package coderd_test

import (

"context"

"fmt"

"net/http"

"sort"

"strings"

"testing"

"time"

"github.com/google/uuid"

"github.com/stretchr/testify/require"

"golang.org/x/sync/errgroup"

"github.com/coder/coder/coderd/audit"

"github.com/coder/coder/coderd/coderdtest"

"github.com/coder/coder/coderd/database"

"github.com/coder/coder/coderd/rbac"

"github.com/coder/coder/codersdk"

"github.com/coder/coder/testutil"

)

func TestFirstUser(t *testing.T) {

t.Parallel()

t.Run("BadRequest", func(t *testing.T) {

t.Parallel()

client := coderdtest.New(t, nil)

ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)

defer cancel()

has, err := client.HasFirstUser(context.Background())

require.NoError(t, err)

require.False(t, has)

_, err = client.CreateFirstUser(ctx, codersdk.CreateFirstUserRequest{})

require.Error(t, err)

})

t.Run("AlreadyExists", func(t *testing.T) {

t.Parallel()

client := coderdtest.New(t, nil)

_ = coderdtest.CreateFirstUser(t, client)

ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)

defer cancel()

_, err := client.CreateFirstUser(ctx, codersdk.CreateFirstUserRequest{

Email: "some@email.com",

Username: "exampleuser",

Password: "SomeSecurePassword!",

})

var apiErr *codersdk.Error

require.ErrorAs(t, err, &apiErr)

require.Equal(t, http.StatusConflict, apiErr.StatusCode())

})

t.Run("Create", func(t *testing.T) {

t.Parallel()

client := coderdtest.New(t, nil)

_ = coderdtest.CreateFirstUser(t, client)

})

t.Run("Trial", func(t *testing.T) {

t.Parallel()

called := make(chan struct{})

client := coderdtest.New(t, &coderdtest.Options{

TrialGenerator: func(ctx context.Context, s string) error {

close(called)

return nil

},

})

ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)

defer cancel()

req := codersdk.CreateFirstUserRequest{

Email: "testuser@coder.com",

Username: "testuser",

Password: "SomeSecurePassword!",

Trial: true,

}

_, err := client.CreateFirstUser(ctx, req)

require.NoError(t, err)

<-called

})

}

func TestPostLogin(t *testing.T) {

t.Parallel()

t.Run("InvalidUser", func(t *testing.T) {

t.Parallel()

auditor := audit.NewMock()

client := coderdtest.New(t, &coderdtest.Options{Auditor: auditor})

numLogs := len(auditor.AuditLogs)

ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)

defer cancel()

_, err := client.LoginWithPassword(ctx, codersdk.LoginWithPasswordRequest{

Email: "my@email.org",

Password: "password",

})

numLogs++ // add an audit log for login

var apiErr *codersdk.Error

require.ErrorAs(t, err, &apiErr)

require.Equal(t, http.StatusUnauthorized, apiErr.StatusCode())

require.Len(t, auditor.AuditLogs, numLogs)

require.Equal(t, database.AuditActionLogin, auditor.AuditLogs[numLogs-1].Action)

})

t.Run("BadPassword", func(t *testing.T) {

t.Parallel()

auditor := audit.NewMock()

client := coderdtest.New(t, &coderdtest.Options{Auditor: auditor})

numLogs := len(auditor.AuditLogs)

ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)

defer cancel()

req := codersdk.CreateFirstUserRequest{

Email: "testuser@coder.com",

Username: "testuser",

Password: "SomeSecurePassword!",

}

_, err := client.CreateFirstUser(ctx, req)

require.NoError(t, err)

_, err = client.LoginWithPassword(ctx, codersdk.LoginWithPasswordRequest{

Email: req.Email,

Password: "badpass",

})

numLogs++ // add an audit log for login

var apiErr *codersdk.Error

require.ErrorAs(t, err, &apiErr)

require.Equal(t, http.StatusUnauthorized, apiErr.StatusCode())

require.Len(t, auditor.AuditLogs, numLogs)

require.Equal(t, database.AuditActionLogin, auditor.AuditLogs[numLogs-1].Action)

})

t.Run("Suspended", func(t *testing.T) {

t.Parallel()

auditor := audit.NewMock()

client := coderdtest.New(t, &coderdtest.Options{Auditor: auditor})

numLogs := len(auditor.AuditLogs)

first := coderdtest.CreateFirstUser(t, client)

numLogs++ // add an audit log for create user

numLogs++ // add an audit log for login

member, _ := coderdtest.CreateAnotherUser(t, client, first.OrganizationID)

numLogs++ // add an audit log for create user

ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)

defer cancel()

memberUser, err := member.User(ctx, codersdk.Me)

require.NoError(t, err, "fetch member user")

_, err = client.UpdateUserStatus(ctx, memberUser.Username, codersdk.UserStatusSuspended)

require.NoError(t, err, "suspend member")

numLogs++ // add an audit log for update user

// Test an existing session

_, err = member.User(ctx, codersdk.Me)

var apiErr *codersdk.Error

require.ErrorAs(t, err, &apiErr)

require.Equal(t, http.StatusUnauthorized, apiErr.StatusCode())

require.Contains(t, apiErr.Message, "Contact an admin")

// Test a new session

_, err = client.LoginWithPassword(ctx, codersdk.LoginWithPasswordRequest{

Email: memberUser.Email,

Password: "SomeSecurePassword!",

})

numLogs++ // add an audit log for login

require.ErrorAs(t, err, &apiErr)

require.Equal(t, http.StatusUnauthorized, apiErr.StatusCode())

require.Contains(t, apiErr.Message, "suspended")

require.Len(t, auditor.AuditLogs, numLogs)

require.Equal(t, database.AuditActionLogin, auditor.AuditLogs[numLogs-1].Action)

})

t.Run("DisabledPasswordAuth", func(t *testing.T) {

t.Parallel()

dc := coderdtest.DeploymentConfig(t)

client := coderdtest.New(t, &coderdtest.Options{

DeploymentConfig: dc,

})

first := coderdtest.CreateFirstUser(t, client)

ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)

defer cancel()

// With a user account.

const password = "SomeSecurePassword!"

user, err := client.CreateUser(ctx, codersdk.CreateUserRequest{

Email: "test+user-@coder.com",

Username: "user",

Password: password,

OrganizationID: first.OrganizationID,

})

require.NoError(t, err)

dc.DisablePasswordAuth.Value = true

userClient := codersdk.New(client.URL)

_, err = userClient.LoginWithPassword(ctx, codersdk.LoginWithPasswordRequest{

Email: user.Email,

Password: password,

})

require.Error(t, err)

var apiErr *codersdk.Error

require.ErrorAs(t, err, &apiErr)

require.Equal(t, http.StatusForbidden, apiErr.StatusCode())

require.Contains(t, apiErr.Message, "Password authentication is disabled")

})

t.Run("Success", func(t *testing.T) {

t.Parallel()

auditor := audit.NewMock()

client := coderdtest.New(t, &coderdtest.Options{Auditor: auditor})

numLogs := len(auditor.AuditLogs)

ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)

defer cancel()

req := codersdk.CreateFirstUserRequest{

Email: "testuser@coder.com",

Username: "testuser",

Password: "SomeSecurePassword!",

}

_, err := client.CreateFirstUser(ctx, req)

require.NoError(t, err)

numLogs++ // add an audit log for create user

numLogs++ // add an audit log for login

_, err = client.LoginWithPassword(ctx, codersdk.LoginWithPasswordRequest{

Email: req.Email,

Password: req.Password,

})

require.NoError(t, err)

// Login should be case insensitive

_, err = client.LoginWithPassword(ctx, codersdk.LoginWithPasswordRequest{

Email: strings.ToUpper(req.Email),

Password: req.Password,

})

require.NoError(t, err)

require.Len(t, auditor.AuditLogs, numLogs)

require.Equal(t, database.AuditActionLogin, auditor.AuditLogs[numLogs-1].Action)

})

t.Run("Lifetime&Expire", func(t *testing.T) {

t.Parallel()

client := coderdtest.New(t, nil)

admin := coderdtest.CreateFirstUser(t, client)

ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)

defer cancel()

split := strings.Split(client.SessionToken(), "-")

key, err := client.APIKey(ctx, admin.UserID.String(), split[0])

require.NoError(t, err, "fetch login key")

require.Equal(t, int64(86400), key.LifetimeSeconds, "default should be 86400")

// tokens have a longer life

token, err := client.CreateToken(ctx, codersdk.Me, codersdk.CreateTokenRequest{})

require.NoError(t, err, "make new token api key")

split = strings.Split(token.Key, "-")

apiKey, err := client.APIKey(ctx, admin.UserID.String(), split[0])

require.NoError(t, err, "fetch api key")

require.True(t, apiKey.ExpiresAt.After(time.Now().Add(time.Hour*24*29)), "default tokens lasts more than 29 days")

require.True(t, apiKey.ExpiresAt.Before(time.Now().Add(time.Hour*24*31)), "default tokens lasts less than 31 days")

require.Greater(t, apiKey.LifetimeSeconds, key.LifetimeSeconds, "token should have longer lifetime")

})

}

func TestDeleteUser(t *testing.T) {

t.Parallel()

t.Run("Works", func(t *testing.T) {

t.Parallel()

api := coderdtest.New(t, nil)

user := coderdtest.CreateFirstUser(t, api)

_, another := coderdtest.CreateAnotherUser(t, api, user.OrganizationID)

err := api.DeleteUser(context.Background(), another.ID)

require.NoError(t, err)

// Attempt to create a user with the same email and username, and delete them again.

another, err = api.CreateUser(context.Background(), codersdk.CreateUserRequest{

Email: another.Email,

Username: another.Username,

Password: "SomeSecurePassword!",

OrganizationID: user.OrganizationID,

})

require.NoError(t, err)

err = api.DeleteUser(context.Background(), another.ID)

require.NoError(t, err)

})

t.Run("NoPermission", func(t *testing.T) {

t.Parallel()

api := coderdtest.New(t, nil)

firstUser := coderdtest.CreateFirstUser(t, api)

client, _ := coderdtest.CreateAnotherUser(t, api, firstUser.OrganizationID)

err := client.DeleteUser(context.Background(), firstUser.UserID)

var apiErr *codersdk.Error

require.ErrorAs(t, err, &apiErr)

require.Equal(t, http.StatusForbidden, apiErr.StatusCode())

})

t.Run("HasWorkspaces", func(t *testing.T) {

t.Parallel()

client, _ := coderdtest.NewWithProvisionerCloser(t, nil)

user := coderdtest.CreateFirstUser(t, client)

anotherClient, another := coderdtest.CreateAnotherUser(t, client, user.OrganizationID)

version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)

coderdtest.AwaitTemplateVersionJob(t, client, version.ID)

template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)

coderdtest.CreateWorkspace(t, anotherClient, user.OrganizationID, template.ID)

err := client.DeleteUser(context.Background(), another.ID)

var apiErr *codersdk.Error

require.ErrorAs(t, err, &apiErr)

require.Equal(t, http.StatusExpectationFailed, apiErr.StatusCode())

})

t.Run("Self", func(t *testing.T) {

t.Parallel()

client := coderdtest.New(t, nil)

user := coderdtest.CreateFirstUser(t, client)

err := client.DeleteUser(context.Background(), user.UserID)

var apiErr *codersdk.Error

require.Error(t, err, "should not be able to delete self")

require.ErrorAs(t, err, &apiErr, "should be a coderd error")

require.Equal(t, http.StatusForbidden, apiErr.StatusCode(), "should be forbidden")

})

}

func TestPostLogout(t *testing.T) {

t.Parallel()

// Checks that the cookie is cleared and the API Key is deleted from the database.

t.Run("Logout", func(t *testing.T) {

t.Parallel()

auditor := audit.NewMock()

client := coderdtest.New(t, &coderdtest.Options{Auditor: auditor})

numLogs := len(auditor.AuditLogs)

admin := coderdtest.CreateFirstUser(t, client)

numLogs++ // add an audit log for login

ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)

defer cancel()

keyID := strings.Split(client.SessionToken(), "-")[0]

apiKey, err := client.APIKey(ctx, admin.UserID.String(), keyID)

require.NoError(t, err)

require.Equal(t, keyID, apiKey.ID, "API key should exist in the database")

fullURL, err := client.URL.Parse("/api/v2/users/logout")

require.NoError(t, err, "Server URL should parse successfully")

res, err := client.Request(ctx, http.MethodPost, fullURL.String(), nil)

numLogs++ // add an audit log for logout

require.NoError(t, err, "/logout request should succeed")

res.Body.Close()

require.Equal(t, http.StatusOK, res.StatusCode)

require.Len(t, auditor.AuditLogs, numLogs)

require.Equal(t, database.AuditActionLogout, auditor.AuditLogs[numLogs-1].Action)

cookies := res.Cookies()

var found bool

for _, cookie := range cookies {

if cookie.Name == codersdk.SessionTokenCookie {

require.Equal(t, codersdk.SessionTokenCookie, cookie.Name, "Cookie should be the auth cookie")

require.Equal(t, -1, cookie.MaxAge, "Cookie should be set to delete")

found = true

}

}

require.True(t, found, "auth cookie should be returned")

_, err = client.APIKey(ctx, admin.UserID.String(), keyID)

sdkErr := &codersdk.Error{}

require.ErrorAs(t, err, &sdkErr)

require.Equal(t, http.StatusUnauthorized, sdkErr.StatusCode(), "Expecting 401")

})

}

func TestPostUsers(t *testing.T) {

t.Parallel()

t.Run("NoAuth", func(t *testing.T) {

t.Parallel()

client := coderdtest.New(t, nil)

ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)

defer cancel()

_, err := client.CreateUser(ctx, codersdk.CreateUserRequest{})

require.Error(t, err)

})

t.Run("Conflicting", func(t *testing.T) {

t.Parallel()

client := coderdtest.New(t, nil)

coderdtest.CreateFirstUser(t, client)

ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)

defer cancel()

me, err := client.User(ctx, codersdk.Me)

require.NoError(t, err)

_, err = client.CreateUser(ctx, codersdk.CreateUserRequest{

Email: me.Email,

Username: me.Username,

Password: "MySecurePassword!",

OrganizationID: uuid.New(),

})

var apiErr *codersdk.Error

require.ErrorAs(t, err, &apiErr)

require.Equal(t, http.StatusConflict, apiErr.StatusCode())

})

t.Run("OrganizationNotFound", func(t *testing.T) {

t.Parallel()

client := coderdtest.New(t, nil)

coderdtest.CreateFirstUser(t, client)

ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)

defer cancel()

_, err := client.CreateUser(ctx, codersdk.CreateUserRequest{

OrganizationID: uuid.New(),

Email: "another@user.org",

Username: "someone-else",

Password: "SomeSecurePassword!",

})

var apiErr *codersdk.Error

require.ErrorAs(t, err, &apiErr)

require.Equal(t, http.StatusNotFound, apiErr.StatusCode())

})

t.Run("OrganizationNoAccess", func(t *testing.T) {

t.Parallel()

client := coderdtest.New(t, nil)

first := coderdtest.CreateFirstUser(t, client)

notInOrg, _ := coderdtest.CreateAnotherUser(t, client, first.OrganizationID)

other, _ := coderdtest.CreateAnotherUser(t, client, first.OrganizationID, rbac.RoleOwner(), rbac.RoleMember())

ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)

defer cancel()

org, err := other.CreateOrganization(ctx, codersdk.CreateOrganizationRequest{

Name: "another",

})

require.NoError(t, err)

_, err = notInOrg.CreateUser(ctx, codersdk.CreateUserRequest{

Email: "some@domain.com",

Username: "anotheruser",

Password: "SomeSecurePassword!",

OrganizationID: org.ID,

})

var apiErr *codersdk.Error

require.ErrorAs(t, err, &apiErr)

require.Equal(t, http.StatusForbidden, apiErr.StatusCode())

})

t.Run("Create", func(t *testing.T) {

t.Parallel()

auditor := audit.NewMock()

client := coderdtest.New(t, &coderdtest.Options{Auditor: auditor})

numLogs := len(auditor.AuditLogs)

user := coderdtest.CreateFirstUser(t, client)

numLogs++ // add an audit log for user create

numLogs++ // add an audit log for login

ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)

defer cancel()

_, err := client.CreateUser(ctx, codersdk.CreateUserRequest{

OrganizationID: user.OrganizationID,

Email: "another@user.org",

Username: "someone-else",

Password: "SomeSecurePassword!",

})

require.NoError(t, err)

require.Len(t, auditor.AuditLogs, numLogs)

require.Equal(t, database.AuditActionCreate, auditor.AuditLogs[numLogs-1].Action)

require.Equal(t, database.AuditActionLogin, auditor.AuditLogs[numLogs-2].Action)

})

t.Run("LastSeenAt", func(t *testing.T) {

t.Parallel()

ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)

defer cancel()

client := coderdtest.New(t, nil)

firstUserResp := coderdtest.CreateFirstUser(t, client)

firstUser, err := client.User(ctx, firstUserResp.UserID.String())

require.NoError(t, err)

_, _ = coderdtest.CreateAnotherUser(t, client, firstUserResp.OrganizationID)

allUsersRes, err := client.Users(ctx, codersdk.UsersRequest{})

require.NoError(t, err)

require.Len(t, allUsersRes.Users, 2)

// We sent the "GET Users" request with the first user, but the second user

// should be Never since they haven't performed a request.

for _, user := range allUsersRes.Users {

if user.ID == firstUser.ID {

require.WithinDuration(t, firstUser.LastSeenAt, database.Now(), testutil.WaitShort)

} else {

require.Zero(t, user.LastSeenAt)

}

}

})

}

func TestUpdateUserProfile(t *testing.T) {

t.Parallel()

t.Run("UserNotFound", func(t *testing.T) {

t.Parallel()

client := coderdtest.New(t, nil)

coderdtest.CreateFirstUser(t, client)

ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)

defer cancel()

_, err := client.UpdateUserProfile(ctx, uuid.New().String(), codersdk.UpdateUserProfileRequest{

Username: "newusername",

})

var apiErr *codersdk.Error

require.ErrorAs(t, err, &apiErr)

// Right now, we are raising a BAD request error because we don't support a

// user accessing other users info

require.Equal(t, http.StatusBadRequest, apiErr.StatusCode())

})

t.Run("ConflictingUsername", func(t *testing.T) {

t.Parallel()

client := coderdtest.New(t, nil)

user := coderdtest.CreateFirstUser(t, client)

ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)

defer cancel()

existentUser, err := client.CreateUser(ctx, codersdk.CreateUserRequest{

Email: "bruno@coder.com",

Username: "bruno",

Password: "SomeSecurePassword!",

OrganizationID: user.OrganizationID,

})

require.NoError(t, err)

_, err = client.UpdateUserProfile(ctx, codersdk.Me, codersdk.UpdateUserProfileRequest{

Username: existentUser.Username,

})

var apiErr *codersdk.Error

require.ErrorAs(t, err, &apiErr)

require.Equal(t, http.StatusConflict, apiErr.StatusCode())

})

t.Run("UpdateUsername", func(t *testing.T) {

t.Parallel()

auditor := audit.NewMock()

client := coderdtest.New(t, &coderdtest.Options{Auditor: auditor})

numLogs := len(auditor.AuditLogs)

coderdtest.CreateFirstUser(t, client)

numLogs++ // add an audit log for login

ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)

defer cancel()

_, _ = client.User(ctx, codersdk.Me)

userProfile, err := client.UpdateUserProfile(ctx, codersdk.Me, codersdk.UpdateUserProfileRequest{

Username: "newusername",

})

require.NoError(t, err)

require.Equal(t, userProfile.Username, "newusername")

numLogs++ // add an audit log for user update

require.Len(t, auditor.AuditLogs, numLogs)

require.Equal(t, database.AuditActionWrite, auditor.AuditLogs[numLogs-1].Action)

})

}

func TestUpdateUserPassword(t *testing.T) {

t.Parallel()

t.Run("MemberCantUpdateAdminPassword", func(t *testing.T) {

t.Parallel()

client := coderdtest.New(t, nil)

admin := coderdtest.CreateFirstUser(t, client)

member, _ := coderdtest.CreateAnotherUser(t, client, admin.OrganizationID)

ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)

defer cancel()

err := member.UpdateUserPassword(ctx, admin.UserID.String(), codersdk.UpdateUserPasswordRequest{

Password: "newpassword",

})

require.Error(t, err, "member should not be able to update admin password")

})

t.Run("AdminCanUpdateMemberPassword", func(t *testing.T) {

t.Parallel()

client := coderdtest.New(t, nil)

admin := coderdtest.CreateFirstUser(t, client)

ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)

defer cancel()

member, err := client.CreateUser(ctx, codersdk.CreateUserRequest{

Email: "coder@coder.com",

Username: "coder",

Password: "SomeStrongPassword!",

OrganizationID: admin.OrganizationID,

})

require.NoError(t, err, "create member")

err = client.UpdateUserPassword(ctx, member.ID.String(), codersdk.UpdateUserPasswordRequest{

Password: "SomeNewStrongPassword!",

})

require.NoError(t, err, "admin should be able to update member password")

// Check if the member can login using the new password

_, err = client.LoginWithPassword(ctx, codersdk.LoginWithPasswordRequest{

Email: "coder@coder.com",

Password: "SomeNewStrongPassword!",

})

require.NoError(t, err, "member should login successfully with the new password")

})

t.Run("MemberCanUpdateOwnPassword", func(t *testing.T) {

t.Parallel()

auditor := audit.NewMock()

client := coderdtest.New(t, &coderdtest.Options{Auditor: auditor})

numLogs := len(auditor.AuditLogs)

admin := coderdtest.CreateFirstUser(t, client)

numLogs++ // add an audit log for user create

numLogs++ // add an audit log for login

member, _ := coderdtest.CreateAnotherUser(t, client, admin.OrganizationID)

numLogs++ // add an audit log for user create

ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)

defer cancel()

err := member.UpdateUserPassword(ctx, "me", codersdk.UpdateUserPasswordRequest{

OldPassword: "SomeSecurePassword!",

Password: "MyNewSecurePassword!",

})

numLogs++ // add an audit log for user update

require.NoError(t, err, "member should be able to update own password")

require.Len(t, auditor.AuditLogs, numLogs)

require.Equal(t, database.AuditActionWrite, auditor.AuditLogs[numLogs-1].Action)

})

t.Run("MemberCantUpdateOwnPasswordWithoutOldPassword", func(t *testing.T) {

t.Parallel()

client := coderdtest.New(t, nil)

admin := coderdtest.CreateFirstUser(t, client)

member, _ := coderdtest.CreateAnotherUser(t, client, admin.OrganizationID)

ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)

defer cancel()

err := member.UpdateUserPassword(ctx, "me", codersdk.UpdateUserPasswordRequest{

Password: "newpassword",

})

require.Error(t, err, "member should not be able to update own password without providing old password")

})

t.Run("AdminCanUpdateOwnPasswordWithoutOldPassword", func(t *testing.T) {

t.Parallel()

auditor := audit.NewMock()

client := coderdtest.New(t, &coderdtest.Options{Auditor: auditor})

numLogs := len(auditor.AuditLogs)

_ = coderdtest.CreateFirstUser(t, client)

numLogs++ // add an audit log for login

ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)

defer cancel()

err := client.UpdateUserPassword(ctx, "me", codersdk.UpdateUserPasswordRequest{

Password: "MySecurePassword!",

})

numLogs++ // add an audit log for user update

require.NoError(t, err, "admin should be able to update own password without providing old password")

require.Len(t, auditor.AuditLogs, numLogs)

require.Equal(t, database.AuditActionWrite, auditor.AuditLogs[numLogs-1].Action)

})

t.Run("ChangingPasswordDeletesKeys", func(t *testing.T) {

t.Parallel()

client := coderdtest.New(t, nil)

user := coderdtest.CreateFirstUser(t, client)

ctx, _ := testutil.Context(t)

apikey1, err := client.CreateToken(ctx, user.UserID.String(), codersdk.CreateTokenRequest{})

require.NoError(t, err)

apikey2, err := client.CreateToken(ctx, user.UserID.String(), codersdk.CreateTokenRequest{})

require.NoError(t, err)

err = client.UpdateUserPassword(ctx, "me", codersdk.UpdateUserPasswordRequest{

Password: "MyNewSecurePassword!",

})

require.NoError(t, err)

// Trying to get an API key should fail since our client's token

// has been deleted.

_, err = client.APIKey(ctx, user.UserID.String(), apikey1.Key)

require.Error(t, err)

cerr := coderdtest.SDKError(t, err)

require.Equal(t, http.StatusUnauthorized, cerr.StatusCode())

resp, err := client.LoginWithPassword(ctx, codersdk.LoginWithPasswordRequest{

Email: coderdtest.FirstUserParams.Email,

Password: "MyNewSecurePassword!",

})

require.NoError(t, err)

client.SetSessionToken(resp.SessionToken)

// Trying to get an API key should fail since all keys are deleted

// on password change.

_, err = client.APIKey(ctx, user.UserID.String(), apikey1.Key)

require.Error(t, err)

cerr = coderdtest.SDKError(t, err)

require.Equal(t, http.StatusNotFound, cerr.StatusCode())

_, err = client.APIKey(ctx, user.UserID.String(), apikey2.Key)

require.Error(t, err)

cerr = coderdtest.SDKError(t, err)

require.Equal(t, http.StatusNotFound, cerr.StatusCode())

})

t.Run("PasswordsMustDiffer", func(t *testing.T) {

t.Parallel()

client := coderdtest.New(t, nil)

_ = coderdtest.CreateFirstUser(t, client)

ctx, _ := testutil.Context(t)

err := client.UpdateUserPassword(ctx, "me", codersdk.UpdateUserPasswordRequest{

Password: coderdtest.FirstUserParams.Password,

})

require.Error(t, err)

cerr := coderdtest.SDKError(t, err)

require.Equal(t, http.StatusBadRequest, cerr.StatusCode())

})

}

func TestGrantSiteRoles(t *testing.T) {

t.Parallel()

requireStatusCode := func(t *testing.T, err error, statusCode int) {

t.Helper()

var e *codersdk.Error

require.ErrorAs(t, err, &e, "error is codersdk error")

require.Equal(t, statusCode, e.StatusCode(), "correct status code")

}

ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)

t.Cleanup(cancel)

var err error

admin := coderdtest.New(t, nil)

first := coderdtest.CreateFirstUser(t, admin)

member, _ := coderdtest.CreateAnotherUser(t, admin, first.OrganizationID)

orgAdmin, _ := coderdtest.CreateAnotherUser(t, admin, first.OrganizationID, rbac.RoleOrgAdmin(first.OrganizationID))

randOrg, err := admin.CreateOrganization(ctx, codersdk.CreateOrganizationRequest{

Name: "random",

})

require.NoError(t, err)

_, randOrgUser := coderdtest.CreateAnotherUser(t, admin, randOrg.ID, rbac.RoleOrgAdmin(randOrg.ID))

userAdmin, _ := coderdtest.CreateAnotherUser(t, admin, first.OrganizationID, rbac.RoleUserAdmin())

const newUser = "newUser"

testCases := []struct {

Name string

Client *codersdk.Client

OrgID uuid.UUID

AssignToUser string

Roles []string

ExpectedRoles []string

Error bool

StatusCode int

}{

{

Name: "OrgRoleInSite",

Client: admin,

AssignToUser: codersdk.Me,

Roles: []string{rbac.RoleOrgAdmin(first.OrganizationID)},

Error: true,

StatusCode: http.StatusBadRequest,

},

{

Name: "UserNotExists",

Client: admin,

AssignToUser: uuid.NewString(),

Roles: []string{rbac.RoleOwner()},

Error: true,

StatusCode: http.StatusBadRequest,

},

{

Name: "MemberCannotUpdateRoles",

Client: member,

AssignToUser: first.UserID.String(),

Roles: []string{},

Error: true,

StatusCode: http.StatusForbidden,

},

{

// Cannot update your own roles

Name: "AdminOnSelf",

Client: admin,

AssignToUser: first.UserID.String(),

Roles: []string{},

Error: true,

StatusCode: http.StatusBadRequest,

},

{

Name: "SiteRoleInOrg",

Client: admin,

OrgID: first.OrganizationID,

AssignToUser: codersdk.Me,

Roles: []string{rbac.RoleOwner()},

Error: true,

StatusCode: http.StatusBadRequest,

},

{

Name: "RoleInNotMemberOrg",

Client: orgAdmin,

OrgID: randOrg.ID,

AssignToUser: randOrgUser.ID.String(),

Roles: []string{rbac.RoleOrgMember(randOrg.ID)},

Error: true,

StatusCode: http.StatusNotFound,

},

{

Name: "AdminUpdateOrgSelf",

Client: admin,

OrgID: first.OrganizationID,

AssignToUser: first.UserID.String(),

Roles: []string{},

Error: true,

StatusCode: http.StatusBadRequest,

},

{

Name: "OrgAdminPromote",

Client: orgAdmin,

OrgID: first.OrganizationID,

AssignToUser: newUser,

Roles: []string{rbac.RoleOrgAdmin(first.OrganizationID)},

ExpectedRoles: []string{

rbac.RoleOrgAdmin(first.OrganizationID),

},

Error: false,

},

{

Name: "UserAdminMakeMember",

Client: userAdmin,

AssignToUser: newUser,

Roles: []string{rbac.RoleMember()},

ExpectedRoles: []string{

rbac.RoleMember(),

},

Error: false,

},

}

for _, c := range testCases {

c := c

t.Run(c.Name, func(t *testing.T) {

t.Parallel()

ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)

defer cancel()

var err error

if c.AssignToUser == newUser {

orgID := first.OrganizationID

if c.OrgID != uuid.Nil {

orgID = c.OrgID

}

_, newUser := coderdtest.CreateAnotherUser(t, admin, orgID)

c.AssignToUser = newUser.ID.String()

}

var newRoles []codersdk.Role

if c.OrgID != uuid.Nil {

// Org assign

var mem codersdk.OrganizationMember

mem, err = c.Client.UpdateOrganizationMemberRoles(ctx, c.OrgID, c.AssignToUser, codersdk.UpdateRoles{

Roles: c.Roles,

})

newRoles = mem.Roles

} else {

// Site assign

var user codersdk.User

user, err = c.Client.UpdateUserRoles(ctx, c.AssignToUser, codersdk.UpdateRoles{

Roles: c.Roles,

})

newRoles = user.Roles

}

if c.Error {

require.Error(t, err)

requireStatusCode(t, err, c.StatusCode)

} else {

require.NoError(t, err)

roles := make([]string, 0, len(newRoles))

for _, r := range newRoles {

roles = append(roles, r.Name)

}

require.ElementsMatch(t, roles, c.ExpectedRoles)

}

})

}

}

// TestInitialRoles ensures the starting roles for the first user are correct.

func TestInitialRoles(t *testing.T) {

t.Parallel()

ctx := context.Background()

client := coderdtest.New(t, nil)

first := coderdtest.CreateFirstUser(t, client)

roles, err := client.UserRoles(ctx, codersdk.Me)

require.NoError(t, err)

require.ElementsMatch(t, roles.Roles, []string{

rbac.RoleOwner(),

}, "should be a member and admin")

require.ElementsMatch(t, roles.OrganizationRoles[first.OrganizationID], []string{

rbac.RoleOrgMember(first.OrganizationID),

}, "should be a member and admin")

}

func TestPutUserSuspend(t *testing.T) {

t.Parallel()

t.Run("SuspendAnOwner", func(t *testing.T) {

t.Parallel()

client := coderdtest.New(t, nil)

me := coderdtest.CreateFirstUser(t, client)

_, user := coderdtest.CreateAnotherUser(t, client, me.OrganizationID, rbac.RoleOwner())

ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)

defer cancel()

_, err := client.UpdateUserStatus(ctx, user.Username, codersdk.UserStatusSuspended)

require.Error(t, err, "cannot suspend owners")

})

t.Run("SuspendAnotherUser", func(t *testing.T) {

t.Parallel()

auditor := audit.NewMock()

client := coderdtest.New(t, &coderdtest.Options{Auditor: auditor})

numLogs := len(auditor.AuditLogs)

me := coderdtest.CreateFirstUser(t, client)

numLogs++ // add an audit log for user create

numLogs++ // add an audit log for login

_, user := coderdtest.CreateAnotherUser(t, client, me.OrganizationID)

numLogs++ // add an audit log for user create

ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)

defer cancel()

user, err := client.UpdateUserStatus(ctx, user.Username, codersdk.UserStatusSuspended)

require.NoError(t, err)

require.Equal(t, user.Status, codersdk.UserStatusSuspended)

numLogs++ // add an audit log for user update

require.Len(t, auditor.AuditLogs, numLogs)

require.Equal(t, database.AuditActionWrite, auditor.AuditLogs[numLogs-1].Action)

})

t.Run("SuspendItSelf", func(t *testing.T) {

t.Parallel()

client := coderdtest.New(t, nil)

coderdtest.CreateFirstUser(t, client)