diff --git a/.bacon.yml b/.bacon.yml index c82fa7d2d..e5d6f81c7 100644 --- a/.bacon.yml +++ b/.bacon.yml @@ -90,13 +90,14 @@ test_suites: script_name: e2e-express-embedded-sign-in-widget criteria: MERGE queue_name: small - - name: e2e-react-oie - script_path: ../okta-auth-js/scripts - sort_order: '14' - timeout: '10' - script_name: e2e-react-oie - criteria: MERGE - queue_name: small + # disable due to request cors issue + # - name: e2e-react-oie + # script_path: ../okta-auth-js/scripts + # sort_order: '14' + # timeout: '10' + # script_name: e2e-react-oie + # criteria: MERGE + # queue_name: small - name: publish script_path: ../okta-auth-js/scripts sort_order: '15' diff --git a/env/index.js b/env/index.js index 115e8d918..4e63d511b 100644 --- a/env/index.js +++ b/env/index.js @@ -11,12 +11,10 @@ */ const dotenv = require('dotenv'); -const yaml = require('js-yaml'); const fs = require('fs'); const path = require('path'); const TESTENV_FILE = 'testenv'; -const TESTENV_YAML = 'testenv.yml'; function setEnvironmentVars(envConfig) { Object.keys(envConfig).forEach((k) => { @@ -47,29 +45,6 @@ function setEnvironmentVarsFromTestEnv(currDir) { setEnvironmentVars(envConfig); } -function setEnvironmentVarsFromTestEnvYaml(name, currDir) { - const testEnvPath = getPath(TESTENV_YAML, currDir); - if (!testEnvPath) { - return; - } - const doc = yaml.load(fs.readFileSync(testEnvPath, 'utf8')); - if (!doc) { - console.log(`Can't load testenv.yml`); - return; - } - - if (doc.default) { - console.log(`Loading environment variables from testenv.yml: "default"`); - setEnvironmentVars(doc.default); - } - - if (doc[name]) { - console.log(`Loading environment variables from testenv.yml: "${name}"`); - setEnvironmentVars(doc[name]); - } -} - module.exports = { - setEnvironmentVarsFromTestEnv, - setEnvironmentVarsFromTestEnvYaml + setEnvironmentVarsFromTestEnv }; diff --git a/env/package.json b/env/package.json index 154937fd5..b76728744 100644 --- a/env/package.json +++ b/env/package.json @@ -4,7 +4,6 @@ "main": "index.js", "private": true, "dependencies": { - "dotenv": "^8.2.0", - "js-yaml": "^4.1.0" + "dotenv": "^8.2.0" } } diff --git a/samples/config.js b/samples/config.js index 8eb56c15b..3d965bb7e 100644 --- a/samples/config.js +++ b/samples/config.js @@ -50,6 +50,7 @@ const templateDefaults = { const samples = [ { name: '@okta/samples.static-spa', + appType: 'browser', template: 'static-spa', generateType: GENERATE_TYPE_FULL, specs: ['spa-app'], @@ -57,6 +58,7 @@ const samples = [ }, { name: '@okta/samples.webpack-spa', + appType: 'browser', template: 'webpack-spa', generateType: GENERATE_TYPE_FULL, specs: ['spa-app'], @@ -64,6 +66,7 @@ const samples = [ }, { name: '@okta/samples.express-web-no-oidc', + appType: 'web', template: 'express-web', generateType: GENERATE_TYPE_FULL, specs: ['web-app'], @@ -71,12 +74,14 @@ const samples = [ }, { name: '@okta/samples.express-web-with-oidc', + appType: 'web', template: 'express-web', generateType: GENERATE_TYPE_FULL, specs: ['web-app'] }, { name: '@okta/samples.express-embedded-auth-with-sdk', + appType: 'web', template: 'express-embedded-auth-with-sdk', generateType: GENERATE_TYPE_OVERWRITE, specs: ['express-embedded-auth-with-sdk'], @@ -88,6 +93,7 @@ const samples = [ 'self-service-registration-custom-attribute', 'self-service-registration-activation-token', 'mfa-password-and-email', + 'mfa-password-and-email-magic-link', 'mfa-password-and-sms', 'social-login-mfa', 'social-idp', @@ -95,10 +101,10 @@ const samples = [ 'totp-signin', ], useEnv: true, - express: true, }, { name: '@okta/samples.express-embedded-sign-in-widget', + appType: 'web', template: 'express-embedded-sign-in-widget', generateType: GENERATE_TYPE_OVERWRITE, specs: [], @@ -110,6 +116,7 @@ const samples = [ }, { name: '@okta/test.app.react-oie', + appType: 'browser', features: [ 'progressive-profiling-view-profile' ], diff --git a/samples/generated/express-embedded-auth-with-sdk/env/okta-env.js b/samples/generated/express-embedded-auth-with-sdk/env/okta-env.js index 115e8d918..4e63d511b 100644 --- a/samples/generated/express-embedded-auth-with-sdk/env/okta-env.js +++ b/samples/generated/express-embedded-auth-with-sdk/env/okta-env.js @@ -11,12 +11,10 @@ */ const dotenv = require('dotenv'); -const yaml = require('js-yaml'); const fs = require('fs'); const path = require('path'); const TESTENV_FILE = 'testenv'; -const TESTENV_YAML = 'testenv.yml'; function setEnvironmentVars(envConfig) { Object.keys(envConfig).forEach((k) => { @@ -47,29 +45,6 @@ function setEnvironmentVarsFromTestEnv(currDir) { setEnvironmentVars(envConfig); } -function setEnvironmentVarsFromTestEnvYaml(name, currDir) { - const testEnvPath = getPath(TESTENV_YAML, currDir); - if (!testEnvPath) { - return; - } - const doc = yaml.load(fs.readFileSync(testEnvPath, 'utf8')); - if (!doc) { - console.log(`Can't load testenv.yml`); - return; - } - - if (doc.default) { - console.log(`Loading environment variables from testenv.yml: "default"`); - setEnvironmentVars(doc.default); - } - - if (doc[name]) { - console.log(`Loading environment variables from testenv.yml: "${name}"`); - setEnvironmentVars(doc[name]); - } -} - module.exports = { - setEnvironmentVarsFromTestEnv, - setEnvironmentVarsFromTestEnvYaml + setEnvironmentVarsFromTestEnv }; diff --git a/samples/generated/express-embedded-auth-with-sdk/web-server/views/home.mustache b/samples/generated/express-embedded-auth-with-sdk/web-server/views/home.mustache index 2fd35fa8d..363186d20 100644 --- a/samples/generated/express-embedded-auth-with-sdk/web-server/views/home.mustache +++ b/samples/generated/express-embedded-auth-with-sdk/web-server/views/home.mustache @@ -33,9 +33,9 @@

- - - + + +
{{/isLoggedIn}} diff --git a/samples/generated/express-embedded-auth-with-sdk/web-server/views/menu.mustache b/samples/generated/express-embedded-auth-with-sdk/web-server/views/menu.mustache index 5381816c1..018c37f30 100644 --- a/samples/generated/express-embedded-auth-with-sdk/web-server/views/menu.mustache +++ b/samples/generated/express-embedded-auth-with-sdk/web-server/views/menu.mustache @@ -4,7 +4,7 @@
{{#isLoggedIn}}
-
diff --git a/samples/generated/express-embedded-auth-with-sdk/web-server/views/select-authenticator-unlock-account.mustache b/samples/generated/express-embedded-auth-with-sdk/web-server/views/select-authenticator-unlock-account.mustache index d1b01bd1b..15de7be94 100644 --- a/samples/generated/express-embedded-auth-with-sdk/web-server/views/select-authenticator-unlock-account.mustache +++ b/samples/generated/express-embedded-auth-with-sdk/web-server/views/select-authenticator-unlock-account.mustache @@ -43,7 +43,7 @@ {{#canSkip}}
-
diff --git a/samples/generated/express-embedded-auth-with-sdk/web-server/views/select-authenticator.mustache b/samples/generated/express-embedded-auth-with-sdk/web-server/views/select-authenticator.mustache index 6d95e225a..84a58edfa 100644 --- a/samples/generated/express-embedded-auth-with-sdk/web-server/views/select-authenticator.mustache +++ b/samples/generated/express-embedded-auth-with-sdk/web-server/views/select-authenticator.mustache @@ -35,7 +35,7 @@ {{#canSkip}}
-
diff --git a/samples/generated/express-embedded-sign-in-widget/env/okta-env.js b/samples/generated/express-embedded-sign-in-widget/env/okta-env.js index 115e8d918..4e63d511b 100644 --- a/samples/generated/express-embedded-sign-in-widget/env/okta-env.js +++ b/samples/generated/express-embedded-sign-in-widget/env/okta-env.js @@ -11,12 +11,10 @@ */ const dotenv = require('dotenv'); -const yaml = require('js-yaml'); const fs = require('fs'); const path = require('path'); const TESTENV_FILE = 'testenv'; -const TESTENV_YAML = 'testenv.yml'; function setEnvironmentVars(envConfig) { Object.keys(envConfig).forEach((k) => { @@ -47,29 +45,6 @@ function setEnvironmentVarsFromTestEnv(currDir) { setEnvironmentVars(envConfig); } -function setEnvironmentVarsFromTestEnvYaml(name, currDir) { - const testEnvPath = getPath(TESTENV_YAML, currDir); - if (!testEnvPath) { - return; - } - const doc = yaml.load(fs.readFileSync(testEnvPath, 'utf8')); - if (!doc) { - console.log(`Can't load testenv.yml`); - return; - } - - if (doc.default) { - console.log(`Loading environment variables from testenv.yml: "default"`); - setEnvironmentVars(doc.default); - } - - if (doc[name]) { - console.log(`Loading environment variables from testenv.yml: "${name}"`); - setEnvironmentVars(doc[name]); - } -} - module.exports = { - setEnvironmentVarsFromTestEnv, - setEnvironmentVarsFromTestEnvYaml + setEnvironmentVarsFromTestEnv }; diff --git a/samples/test/README.md b/samples/test/README.md index d0bf8cf39..1eec55be8 100644 --- a/samples/test/README.md +++ b/samples/test/README.md @@ -29,6 +29,16 @@ WEB_CLIENT_ID=123xxxx WEB_CLIENT_SECRET=sOmeSecretString ``` +## Reproduce test locally + +Most cucumber tests setup org configs dynamiclly via management api and tear down the created app/polices/user after each test. It might make it difficult to repro the test with the exact org config after a failure, here are some approaches to persist the created org config during a test: + +* Comment out the org context deletion part in `./steps/after.ts`. **Note:** the changes should not be commited. + +* Add a break point at the end of `Given` step, so configs can be grabbed from the test org, then you can target to the generated test app for local manual debugging. See the `sample: test feature` section in `launch.json`. + +* Use `await browser.debug()` to pause the test process. + ## Commands If running from the workspace directory: `yarn workspace @okta/test.e2e.samples start` diff --git a/samples/test/features/basic-auth.feature b/samples/test/features/basic-auth.feature index b3f97383e..d1d60bc25 100644 --- a/samples/test/features/basic-auth.feature +++ b/samples/test/features/basic-auth.feature @@ -1,13 +1,14 @@ Feature: Direct Auth Basic Login with Password Factor Background: - Given an APP Sign On Policy that defines Password as required and the only factor for login - # And the list of Authenticators only contains Email and Password - # And User Enumeration Prevention is set to ENABLED in Security > General - And a User named "Mary" exists, and this user has already setup email and password factors + Given an App + And a Policy that defines "Authentication" + And with a Policy Rule that defines "Password as the only factor" + And a user named "Mary" Scenario: Mary logs in with a Password - Given Mary navigates to Login with Username and Password + Given she has an account with "active" state in the org + And Mary navigates to Login with Username and Password When she fills in her username And she fills in her correct password And she submits the Login form @@ -22,14 +23,17 @@ Feature: Direct Auth Basic Login with Password Factor Then she is redirected to the Self Service Password Reset View Scenario: Mary doesn't know her username - Given Mary navigates to Login with Username and Password + Given she does not have account in the org + And the app is assigned to "Everyone" group + And Mary navigates to Login with Username and Password When she fills in her incorrect username And she fills in her password And she submits the Login form Then she should see a message on the Login form "There is no account with the Username Mory." Scenario: Mary doesn't know her password - Given Mary navigates to the Basic Login View + Given she has an account with "active" state in the org + And Mary navigates to the Basic Login View When she fills in her correct username And she fills in her incorrect password And she submits the Login form with blank fields diff --git a/samples/test/features/embedded-widget-basic-auth.feature b/samples/test/features/embedded-widget-basic-auth.feature index 32e0cfe6d..480b4e70a 100644 --- a/samples/test/features/embedded-widget-basic-auth.feature +++ b/samples/test/features/embedded-widget-basic-auth.feature @@ -1,10 +1,11 @@ Feature: Basic Login with Embedded Sign In Widget Background: - Given a SPA, WEB APP or MOBILE Policy that defines Password as required and the only factor for login - #AND the list of Authenticators contains Email and Password - And a user named "Mary" - And Mary has an account in the org + Given an App + And a Policy that defines "Authentication" + And with a Policy Rule that defines "Password as the only factor" + And a user named "Mary" + And she has an account with "active" state in the org Scenario: Mary logs in with a Password When she clicks the login button diff --git a/samples/test/features/mfa-password-and-email-magic-link.feature b/samples/test/features/mfa-password-and-email-magic-link.feature new file mode 100644 index 000000000..d455e5bad --- /dev/null +++ b/samples/test/features/mfa-password-and-email-magic-link.feature @@ -0,0 +1,22 @@ +Feature: Multi-Factor Authentication with Password and Email Magic Link + + Background: + Given an App + And the app has Email Verification callback uri defined + And a Policy that defines "Authentication" + And with a Policy Rule that defines "Password + Another Factor" + And a user named "Mary" + And she has an account with "active" state in the org + + Scenario: 2FA Login with Email Magic Link on the same browser + Given Mary navigates to the Basic Login View + And she has inserted her username + And she has inserted her password + And her password is correct + When she clicks Login + Then she is presented with an option to select Email to verify + When She selects Email from the list + And She selects "Receive a Code" + And she clicks the Email magic link + Then she is redirected to the Root View + And an application session is created diff --git a/samples/test/features/mfa-password-and-email.feature b/samples/test/features/mfa-password-and-email.feature index 1de79288a..37d773571 100644 --- a/samples/test/features/mfa-password-and-email.feature +++ b/samples/test/features/mfa-password-and-email.feature @@ -1,8 +1,11 @@ Feature: Multi-Factor Authentication with Password and Email Background: - Given a SPA, WEB APP or MOBILE Policy that defines MFA with Password and Email as required - And a User named "Mary" created in the admin interface with a Password only + Given an App + And a Policy that defines "Authentication" + And with a Policy Rule that defines "Password + Another Factor" + And a user named "Mary" + And she has an account with "active" state in the org Scenario: Mary enters a wrong verification code Given Mary navigates to the Basic Login View @@ -28,16 +31,3 @@ Feature: Multi-Factor Authentication with Password and Email And She selects "Verify" Then she is redirected to the Root View And an application session is created - - Scenario: 2FA Login with Email Magic Link on the same browser - Given Mary navigates to the Basic Login View - And she has inserted her username - And she has inserted her password - And her password is correct - When she clicks Login - Then she is presented with an option to select Email to verify - When She selects Email from the list - And She selects "Receive a Code" - And she clicks the Email magic link - Then she is redirected to the Root View - And an application session is created diff --git a/samples/test/features/mfa-password-and-sms.feature b/samples/test/features/mfa-password-and-sms.feature index ee7078476..695626cc1 100644 --- a/samples/test/features/mfa-password-and-sms.feature +++ b/samples/test/features/mfa-password-and-sms.feature @@ -1,10 +1,16 @@ Feature: Multi-Factor Authentication with Password and SMS Background: - Given a SPA, WEB APP or MOBILE Policy that defines MFA with Password and SMS as required - And an Authenticator Enrollment Policy that has PHONE as optional and EMAIL as required for the Everyone Group - And a User named "Mary" created that HAS NOT yet enrolled in the SMS factor - + Given a Group + And an App + And a Policy that defines "Authentication" + And with a Policy Rule that defines "Password + Another Factor" + And a Policy that defines "MFA Enrollment with password and phone as required authenticator" + And with a Policy Rule that defines "MFA Enrollment Challenge" + And a user named "Mary" + And she has an account with "active" state in the org + And she is assigned to the created group + Scenario: Enroll in SMS Factor prompt when authenticating Given Mary navigates to the Basic Login View And she has inserted her username @@ -22,7 +28,7 @@ Feature: Multi-Factor Authentication with Password and SMS And an application session is created Scenario: Mary enters a wrong verification code on verify - Given Mary has enrolled in the SMS factor + Given she has enrolled in the "SMS" factor And Mary navigates to the Basic Login View And she has inserted her username And she has inserted her password @@ -49,7 +55,7 @@ Feature: Multi-Factor Authentication with Password and SMS Scenario: 2FA Login with SMS - Given Mary has enrolled in the SMS factor + Given she has enrolled in the "SMS" factor And Mary navigates to the Basic Login View And she has inserted her username And she has inserted her password diff --git a/samples/test/features/progressive-profiling-view-profile.feature b/samples/test/features/progressive-profiling-view-profile.feature index 5b7ef780f..fd0016965 100644 --- a/samples/test/features/progressive-profiling-view-profile.feature +++ b/samples/test/features/progressive-profiling-view-profile.feature @@ -1,17 +1,19 @@ Feature: View Profile Information Background: - Given a Profile Enrollment policy defined assigning new users to the Everyone Group - And by collecting "First Name", "Last Name", "Email" - # And a property named "age" is allowed and assigned to a SPA, WEB APP or MOBILE application - And a user named "Mary" - And Mary has an account in the org + Given an App + And the app is granted "okta.myAccount.read" scope + And the app is granted "okta.myAccount.manage" scope + And a Policy that defines "Authentication" + And with a Policy Rule that defines "Password as the only factor" + And a user named "Mary" + And she has an account with "active" state in the org Scenario: Mary views her profile Given Mary is on the Root View in an UNAUTHENTICATED state When she logs in to the app Then she sees a table with her profile info - And the cell for the value of "primary email" is shown and contains her "primary email" - And the cell for the value of "first name" is shown and contains her "first name" - And the cell for the value of "last name" is shown and contains her "last name" - And she sees an "Edit" button incidating she can update her profile + And the cell for the value of "primary email" is shown and contains her "primary email" + And the cell for the value of "first name" is shown and contains her "first name" + And the cell for the value of "last name" is shown and contains her "last name" + And she sees an "Edit" button incidating she can update her profile diff --git a/samples/test/features/root-page.feature b/samples/test/features/root-page.feature index ddbb48f8b..9b39b803b 100644 --- a/samples/test/features/root-page.feature +++ b/samples/test/features/root-page.feature @@ -1,8 +1,11 @@ Feature: Root page for Direct Auth Demo Application Background: - Given an APP Sign On Policy that defines Password as required and the only factor for login - And Mary is a user with a verified email and a set password + Given an App + And a Policy that defines "Authentication" + And with a Policy Rule that defines "Password as the only factor" + And a user named "Mary" + And she has an account with "active" state in the org Scenario: Mary visits the Root View WITHOUT an authentcation session (no tokens) Given Mary navigates to the Root View diff --git a/samples/test/features/self-service-password-recovery.feature b/samples/test/features/self-service-password-recovery.feature index 9585852c2..2ff05de7d 100644 --- a/samples/test/features/self-service-password-recovery.feature +++ b/samples/test/features/self-service-password-recovery.feature @@ -1,9 +1,11 @@ Feature: Direct Auth Password Recovery Background: - Given an org with an ORG Policy that defines Authenticators with Password and Email as required - And a user named "Mary" - And Mary is a user with a verified email and a set password + Given an App + And a Policy that defines "Authentication" + And with a Policy Rule that defines "Password as the only factor" + And a user named "Mary" + And she has an account with "active" state in the org Scenario: Mary resets her password Given Mary navigates to the Self Service Password Reset View @@ -23,7 +25,8 @@ Background: Then she is redirected to the Root Page Scenario: Mary tries to reset a password with the wrong email - Given Mary navigates to the Self Service Password Reset View + Given the app is assigned to "Everyone" group + And Mary navigates to the Self Service Password Reset View When she inputs an Email that doesn't exist And she submits the form Then she should see the message "There is no account with the Username test_with_really_invalid_email@invalidemail.com." diff --git a/samples/test/features/self-service-registration-activation-token.feature b/samples/test/features/self-service-registration-activation-token.feature index 2aca9dfff..747afe360 100644 --- a/samples/test/features/self-service-registration-activation-token.feature +++ b/samples/test/features/self-service-registration-activation-token.feature @@ -1,9 +1,12 @@ Feature: Add another Required Attribute to the Profile Enrollment Policy Background: - Given a Profile Enrollment policy defined assigning new users to the Everyone Group - And by collecting "First Name", "Last Name", "Email" is allowed and assigned to a SPA, WEB APP or MOBILE application - And a User named "Mary" is created in staged state + Given an App + And the app is assigned to "Everyone" group + And a Policy that defines "Profile Enrollment" + And with a Policy Rule that defines "collecting default attributes" + And a user named "Mary" + And she has an account with "staged" state in the org Scenario: Mary signs up for an account using activation token Given Mary opens the Self Service Registration View with activation token diff --git a/samples/test/features/self-service-registration-custom-attribute.feature b/samples/test/features/self-service-registration-custom-attribute.feature index 3afa7c8fe..4bbf32d2d 100644 --- a/samples/test/features/self-service-registration-custom-attribute.feature +++ b/samples/test/features/self-service-registration-custom-attribute.feature @@ -1,13 +1,13 @@ Feature: Add another Required Attribute to the Profile Enrollment Policy Background: - Given a Profile Enrollment policy defined assigning new users to the Everyone Group - And by collecting "First Name", "Last Name", "Email" - And a property named "customAttribute" is allowed and assigned to a SPA, WEB APP or MOBILE application - # And "Required before access is granted" is selected for Email Verification under Profile Enrollment in Security > Profile Enrollment - # And configured Authenticators are Password (required), Email (required), and SMS (optional) - And a user named "Mary" - # And Mary does not have an account in the org + Given a Group + And an App + # And the app is assigned to "Everyone" group + And a Policy that defines "Profile Enrollment" + And with a Policy Rule that defines 'collecting default attributes and a required "customAttribute"' + And a user named "Mary" + And she does not have account in the org Scenario: Mary signs up for an account with a random property Given Mary navigates to the Self Service Registration View diff --git a/samples/test/features/self-service-registration.feature b/samples/test/features/self-service-registration.feature index 17aacdb80..fda613b48 100644 --- a/samples/test/features/self-service-registration.feature +++ b/samples/test/features/self-service-registration.feature @@ -1,12 +1,12 @@ Feature: Self Service Registration with Email Activation and optional SMS Background: - Given a Profile Enrollment policy defined assigning new users to the Everyone Group - And by collecting "First Name", "Last Name", "Email" is allowed and assigned to a SPA, WEB APP or MOBILE application - #And "Required before access is granted" is selected for Email Verification under Profile Enrollment in Security > Profile Enrollment - #And configured Authenticators are Password (required), Email (required), and SMS (optional) - And a user named "Mary" - #And Mary does not have an account in the org + Given an App + And the app is assigned to "Everyone" group + And a Policy that defines "Profile Enrollment" + And with a Policy Rule that defines "collecting default attributes" + And a user named "Mary" + And she does not have account in the org Scenario: Mary signs up for an account with Password, setups up required Email factor, then skips optional SMS Given Mary navigates to the Self Service Registration View diff --git a/samples/test/features/social-idp-with-widget.feature b/samples/test/features/social-idp-with-widget.feature index 349c19c83..0e161b0b1 100644 --- a/samples/test/features/social-idp-with-widget.feature +++ b/samples/test/features/social-idp-with-widget.feature @@ -1,12 +1,11 @@ Feature: Direct Auth with Self Hosted Sign In Widget Social Login with 1 Social IDP Background: - Given a SPA, WEB APP or MOBILE Policy that defines Password as the only factor required for authentication - #And a configured IDP object for Facebook - #And an IDP routing rule defined to allow users in the Sample App to use the IDP - #And a user named "Mary" - #And Mary does not have an account in the org - + Given an App + And the app is assigned to "Everyone" group + And a Policy that defines "Authentication" + And with a Policy Rule that defines "Password as the only factor" + # Scenario: Mary Logs in with Social IDP # Given Mary navigates to Login with Social IDP # When she clicks the "Login with Facebook" button in the embedded Sign In Widget diff --git a/samples/test/features/social-idp.feature b/samples/test/features/social-idp.feature index faf628262..594437c53 100644 --- a/samples/test/features/social-idp.feature +++ b/samples/test/features/social-idp.feature @@ -1,12 +1,14 @@ Feature: Direct Auth with Self Hosted Sign In Widget Social Login with 1 Social IDP Background: - Given a SPA, WEB APP or MOBILE Policy that defines Password as the only factor required for authentication - # And a configured IDP object for Facebook + Given an App + And the app is assigned to "Everyone" group + And a Policy that defines "Authentication" + And with a Policy Rule that defines "Password as the only factor" + # And a prefined user Mary with an active account + # And Okta OIDC IdP predefined # And an IDP routing rule defined to allow users in the Sample App to use the IDP - # And a user named "Mary" - # And Mary does not have an account in the org - + # Scenario: Mary Logs in with Social IDP # Given Mary navigates to the Login View # When she clicks the "Login with Facebook" button diff --git a/samples/test/features/social-login-mfa.feature b/samples/test/features/social-login-mfa.feature index fb1cb336f..f299cc8f6 100644 --- a/samples/test/features/social-login-mfa.feature +++ b/samples/test/features/social-login-mfa.feature @@ -1,9 +1,12 @@ Feature: Direct Auth Social Login with MFA Background: - Given a SPA, WEB APP or MOBILE Policy that defines Password as the only factor required for authentication - And the Application Sign on Policy is set to "Password + Another Factor" - And a user named "Mary" + Given an App + And the app is assigned to "Everyone" group + And a Policy that defines "Authentication" + And with a Policy Rule that defines "Password + Another Factor" + And a user named "Mary" + And she has an account with "active" state in the org Scenario: Mary logs in with a Okta OIDC IDP and gets an error message Given Mary navigates to the Login View diff --git a/samples/test/features/totp-signin.feature b/samples/test/features/totp-signin.feature index 69811230f..487d8d806 100644 --- a/samples/test/features/totp-signin.feature +++ b/samples/test/features/totp-signin.feature @@ -1,11 +1,13 @@ Feature: TOTP Support (Google Authenticator) Sign In Background: - Given configured Authenticators are Password (required), and Google Authenticator (required) - And the Application Sign on Policy is set to "Password and Google Authenticator Required" + Given an App + And a Policy that defines "MFA Enrollment with Password and Google Authenticator as required authenticators" + And with a Policy Rule that defines "MFA Enrollment Challenge" + And a Policy that defines "Authentication" + And with a Policy Rule that defines "Password + Another Factor" And a user named "Mary" - And Mary has an account in the org - And she is not enrolled in any authenticators + And she has an account with "active" state in the org Scenario: Mary signs in to an account and enrolls in Password and Google Authenticator by scanning a QR Code Given Mary navigates to the Basic Login View @@ -44,11 +46,12 @@ Feature: TOTP Support (Google Authenticator) Sign In And the cell for the value of "name" is shown and contains her "first name and last name" Scenario: Mary Signs in to the Sample App with Password and Google Authenticator - Given Mary navigates to the Basic Login View - And she has inserted her username + Given she has enrolled in the "Google Authenticator" factor + And Mary navigates to the Basic Login View + When she has inserted her username And she has inserted her password And her password is correct - When she clicks Login + And she clicks Login # Then she is presented with an option to select Google Authenticator to verify # When She selects Google Authenticator from the list Then the screen changes to receive an input for a code diff --git a/samples/test/features/totp-signup.feature b/samples/test/features/totp-signup.feature index f4f1e1f94..11e515fa2 100644 --- a/samples/test/features/totp-signup.feature +++ b/samples/test/features/totp-signup.feature @@ -1,16 +1,19 @@ Feature: TOTP Support (Google Authenticator) Sign Up Background: - Given configured Authenticators are Password (required), and Google Authenticator (required) - And the Application Sign on Policy is set to "Password and Google Authenticator Required" - And a user named "Mary" - And Mary does not have account in the org - + Given a Group + And an App + And a Policy that defines "Profile Enrollment" + And with a Policy Rule that defines "collecting default attributes and emailVerification is not required" + And a Policy that defines "MFA Enrollment with Password and Google Authenticator as required authenticators" + And with a Policy Rule that defines "MFA Enrollment Challenge" + And a user named "Mary" + And she does not have account in the org + Scenario: Mary signs up for an account with Password, setups up required Google Authenticator by scanning a QR Code Given Mary navigates to the Self Service Registration View When she fills out her First Name And she fills out her Last Name And she fills out her Email - #And she fills out her Age And she submits the registration form Then she sees the Select Authenticator page with password as the only option When she chooses password factor option @@ -38,7 +41,6 @@ Feature: TOTP Support (Google Authenticator) Sign Up When she fills out her First Name And she fills out her Last Name And she fills out her Email - #And she fills out her Age And she submits the registration form Then she sees the Select Authenticator page with password as the only option When she chooses password factor option diff --git a/samples/test/steps/after.ts b/samples/test/steps/after.ts index 90bb4a91d..db5276424 100644 --- a/samples/test/steps/after.ts +++ b/samples/test/steps/after.ts @@ -13,26 +13,30 @@ import { After } from '@cucumber/cucumber'; import ActionContext from '../support/context'; -import deleteUserAndCredentials from '../support/action/context-enabled/live-user/deleteUserAndCredentials'; -import deleteTestPolicies from '../support/action/context-enabled/org-config/deleteTestPolicies'; +import a18nClient from '../support/management-api/a18nClient'; +import deleteSelfEnrolledUser from '../support/management-api/deleteSelfEnrolledUser'; -After(deleteUserAndCredentials); -After(deleteTestPolicies); - -After(() => browser.deleteCookies()); - -After(async function (this: ActionContext) { - switch (this.featureName) { - case 'Direct Auth Social Login with 1 Social IDP': - case 'Direct Auth with Self Hosted Sign In Widget Social Login with 1 Social IDP': { - const url = 'https://facebook.com'; - await browser.url(url); - await browser.deleteCookies(); - break; - } - default: { - break; +After(async function(this: ActionContext) { + if (this.app) { + await this.app.deactivate(); + await this.app.delete(); + } + if (this.policies) { + for (const policy of this.policies) { + await policy.delete(); } } + if (this.group) { + await this.group.delete(); + } + if(this.user) { + await this.user.deactivate(); + await this.user.delete(); + } + if (this.credentials) { + await deleteSelfEnrolledUser(this.credentials.emailAddress); + await a18nClient.deleteProfile(this.credentials.profileId); + } }); +After(() => browser.deleteCookies()); diff --git a/samples/test/steps/before.ts b/samples/test/steps/before.ts index 6bd9766e3..853e580a5 100644 --- a/samples/test/steps/before.ts +++ b/samples/test/steps/before.ts @@ -13,13 +13,9 @@ import { Before } from '@cucumber/cucumber'; import ActionContext from '../support/context'; -import { matchScenario, Scenario } from '../support/scenario'; Before(function (this: ActionContext, scenario: any) { this.featureName = scenario?.gherkinDocument?.feature?.name; this.scenarioName = scenario?.pickle?.name; this.currentTestCaseId = `TESTCASEID-${scenario?.testCaseStartedId}`; - this.isCurrentScenario = function (scenario: Scenario) { - return matchScenario(scenario, this.featureName, this.scenarioName); - }; }); diff --git a/samples/test/steps/given.ts b/samples/test/steps/given.ts index d391cfab1..854d9d037 100644 --- a/samples/test/steps/given.ts +++ b/samples/test/steps/given.ts @@ -13,111 +13,179 @@ /* eslint-disable max-len */ import { Given } from '@cucumber/cucumber'; -import setEnvironment from '../support/action/setEnvironment'; import navigateTo from '../support/action/navigateTo'; import navigateToLoginAndAuthenticate from '../support/action/context-enabled/live-user/navigateToLoginAndAuthenticate'; -import createContextUserAndCredentials from '../support/action/context-enabled/live-user/createContextUserAndCredentials'; -import createContextCredentials from '../support/action/context-enabled/live-user/createContextCredentials'; -import activateContextUserSms from '../support/action/context-enabled/live-user/activateContextUserSms'; import ActionContext from '../support/context'; -import attachPolicy from '../support/action/context-enabled/org-config/attachPolicy'; -import createContextUser from '../support/action/context-enabled/live-user/createContextUser'; import activateContextUserActivationToken from '../support/action/context-enabled/live-user/activateContextUserActivationToken'; import Home from '../support/selectors/Home'; import startApp from '../support/action/startApp'; import noop from '../support/action/noop'; +import createApp from '../support/management-api/createApp'; +import createPolicy from '../support/management-api/createPolicy'; +import upsertPolicyRule from '../support/management-api/upsertPolicyRule'; +import addAppToPolicy from '../support/management-api/addAppToPolicy'; +import createUser from '../support/management-api/createUser'; +import createGroup from '../support/management-api/createGroup'; +import addAppToGroup from '../support/management-api/addAppToGroup'; +import addUserToGroup from '../support/management-api/addUserToGroup'; +import createCredentials from '../support/management-api/createCredentials'; +import enrollFactor from '../support/management-api/enrollFactor'; +import grantConsentToScope from '../support/management-api/grantConsentToScope'; +import updateAppOAuthClient from '../support/management-api/updateAppOAuthClient'; // NOTE: noop function is used for predefined settings -Given( - 'a Profile Enrollment policy defined assigning new users to the Everyone Group', - noop -); +Given('a Group', async function(this: ActionContext) { + this.group = await createGroup(); +}); + +Given('an App', async function(this: ActionContext) { + this.app = await createApp(); + const { + credentials: { + oauthClient: { + client_id: clientId, + client_secret: clientSecret + } + } + } = this.app; + + if (this.group) { + await addAppToGroup({ appId: this.app.id, groupId: this.group.id }); + } -Given( - /^by collecting "First Name", "Last Name", "Email"(?: is allowed and assigned to a SPA, WEB APP or MOBILE application)?$/, - noop -); + // update test app with new oauthClient info + startApp('/', { + ...(clientId && { clientId }), + ...(clientSecret && { clientSecret }), + }); +}); Given( - 'a property named {string} is allowed and assigned to a SPA, WEB APP or MOBILE application', - async function(this: ActionContext, propertyName: string) { - const PROPERTY_POLICY_MAP = { - customAttribute: 'Custom Attribute Policy', - age: 'Age Attribute Policy' - }; - await attachPolicy.call(this, (PROPERTY_POLICY_MAP as any)[propertyName]); - this.customAttribute = propertyName; + 'the app is assigned to {string} group', + async function(this: ActionContext, groupName: string) { + if (!this.app) { + throw new Error('Application should be predefined'); + } + await addAppToGroup({ appId: this.app.id, groupName }); } ); Given( - /^an APP$/, - async function() { - return await setEnvironment('default'); + 'the app is assigned to the created group', + async function(this: ActionContext) { + if (!this.group) { + throw new Error('Group should be predefined'); + } + await addAppToGroup({ appId: this.app.id, groupId: this.group.id }); } ); Given( - /^an APP Sign On Policy (.*)$/, - setEnvironment -); - -Given( - /^an org with (.*)$/, - setEnvironment -); - -Given( - /^a SPA, WEB APP or MOBILE Policy (.*)$/, - setEnvironment + 'the app is granted {string} scope', + async function(this: ActionContext, scopeId: string) { + await grantConsentToScope(this.app.id, scopeId); + } ); -// 1. Org has preconfigured MFA policy "Google Authenticator Required Policy" -// for group "Google Authenticator Enrollment Required" -// 2. App has preconfigured sign-on policy "MFA Required" for group "MFA Required" -// 3. App has preconfigured profile enrollment policy "Google Authenticator Policy" -// for group "Google Authenticator Enrollment Required" -// 4. App should be changed with environment "Password and Google Authenticator Required" -// (see next line) Given( - /^configured Authenticators are Password \(required\), and Google Authenticator \(required\)$/, - noop + 'the app has Email Verification callback uri defined', + async function(this: ActionContext) { + // Update app settings via internal API, public API should be used once available + await updateAppOAuthClient(this.app, { + // eslint-disable-next-line @typescript-eslint/camelcase + email_magic_link_redirect_uri: 'http://localhost:8080/login/callback' + }); + } ); Given( - /^the Application Sign on Policy is set to "(.*)"$/, - setEnvironment + 'a Policy that defines {string}', + async function(this: ActionContext, policyDescription: string) { + this.policies = this.policies || []; + const policy = await createPolicy({ + policyDescription, + groupId: this.group?.id + }); + this.policies.push(policy); + try { + await addAppToPolicy(policy.id, this.app.id); + } catch(err) {/* do nothing */} + } ); Given( - /([^/s]+) has an account in the org/, - async function(this: ActionContext, firstName: string) { - await createContextUser.call(this, { firstName }); + 'with a Policy Rule that defines {string}', + async function(this: ActionContext, policyRuleDescription: string) { + const lastPolicy = this.policies[this.policies.length - 1]; + await upsertPolicyRule({ + policyId: lastPolicy.id, + policyType: lastPolicy.type, + policyRuleDescription, + groupId: this.group?.id + }); } ); -Given( - /[^/s]+ does not have account in the org/, - noop +Given('a user named {string}', async function(this: ActionContext, firstName: string) { + this.credentials = await createCredentials(firstName, this.featureName); +}); + +Given( + 'she has an account with {string} state in the org', + async function(this: ActionContext, accountState: string) { + if (!this.credentials) { + throw new Error('Context credentials has not been created!'); + } + const activate = (() => { + switch (accountState) { + case 'active': + return true; + default: + return false; + } + })(); + this.user = await createUser({ + // use predefined app when features are not available via management api + appId: this.app?.id || process.env.CLIENT_ID, + credentials: this.credentials, + activate + }); + } ); Given( - /^a User named "([^/w]+)" exists, and this user has already setup email and password factors$/, - async function(this: ActionContext, firstName: string) { - await createContextUserAndCredentials.call(this, firstName); + 'she is assigned to the created group', + async function(this: ActionContext) { + if (!this.group) { + throw new Error('Group has not been created'); + } + if (!this.user) { + throw new Error('User has not been created'); + } + await addUserToGroup({ + userId: this.user.id, + groupId: this.group.id + }); } ); +Given('she does not have account in the org', noop); + Given( - 'a user named {string}', - createContextCredentials + 'she has an authenticated session', + navigateToLoginAndAuthenticate ); Given( - /^([^/s]+) is a user with a verified email and a set password$/, - async function(this: ActionContext, firstName: string) { - await createContextUserAndCredentials.call(this, firstName); + 'she has enrolled in the {string} factor', + async function(this: ActionContext, factorType: string) { + this.enrolledFactor = await enrollFactor({ + userId: this.user.id, + factorType, + phoneNumber: this.credentials.phoneNumber + }); + this.sharedSecret = this.enrolledFactor._embedded?.activation?.sharedSecret; } ); @@ -133,20 +201,6 @@ Given( navigateToLoginAndAuthenticate ); -Given( - /^a User named "([^/s]+)" created in the admin interface with a Password only$/, - async function(this: ActionContext, firstName: string) { - await createContextUserAndCredentials.call(this, firstName, ['MFA Required']); - } -); - -Given( - /^a User named "([^/s]+)" is created in staged state$/, - async function(this: ActionContext, firstName: string) { - await createContextUserAndCredentials.call(this, firstName, ['MFA Required'], false); - } -); - Given( /^Mary opens the Self Service Registration View with activation token/, activateContextUserActivationToken @@ -157,18 +211,6 @@ Given( noop ); -Given( - /^a User named "([^/s]+)" created that HAS NOT yet enrolled in the SMS factor$/, - async function(this: ActionContext, firstName: string) { - await createContextUserAndCredentials.call(this, firstName, ['Phone Enrollment Required', 'MFA Required']); - } -); - -Given( - /^Mary has enrolled in the SMS factor$/, - activateContextUserSms -); - Given( /^she is not enrolled in any authenticators$/, noop diff --git a/samples/test/support/action/clickButton.ts b/samples/test/support/action/clickButton.ts new file mode 100644 index 000000000..0f92b2524 --- /dev/null +++ b/samples/test/support/action/clickButton.ts @@ -0,0 +1,7 @@ +import clickElement from './clickElement'; +import buttons from '../selectors/maps/buttons'; + +export default async (buttonName: string) => { + const name = (buttons as any)[buttonName] || buttonName; + await clickElement('click', 'selector', `button[name="${name}"]`); +}; diff --git a/samples/test/support/action/clickLink.ts b/samples/test/support/action/clickLink.ts new file mode 100644 index 000000000..c7ec85f8e --- /dev/null +++ b/samples/test/support/action/clickLink.ts @@ -0,0 +1,10 @@ +import clickElement from './clickElement'; +import links from '../selectors/maps/links'; + +export default async (linkName: string) => { + const link = (links as any)[linkName]; + if (!link) { + throw new Error(`No link can match name ${linkName}`); + } + await clickElement('click', 'link', link); +}; diff --git a/samples/test/support/action/context-enabled/enterCorrectGoogleAuthenticatorCode.ts b/samples/test/support/action/context-enabled/enterCorrectGoogleAuthenticatorCode.ts index ca177f38f..0cf98dae2 100644 --- a/samples/test/support/action/context-enabled/enterCorrectGoogleAuthenticatorCode.ts +++ b/samples/test/support/action/context-enabled/enterCorrectGoogleAuthenticatorCode.ts @@ -18,7 +18,7 @@ const totp = require('totp-generator'); export default async function (this: ActionContext) { const token = totp(this.sharedSecret || '', { - timestamp: Date.now() + (this.scenarioName.includes('enroll') ? -30*1000 : 0) + timestamp: Date.now() - 30 * 1000 }); await setInputField('set', token, EnrollGoogleAuthenticator.code); } diff --git a/samples/test/support/action/context-enabled/live-user/createContextUser.ts b/samples/test/support/action/context-enabled/live-user/createContextUser.ts deleted file mode 100644 index ee8628916..000000000 --- a/samples/test/support/action/context-enabled/live-user/createContextUser.ts +++ /dev/null @@ -1,53 +0,0 @@ -/*! - * Copyright (c) 2015-present, Okta, Inc. and/or its affiliates. All rights reserved. - * The Okta software accompanied by this notice is provided pursuant to the Apache License, Version 2.0 (the "License.") - * - * You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0. - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * - * See the License for the specific language governing permissions and limitations under the License. - */ - - -import createCredentials from '../../../management-api/createCredentials'; -import createUser from '../../../management-api/createUser'; -import ActionContext, { getReusedContext } from '../../../context'; -import { Scenario } from '../../../scenario'; - -const FEATURE_GROUPS_MAP = { - 'TOTP Support (Google Authenticator) Sign In': ['MFA Required', 'Google Authenticator Enrollment Required'], - 'TOTP Support (Google Authenticator) Sign Up': ['MFA Required', 'Google Authenticator Enrollment Required'] -}; - -type CreateContextUserOptions = { - firstName: string; - assignToGroups?: string[]; - activate?: boolean; -}; - -export default async function (this: ActionContext, { - firstName, - assignToGroups, - activate = true -}: CreateContextUserOptions): Promise { - // Scenario 10.1.3 - if (this.isCurrentScenario(Scenario.TOTP_SIGN_IN_REUSE_SHARED_SECRET)) { - // reuse context - this.sharedSecret = getReusedContext().sharedSecret; - this.user = getReusedContext().user; - this.userName = getReusedContext().userName; - } else { - // don't create a18n profile and don't save credentials in context - assignToGroups = assignToGroups || (FEATURE_GROUPS_MAP as any)[this.featureName]; - const credentials = this.credentials || await createCredentials(firstName, this.featureName, false); - const user = await createUser({ - credentials, - assignToGroups, - activate, - customAttribute: this.customAttribute - }); - this.user = user; - } -} diff --git a/samples/test/support/action/context-enabled/live-user/createContextUserAndCredentials.ts b/samples/test/support/action/context-enabled/live-user/createContextUserAndCredentials.ts deleted file mode 100644 index 8206c7042..000000000 --- a/samples/test/support/action/context-enabled/live-user/createContextUserAndCredentials.ts +++ /dev/null @@ -1,39 +0,0 @@ -/*! - * Copyright (c) 2015-present, Okta, Inc. and/or its affiliates. All rights reserved. - * The Okta software accompanied by this notice is provided pursuant to the Apache License, Version 2.0 (the "License.") - * - * You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0. - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * - * See the License for the specific language governing permissions and limitations under the License. - */ - - -import createCredentials from '../../../management-api/createCredentials'; -import createUser from '../../../management-api/createUser'; -import ActionContext, {getReusedContext } from '../../../context'; -import { Scenario } from '../../../scenario'; - -export default async function - (this: ActionContext, firstName: string, assignToGroups?: string[], activate = true): Promise { - // Scenario 10.1.3 - if (this.isCurrentScenario(Scenario.TOTP_SIGN_IN_REUSE_SHARED_SECRET)) { - // reuse context - this.credentials = getReusedContext().credentials; - this.sharedSecret = getReusedContext().sharedSecret; - this.user = getReusedContext().user; - this.userName = getReusedContext().userName; - } else { - const credentials = this.credentials || await createCredentials(firstName, this.featureName); - this.credentials = credentials; - const user = await createUser({ - credentials, - assignToGroups, - activate, - customAttribute: this.customAttribute - }); - this.user = user; - } -} diff --git a/samples/test/support/action/context-enabled/live-user/deleteUserAndCredentials.ts b/samples/test/support/action/context-enabled/live-user/deleteUserAndCredentials.ts deleted file mode 100644 index 423d81270..000000000 --- a/samples/test/support/action/context-enabled/live-user/deleteUserAndCredentials.ts +++ /dev/null @@ -1,39 +0,0 @@ -/*! - * Copyright (c) 2015-present, Okta, Inc. and/or its affiliates. All rights reserved. - * The Okta software accompanied by this notice is provided pursuant to the Apache License, Version 2.0 (the "License.") - * - * You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0. - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * - * See the License for the specific language governing permissions and limitations under the License. - */ - - - -import a18nClient from '../../../management-api/a18nClient'; -import deleteSelfEnrolledUser from '../../../management-api/deleteSelfEnrolledUser'; -import deleteUser from '../../../management-api/deleteUser'; -import ActionContext, {reuseContext } from '../../../context'; -import { Scenario } from '../../../scenario'; - -export default async function(this: ActionContext): Promise { - // Scenario 10.1.2 - if (this.isCurrentScenario(Scenario.TOTP_ENROLL_WITH_SECRET_KEY)) { - // save context for reuse - reuseContext(this); - } else { - if (this.credentials) { - if (!this.user) { - await deleteSelfEnrolledUser(this.credentials.emailAddress); - } - if (this.credentials.profileId) { - await a18nClient.deleteProfile(this.credentials.profileId); - } - } - if (this.user) { - await deleteUser(this.user); - } - } -} diff --git a/samples/test/support/action/context-enabled/live-user/createContextCredentials.ts b/samples/test/support/action/context-enabled/live-user/enterCorrectEmailCode.ts similarity index 51% rename from samples/test/support/action/context-enabled/live-user/createContextCredentials.ts rename to samples/test/support/action/context-enabled/live-user/enterCorrectEmailCode.ts index 6037d17b2..25f151df3 100644 --- a/samples/test/support/action/context-enabled/live-user/createContextCredentials.ts +++ b/samples/test/support/action/context-enabled/live-user/enterCorrectEmailCode.ts @@ -11,16 +11,12 @@ */ -import createCredentials from '../../../management-api/createCredentials'; -import ActionContext, { getReusedContext } from '../../../context'; -import { Scenario } from '../../../scenario'; +import ChallengeAuthenticator from '../../../selectors/ChallengeAuthenticator'; +import a18nClient from '../../../management-api/a18nClient'; +import setInputField from '../../setInputField'; +import ActionContext from '../../../context'; -export default async function (this: ActionContext, firstName: string): Promise { - if (this.isCurrentScenario(Scenario.TOTP_SIGN_IN_REUSE_SHARED_SECRET)) { - this.credentials = getReusedContext().credentials; - this.sharedSecret = getReusedContext().sharedSecret; - this.userName = getReusedContext().userName; - } else { - this.credentials = await createCredentials(firstName, this.featureName); - } +export default async function (this: ActionContext) { + const code = await a18nClient.getEmailCode(this.credentials.profileId); + await setInputField('set', code, ChallengeAuthenticator.code); } diff --git a/samples/test/support/action/context-enabled/live-user/openEmailMagicLink.ts b/samples/test/support/action/context-enabled/live-user/openEmailMagicLink.ts index 87a57addc..11338a483 100644 --- a/samples/test/support/action/context-enabled/live-user/openEmailMagicLink.ts +++ b/samples/test/support/action/context-enabled/live-user/openEmailMagicLink.ts @@ -15,5 +15,5 @@ import ActionContext from '../../../context'; export default async function (this: ActionContext) { const emailMagicLink = await a18nClient.getEmailMagicLink(this.credentials.profileId); - browser.url(emailMagicLink); + await browser.url(emailMagicLink); } diff --git a/samples/test/support/action/context-enabled/org-config/attachPolicy.ts b/samples/test/support/action/context-enabled/org-config/attachPolicy.ts deleted file mode 100644 index 88df299f4..000000000 --- a/samples/test/support/action/context-enabled/org-config/attachPolicy.ts +++ /dev/null @@ -1,13 +0,0 @@ -import { getConfig } from '../../../../util/configUtils'; -import ActionContext from '../../../context'; -import addAppToPolicy from '../../../management-api/addAppToPolicy'; -import fetchPolicy from '../../../management-api/fetchPolicy'; - -export default async function (this: ActionContext, policyName: string) { - const { clientId } = getConfig(); - const policy = await fetchPolicy(policyName, 'PROFILE_ENROLLMENT'); - if (policy) { - await addAppToPolicy(policy.id, clientId as string); - this.useProfileEnrollPolicy = true; - } -} diff --git a/samples/test/support/action/context-enabled/org-config/deleteTestPolicies.ts b/samples/test/support/action/context-enabled/org-config/deleteTestPolicies.ts deleted file mode 100644 index 0a7531ddf..000000000 --- a/samples/test/support/action/context-enabled/org-config/deleteTestPolicies.ts +++ /dev/null @@ -1,8 +0,0 @@ -import ActionContext from '../../../context'; -import deletePolicy from '../../../management-api/deletePolicy'; - -export default async function (this: ActionContext) { - if (this.useProfileEnrollPolicy) { - await deletePolicy(this.currentTestCaseId, 'PROFILE_ENROLLMENT'); - } -} diff --git a/samples/test/support/action/context-enabled/live-user/activateContextUserSms.ts b/samples/test/support/action/enterIncorrectCredential.ts similarity index 71% rename from samples/test/support/action/context-enabled/live-user/activateContextUserSms.ts rename to samples/test/support/action/enterIncorrectCredential.ts index 48604e663..b0d909f11 100644 --- a/samples/test/support/action/context-enabled/live-user/activateContextUserSms.ts +++ b/samples/test/support/action/enterIncorrectCredential.ts @@ -11,9 +11,10 @@ */ -import activateUserSms from '../../../management-api/activateUserSms'; -import ActionContext from '../../../context'; +import setInputField from './setInputField'; -export default async function (this: ActionContext): Promise { - await activateUserSms(this.user, this.credentials.phoneNumber); +export default async function (credName: string) { + const selector = `input[name="${credName}"]`; + const value = '!incorrect!'; + await setInputField('set', value, selector); } diff --git a/samples/test/support/action/navigateTo.ts b/samples/test/support/action/navigateTo.ts index 467d476b6..a69d1aa88 100644 --- a/samples/test/support/action/navigateTo.ts +++ b/samples/test/support/action/navigateTo.ts @@ -15,13 +15,13 @@ import waitForDisplayed from '../wait/waitForDisplayed'; import LoginForm from '../selectors/LoginForm'; import OktaSignInOIE, { OktaSignInOIE as WidgetForm } from '../selectors/OktaSignInOIE'; import Home from '../selectors/Home'; -import startApp from './startApp'; import { pages } from '../selectors'; import { Page } from '../selectors/Page'; import PasswordRecover from '../selectors/PasswordRecover'; import Registration from '../selectors/Registration'; import OktaSignInOIEFacebookIdp from '../selectors/OktaSignInOIEFacebookIdp'; import OktaSignInOIEOktaIdp from '../selectors/OktaSignInOIEOktaIdp'; +import { toQueryString } from '../../util'; const urls = new Map([ @@ -59,6 +59,6 @@ export default async ( page: string ) => { const { url, queryParams, selector } = getContext(page); - await startApp(url, queryParams); + await browser.url(url + toQueryString(queryParams)); await waitForDisplayed(selector); }; diff --git a/samples/test/support/action/setEnvironment.ts b/samples/test/support/action/setEnvironment.ts deleted file mode 100644 index d852cfd9b..000000000 --- a/samples/test/support/action/setEnvironment.ts +++ /dev/null @@ -1,41 +0,0 @@ -/*! - * Copyright (c) 2015-present, Okta, Inc. and/or its affiliates. All rights reserved. - * The Okta software accompanied by this notice is provided pursuant to the Apache License, Version 2.0 (the "License.") - * - * You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0. - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * - * See the License for the specific language governing permissions and limitations under the License. - */ - - -/** - * Set a test environment by name. Test environments are stored in the `testenv.yml` file in the workspace root - * @param {String} envName The name of the test environment - */ - -const env = require('@okta/env'); -import waitForDisplayed from '../wait/waitForDisplayed'; -import Home from '../selectors/Home'; -import startApp from './startApp'; - -export default async (envName: string) => { - envName = { - 'that defines MFA with Password and Email as required': 'Password + Another Factor', - 'that defines MFA with Password and SMS as required': 'Password + Another Factor' - }[envName] || envName; - - // update variables for runner process - env.setEnvironmentVarsFromTestEnvYaml(envName, __dirname); - - // update variables for server process - const { issuer, clientId, clientSecret } = process.env; - await startApp('/', { - ...(issuer && { issuer }), - ...(clientId && { clientId }), - ...(clientSecret && { clientSecret }), - }); - await waitForDisplayed(Home.serverConfig, false); -}; diff --git a/samples/test/support/action/submitForm.ts b/samples/test/support/action/submitForm.ts new file mode 100644 index 000000000..533b0580e --- /dev/null +++ b/samples/test/support/action/submitForm.ts @@ -0,0 +1,18 @@ +/*! + * Copyright (c) 2015-present, Okta, Inc. and/or its affiliates. All rights reserved. + * The Okta software accompanied by this notice is provided pursuant to the Apache License, Version 2.0 (the "License.") + * + * You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * + * See the License for the specific language governing permissions and limitations under the License. + */ + + +import clickElement from './clickElement'; + +export default async () => { + await clickElement('click', 'selector', 'form button[type=submit]'); +}; diff --git a/samples/test/support/check/checkButton.ts b/samples/test/support/check/checkButton.ts index 3efeab4e5..d287967b3 100644 --- a/samples/test/support/check/checkButton.ts +++ b/samples/test/support/check/checkButton.ts @@ -11,26 +11,13 @@ */ -import { UserHome } from '../selectors'; -import isDisplayed from './isDisplayed'; +import waitForDisplayed from '../wait/waitForDisplayed'; +import buttons from '../selectors/maps/buttons'; -/** - * Check if the given element is (not) visible - * @param {String} objectName as defined in bdd steps - */ -export default async(objectName: string) => { - /** - * Visible state of the give element - * @type {String} - */ - switch (objectName) { - case 'logout': { - await isDisplayed(UserHome.logoutButton, false); - break; - } - - default: { - throw new Error(`Unknown object "${objectName}"`); - } - } +export default async(buttonName: string) => { + const button = (buttons as any)[buttonName]; + if (!button) { + throw new Error(`No button can match name ${buttonName}`); + } + await waitForDisplayed(`button[name="${button}"]`); }; diff --git a/samples/test/support/check/checkLink.ts b/samples/test/support/check/checkLink.ts new file mode 100644 index 000000000..0248d48da --- /dev/null +++ b/samples/test/support/check/checkLink.ts @@ -0,0 +1,10 @@ +import waitForDisplayed from '../wait/waitForDisplayed'; +import links from '../selectors/maps/links'; + +export default async function checkLink(linkName: string) { + const link = (links as any)[linkName]; + if (!link) { + throw new Error(`No link can match name ${linkName}`); + } + await waitForDisplayed(`a[href="${link}"]`); +} diff --git a/samples/test/support/context.ts b/samples/test/support/context.ts index 56edf8b37..9dcc1b5ea 100644 --- a/samples/test/support/context.ts +++ b/samples/test/support/context.ts @@ -11,30 +11,22 @@ */ -import { User } from '@okta/okta-sdk-nodejs'; -import {UserCredentials} from './management-api/createCredentials'; -import { Scenario } from './scenario'; +import { User, Application, Policy, Group } from '@okta/okta-sdk-nodejs'; +import { UserCredentials } from './management-api/createCredentials'; interface ActionContext { credentials: UserCredentials; user: User; + app: Application; + policies: Policy[]; + group: Group; + enrolledFactor: any; featureName: string; scenarioName: string; currentTestCaseId: string; userName?: string; sharedSecret?: string; - disableEmailVerification?: boolean; - useProfileEnrollPolicy: boolean; customAttribute: string; - isCurrentScenario: (scenario: Scenario) => boolean; } -let reusedContext: ActionContext; -export const getReusedContext = () => { - return reusedContext; -}; -export const reuseContext = (context: ActionContext) => { - reusedContext = context; -}; - export default ActionContext; diff --git a/samples/test/support/management-api/addAppToGroup.ts b/samples/test/support/management-api/addAppToGroup.ts new file mode 100644 index 000000000..3c2833804 --- /dev/null +++ b/samples/test/support/management-api/addAppToGroup.ts @@ -0,0 +1,32 @@ +import { Client } from '@okta/okta-sdk-nodejs'; +import { getConfig } from '../../util/configUtils'; + +type Options = { + appId: string; + groupId?: string; + groupName?: string ; +}; + +export default async function({ + appId, + groupId = '', + groupName +}: Options) { + const config = getConfig(); + const oktaClient = new Client({ + orgUrl: config.orgUrl, + token: config.oktaAPIKey, + }); + + if (groupName) { + const { value: group } = await oktaClient.listGroups({ + q: groupName + }).next(); + if (!group) { + throw new Error(`Group cannot be found with name ${groupName}`); + } + groupId = group.id; + } + + await oktaClient.createApplicationGroupAssignment(appId, groupId); +} diff --git a/samples/test/support/management-api/activateUserSms.ts b/samples/test/support/management-api/addUserToGroup.ts similarity index 67% rename from samples/test/support/management-api/activateUserSms.ts rename to samples/test/support/management-api/addUserToGroup.ts index a6ca7674d..d216d6611 100644 --- a/samples/test/support/management-api/activateUserSms.ts +++ b/samples/test/support/management-api/addUserToGroup.ts @@ -10,28 +10,23 @@ * See the License for the specific language governing permissions and limitations under the License. */ +/* eslint-disable complexity, max-statements */ -import { Client, User } from '@okta/okta-sdk-nodejs'; + +import { Client } from '@okta/okta-sdk-nodejs'; import { getConfig } from '../../util'; -export default async function(user: User, phoneNumber: string): Promise { +type Options = { + userId: string; + groupId: string; +} + +export default async function({ userId, groupId }: Options) { const config = getConfig(); const oktaClient = new Client({ orgUrl: config.orgUrl, token: config.oktaAPIKey, }); - const smsFactor = { - factorType: 'sms', - provider: 'OKTA', - profile: { - phoneNumber: phoneNumber - } - }; - - const res = await oktaClient.enrollFactor(user.id, smsFactor, { - activate: true - }); - - return (res.status == 'ACTIVE'); + await oktaClient.addUserToGroup(groupId, userId); } diff --git a/samples/test/support/management-api/createApp.ts b/samples/test/support/management-api/createApp.ts new file mode 100644 index 000000000..a9e17e3a1 --- /dev/null +++ b/samples/test/support/management-api/createApp.ts @@ -0,0 +1,52 @@ +import { Client } from '@okta/okta-sdk-nodejs'; +import { getConfig, randomStr } from '../../util'; + +export default async function() { + const { + orgUrl, + oktaAPIKey, + sampleConfig: { appType } + } = getConfig(); + const oktaClient = new Client({ + orgUrl, + token: oktaAPIKey, + }); + + const testApp = { + 'name': 'oidc_client', + 'label': `Generated E2E Test Client - ${randomStr(6)}`, + 'signOnMode': 'OPENID_CONNECT', + 'credentials': { + 'oauthClient': { + 'token_endpoint_auth_method': appType === 'browser' ? 'none' : 'client_secret_basic' + } + }, + 'settings': { + 'oauthClient': { + 'client_uri': 'http://localhost:8080', + 'logo_uri': 'http://developer.okta.com/assets/images/logo-new.png', + 'redirect_uris': [ + 'http://localhost:8080/login/callback' + ], + 'post_logout_redirect_uris': [ + 'http://localhost:8080' + ], + 'response_types': [ + 'token', + 'id_token', + 'code' + ], + 'grant_types': [ + 'implicit', + 'authorization_code', + 'interaction_code', + 'refresh_token' + ], + 'application_type': appType + } + } + }; + + const app = await oktaClient.createApplication(testApp); + return app; +} diff --git a/samples/test/support/management-api/createCredentials.ts b/samples/test/support/management-api/createCredentials.ts index 224f4ba02..da64e45dd 100644 --- a/samples/test/support/management-api/createCredentials.ts +++ b/samples/test/support/management-api/createCredentials.ts @@ -31,6 +31,8 @@ export default async function ( return Object.assign({}, a18nProfile, { firstName, lastName: lastName || `Mc${firstName}face`, - password: crypto.randomBytes(16).toString('base64') + password: crypto.randomBytes(16).toString('base64'), + username: a18nProfile.emailAddress, + email: a18nProfile.emailAddress, }); } diff --git a/samples/test/support/management-api/createGroup.ts b/samples/test/support/management-api/createGroup.ts new file mode 100644 index 000000000..28a08560c --- /dev/null +++ b/samples/test/support/management-api/createGroup.ts @@ -0,0 +1,17 @@ +import { Client } from '@okta/okta-sdk-nodejs'; +import { getConfig, randomStr } from '../../util'; + +export default async () => { + const config = getConfig(); + const oktaClient = new Client({ + orgUrl: config.orgUrl, + token: config.oktaAPIKey, + }); + + const group = await oktaClient.createGroup({ + profile: { + name: `TestGroup-${randomStr(6)}` + } + }); + return group; +}; diff --git a/samples/test/support/management-api/createPolicy.ts b/samples/test/support/management-api/createPolicy.ts index a90e1e68d..e693141b2 100644 --- a/samples/test/support/management-api/createPolicy.ts +++ b/samples/test/support/management-api/createPolicy.ts @@ -1,25 +1,97 @@ import { Client } from '@okta/okta-sdk-nodejs'; -import { getConfig } from '../../util/configUtils'; +import { randomStr, getConfig } from '../../util'; -export default async function(policyName: string, policyType: string) { +type Options = { + policyDescription: string; + groupId?: string; +} + +const POLICY_MAP = { + 'Authentication': { + type: 'ACCESS_POLICY', + }, + 'Profile Enrollment': { + type: 'PROFILE_ENROLLMENT' + }, + 'MFA Enrollment with password and email as required authenticators and phone as optional authenticator': { + type: 'MFA_ENROLL', + settings: { + type: 'AUTHENTICATORS', + authenticators: [ + { + key: 'okta_password', + enroll: { self: 'REQUIRED' } + }, + { + key: 'okta_email', + enroll: { self: 'REQUIRED' } + }, + { + key: 'phone_number', + enroll: { self: 'OPTIONAL' } + }, + ] + } + }, + 'MFA Enrollment with password and phone as required authenticator': { + type: 'MFA_ENROLL', + settings: { + type: 'AUTHENTICATORS', + authenticators: [ + { + key: 'okta_password', + enroll: { self: 'REQUIRED' } + }, + { + key: 'phone_number', + enroll: { self: 'REQUIRED' } + }, + ] + } + }, + 'MFA Enrollment with Password and Google Authenticator as required authenticators': { + type: 'MFA_ENROLL', + settings: { + type: 'AUTHENTICATORS', + authenticators: [ + { + key: 'okta_password', + enroll: { self: 'REQUIRED' } + }, + { + key: 'google_otp', + enroll: { self: 'REQUIRED' } + }, + ] + } + } +}; + +export default async function({ + policyDescription, + groupId +}: Options) { const config = getConfig(); const oktaClient = new Client({ orgUrl: config.orgUrl, token: config.oktaAPIKey, }); - let policy; - try { - policy = await oktaClient.createPolicy({ - type: policyType, - status: 'ACTIVE', - name: policyName - }); - return policy; - } catch (err) { - if (policy) { - oktaClient.deletePolicy(policy.id); - } - throw err; - } + const policyObject = (POLICY_MAP as any)[policyDescription]; + const policy = await oktaClient.createPolicy({ + ...policyObject, + ...(groupId + && policyDescription.includes('MFA Enrollment') + && { + conditions: { + people: { + groups: { + include: [groupId] + } + } + } + }), + name: `${policyObject.type}-${randomStr(6)}` + }); + return policy; } diff --git a/samples/test/support/management-api/createUser.ts b/samples/test/support/management-api/createUser.ts index 30704d079..8bd1e6490 100644 --- a/samples/test/support/management-api/createUser.ts +++ b/samples/test/support/management-api/createUser.ts @@ -18,19 +18,23 @@ import { getConfig } from '../../util'; import deleteUser from './deleteUser'; import { UserCredentials } from './createCredentials'; +type CreateUserOptions = { + appId: string; + credentials: UserCredentials; + assignToGroups?: string[]; + activate?: boolean; + customAttribute?: string; +} + const userGroup = 'Basic Auth Web'; export default async ({ + appId, credentials, assignToGroups = [userGroup], activate = true, customAttribute -}: { - credentials: UserCredentials; - assignToGroups?: string[]; - activate?: boolean; - customAttribute?: string; -}): +}: CreateUserOptions): Promise => { const config = getConfig(); const oktaClient = new Client({ @@ -88,7 +92,7 @@ export default async ({ }); } - await oktaClient.assignUserToApplication(config.clientId as string, { + await oktaClient.assignUserToApplication(appId, { id: user.id }); diff --git a/samples/test/support/management-api/enrollFactor.ts b/samples/test/support/management-api/enrollFactor.ts new file mode 100644 index 000000000..a78b319e3 --- /dev/null +++ b/samples/test/support/management-api/enrollFactor.ts @@ -0,0 +1,74 @@ +/*! + * Copyright (c) 2015-present, Okta, Inc. and/or its affiliates. All rights reserved. + * The Okta software accompanied by this notice is provided pursuant to the Apache License, Version 2.0 (the "License.") + * + * You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0. + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * + * See the License for the specific language governing permissions and limitations under the License. + */ + + +import { Client } from '@okta/okta-sdk-nodejs'; +import { getConfig } from '../../util'; +const totp = require('totp-generator'); + +type Options = { + userId: string; + factorType: string; + phoneNumber?: string; +}; + +const getOktaClient = () => { + const config = getConfig(); + return new Client({ + orgUrl: config.orgUrl, + token: config.oktaAPIKey, + }); +}; + +const enrollSMS = async (options: Options) => { + const factorObject = { + factorType: 'sms', + provider: 'OKTA', + profile: { + phoneNumber: options.phoneNumber + } + }; + const res = await getOktaClient().enrollFactor( + options.userId, + factorObject, + { activate: true } + ); + return res; +}; + +const enrollGoogleAuthenticator = async (options: Options) => { + const factorObject = { + factorType: 'token:software:totp', + provider: 'GOOGLE' + }; + const client = getOktaClient(); + const enrollRes = await client.enrollFactor(options.userId, factorObject); + const passCode = totp((enrollRes._embedded.activation as any).sharedSecret, { + timestamp: Date.now() + }); + await enrollRes.activate(options.userId, { + passCode + }); + return enrollRes; +}; + +export default async function(options: Options) { + let res; + if (options.factorType === 'SMS') { + res = await enrollSMS(options); + } else if (options.factorType === 'Google Authenticator') { + res = await enrollGoogleAuthenticator(options); + } else { + throw new Error(`Unknown factorType: ${options.factorType}`); + } + return res; +} diff --git a/samples/test/support/management-api/fetchApp.ts b/samples/test/support/management-api/fetchApp.ts new file mode 100644 index 000000000..da8153bad --- /dev/null +++ b/samples/test/support/management-api/fetchApp.ts @@ -0,0 +1,24 @@ +import { Client } from '@okta/okta-sdk-nodejs'; +import { getConfig } from '../../util/configUtils'; + +export default async function(appPrefix: string) { + const { + orgUrl, + oktaAPIKey, + sampleConfig: { appType } + } = getConfig(); + const oktaClient = new Client({ + orgUrl, + token: oktaAPIKey, + }); + + const appName = `${appPrefix}-${appType}`; + const { value: group } = await oktaClient.listGroups({ + q: appName + }).next(); + if (!group) { + throw new Error(`Group cannot be found with ${appName}`); + } + + return group; +} diff --git a/samples/test/support/management-api/fetchGroup.ts b/samples/test/support/management-api/fetchGroup.ts new file mode 100644 index 000000000..b6b6187b4 --- /dev/null +++ b/samples/test/support/management-api/fetchGroup.ts @@ -0,0 +1,19 @@ +import { Client } from '@okta/okta-sdk-nodejs'; +import { getConfig } from '../../util/configUtils'; + +export default async function(groupName: string) { + const config = getConfig(); + const oktaClient = new Client({ + orgUrl: config.orgUrl, + token: config.oktaAPIKey, + }); + + const { value: group } = await oktaClient.listGroups({ + q: groupName + }).next(); + if (!group) { + throw new Error(`Group cannot be found with ${groupName}`); + } + + return group; +} diff --git a/samples/test/support/management-api/grantConsentToScope.ts b/samples/test/support/management-api/grantConsentToScope.ts new file mode 100644 index 000000000..95a587773 --- /dev/null +++ b/samples/test/support/management-api/grantConsentToScope.ts @@ -0,0 +1,14 @@ +import { Client } from '@okta/okta-sdk-nodejs'; +import { getConfig } from '../../util'; + +export default async function(appId: string, scopeId: string) { + const { issuer, orgUrl, oktaAPIKey } = getConfig(); + const oktaClient = new Client({ + orgUrl, + token: oktaAPIKey, + }); + + await oktaClient.grantConsentToScope(appId, { + issuer, scopeId + }); +} diff --git a/samples/test/support/management-api/updateAppOAuthClient.ts b/samples/test/support/management-api/updateAppOAuthClient.ts new file mode 100644 index 000000000..0d1e74f98 --- /dev/null +++ b/samples/test/support/management-api/updateAppOAuthClient.ts @@ -0,0 +1,23 @@ +import { Application, Client } from '@okta/okta-sdk-nodejs'; +import { getConfig } from '../../util/configUtils'; + + +export default async function(app: Application, options: any) { + const config = getConfig(); + const oktaClient = new Client({ + orgUrl: config.orgUrl, + token: config.oktaAPIKey, + }); + + const orgUrl = config.issuer?.replace('/oauth2/default', ''); + const url = `${orgUrl}/api/v1/internal/apps/${app.id}/settings/oidc`; + const body = { + ...(app.settings as any).oauthClient, + ...options, + label: app.label + }; + // eslint-disable-next-line @typescript-eslint/ban-ts-ignore + // @ts-ignore + const res = await oktaClient.http.postJson(url, { body }); + return res; +} diff --git a/samples/test/support/management-api/upsertPolicyRule.ts b/samples/test/support/management-api/upsertPolicyRule.ts new file mode 100644 index 000000000..6df6ff880 --- /dev/null +++ b/samples/test/support/management-api/upsertPolicyRule.ts @@ -0,0 +1,195 @@ +import { Client } from '@okta/okta-sdk-nodejs'; +import { getConfig, randomStr } from '../../util'; + +type Options = { + policyId: string; + policyType: string; + policyRuleDescription: string; + groupId?: string; +}; + +const getAccessPolicyActions = (description: string) => { + return ({ + 'Password as the only factor': { + 'actions': { + 'appSignOn': { + 'access': 'ALLOW', + 'verificationMethod': { + 'factorMode': '1FA', + 'reauthenticateIn': 'PT2H', + 'constraints': [ + { + 'knowledge': { + 'types': [ + 'password' + ] + } + } + ], + 'type': 'ASSURANCE' + } + } + } + }, + + 'Password + Another Factor': { + 'actions': { + 'appSignOn': { + 'access': 'ALLOW', + 'verificationMethod': { + 'factorMode': '2FA', + 'type': 'ASSURANCE', + 'reauthenticateIn': 'PT2H', + 'constraints': [ + { + 'knowledge': { + 'types': [ + 'password' + ], + 'reauthenticateIn': 'PT2H' + } + } + ] + } + } + }, + + 'Any one factor': { + 'actions': { + 'appSignOn': { + 'access': 'ALLOW', + 'verificationMethod': { + 'factorMode': '1FA', + 'type': 'ASSURANCE', + 'reauthenticateIn': 'PT43800H' + } + } + }, + + } + } + } as any)[description]; +}; + +const getMFAEnrollPolicyActions = (description: string) => { + return ({ + 'MFA Enrollment Challenge': { + 'actions': { + 'enroll': { + 'self': 'CHALLENGE' + } + } + } + } as any)[description]; +}; + +const getProfileEnrollmentPolicyActions = (description: string) => { + return ({ + 'collecting default attributes': { + 'actions': { + 'profileEnrollment': { + 'access': 'ALLOW', + 'unknownUserAction': 'REGISTER', + 'activationRequirements': { + 'emailVerification': true + }, + 'profileAttributes': [ + { + 'name': 'email', + 'label': 'Email', + 'required': true + } + ], + } + } + }, + 'collecting default attributes and emailVerification is not required': { + 'actions': { + 'profileEnrollment': { + 'access': 'ALLOW', + 'unknownUserAction': 'REGISTER', + 'activationRequirements': { + 'emailVerification': false + }, + 'profileAttributes': [ + { + 'name': 'email', + 'label': 'Email', + 'required': true + } + ], + } + } + }, + 'collecting default attributes and a required "customAttribute"': { + 'actions': { + 'profileEnrollment': { + 'access': 'ALLOW', + 'unknownUserAction': 'REGISTER', + 'activationRequirements': { + 'emailVerification': true + }, + 'profileAttributes': [ + { + 'name': 'email', + 'label': 'Email', + 'required': true + }, + { + 'name': 'customAttribute', + 'label': 'Custom Attribute', + 'required': true + }, + ] + } + } + } + } as any)[description]; +}; + +export default async function ({ + policyId, + policyType, + policyRuleDescription, + groupId +}: Options) { + const config = getConfig(); + const oktaClient = new Client({ + orgUrl: config.orgUrl, + token: config.oktaAPIKey, + }); + + let actions; + switch (policyType) { + case 'ACCESS_POLICY': + actions = getAccessPolicyActions(policyRuleDescription); + break; + case 'MFA_ENROLL': + actions = getMFAEnrollPolicyActions(policyRuleDescription); + break; + case 'PROFILE_ENROLLMENT': + actions = getProfileEnrollmentPolicyActions(policyRuleDescription); + if (groupId) { + actions.actions.profileEnrollment.targetGroupIds = [groupId]; + } + break; + default: + throw new Error(`No actions is found with ${policyType} ${policyRuleDescription}`); + } + + let res; + const { value: existingRule } = await oktaClient.listPolicyRules(policyId).next(); + if (existingRule) { + res = await oktaClient.updatePolicyRule(policyId, existingRule.id, { + ...existingRule, + ...actions + }); + } else { + res = await oktaClient.createPolicyRule(policyId, { + name: `Test-Policy-Rule-${randomStr(6)}`, + type: policyType, + ...actions + }); + } + return res; +} diff --git a/samples/test/support/scenario.ts b/samples/test/support/scenario.ts deleted file mode 100644 index 521031846..000000000 --- a/samples/test/support/scenario.ts +++ /dev/null @@ -1,17 +0,0 @@ -export enum Scenario { - TOTP_ENROLL_WITH_SECRET_KEY = 'TOTP_ENROLL_WITH_SECRET_KEY', - TOTP_SIGN_IN_REUSE_SHARED_SECRET = 'TOTP_SIGN_IN_REUSE_SHARED_SECRET' -} - -export function matchScenario(scenario: Scenario, featureName?: string, scenarioName?: string) { - switch (scenario) { - case Scenario.TOTP_ENROLL_WITH_SECRET_KEY: - return Boolean(featureName?.includes('Google Authenticator') && - scenarioName?.includes('by entering a Secret Key')); - case Scenario.TOTP_SIGN_IN_REUSE_SHARED_SECRET: - return Boolean(featureName?.includes('Google Authenticator') && - scenarioName?.includes('Signs in')); - default: - return false; - } -} diff --git a/samples/test/support/selectors/maps/buttons.ts b/samples/test/support/selectors/maps/buttons.ts new file mode 100644 index 000000000..69bf47b7a --- /dev/null +++ b/samples/test/support/selectors/maps/buttons.ts @@ -0,0 +1,5 @@ +export default { + login: 'signin', + register: 'signup', + logout: 'signout' +}; diff --git a/samples/test/support/selectors/maps/links.ts b/samples/test/support/selectors/maps/links.ts new file mode 100644 index 000000000..fa107b964 --- /dev/null +++ b/samples/test/support/selectors/maps/links.ts @@ -0,0 +1,3 @@ +export default { + 'Forgot Password': '/recover-password' +}; diff --git a/samples/test/util/configUtils.js b/samples/test/util/configUtils.js index 44b9deda1..a57137ae7 100644 --- a/samples/test/util/configUtils.js +++ b/samples/test/util/configUtils.js @@ -57,7 +57,7 @@ function getConfig() { issuer, orgUrl, orgName, - clientId: sampleConfig.express ? webClientId : clientId, + clientId: sampleConfig.appType === 'web' ? webClientId : clientId, username, password, fbUsername, diff --git a/samples/test/util/index.js b/samples/test/util/index.js index 20d30da50..a437119ae 100644 --- a/samples/test/util/index.js +++ b/samples/test/util/index.js @@ -21,3 +21,4 @@ export * from './browserUtils'; export * from './selectorUtils'; export { toQueryString }; export { camelize }; +export * from './random'; diff --git a/samples/test/util/random.js b/samples/test/util/random.js new file mode 100644 index 000000000..5f20b939b --- /dev/null +++ b/samples/test/util/random.js @@ -0,0 +1,3 @@ +import crypto from 'crypto'; + +export const randomStr = len => crypto.randomBytes(len).toString('hex'); diff --git a/scripts/e2e-express-embedded-auth-with-sdk.sh b/scripts/e2e-express-embedded-auth-with-sdk.sh index 899f82ddc..081a26f98 100644 --- a/scripts/e2e-express-embedded-auth-with-sdk.sh +++ b/scripts/e2e-express-embedded-auth-with-sdk.sh @@ -23,7 +23,7 @@ get_secret prod/okta-sdk-vars/fb_password FB_PASSWORD # If this script is run as a bacon task, run against trexcloud environment if [[ "${BACON_TASK}" == true ]]; then echo "Running tests against trexcloud org" - export ISSUER=https://javascript-idx-sdk.trexcloud.com + export ISSUER=https://javascript-idx-sdk.trexcloud.com/oauth2/default export CLIENT_ID=0oa3r1keeeFFb7VMG0g7 get_vault_secret_key devex/trex-js-idx-sdk-vars trex_client_secret CLIENT_SECRET get_vault_secret_key devex/trex-js-idx-sdk-vars trex_idx_sdk_org_api_key OKTA_API_KEY @@ -33,7 +33,7 @@ if [[ "${BACON_TASK}" == true ]]; then get_vault_secret_key devex/trex-js-idx-sdk-vars trex_mfa_client_secret CUSTOM_CLIENT_SECRET else echo "Running tests against production (ok12) org" - export ISSUER=https://javascript-idx-sdk.okta.com + export ISSUER=https://javascript-idx-sdk.okta.com/oauth2/default export CLIENT_ID=0oav2oxnlYjULp0Cy5d6 get_vault_secret_key devex/prod-js-idx-sdk-vars prod_client_secret CLIENT_SECRET get_vault_secret_key devex/prod-js-idx-sdk-vars prod_idx_sdk_org_api_key OKTA_API_KEY diff --git a/scripts/e2e-express-embedded-sign-in-widget.sh b/scripts/e2e-express-embedded-sign-in-widget.sh index 3e6ff43c1..0b9bc1b6c 100644 --- a/scripts/e2e-express-embedded-sign-in-widget.sh +++ b/scripts/e2e-express-embedded-sign-in-widget.sh @@ -25,7 +25,7 @@ get_secret prod/okta-sdk-vars/fb_password FB_PASSWORD # If this script is run as a bacon task, run against trexcloud environment if [[ "${BACON_TASK}" == true ]]; then echo "Running tests against trexcloud org" - export ISSUER=https://javascript-idx-sdk.trexcloud.com + export ISSUER=https://javascript-idx-sdk.trexcloud.com/oauth2/default export CLIENT_ID=0oa3r1keeeFFb7VMG0g7 get_vault_secret_key devex/trex-js-idx-sdk-vars trex_client_secret CLIENT_SECRET get_vault_secret_key devex/trex-js-idx-sdk-vars trex_idx_sdk_org_api_key OKTA_API_KEY @@ -35,7 +35,7 @@ if [[ "${BACON_TASK}" == true ]]; then get_vault_secret_key devex/trex-js-idx-sdk-vars trex_mfa_client_secret CUSTOM_CLIENT_SECRET else echo "Running tests against production (ok12) org" - export ISSUER=https://javascript-idx-sdk.okta.com + export ISSUER=https://javascript-idx-sdk.okta.com/oauth2/default export CLIENT_ID=0oav2oxnlYjULp0Cy5d6 get_vault_secret_key devex/prod-js-idx-sdk-vars prod_client_secret CLIENT_SECRET get_vault_secret_key devex/prod-js-idx-sdk-vars prod_idx_sdk_org_api_key OKTA_API_KEY @@ -47,21 +47,6 @@ else get_vault_secret_key devex/prod-js-idx-sdk-vars prod_totp_client_secret TOTP_CLIENT_SECRET fi -cp $OKTA_HOME/$REPO/_testenv.yml $OKTA_HOME/$REPO/testenv.yml -sed -i "s|REPLACE_ISSUER|"$ISSUER"|g" $OKTA_HOME/$REPO/testenv.yml -sed -i "s|REPLACE_DEFAULT_CLIENT_ID|"$CLIENT_ID"|g" $OKTA_HOME/$REPO/testenv.yml -sed -i "s|REPLACE_DEFAULT_CLIENT_SECRET|"$CLIENT_SECRET"|g" $OKTA_HOME/$REPO/testenv.yml -sed -i "s|REPLACE_USERNAME|"$USERNAME"|g" $OKTA_HOME/$REPO/testenv.yml -sed -i "s|REPLACE_PASSWORD|"$PASSWORD"|g" $OKTA_HOME/$REPO/testenv.yml -sed -i "s|REPLACE_A18N_API_KEY|"$A18N_API_KEY"|g" $OKTA_HOME/$REPO/testenv.yml -sed -i "s|REPLACE_OKTA_API_KEY|"$OKTA_API_KEY"|g" $OKTA_HOME/$REPO/testenv.yml -sed -i "s|REPLACE_MFA_CLIENT_ID|"$MFA_CLIENT_ID"|g" $OKTA_HOME/$REPO/testenv.yml -sed -i "s|REPLACE_MFA_CLIENT_SECRET|"$MFA_CLIENT_SECRET"|g" $OKTA_HOME/$REPO/testenv.yml -sed -i "s|REPLACE_CUSTOM_CLIENT_ID|"$CUSTOM_CLIENT_ID"|g" $OKTA_HOME/$REPO/testenv.yml -sed -i "s|REPLACE_CUSTOM_CLIENT_SECRET|"$CUSTOM_CLIENT_SECRET"|g" $OKTA_HOME/$REPO/testenv.yml -sed -i "s|REPLACE_TOTP_CLIENT_ID|"$TOTP_CLIENT_ID"|g" $OKTA_HOME/$REPO/testenv.yml -sed -i "s|REPLACE_TOTP_CLIENT_SECRET|"$TOTP_CLIENT_SECRET"|g" $OKTA_HOME/$REPO/testenv.yml - # Run the tests if ! yarn test:samples; then echo "tests failed! Exiting..." diff --git a/test/apps/react-oie/src/App.jsx b/test/apps/react-oie/src/App.jsx index 226749d3a..85bbb6e18 100644 --- a/test/apps/react-oie/src/App.jsx +++ b/test/apps/react-oie/src/App.jsx @@ -23,13 +23,22 @@ import { Transaction } from './TransactionContext'; import oidcConfig from './config'; const oktaAuth = (() => { - const { state, recoveryToken } = urlParamsToObject(window.location.search); + const { + state, + recoveryToken, + issuer, + clientId + } = urlParamsToObject(window.location.search); return new OktaAuth(Object.assign({}, oidcConfig, { state, - recoveryToken + recoveryToken, + ...(issuer && { issuer }), + ...(clientId && { clientId }) })); })(); +console.log(oktaAuth); + const restoreOriginalUri = () => {}; function App() { diff --git a/test/apps/react-oie/vite.config.js b/test/apps/react-oie/vite.config.js index 1cdff676f..33bc17f38 100644 --- a/test/apps/react-oie/vite.config.js +++ b/test/apps/react-oie/vite.config.js @@ -11,7 +11,7 @@ const env = {}; // List of environment variables made available to the app ['ISSUER', 'SPA_CLIENT_ID'].forEach((key) => { if (!process.env[key]) { - throw new Error(`Environment variable ${key} must be set. See README.md`); + console.warn(`Environment variable ${key} should be set for development. See README.md`); } env[key] = process.env[key]; });