Test OAuth2

.github/workflows/oauth.yaml

@@ -0,0 +1,64 @@
+name: OAuth2-OIDC
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["main"]
+
+jobs:
+
+  test_oauth2_oidc:
+    name: OAuth2-OIDC
+    runs-on: ubuntu-22.04
+
+    services:
+      dexidp:
+        image: ychiucco/dex-fractal:latest
+        # options: >-
+        #   --health-cmd "curl http://127.0.0.1:5556/dex/.well-known/openid-configuration"
+        #   --health-interval 10s
+        #   --health-timeout 5s
+        #   --health-retries 5
+        ports:
+          - 5556:5556
+
+    steps:
+
+        # - name: Install 'curl' and 'jq'
+        #   run: sudo apt-get install -y curl jq
+
+        - uses: actions/checkout@v4
+          with:
+            fetch-depth: 1
+
+        - name: Set up Python 3.10
+          uses: actions/setup-python@v5
+          with:
+            python-version: "3.10"
+            cache: "pip"
+
+        - name: Install dependencies
+          run: pip install -e .
+
+        - name: Run Fractal
+          run: |
+            export FRACTAL_TASKS_DIR=/dev/fractal/task
+            export FRACTAL_RUNNER_WORKING_BASE_DIR=/dev/fractal/base_dir
+            export FRACTAL_RUNNER_BACKEND=local
+            export JWT_SECRET_KEY=jwt_secret_key
+            export JWT_EXPIRE_SECONDS=1000
+            export DB_ENGINE=sqlite
+            export SQLITE_PATH=fractal.sqlite
+            export OAUTH_DEXIDP_CLIENT_ID=client_test_id
+            export OAUTH_DEXIDP_CLIENT_SECRET=client_test_secret
+            export OAUTH_DEXIDP_REDIRECT_URL=http://localhost:8001/auth/dexidp/callback/
+            export OAUTH_DEXIDP_OIDC_CONFIGURATION_ENDPOINT=http://127.0.0.1:5556/dex/.well-known/openid-configuration
+            cd tests/oauth/
+            fractalctl set-db
+            bash serve.sh && sleep 2
+
+        - name: OAuth authentication
+          run: |
+            cd tests/oauth/
+            bash -x oauth.sh

tests/oauth/Dockerfile

@@ -0,0 +1,5 @@
+FROM dexidp/dex
+
+COPY config.yaml /etc/dex/cfg/config.yaml
+
+ENTRYPOINT ["dex", "serve", "/etc/dex/cfg/config.yaml"]

tests/oauth/config.yaml

@@ -0,0 +1,25 @@
+# Documentation: https://dexidp.io/docs
+
+issuer: http://127.0.0.1:5556/dex
+
+storage:
+  type: memory
+
+web:
+  http: 0.0.0.0:5556
+
+oauth2:
+  skipApprovalScreen: true
+
+staticClients:
+  - name: TestClient
+    id: client_test_id
+    secret: client_test_secret
+    redirectURIs:
+      - http://localhost:8001/auth/dexidp/callback/
+
+connectors:
+# mockCallback connector always returns the user '[email protected]'.
+- type: mockCallback
+  id: mock
+  name: Mock

tests/oauth/docker-compose.yaml

@@ -0,0 +1,10 @@
+version: '3.1'
+services:
+  dex:
+    image: dexidp/dex
+    container_name: dex
+    ports:
+      - "5556:5556"
+    volumes:
+      - ./config.yaml:/etc/dex/cfg/config.yaml
+    entrypoint: ["dex","serve","/etc/dex/cfg/config.yaml"]

tests/oauth/oauth.sh

@@ -0,0 +1,44 @@
+#!/bin/bash
+
+AUTHORIZATION_URL=$(curl --silent \
+    http://127.0.0.1:8001/auth/dexidp/authorize/ \
+    | jq -r ".authorization_url"
+)
+TOKEN=$(
+    curl -L --silent --output /dev/null --cookie-jar - $AUTHORIZATION_URL \
+    | grep "fastapiusersauth" | awk '{print $NF}'
+)
+WHOAMI=$(
+    curl --silent -H "Authorization: Bearer $TOKEN" \
+    http://127.0.0.1:8001/auth/current-user/
+)
+
+# ----
+
+assert_equal() {
+  if [ "$1" != "$2" ]; then
+    echo "Error: $1 != $2"
+    exit 1
+  fi
+}
+
+USER_ID=$(echo $WHOAMI | jq -r ".id")
+EMAIL=$(echo $WHOAMI | jq -r ".email")
+IS_ACTIVE=$(echo $WHOAMI | jq -r ".is_active")
+IS_SUPERUSER=$(echo $WHOAMI | jq -r ".is_superuser")
+IS_VERIFIED=$(echo $WHOAMI | jq -r ".is_verified")
+SLURM_USER=$(echo $WHOAMI | jq -r ".slurm_user")
+CACHE_DIR=$(echo $WHOAMI | jq -r ".cache_dir")
+USER_NAME=$(echo $WHOAMI | jq -r ".user_name")
+SLURM_ACCOUNTS=$(echo $WHOAMI | jq -r ".slurm_accounts")
+
+
+assert_equal $USER_ID "2"
+assert_equal $EMAIL "[email protected]"
+assert_equal $IS_ACTIVE "true"
+assert_equal $IS_SUPERUSER "false"
+assert_equal $IS_VERIFIED "false"
+assert_equal $SLURM_USER "null"
+assert_equal $CACHE_DIR "null"
+assert_equal $USER_NAME "null"
+assert_equal $SLURM_ACCOUNTS "[]"

tests/oauth/serve.sh

@@ -0,0 +1,3 @@
+#!/bin/bash
+
+fractalctl start --port 8001 &