Clients

tests/validate.py

@@ -8,31 +8,41 @@ from kubernetes_validate import validate
 from ansible.parsing.dataloader import DataLoader
 from ansible.template import Templar
 
-# Resolve the site's actual workflow variables with fixture credentials only;
-# verify both Matrix-only migration and opt-in website integration.
+# Resolve the site's actual workflow with fixture credentials only.
 defaults = yaml.safe_load(Path('defaults/main.yml').read_text())
 site = yaml.safe_load(Path('playbooks/deploy-eom.yml').read_text())[0]['vars']
-for website_enabled in (False, True):
+for fixture_run in (1,):
     variables = {
         **defaults, **site,
         'dex_admin_password': 'fixture-db',
         'openldap_readonly_password': 'fixture-ldap',
         'matrix_dex_oidc_client_id': 'matrix-fixture',
         'matrix_dex_oidc_client_secret': 'fixture-matrix',
+        'www_dex_client_secret': 'fixture-www',
+        'gitea_dex_client_secret': 'fixture-gitea',
+        'discourse_dex_client_secret': 'fixture-discourse',
+        'peertube_dex_client_secret': 'fixture-peertube',
+        'mastodon_dex_client_secret': 'fixture-mastodon',
+        'nextcloud_dex_client_secret': 'fixture-nextcloud',
     }
-    if website_enabled:
-        variables['www_dex_client_secret'] = 'fixture-www'
     resolved = Templar(loader=DataLoader(), variables=variables).template(site)
     assert resolved['dex_issuer'] == 'https://dex.eom.dev/'
     assert resolved['dex_postgres_password'] == 'fixture-db'
     assert resolved['dex_ldap_group_user_attribute'] == 'cn'
     assert resolved['dex_theme_enabled'] is True
     assert resolved['dex_postgres_manage'] is False
-    assert bool(resolved['dex_static_clients']) == website_enabled
-    assert bool(resolved['dex_additional_connectors']) == website_enabled
-    if website_enabled:
-        assert resolved['dex_static_clients'][0]['secret'] == 'fixture-www'
-        assert resolved['dex_additional_connectors'][0]['config']['userSearch']['idAttr'] == 'entryUUID'
+    clients = {client['id']: client for client in resolved['dex_static_clients']}
+    assert len(clients) == len(resolved['dex_static_clients']) == 7
+    assert resolved['dex_matrix_client_enabled'] is False
+    assert clients['matrix-fixture']['redirectURIs'] == ['https://mas.eom.dev/upstream/callback/01K96AQEZKKABW34PY3R6BVNJ4']
+    assert clients['www-membership']['secret'] == 'fixture-www'
+    assert clients['gitea']['redirectURIs'] == ['https://gitea.eom.dev/user/oauth2/dex/callback']
+    assert clients['discourse']['redirectURIs'] == ['https://discourse.eom.dev/auth/oidc/callback']
+    assert clients['peertube']['redirectURIs'] == ['https://peertube.eom.dev/plugins/auth-openid-connect/router/code-cb']
+    assert clients['mastodon']['redirectURIs'] == ['https://mastodon.eom.dev/auth/auth/openid_connect/callback']
+    assert clients['nextcloud']['redirectURIs'] == ['https://nextcloud.eom.dev/index.php/apps/user_oidc/code']
+    assert all(client['secret'] and len(client['redirectURIs']) == 1 for client in clients.values())
+    assert resolved['dex_additional_connectors'][0]['config']['userSearch']['idAttr'] == 'entryUUID'
 
 values = yaml.safe_load(Path('/tmp/dex-values.yml').read_text())
 config = values['config']