Merge branch 'master' into feat/client-ip-forwarding

Author: jnschaeffer

cmd/migrate_cmd.go

@@ -2,7 +2,6 @@ package cmd
 
 import (
 	"embed"
-	"fmt"
 	"net/url"
 	"os"
 
@@ -23,12 +22,12 @@ var migrateCmd = cobra.Command{
 
 func migrate(cmd *cobra.Command, args []string) {
 	globalConfig := loadGlobalConfig(cmd.Context())
+	u, err := url.Parse(globalConfig.DB.URL)
+	if err != nil {
+		logrus.Fatalf("%+v", errors.Wrap(err, "parsing db connection url"))
+	}
 
 	if globalConfig.DB.Driver == "" && globalConfig.DB.URL != "" {
-		u, err := url.Parse(globalConfig.DB.URL)
-		if err != nil {
-			logrus.Fatalf("%+v", errors.Wrap(err, "parsing db connection url"))
-		}
 		globalConfig.DB.Driver = u.Scheme
 	}
 
@@ -53,16 +52,12 @@ func migrate(cmd *cobra.Command, args []string) {
 		}
 	}
 
-	u, _ := url.Parse(globalConfig.DB.URL)
-	processedUrl := globalConfig.DB.URL
-	if len(u.Query()) != 0 {
-		processedUrl = fmt.Sprintf("%s&application_name=gotrue_migrations", processedUrl)
-	} else {
-		processedUrl = fmt.Sprintf("%s?application_name=gotrue_migrations", processedUrl)
-	}
+	q := u.Query()
+	q.Add("application_name", "auth_migrations")
+	u.RawQuery = q.Encode()
 	deets := &pop.ConnectionDetails{
 		Dialect: globalConfig.DB.Driver,
-		URL:     processedUrl,
+		URL:     u.String(),
 	}
 	deets.Options = map[string]string{
 		"migration_table_name": "schema_migrations",

internal/api/e2e_test.go

@@ -971,6 +971,90 @@ func TestE2EHooks(t *testing.T) {
 				}
 			})
 		}
+
+		t.Run("AMRStringArrayUnmarshalling", func(t *testing.T) {
+			defer inst.HookRecorder.CustomizeAccessToken.ClearCalls()
+
+			// Setup hook that returns amr as array of strings
+			var claimsIn M
+			hr := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				w.Header().Add("content-type", "application/json")
+				w.WriteHeader(http.StatusOK)
+
+				err := json.NewDecoder(r.Body).Decode(&claimsIn)
+				require.NoError(t, err)
+
+				// Modify amr to be array of strings instead of objects
+				claimsOut := copyMap(t, claimsIn)
+				claimsOut["claims"].(M)["amr"] = []string{"password", "totp"}
+
+				err = json.NewEncoder(w).Encode(claimsOut)
+				require.NoError(t, err)
+			})
+
+			inst.HookRecorder.CustomizeAccessToken.ClearCalls()
+			inst.HookRecorder.CustomizeAccessToken.SetHandler(hr)
+
+			// Get token with modified amr
+			req := &api.PasswordGrantParams{
+				Email:    string(currentUser.Email),
+				Password: defaultPassword,
+			}
+
+			res := new(api.AccessTokenResponse)
+			err := e2eapi.Do(ctx, http.MethodPost, inst.APIServer.URL+"/token?grant_type=password", req, res)
+			require.NoError(t, err)
+			require.True(t, len(res.Token) > 0)
+
+			// Verify hook was called
+			{
+				calls := inst.HookRecorder.CustomizeAccessToken.GetCalls()
+				require.Equal(t, 1, len(calls))
+			}
+
+			// Parse token to verify it can be unmarshalled
+			p := jwt.NewParser(jwt.WithValidMethods(globalCfg.JWT.ValidMethods))
+			token, err := p.ParseWithClaims(
+				res.Token,
+				&api.AccessTokenClaims{},
+				func(token *jwt.Token) (any, error) {
+					if kid, ok := token.Header["kid"]; ok {
+						if kidStr, ok := kid.(string); ok {
+							return conf.FindPublicKeyByKid(kidStr, &globalCfg.JWT)
+						}
+					}
+					if alg, ok := token.Header["alg"]; ok {
+						if alg == jwt.SigningMethodHS256.Name {
+							return []byte(globalCfg.JWT.Secret), nil
+						}
+					}
+					return nil, fmt.Errorf("missing kid")
+				})
+			require.NoError(t, err, "Token should parse successfully even with string array amr")
+
+			fmt.Println("token hereee", res.Token)
+			// Verify claims were unmarshalled correctly
+			claims, ok := token.Claims.(*api.AccessTokenClaims)
+			require.True(t, ok, "Claims should be AccessTokenClaims type")
+			require.NotNil(t, claims.AuthenticationMethodReference, "AMR should not be nil")
+			require.Len(t, claims.AuthenticationMethodReference, 2, "AMR should have 2 entries")
+			require.Equal(t, "password", claims.AuthenticationMethodReference[0].Method)
+			require.Equal(t, "totp", claims.AuthenticationMethodReference[1].Method)
+
+			// Call /user endpoint with the token to verify it works end-to-end
+			httpReq, err := http.NewRequestWithContext(ctx, http.MethodGet, "/user", nil)
+			require.NoError(t, err)
+
+			httpRes, err := inst.DoAuth(httpReq, res.Token)
+			require.NoError(t, err, "Should be able to call /user endpoint with token containing string array amr")
+			require.Equal(t, http.StatusOK, httpRes.StatusCode, "/user endpoint should return 200 OK")
+
+			// Verify we got user data back
+			var userData models.User
+			err = json.NewDecoder(httpRes.Body).Decode(&userData)
+			require.NoError(t, err, "Should be able to decode user response")
+			require.Equal(t, currentUser.ID, userData.ID, "Should get the correct user")
+		})
 	})
 
 	t.Run("SendEmail", func(t *testing.T) {

internal/api/token_test.go

@@ -741,6 +741,43 @@ end; $$ language plpgsql;`,
 				"user_metadata": nil,
 			},
 			shouldError: false,
+		}, {
+			desc: "Modify amr to be array of strings",
+			uri:  "pg-functions://postgres/auth/custom_access_token_amr_strings",
+			hookFunctionSQL: `
+create or replace function custom_access_token_amr_strings(input jsonb)
+returns jsonb as $$
+declare
+    result jsonb;
+begin
+    input := jsonb_set(input, '{claims,amr}', '["password", "mfa"]'::jsonb);
+    result := jsonb_build_object('claims', input->'claims');
+    return result;
+end; $$ language plpgsql;`,
+			expectedClaims: map[string]interface{}{
+				"amr": []interface{}{"password", "mfa"},
+			},
+			shouldError: false,
+		}, {
+			desc: "Modify amr to be array of objects",
+			uri:  "pg-functions://postgres/auth/custom_access_token_amr_objects",
+			hookFunctionSQL: `
+create or replace function custom_access_token_amr_objects(input jsonb)
+returns jsonb as $$
+declare
+    result jsonb;
+begin
+    input := jsonb_set(input, '{claims,amr}', '[{"method": "password"}, {"method": "mfa"}]'::jsonb);
+    result := jsonb_build_object('claims', input->'claims');
+    return result;
+end; $$ language plpgsql;`,
+			expectedClaims: map[string]interface{}{
+				"amr": []interface{}{
+					map[string]interface{}{"method": "password"},
+					map[string]interface{}{"method": "mfa"},
+				},
+			},
+			shouldError: false,
 		},
 	}
 	for _, c := range cases {