Function TestExpireAPIKey

coderd/apikey_test.go:549–701

nolint:tparallel,paralleltest // Subtests share the same coderdtest instance and auditor.

(t *testing.T)

//nolint:tparallel,paralleltest // Subtests share the same coderdtest instance and auditor.
func TestExpireAPIKey(t *testing.T) {
	t.Parallel()

	auditor := audit.NewMock()
	adminClient := coderdtest.New(t, &coderdtest.Options{Auditor: auditor})
	admin := coderdtest.CreateFirstUser(t, adminClient)
	memberClient, member := coderdtest.CreateAnotherUser(t, adminClient, admin.OrganizationID)

	t.Run("OwnerCanExpireOwnToken", func(t *testing.T) {
		ctx := testutil.Context(t, testutil.WaitLong)

		// Create a token.
		res, err := adminClient.CreateToken(ctx, codersdk.Me, codersdk.CreateTokenRequest{
			Lifetime: time.Hour * 24 * 7,
		})
		require.NoError(t, err)
		keyID := strings.Split(res.Key, "-")[0]

		// Verify the token is not expired.
		key, err := adminClient.APIKeyByID(ctx, codersdk.Me, keyID)
		require.NoError(t, err)
		require.True(t, key.ExpiresAt.After(dbtime.Now()))

		auditor.ResetLogs()

		// Expire the token.
		err = adminClient.ExpireAPIKey(ctx, codersdk.Me, keyID)
		require.NoError(t, err)

		// Verify the token is expired.
		key, err = adminClient.APIKeyByID(ctx, codersdk.Me, keyID)
		require.NoError(t, err)
		require.True(t, key.ExpiresAt.Before(dbtime.Now()))

		// Verify audit log.
		als := auditor.AuditLogs()
		require.Len(t, als, 1)
		require.Equal(t, database.AuditActionWrite, als[0].Action)
		require.Equal(t, database.ResourceTypeApiKey, als[0].ResourceType)
		require.Equal(t, admin.UserID.String(), als[0].UserID.String())
	})

	t.Run("AdminCanExpireOtherUsersToken", func(t *testing.T) {
		ctx := testutil.Context(t, testutil.WaitLong)

		// Create a token for the member.
		res, err := memberClient.CreateToken(ctx, codersdk.Me, codersdk.CreateTokenRequest{
			Lifetime: time.Hour * 24 * 7,
		})
		require.NoError(t, err)
		keyID := strings.Split(res.Key, "-")[0]

		// Admin expires the member's token.
		err = adminClient.ExpireAPIKey(ctx, member.ID.String(), keyID)
		require.NoError(t, err)

		// Verify the token is expired.
		key, err := memberClient.APIKeyByID(ctx, codersdk.Me, keyID)