clients/v1: define user metadata RPCs (#78)

Part of https://linear.app/sourcegraph/issue/CORE-545/confirm-absence-of-api-for-writing-sams-user-metadata - see issue description ## Test plan CI --------- Co-authored-by: Joe Chen <jc@unknwon.io>
sourcegraph · Dec 11, 2024 · 6e9aa6a · 6e9aa6a
1 parent 8ad5975
commit 6e9aa6a
Show file tree

Hide file tree

Showing 9 changed files with 931 additions and 282 deletions.
diff --git a/auth/clientcredentials/connectrpc.go b/auth/clientcredentials/connectrpc.go
@@ -170,9 +170,6 @@ func extractSchemaRequiredScopes(spec connect.Spec, extension *protoimpl.Extensi
 		return nil, errors.Newf("extension field %s not valid", extension.TypeDescriptor().FullName())
 	}
 	list := value.List()
-	if list.Len() == 0 {
-		return nil, errors.Newf("extension field %s cannot be empty", extension.TypeDescriptor().FullName())
-	}
 
 	requiredScopes := make(scopes.Scopes, list.Len())
 	for i := 0; i < list.Len(); i++ {

diff --git a/auth/clientcredentials/connectrpc_test.go b/auth/clientcredentials/connectrpc_test.go
@@ -20,10 +20,14 @@ import (
 )
 
 func TestInterceptor(t *testing.T) {
-	// All tests based on UsersService.GetUser()
+	// All tests based on UsersService
 	for _, tc := range []struct {
-		name      string
-		token     *sams.IntrospectTokenResponse
+		name  string
+		token *sams.IntrospectTokenResponse
+
+		// doRPC, if nil, tests against UsersService.GetUser()
+		doRPC func(svc clientsv1connect.UsersServiceClient) error
+
 		wantError autogold.Value
 		wantLogs  autogold.Value
 	}{{
@@ -56,6 +60,34 @@ func TestInterceptor(t *testing.T) {
 		},
 		wantError: autogold.Expect("permission_denied: insufficient scopes: got scopes [not-a-scope], required: [profile]"),
 		wantLogs:  autogold.Expect([]string{}),
+	}, {
+		name: "no scopes required, active session",
+		token: &sams.IntrospectTokenResponse{
+			Active: true,
+			Scopes: scopes.Scopes{},
+		},
+		doRPC: func(svc clientsv1connect.UsersServiceClient) error {
+			// GetUserMetadata has no sams_required_scopes extension
+			_, err := svc.GetUserMetadata(context.Background(), connect.NewRequest(&clientsv1.GetUserMetadataRequest{}))
+			return err
+		},
+		wantError: autogold.Expect(nil), // should not error!
+		wantLogs:  autogold.Expect([]string{}),
+	}, {
+		name: "no scopes required, inactive session",
+		token: &sams.IntrospectTokenResponse{
+			Active: false,
+			Scopes: scopes.Scopes{},
+		},
+		doRPC: func(svc clientsv1connect.UsersServiceClient) error {
+			// GetUserMetadata has no sams_required_scopes extension
+			_, err := svc.GetUserMetadata(context.Background(), connect.NewRequest(&clientsv1.GetUserMetadataRequest{}))
+			return err
+		},
+		// should error - no required scopes still requires an active and valid
+		// client credentials token
+		wantError: autogold.Expect("permission_denied: permission denied"),
+		wantLogs:  autogold.Expect([]string{}),
 	}} {
 		t.Run(tc.name, func(t *testing.T) {
 			logger, exportLogs := logtest.Captured(t)
@@ -83,7 +115,13 @@ func TestInterceptor(t *testing.T) {
 					}),
 				),
 				srv.URL)
-			_, err := c.GetUser(context.Background(), connect.NewRequest(&clientsv1.GetUserRequest{}))
+
+			var err error
+			if tc.doRPC == nil {
+				_, err = c.GetUser(context.Background(), connect.NewRequest(&clientsv1.GetUserRequest{}))
+			} else {
+				err = tc.doRPC(c)
+			}
 
 			// Success cases are connect.CodeUnimplemented
 			require.Error(t, err)