fix: use a random value for a simulated hash for built-in users (#262… · coder/coder@027cf9a

"github.com/coder/coder/v2/coderd/coderdtest"

"github.com/coder/coder/v2/coderd/coderdtest/oidctest"

"github.com/coder/coder/v2/coderd/database"

"github.com/coder/coder/v2/coderd/database/dbauthz"

"github.com/coder/coder/v2/coderd/database/dbfake"

"github.com/coder/coder/v2/coderd/database/dbgen"

"github.com/coder/coder/v2/coderd/database/dbtime"

require.Equal(t, database.AuditActionLogin, auditor.AuditLogs()[numLogs-1].Action)

})

// "hunter2" was the input of the previous hardcoded simulated hash, which

// an empty stored hash wrongly matched; this is a regression test.

t.Run("NonexistentUser401", func(t *testing.T) {

t.Parallel()

client := coderdtest.New(t, nil)

ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)

defer cancel()

_, err := client.LoginWithPassword(ctx, codersdk.LoginWithPasswordRequest{

Email: "does-not-exist@coder.com",

Password: "hunter2",

})

var apiErr *codersdk.Error

require.ErrorAs(t, err, &apiErr)

require.Equal(t, http.StatusUnauthorized, apiErr.StatusCode())

require.Equal(t, "Incorrect email or password.", apiErr.Message)

})

// Attempting built-in login as an SSO user returns a 401 to avoid

// divulging login type.

t.Run("SSOReturns401", func(t *testing.T) {

t.Parallel()

client, db := coderdtest.NewWithDatabase(t, nil)

ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)

defer cancel()

// An SSO user has no password hash stored. Create one directly in the

// database since the API requires OIDC to be configured. dbgen.User

// substitutes a random hash for an empty one, so clear it explicitly.

ssoUser := dbgen.User(t, db, database.User{

Email: "sso-user@coder.com",

LoginType: database.LoginTypeOIDC,

})

//nolint:gocritic // Test setup requires a system context to clear the hash.

err := db.UpdateUserHashedPassword(dbauthz.AsSystemRestricted(ctx), database.UpdateUserHashedPasswordParams{

ID: ssoUser.ID,

HashedPassword: []byte{},

})

require.NoError(t, err)

anonClient := codersdk.New(client.URL)

_, err = anonClient.LoginWithPassword(ctx, codersdk.LoginWithPasswordRequest{

Email: ssoUser.Email,

Password: "hunter2",

})

var apiErr *codersdk.Error

require.ErrorAs(t, err, &apiErr)

require.Equal(t, http.StatusUnauthorized, apiErr.StatusCode())

require.Equal(t, "Incorrect email or password.", apiErr.Message)

// The login type must not be leaked.

require.NotContains(t, apiErr.Message, string(codersdk.LoginTypeOIDC))

})

t.Run("Suspended", func(t *testing.T) {

t.Parallel()

auditor := audit.NewMock()