Function TestCreateWorkspaceExternalAuth

coderd/workspaces_test.go:1472–1708

(t *testing.T)

}

func TestCreateWorkspaceExternalAuth(t *testing.T) {
	t.Parallel()

	// The expected 403 message returned by createWorkspace when the workspace
	// owner is missing required external auth.
	const externalAuthRequiredMessage = "External authentication is required to create a workspace with this template."

	// externalAuthVersion returns echo responses for a template version whose
	// graph references the given external auth providers.
	externalAuthVersion := func(providers ...*proto.ExternalAuthProviderResource) *echo.Responses {
		return &echo.Responses{
			Parse: echo.ParseComplete,
			ProvisionGraph: []*proto.Response{{
				Type: &proto.Response_Graph{
					Graph: &proto.GraphComplete{
						ExternalAuthProviders: providers,
					},
				},
			}},
		}
	}

	t.Run("RequiredAuthMissing", func(t *testing.T) {
		t.Parallel()
		client := coderdtest.New(t, &coderdtest.Options{
			IncludeProvisionerDaemon: true,
			ExternalAuthConfigs: []*externalauth.Config{{
				InstrumentedOAuth2Config: &testutil.OAuth2Config{},
				ID:                       "github",
				Regex:                    regexp.MustCompile(`github\.com`),
				Type:                     codersdk.EnhancedExternalAuthProviderGitHub.String(),
				DisplayName:              "GitHub",
			}},
		})
		first := coderdtest.CreateFirstUser(t, client)
		version := coderdtest.CreateTemplateVersion(t, client, first.OrganizationID,
			externalAuthVersion(&proto.ExternalAuthProviderResource{Id: "github"}))
		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
		template := coderdtest.CreateTemplate(t, client, first.OrganizationID, version.ID)
		memberClient, member := coderdtest.CreateAnotherUser(t, client, first.OrganizationID)

		ctx := testutil.Context(t, testutil.WaitLong)

		req := codersdk.CreateWorkspaceRequest{
			TemplateID: template.ID,
			Name:       coderdtest.RandomUsername(t),
		}
		_, err := memberClient.CreateUserWorkspace(ctx, codersdk.Me, req)
		var apiErr *codersdk.Error
		require.ErrorAs(t, err, &apiErr)
		require.Equal(t, http.StatusForbidden, apiErr.StatusCode())
		require.Equal(t, externalAuthRequiredMessage, apiErr.Message)
		require.Equal(t, "The workspace owner must authenticate with the following external auth providers: GitHub.", apiErr.Detail)
		require.Equal(t, []codersdk.ValidationError{{
			Field:  "external_auth",
			Detail: "github",
		}}, apiErr.Validations)