lyrebird 1.0.0 → 2.0.0

data/test/lyrebird/assertion_test.rb

@@ -1,348 +0,0 @@
-# frozen_string_literal: true
-
-require "test_helper"
-
-module Lyrebird
-  class AssertionTest < Minitest::Test
-    NS = { "saml" => SAML_ASSERTION_NS }.freeze
-
-    def setup
-      unless defined?(@@assertion)
-        @@assertion = Assertion.new.document
-        @@root = @@assertion.root
-        @@subject = @@root.at_xpath("saml:Subject", NS)
-        @@sc = @@subject.at_xpath("saml:SubjectConfirmation", NS)
-        @@scd = @@sc.at_xpath("saml:SubjectConfirmationData", NS)
-        @@conditions = @@root.at_xpath("saml:Conditions", NS)
-        @@audience_restriction = @@conditions.at_xpath("saml:AudienceRestriction", NS)
-        @@authn_statement = @@root.at_xpath("saml:AuthnStatement", NS)
-      end
-
-      @assertion = @@assertion
-      @root = @@root
-      @subject = @@subject
-      @sc = @@sc
-      @scd = @@scd
-      @conditions = @@conditions
-      @audience_restriction = @@audience_restriction
-      @authn_statement = @@authn_statement
-    end
-
-    def test_root_name
-      assert_equal "Assertion", @root.name
-      assert_equal "saml", @root.namespace.prefix
-    end
-
-    def test_root_namespace
-      assert_equal SAML_ASSERTION_NS, @root.namespace.href
-    end
-
-    def test_root_id
-      assert @root["ID"].start_with?("_")
-    end
-
-    def test_root_version
-      assert_equal "2.0", @root["Version"]
-    end
-
-    def test_root_issue_instant
-      instant = Time.iso8601(@root["IssueInstant"])
-      assert_in_delta Time.now.to_i, instant.to_i, 1
-    end
-
-    def test_issuer
-      issuer = @root.at_xpath("saml:Issuer", NS)
-      assert_equal "Issuer", issuer.name
-      assert_equal "saml", issuer.namespace.prefix
-      assert_equal DEFAULTS.issuer, issuer.text
-    end
-
-    def test_issuer_override
-      assertion = Assertion.new(issuer: "https://test.example.com").document
-      issuer = assertion.root.at_xpath("saml:Issuer", NS)
-      assert_equal "https://test.example.com", issuer.text
-    end
-
-    def test_subject
-      assert_equal "Subject", @subject.name
-      assert_equal "saml", @subject.namespace.prefix
-    end
-
-    def test_name_id
-      name_id = @subject.at_xpath("saml:NameID", NS)
-      assert_equal "NameID", name_id.name
-      assert_equal "saml", name_id.namespace.prefix
-      assert_equal DEFAULTS.name_id, name_id.text
-    end
-
-    def test_name_id_format_default
-      name_id = @subject.at_xpath("saml:NameID", NS)
-      assert_equal NAMEID_EMAIL, name_id["Format"]
-    end
-
-    def test_name_id_override
-      email = "user@test.com"
-      refute_equal email, DEFAULTS.name_id
-      assertion = Assertion.new(name_id: email).document
-      name_id = assertion.root.at_xpath("saml:Subject/saml:NameID", NS)
-      assert_equal email, name_id.text
-    end
-
-    def test_name_id_format_override
-      format = NAMEID_PERSISTENT
-      refute_equal format, DEFAULTS.name_id_format
-      assertion = Assertion.new(name_id_format: format).document
-      name_id = assertion.root.at_xpath("saml:Subject/saml:NameID", NS)
-      assert_equal format, name_id["Format"]
-    end
-
-    def test_subject_confirmation
-      assert_equal "SubjectConfirmation", @sc.name
-      assert_equal "saml", @sc.namespace.prefix
-    end
-
-    def test_subject_confirmation_method
-      assert_equal CM_BEARER, @sc["Method"]
-    end
-
-    def test_subject_confirmation_data
-      assert_equal "SubjectConfirmationData", @scd.name
-      assert_equal "saml", @scd.namespace.prefix
-    end
-
-    def test_valid_for_default
-      not_on_or_after = Time.iso8601(@scd["NotOnOrAfter"])
-      expected = Time.now.utc + DEFAULTS.valid_for
-      assert_in_delta expected.to_i, not_on_or_after.to_i, 1
-    end
-
-    def test_recipient_default
-      assert_equal DEFAULTS.recipient, @scd["Recipient"]
-    end
-
-    def test_in_response_to_default
-      assert_equal DEFAULTS.in_response_to, @scd["InResponseTo"]
-    end
-
-    def test_recipient_override
-      recipient = "https://custom.example.com/acs"
-      refute_equal recipient, DEFAULTS.recipient
-      assertion = Assertion.new(recipient: recipient).document
-      subject = assertion.root.at_xpath("saml:Subject", NS)
-      sc = subject.at_xpath("saml:SubjectConfirmation", NS)
-      scd = sc.at_xpath("saml:SubjectConfirmationData", NS)
-      assert_equal recipient, scd["Recipient"]
-    end
-
-    def test_in_response_to_override
-      in_response_to = "_custom_request"
-      refute_equal in_response_to, DEFAULTS.in_response_to
-      assertion = Assertion.new(in_response_to: in_response_to).document
-      subject = assertion.root.at_xpath("saml:Subject", NS)
-      sc = subject.at_xpath("saml:SubjectConfirmation", NS)
-      scd = sc.at_xpath("saml:SubjectConfirmationData", NS)
-      assert_equal in_response_to, scd["InResponseTo"]
-    end
-
-    def test_in_response_to_omitted_when_nil
-      assertion = Assertion.new(in_response_to: nil).document
-      subject = assertion.root.at_xpath("saml:Subject", NS)
-      sc = subject.at_xpath("saml:SubjectConfirmation", NS)
-      scd = sc.at_xpath("saml:SubjectConfirmationData", NS)
-      assert_nil scd["InResponseTo"]
-    end
-
-    def test_valid_for_override
-      valid_for = 600 # 10 minutes
-      refute_equal valid_for, DEFAULTS.valid_for
-      assertion = Assertion.new(valid_for: valid_for).document
-      subject = assertion.root.at_xpath("saml:Subject", NS)
-      sc = subject.at_xpath("saml:SubjectConfirmation", NS)
-      scd = sc.at_xpath("saml:SubjectConfirmationData", NS)
-      not_on_or_after = Time.iso8601(scd["NotOnOrAfter"])
-      expected = Time.now.utc + valid_for
-      assert_in_delta expected.to_i, not_on_or_after.to_i, 1
-    end
-
-    def test_conditions
-      assert_equal "Conditions", @conditions.name
-      assert_equal "saml", @conditions.namespace.prefix
-    end
-
-    def test_conditions_not_before
-      not_before = Time.iso8601(@conditions["NotBefore"])
-      assert_in_delta Time.now.to_i, not_before.to_i, 1
-    end
-
-    def test_conditions_not_before_override
-      not_before = Time.now.utc - 60
-      assertion = Assertion.new(not_before: not_before).document
-      conditions = assertion.root.at_xpath("saml:Conditions", NS)
-      assert_equal not_before.iso8601, conditions["NotBefore"]
-    end
-
-    def test_conditions_not_on_or_after
-      not_on_or_after = Time.iso8601(@conditions["NotOnOrAfter"])
-      expected = Time.now.utc + DEFAULTS.valid_for
-      assert_in_delta expected.to_i, not_on_or_after.to_i, 1
-    end
-
-    def test_conditions_valid_for_override
-      valid_for = 600 # 10 minutes
-      refute_equal valid_for, DEFAULTS.valid_for
-      assertion = Assertion.new(valid_for: valid_for).document
-      conditions = assertion.root.at_xpath("saml:Conditions", NS)
-      not_on_or_after = Time.iso8601(conditions["NotOnOrAfter"])
-      expected = Time.now.utc + valid_for
-      assert_in_delta expected.to_i, not_on_or_after.to_i, 1
-    end
-
-    def test_audience_restriction
-      assert_equal "AudienceRestriction", @audience_restriction.name
-      assert_equal "saml", @audience_restriction.namespace.prefix
-    end
-
-    def test_audience
-      audience = @audience_restriction.at_xpath("saml:Audience", NS)
-      assert_equal "Audience", audience.name
-      assert_equal "saml", audience.namespace.prefix
-      assert_equal DEFAULTS.audience, audience.text
-    end
-
-    def test_audience_override
-      audience = "https://custom.sp.example.com"
-      refute_equal audience, DEFAULTS.audience
-      assertion = Assertion.new(audience: audience).document
-      conditions = assertion.root.at_xpath("saml:Conditions", NS)
-      ar = conditions.at_xpath("saml:AudienceRestriction", NS)
-      assert_equal audience, ar.at_xpath("saml:Audience", NS).text
-    end
-
-    def test_authn_statement
-      assert_equal "AuthnStatement", @authn_statement.name
-      assert_equal "saml", @authn_statement.namespace.prefix
-    end
-
-    def test_authn_statement_authn_instant
-      authn_instant = Time.iso8601(@authn_statement["AuthnInstant"])
-      assert_in_delta Time.now.to_i, authn_instant.to_i, 1
-    end
-
-    def test_authn_statement_session_index
-      assert @authn_statement["SessionIndex"].start_with?("_")
-    end
-
-    def test_authn_context
-      authn_context = @authn_statement.at_xpath("saml:AuthnContext", NS)
-      assert_equal "AuthnContext", authn_context.name
-      assert_equal "saml", authn_context.namespace.prefix
-    end
-
-    def test_authn_context_class_ref
-      ac = @authn_statement.at_xpath("saml:AuthnContext", NS)
-      class_ref = ac.at_xpath("saml:AuthnContextClassRef", NS)
-      assert_equal "AuthnContextClassRef", class_ref.name
-      assert_equal "saml", class_ref.namespace.prefix
-      assert_equal DEFAULTS.authn_context, class_ref.text
-    end
-
-    def test_authn_context_override
-      custom_ref = "urn:oasis:names:tc:SAML:2.0:ac:classes:Password"
-      refute_equal custom_ref, DEFAULTS.authn_context
-      assertion = Assertion.new(authn_context: custom_ref).document
-      as = assertion.root.at_xpath("saml:AuthnStatement", NS)
-      ac = as.at_xpath("saml:AuthnContext", NS)
-      class_ref = ac.at_xpath("saml:AuthnContextClassRef", NS)
-      assert_equal custom_ref, class_ref.text
-    end
-
-    def test_default_attributes
-      as = @root.at_xpath("saml:AttributeStatement", NS)
-      attrs = as.xpath("saml:Attribute", NS)
-      assert_equal 2, attrs.size
-
-      first = attrs.find { |a| a["Name"] == "first_name" }
-      assert_equal "Test", first.at_xpath("saml:AttributeValue", NS).text
-
-      last = attrs.find { |a| a["Name"] == "last_name" }
-      assert_equal "User", last.at_xpath("saml:AttributeValue", NS).text
-    end
-
-    def test_no_attribute_statement_when_empty
-      assertion = Assertion.new(attributes: {}).document
-      assert_nil assertion.root.at_xpath("saml:AttributeStatement", NS)
-    end
-
-    def test_attribute_statement_with_single_value
-      attributes = { "email" => "user@example.com" }
-      assertion = Assertion.new(attributes: attributes).document
-      as = assertion.root.at_xpath("saml:AttributeStatement", NS)
-      assert_equal "AttributeStatement", as.name
-      assert_equal "saml", as.namespace.prefix
-    end
-
-    def test_attribute_name_and_format
-      attributes = { "email" => "user@example.com" }
-      assertion = Assertion.new(attributes: attributes).document
-      path = "saml:AttributeStatement/saml:Attribute"
-      attr = assertion.root.at_xpath(path, NS)
-
-      assert_equal "Attribute", attr.name
-      assert_equal "saml", attr.namespace.prefix
-      assert_equal "email", attr["Name"]
-      assert_equal ATTR_NAME_FORMAT, attr["NameFormat"]
-    end
-
-    def test_attribute_single_value
-      attributes = { "email" => "user@example.com" }
-      assertion = Assertion.new(attributes: attributes).document
-      path = "saml:AttributeStatement/saml:Attribute"
-      attr = assertion.root.at_xpath(path, NS)
-      value = attr.at_xpath("saml:AttributeValue", NS)
-
-      assert_equal "AttributeValue", value.name
-      assert_equal "saml", value.namespace.prefix
-      assert_equal "user@example.com", value.text
-    end
-
-    def test_attribute_multi_value
-      attributes = { "groups" => ["admin", "users", "developers"] }
-      assertion = Assertion.new(attributes: attributes).document
-      path = "saml:AttributeStatement/saml:Attribute"
-      attr = assertion.root.at_xpath(path, NS)
-      values = attr.xpath("saml:AttributeValue", NS)
-
-      assert_equal 3, values.size
-      assert_equal "admin", values[0].text
-      assert_equal "users", values[1].text
-      assert_equal "developers", values[2].text
-    end
-
-    def test_multiple_attributes
-      attributes = {
-        email: "user@example.com",
-        name: "Test User",
-        groups: ["admin", "users"]
-      }
-
-      assertion = Assertion.new(attributes: attributes).document
-      as = assertion.root.at_xpath("saml:AttributeStatement", NS)
-      attrs = as.xpath("saml:Attribute", NS)
-      assert_equal 3, attrs.size
-
-      email_attr = attrs.find { |a| a["Name"] == "email" }
-      email_value = email_attr.at_xpath("saml:AttributeValue", NS).text
-      assert_equal "user@example.com", email_value
-
-      name_attr = attrs.find { |a| a["Name"] == "name" }
-      name_value = name_attr.at_xpath("saml:AttributeValue", NS).text
-      assert_equal "Test User", name_value
-
-      groups_attr = attrs.find { |a| a["Name"] == "groups" }
-      group_values = groups_attr.xpath("saml:AttributeValue", NS)
-      assert_equal 2, group_values.size
-      assert_equal "admin", group_values[0].text
-      assert_equal "users", group_values[1].text
-    end
-  end
-end

data/test/lyrebird/certificate_test.rb

@@ -1,120 +0,0 @@
-# frozen_string_literal: true
-
-require "test_helper"
-
-module Lyrebird
-  class CertificateTest < Minitest::Test
-    def setup
-      unless defined?(@@shared)
-        @@shared = Certificate.build
-        @@created_at = Time.now.utc
-      end
-
-      @certificate = @@shared
-      @created_at = @@created_at
-    end
-
-    def test_key_is_rsa
-      assert_instance_of OpenSSL::PKey::RSA, @certificate.key
-    end
-
-    def test_key_defaults_to_2048_bits
-      assert_equal 2048, @certificate.key.n.num_bits
-    end
-
-    def test_key_with_custom_bits
-      certificate = Certificate.build(bits: 4096)
-      assert_equal 4096, certificate.key.n.num_bits
-    end
-
-    def test_x509_is_x509
-      assert_instance_of OpenSSL::X509::Certificate, @certificate.x509
-    end
-
-    def test_x509_version_is_v3
-      assert_equal 2, @certificate.x509.version
-    end
-
-    def test_x509_has_serial_number
-      refute_nil @certificate.x509.serial
-      assert @certificate.x509.serial.to_i > 0
-    end
-
-    def test_x509_not_before_is_now
-      assert_in_delta @created_at, @certificate.x509.not_before, 1
-    end
-
-    def test_x509_not_after_is_one_year_from_now
-      expected = @created_at + (365 * 24 * 60 * 60)
-      assert_in_delta expected, @certificate.x509.not_after, 1
-    end
-
-    def test_x509_is_signed
-      assert @certificate.x509.verify(@certificate.key)
-    end
-
-    def test_sign
-      data = "test"
-      signature = @certificate.sign(data)
-      public_key = @certificate.x509.public_key
-      assert public_key.verify("SHA256", signature, data)
-    end
-
-    def test_x509_with_custom_subject
-      certificate = Certificate.build(cn: "Test", o: "Acme")
-      subject = certificate.x509.subject.to_s
-      assert_equal "/CN=Test/O=Acme", subject
-    end
-
-    def test_x509_with_custom_valid_for
-      certificate = Certificate.build(valid_for: 30).x509
-      expected = Time.now.utc + (30 * 24 * 60 * 60)
-      assert_in_delta expected, certificate.not_after, 1
-    end
-
-    def test_x509_with_valid_until
-      valid_until = Time.new(2030, 1, 1)
-      certificate = Certificate.build(valid_until: valid_until)
-      assert_equal valid_until, certificate.x509.not_after
-    end
-
-    def test_key_pem
-      assert @certificate.key_pem.start_with?("-----BEGIN")
-    end
-
-    def test_x509_pem
-      assert @certificate.x509_pem.start_with?("-----BEGIN")
-    end
-
-    def test_fingerprint
-      der = @certificate.x509.to_der
-      expected = OpenSSL::Digest::SHA256.hexdigest(der)
-      assert_equal expected, @certificate.fingerprint
-    end
-
-    def test_base64
-      der = @certificate.x509.to_der
-      expected = Base64.strict_encode64(der)
-      assert_equal expected, @certificate.base64
-    end
-
-    def test_build_with_block
-      certificate = Certificate.build do |c|
-        c.cn = "Name"
-        c.o = "Org"
-      end
-
-      subject = certificate.x509.subject.to_s
-      assert_equal "/CN=Name/O=Org", subject
-    end
-
-    def test_load
-      loaded = Certificate.load(
-        key_pem: @certificate.key_pem,
-        x509_pem: @certificate.x509_pem,
-      )
-
-      assert_equal @certificate.fingerprint, loaded.fingerprint
-    end
-  end
-end

data/test/lyrebird/defaults_test.rb

@@ -1,58 +0,0 @@
-# frozen_string_literal: true
-
-require "test_helper"
-
-module Lyrebird
-  class DefaultsTest < Minitest::Test
-    def test_issuer
-      assert_equal "https://idp.example.com", DEFAULTS.issuer
-    end
-
-    def test_name_id
-      assert_equal "user@example.com", DEFAULTS.name_id
-    end
-
-    def test_name_id_format
-      assert_equal NAMEID_EMAIL, DEFAULTS.name_id_format
-    end
-
-    def test_recipient
-      assert_equal "https://sp.example.com/acs", DEFAULTS.recipient
-    end
-
-    def test_in_response_to
-      assert_equal "_request_id", DEFAULTS.in_response_to
-    end
-
-    def test_valid_for
-      assert_equal 300, DEFAULTS.valid_for
-    end
-
-    def test_audience
-      assert_equal "https://sp.example.com", DEFAULTS.audience
-    end
-
-    def test_authn_context
-      expected = "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"
-      assert_equal expected, DEFAULTS.authn_context
-    end
-
-    def test_attributes
-      expected = { first_name: "Test", last_name: "User" }
-      assert_equal expected, DEFAULTS.attributes
-    end
-  end
-
-  class ConfigureTest < Minitest::Test
-    def test_configure_yields_defaults
-      yielded = nil
-      Lyrebird.configure { |d| yielded = d }
-      assert_same DEFAULTS, yielded
-    end
-
-    def test_configure_freezes_defaults
-      Lyrebird.configure { |d| }
-      assert DEFAULTS.frozen?
-    end
-  end
-end

data/test/lyrebird/encryption_test.rb

@@ -1,139 +0,0 @@
-# frozen_string_literal: true
-
-require "test_helper"
-
-module Lyrebird
-  class EncryptionTest < Minitest::Test
-    NS = {
-      "saml" => SAML_ASSERTION_NS,
-      "xenc" => XMLENC_NS,
-      "ds" => XMLDSIG_NS
-    }.freeze
-
-    def setup
-      unless defined?(@@certificate)
-        @@assertion = Assertion.new.document
-        @@element = @@assertion.root
-        @@certificate = Certificate.build
-        @@encrypted = Encryption.new(@@element, @@certificate).encrypt
-      end
-
-      @assertion = @@assertion
-      @element = @@element
-      @certificate = @@certificate
-      @encrypted = @@encrypted
-      @ed = @encrypted.at_xpath("xenc:EncryptedData", NS)
-      @ki = @ed.at_xpath("ds:KeyInfo", NS)
-      @ek = @ki.at_xpath("xenc:EncryptedKey", NS)
-      @cd = @ed.at_xpath("xenc:CipherData", NS)
-    end
-
-    def test_returns_encrypted_assertion_element
-      assert_equal "EncryptedAssertion", @encrypted.name
-      assert_equal "saml", @encrypted.namespace.prefix
-    end
-
-    def test_encrypted_assertion_namespace
-      assert_equal SAML_ASSERTION_NS, @encrypted.namespace.href
-    end
-
-    def test_encrypted_data_element
-      assert_equal "EncryptedData", @ed.name
-      assert_equal "xenc", @ed.namespace.prefix
-    end
-
-    def test_encrypted_data_namespace
-      assert_equal XMLENC_NS, @ed.namespace.href
-    end
-
-    def test_encrypted_data_type
-      assert_equal "#{XMLENC_NS}Element", @ed["Type"]
-    end
-
-    def test_encryption_method_element
-      em = @ed.at_xpath("xenc:EncryptionMethod", NS)
-      assert_equal "EncryptionMethod", em.name
-      assert_equal "xenc", em.namespace.prefix
-    end
-
-    def test_encryption_method_algorithm
-      em = @ed.at_xpath("xenc:EncryptionMethod", NS)
-      assert_equal AES256_CBC, em["Algorithm"]
-    end
-
-    def test_cipher_data_element
-      assert_equal "CipherData", @cd.name
-      assert_equal "xenc", @cd.namespace.prefix
-    end
-
-    def test_cipher_value_element
-      cv = @cd.at_xpath("xenc:CipherValue", NS)
-      assert_equal "CipherValue", cv.name
-      assert_equal "xenc", cv.namespace.prefix
-    end
-
-    def test_cipher_value_is_base64
-      cv = @cd.at_xpath("xenc:CipherValue", NS)
-      decoded = Base64.strict_decode64(cv.text)
-      assert decoded.bytesize > 16
-    end
-
-    def test_cipher_value_starts_with_iv
-      cv = @cd.at_xpath("xenc:CipherValue", NS)
-      decoded = Base64.strict_decode64(cv.text)
-      iv = decoded[0, 16]
-      assert_equal 16, iv.bytesize
-    end
-
-    def test_key_info_element
-      assert_equal "KeyInfo", @ki.name
-      assert_equal "ds", @ki.namespace.prefix
-    end
-
-    def test_key_info_namespace
-      assert_equal XMLDSIG_NS, @ki.namespace.href
-    end
-
-    def test_encrypted_key_element
-      assert_equal "EncryptedKey", @ek.name
-      assert_equal "xenc", @ek.namespace.prefix
-    end
-
-    def test_encrypted_key_namespace
-      assert_equal XMLENC_NS, @ek.namespace.href
-    end
-
-    def test_encrypted_key_encryption_method
-      em = @ek.at_xpath("xenc:EncryptionMethod", NS)
-      assert_equal "EncryptionMethod", em.name
-      assert_equal RSA_OAEP, em["Algorithm"]
-    end
-
-    def test_encrypted_key_cipher_data
-      cd = @ek.at_xpath("xenc:CipherData", NS)
-      assert_equal "CipherData", cd.name
-      assert_equal "xenc", cd.namespace.prefix
-    end
-
-    def test_encrypted_key_cipher_value
-      cv = @ek.at_xpath("xenc:CipherData/xenc:CipherValue", NS)
-      assert_equal "CipherValue", cv.name
-      assert_equal "xenc", cv.namespace.prefix
-    end
-
-    def test_encrypted_key_cipher_value_is_base64
-      cv = @ek.at_xpath("xenc:CipherData/xenc:CipherValue", NS)
-      decoded = Base64.strict_decode64(cv.text)
-      assert decoded.bytesize > 0
-    end
-
-    def test_encrypted_key_can_be_decrypted
-      cv = @ek.at_xpath("xenc:CipherData/xenc:CipherValue", NS)
-      encrypted_key = Base64.strict_decode64(cv.text)
-      private_key = @certificate.key
-      padding = OpenSSL::PKey::RSA::PKCS1_OAEP_PADDING
-      decrypted_key = private_key.private_decrypt(encrypted_key, padding)
-      assert_equal 32, decrypted_key.bytesize
-    end
-  end
-end

data/test/lyrebird/id_test.rb

@@ -1,18 +0,0 @@
-# frozen_string_literal: true
-
-require "test_helper"
-
-module Lyrebird
-  class IDTest < Minitest::Test
-    def test_generate_starts_with_underscore
-      assert ID.generate.start_with?("_")
-    end
-
-    def test_generate_contains_uuid
-      id = ID.generate
-      uuid = id[1..]
-      uuid_pattern = /\A[0-9a-f-]{36}\z/
-      assert_match uuid_pattern, uuid
-    end
-  end
-end