem
+        res = self.client.post(url + '?type=private', {'jwk':json.dumps(RP_METADATA_JWK1_pub)})
+        self.assertEqual(res.status_code, 200)
+        self.assertIn("alert-error", res.content.decode())
+        
+        #check with right jwk private
+        res = self.client.post(url + '?type=private', {'jwk':json.dumps(RP_METADATA_JWK1)})
+        self.assertEqual(res.status_code, 200)
+        self.assertNotIn("alert-error", res.content.decode())
+
+        #check with right jwk public
+        res = self.client.post(url + '?type=public', {'jwk':json.dumps(RP_METADATA_JWK1_pub)})
+        self.assertEqual(res.status_code, 200)
+        self.assertNotIn("alert-error", res.content.decode())
+    
+    def test_convert_pem_to_jwk(self):
+        url = reverse("oidc_onboarding_convert_pem")
+        res = self.client.get(url)
+        self.assertEqual(res.status_code, 200)
+
+        pem_private = private_pem_from_jwk(RP_METADATA_JWK1)
+        res = self.client.post(url + '?type=private', {"pem": pem_private})
+        self.assertEqual(res.status_code, 200)
+        self.assertNotIn("alert-error", res.content.decode())
+
+        pem_public = public_pem_from_jwk(RP_METADATA_JWK1_pub)
+        res = self.client.post(url + '?type=public', {"pem": pem_public})
+        self.assertEqual(res.status_code, 200)
+        self.assertNotIn("alert-error", res.content.decode())
+        
+    def test_decode_and_verify_jwt(self):
+        url = reverse("oidc_onboarding_tools_decode_jwt")
+        res = self.client.get(url)
+        self.assertEqual(res.status_code, 200)
+        res = self.client.post(url, {"jwt":jwt})
+        self.assertEqual(res.status_code, 200)
+        self.assertIsNotNone(res.context['payload'])
+        self.assertIsNotNone(res.context['head'])
+        jwkError = {"jwkerror":"error"}
+        jwk = json.dumps(jwkError)
+        res = self.client.post(url, {"jwt":jwt, "jwk": jwk})
+        self.assertEqual(res.status_code, 200)
+        self.assertIn("alert-error", res.content.decode())
+        jwk = json.dumps(jwk_priv)
+        res = self.client.post(url, {"jwt":jwt, "jwk": jwk})
+        self.assertEqual(res.status_code, 200)
+        self.assertIn("alert-success", res.content.decode())
+
+    def test_decode_and_verify_jwe(self):
+        
+        # first failed because no jwks is submitted
+        url = reverse("oidc_onboarding_tools_decode_jwt")
+        res = self.client.get(url)
+        self.assertEqual(res.status_code, 200)
+        res = self.client.post(url, {"jwt":jwe})
+        self.assertEqual(res.status_code, 400)
+        
+        res = self.client.post(url, {"jwt": jwe, "jwk": json.dumps(jwk_priv)})
+        self.assertEqual(res.status_code, 200)
+
+    def test_resolve_statement(self):
+        url = reverse("oidc_onboarding_resolve_statement")
+        res = self.client.get(url)
+        self.assertEqual(res.status_code, 200)
+        res = self.client.get(url, {
+            "sub":"http://127.0.0.1:8000/oidc",
+            "type": "openid_provider",
+            "trust_anchor": "http://127.0.0.1:8000"
+        })
+        self.assertEqual(res.status_code, 200)
+        self.assertIn("text-danger", res.content.decode())
+        #  self.assertIn(
+            #  "Failed to resolve entity statement, Please check your inserted data", 
+            #  res.content.decode())
+
+        form_data= {
+            "sub": "http://127.0.0.1:8000/oidc/op",
+            "type": "openid_provider",
+            "trust_anchor": "http://127.0.0.1:8000",
+        }
+        res = self.client.get(url, form_data)
+        self.assertEqual(res.status_code, 200)
+        self.assertIsNotNone(res.context['resolved_statement'])
+
+    def test_validating_trust_mark(self):
+        url = reverse("oidc_onboarding_validating_trustmark")
+        res = self.client.get(url)
+        self.assertEqual(res.status_code, 200)
+
+        res = self.client.get(url, {
+            "id": "https://www.ciao.gov.it/certification/rp",
+            "sub": "http://ciao.it/oidc/rp/",
+        })
+        self.assertEqual(res.status_code, 200)
+        self.assertIn("alert-error", res.content.decode())
+
+        res = self.client.get(url, {
+            "id": "https://www.spid.gov.it/certification/rp",
+            "sub": "http://rp-test.it/oidc/rp/",
+        })
+
+        self.assertEqual(res.status_code, 200)
+        self.assertIn("alert-success", res.content.decode())
+
+        trust_mark = self.rp_assigned_profile.trust_mark_as_jws
+        
+        res = self.client.get(url, {
+            "trust_mark": trust_mark,
+        })
+        self.assertEqual(res.status_code, 200)
+        self.assertIn("alert-success", res.content.decode())
+
+    def test_validate_metadata(self):
+        url = reverse("oidc_onboarding_validate_md")
+
+        OP_METADATA_SPID_WRONG = deepcopy(OP_METADATA_SPID)
+        OP_METADATA_SPID_WRONG["issuer"] = "htps://idserver.servizicie.interno.gov.it/op/"
+        res = self.client.post(url + '?metadata_type=op_metadata&provider_profile=spid', 
+            {'md': json.dumps(OP_METADATA_SPID_WRONG)})
+        self.assertEqual(res.status_code, 200)
+        self.assertIn("alert-error", res.content.decode())
+
+        res = self.client.post(url + '?metadata_type=op_metadata&provider_profile=spid', 
+            {'md': json.dumps(OP_METADATA_SPID)})
+        self.assertEqual(res.status_code, 200)
+        self.assertIn("alert-success", res.content.decode())
+
+        RP_METADATA_CIE_WRONG = deepcopy(RP_METADATA_CIE)
+        RP_METADATA_CIE_WRONG["jwks_uri"] = "htps://registry.cie.gov.it/keys.json"
+        res = self.client.post(url + '?metadata_type=rp_metadata&provider_profile=cie', 
+            {'md': json.dumps(RP_METADATA_CIE_WRONG)})
+        self.assertEqual(res.status_code, 200)
+        self.assertIn("alert-error", res.content.decode())
+
+        res = self.client.post(url + '?metadata_type=rp_metadata&provider_profile=cie', 
+            {'md': json.dumps(RP_METADATA_CIE)})
+        self.assertEqual(res.status_code, 200)
+        self.assertIn("alert-success", res.content.decode())
+
+        res = self.client.post(url + '?metadata_type=rp_metadata&provider_profile=cie', 
+            {'md': "hello world"})
+        self.assertEqual(res.status_code, 200)
+        self.assertIn("alert-error", res.content.decode())
+    
+    def test_validating_trust_mark(self):
+        url = reverse("oidc_onboarding_validating_trustmark")
+        res = self.client.post(url)
+        self.assertEqual(res.status_code, 200)
+
+        res = self.client.post(url, data={
+            "id": "https://www.ciao.gov.it/certification/rp",
+            "sub": "http://ciao.it/oidc/rp/",
+        })
+        self.assertEqual(res.status_code, 200)
+        self.assertIn("alert-error", res.content.decode())
+
+        res = self.client.post(url, data={
+            "id": "https://www.spid.gov.it/certification/rp",
+            "sub": "http://rp-test.it/oidc/rp/",
+        })
+
+        self.assertEqual(res.status_code, 200)
+        self.assertIn("alert-success", res.content.decode())
+
+        trust_mark = self.rp_assigned_profile.trust_mark_as_jws
+        
+        res = self.client.post(url, data={
+            "trust_mark": trust_mark,
+        })
+        self.assertEqual(res.status_code, 200)
+        self.assertIn("alert-success", res.content.decode())
+
+    def test_validate_authn_request(self):
+        url = reverse("oidc_onboarding_validate_authn_request_jwt")
+        AUTHN_REQUEST_SPID_WRONG = deepcopy(AUTHN_REQUEST_SPID)
+        AUTHN_REQUEST_SPID_WRONG["client_id"] = "hps://rp.cie.it/callback1/"
+        jwt = create_jws(AUTHN_REQUEST_SPID_WRONG, RP_METADATA_JWK1)
+        res = self.client.post(url + '?provider_profile=spid',
+            {'md': jwt})
+        self.assertEqual(res.status_code, 200)
+        self.assertIn("alert-error", res.content.decode())
+
+        jwt = create_jws(AUTHN_REQUEST_SPID, RP_METADATA_JWK1)
+        res = self.client.post(url + '?provider_profile=spid', 
+            {'md': jwt})
+        self.assertEqual(res.status_code, 200)
+        self.assertIn("alert-success", res.content.decode())
+
+
+
@@ -0,0 +1,25 @@
+
+from django.test import TestCase
+from spid_cie_oidc.authority.models import FederationDescendant, FederationDescendantContact
+
+from spid_cie_oidc.onboarding.admin import OnBoardingRegistrationAdmin
+from spid_cie_oidc.onboarding.models import OnBoardingRegistration
+
+from spid_cie_oidc.authority.tests.settings import RP_METADATA_JWK1_pub, rp_conf
+class AdminTest(TestCase):
+
+    def setUp(self):
+        self.onb_regist = OnBoardingRegistration.objects.create(
+            organization_name = "RP test",
+            url_entity = rp_conf["sub"],
+            public_jwks = RP_METADATA_JWK1_pub,
+            type = "openid_relying_party",
+            contact = "[email protected]"
+        )
+        print(self.onb_regist)
+
+    def test_make_published(self):
+        queryset = [self.onb_regist]
+        OnBoardingRegistrationAdmin.enable_as_descendant(None, request = {}, queryset = queryset)
+        self.assertTrue(len(FederationDescendantContact.objects.all()) == 1)
+        self.assertTrue(len(FederationDescendant.objects.all()) == 1)
@@ -0,0 +1,15 @@
+from spid_cie_oidc.entity.jwtse import create_jwe
+
+
+jwk_priv = {
+    'kty': 'RSA',
+    'n': 'wct3JUvUxk0JYnDD0sdy0BkLfiLO_Kfy7hvRp7AC1GlvV74FrDfDnYeTTCDPoXEJN2DMiTnMvWXENaFcBkI1RMSaMqupwp6aoGniFDNCiwEh5wgrjVpaxb5Au4pj4Lq1ecbRDDktwqKDVoQsCXsAAApiTkwjq4g6liH8-PTVG-QCM0gL7VIU0jEKCGX6BuZwuKvfEeNTMboMLnn8_AqdsTtvmDommLaOiOgjU0qS7cvowdVX7fhtDeCgVYvPetAFEvimPAE0i4cQ9RAoqlgFCBpRXz9UyeGAXlaFWtLk_t59jNv4nJEP1gQ2VvAvqA4gOn0f9s7Gf1AsFSxrnmeP1Q',
+    'e': 'AQAB',
+    'd': 'vtW1hiyeYogJ7b5Nl4qALRv8jUGJwpNATelnE1Hn93O8CRM-UtC2-LFBA35r9_ZvtPDFeXxJeVh1VrqG_ELGYemYTr1sdhHpAn5B-tJffLKox_Drsk5_hKpM5GDq6anyevClevvza-7Mlq2hD9TnsyKGm8OufIOx7ZWany25jbPK_ksU9X_G9J5RkQ5aDUz7OiUJ-LyL2xmW4gldp_frk_lYgFTgWOp7ZilDQWKYkeLCDzuuRLbM01D7jEJR2c28huQ_vVlw7457NVh-WWyY8Kw0TBgMOU8rrfmgdicv-kbrQaAz60ip95g5FV8ALqSewQYo3v7-4FD8nWVWu01yIQ',
+    'p': '5Qo4l7oom0P08IBun83TtYOEoDjFEuxsOKcWHfSMYcbMpMCog97BA7ji_0tFHVgqjUAfnEXj4U1yi-ScKZHeiusVYzo5_tQXm8f9bjylw4kOQ1UMSoloz7_sd9xT9jpnWXNxLWHXCoXXWDHUV-iXTewDnRM3McWkA1REIdGogG8',
+    'q': '2JsvLNvn5O1CAm5bZesbI4WA2Lx30Y0pEfeqMgpsGYg6QSP-zHc1-jJ5D2zhl4W334NeeUx5pSFzQczg7k-jCWrgKD-nvHzjVxOrzKsG4bOUHIqMDaRbeYH9t-BFNy3b8E6O6sqHKWTbd36JFOi7OBZpmtwSVl7JRYr7sXkUDfs',
+    'kid': 'yxMflR9L6k9Uf-uarpBS3OfgcO1SzbwpZEWbCeOSM3I'
+}
+
+jwt = 'eyJhbGciOiJSUzI1NiIsImtpZCI6Inl4TWZsUjlMNms5VWYtdWFycEJTM09mZ2NPMVN6YndwWkVXYkNlT1NNM0kifQ.eyJjbGllbnRfaWQiOiJodHRwczovL3JwLmNpZS5pdCIsInJlc3BvbnNlX3R5cGUiOiJjb2RlIiwic2NvcGUiOiJvcGVuaWQiLCJjb2RlX2NoYWxsZW5nZSI6InFXSmxNZTB4ZGJYckt4VG03MkVwSDY1OWJVeEF4dzgwIiwiY29kZV9jaGFsbGVuZ2VfbWV0aG9kIjoiUzI1NiIsIm5vbmNlIjoiTUJ6R3F5ZjlReXREMjhldXB5V2hTcU1qNzhXTnFwYzIiLCJwcm9tcHQiOiJjb25zZW50IGxvZ2luIiwicmVkaXJlY3RfdXJpIjoiaHR0cHM6Ly9ycC5jaWUuaXQvY2FsbGJhY2sxLyIsImFjcl92YWx1ZXMiOiJDSUVfTDEgQ0lFX0wyIiwiY2xhaW1zIjp7ImlkX3Rva2VuIjp7ImZhbWlseV9uYW1lIjp7ImVzc2VudGlhbCI6dHJ1ZX0sImVtYWlsIjp7ImVzc2VudGlhbCI6dHJ1ZX19LCJ1c2VyaW5mbyI6eyJuYW1lIjpudWxsLCJmYW1pbHlfbmFtZSI6bnVsbH19LCJzdGF0ZSI6ImZ5WmlPTDlMZjJDZUt1TlQySnp4aUxSRGluazB1UGNkIn0.tJqM9mXrg35C78WkCTJQgr7cDirr5mBa22XHDKQI4Bsto5g70LnBJcBN4v85gAqTOYOvhVPcjfN5UKtS2yTnlXMMbWtIjjX3lBlPVTxze5CjdPVKaDf4EB_za2ampPmc2pZh71T9M9exUaSSi1537Sxq9Wbh3QHomtNOoCapp9IS5UheBDe7P3xkU5-pm24NtC3M9EdJHa8AS42EpdbYx5N4md2DaUg0mU1-5sBFLoESVXOj6J1qDQdOqs8Z-wFpjpBi82v4l7woWalzkdVsmeTDxkeb2TCuNAjN29rpgYiVw78WMFi2P5c7t2ZPdQADUdAqpbUvfN4k1hq3Q-WPPA'
+jwe = create_jwe(jwt, jwk_priv)