mirrors/pinniped
1
0
Fork 0
mirror of https://github.com/vmware-tanzu/pinniped.git synced 2026-09-19 14:34:27 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Update the session storage versions due to new ID token lifetime field

Browse Source
This commit is contained in:
Ryan Richard
2024-04-24 14:13:41 -07:00
parent af9612e98e
commit 5dbf05c31d
12 changed files with 134 additions and 96 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/controller/supervisorstorage/garbage_collector_test.go
+17 -16
View File
@@ -121,7 +121,8 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
spec.Run(t, "Sync", func(t *testing.T, when spec.G, it spec.S) {
const (
installedInNamespace = "some-namespace"
installedInNamespace = "some-namespace"
currentSessionStorageVersion = "7" // update this when you update the storage version in the production code
)
var (
@@ -265,7 +266,7 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
when("there are valid, expired authcode secrets which contain upstream refresh tokens", func() {
it.Before(func() {
activeOIDCAuthcodeSession := &authorizationcode.Session{
Version: "6",
Version: currentSessionStorageVersion,
Active: true,
Request: &fosite.Request{
ID: "request-id-1",
@@ -310,7 +311,7 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
r.NoError(kubeClient.Tracker().Add(activeOIDCAuthcodeSessionSecret))
inactiveOIDCAuthcodeSession := &authorizationcode.Session{
Version: "6",
Version: currentSessionStorageVersion,
Active: false,
Request: &fosite.Request{
ID: "request-id-2",
@@ -389,7 +390,7 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
when("there are valid, expired authcode secrets which contain upstream access tokens", func() {
it.Before(func() {
activeOIDCAuthcodeSession := &authorizationcode.Session{
Version: "6",
Version: currentSessionStorageVersion,
Active: true,
Request: &fosite.Request{
ID: "request-id-1",
@@ -434,7 +435,7 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
r.NoError(kubeClient.Tracker().Add(activeOIDCAuthcodeSessionSecret))
inactiveOIDCAuthcodeSession := &authorizationcode.Session{
Version: "6",
Version: currentSessionStorageVersion,
Active: false,
Request: &fosite.Request{
ID: "request-id-2",
@@ -513,7 +514,7 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
when("there is an invalid, expired authcode secret", func() {
it.Before(func() {
invalidOIDCAuthcodeSession := &authorizationcode.Session{
Version: "6",
Version: currentSessionStorageVersion,
Active: true,
Request: &fosite.Request{
ID: "", // it is invalid for there to be a missing request ID
@@ -582,7 +583,7 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
when("there is a valid, expired authcode secret but its upstream name does not match any existing upstream", func() {
it.Before(func() {
wrongProviderNameOIDCAuthcodeSession := &authorizationcode.Session{
Version: "6",
Version: currentSessionStorageVersion,
Active: true,
Request: &fosite.Request{
ID: "request-id-1",
@@ -653,7 +654,7 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
when("there is a valid, expired authcode secret but its upstream UID does not match any existing upstream", func() {
it.Before(func() {
wrongProviderNameOIDCAuthcodeSession := &authorizationcode.Session{
Version: "6",
Version: currentSessionStorageVersion,
Active: true,
Request: &fosite.Request{
ID: "request-id-1",
@@ -724,7 +725,7 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
when("there is a valid, recently expired authcode secret but the upstream revocation fails", func() {
it.Before(func() {
activeOIDCAuthcodeSession := &authorizationcode.Session{
Version: "6",
Version: currentSessionStorageVersion,
Active: true,
Request: &fosite.Request{
ID: "request-id-1",
@@ -829,7 +830,7 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
when("there is a valid, long-since expired authcode secret but the upstream revocation fails", func() {
it.Before(func() {
activeOIDCAuthcodeSession := &authorizationcode.Session{
Version: "6",
Version: currentSessionStorageVersion,
Active: true,
Request: &fosite.Request{
ID: "request-id-1",
@@ -908,7 +909,7 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
when("there are valid, expired access token secrets which contain upstream refresh tokens", func() {
it.Before(func() {
offlineAccessGrantedOIDCAccessTokenSession := &accesstoken.Session{
Version: "6",
Version: currentSessionStorageVersion,
Request: &fosite.Request{
GrantedScope: fosite.Arguments{"scope1", "scope2", "offline_access"},
ID: "request-id-1",
@@ -953,7 +954,7 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
r.NoError(kubeClient.Tracker().Add(offlineAccessGrantedOIDCAccessTokenSessionSecret))
offlineAccessNotGrantedOIDCAccessTokenSession := &accesstoken.Session{
Version: "6",
Version: currentSessionStorageVersion,
Request: &fosite.Request{
GrantedScope: fosite.Arguments{"scope1", "scope2"},
ID: "request-id-2",
@@ -1032,7 +1033,7 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
when("there are valid, expired access token secrets which contain upstream access tokens", func() {
it.Before(func() {
offlineAccessGrantedOIDCAccessTokenSession := &accesstoken.Session{
Version: "6",
Version: currentSessionStorageVersion,
Request: &fosite.Request{
GrantedScope: fosite.Arguments{"scope1", "scope2", "offline_access"},
ID: "request-id-1",
@@ -1077,7 +1078,7 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
r.NoError(kubeClient.Tracker().Add(offlineAccessGrantedOIDCAccessTokenSessionSecret))
offlineAccessNotGrantedOIDCAccessTokenSession := &accesstoken.Session{
Version: "6",
Version: currentSessionStorageVersion,
Request: &fosite.Request{
GrantedScope: fosite.Arguments{"scope1", "scope2"},
ID: "request-id-2",
@@ -1156,7 +1157,7 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
when("there are valid, expired refresh secrets which contain upstream refresh tokens", func() {
it.Before(func() {
oidcRefreshSession := &refreshtoken.Session{
Version: "6",
Version: currentSessionStorageVersion,
Request: &fosite.Request{
ID: "request-id-1",
Client: &clientregistry.Client{},
@@ -1233,7 +1234,7 @@ func TestGarbageCollectorControllerSync(t *testing.T) {
when("there are valid, expired refresh secrets which contain upstream access tokens", func() {
it.Before(func() {
oidcRefreshSession := &refreshtoken.Session{
Version: "6",
Version: currentSessionStorageVersion,
Request: &fosite.Request{
ID: "request-id-1",
Client: &clientregistry.Client{},