langgenius/dify
1
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-07-23 04:55:28 -04:00
Code Issues 775 Packages Projects Releases 10 Wiki Activity

[PR #22528] test: add comprehensive OAuth authentication unit tests #29959

New Issue
Closed
opened 2026-02-21 20:46:34 -05:00 by yindo · 0 comments
yindo commented 2026-02-21 20:46:34 -05:00
Owner
Copy Link
Copy Source

Original Pull Request: https://github.com/langgenius/dify/pull/22528

State: closed
Merged: Yes

PR Description

Add comprehensive unit tests for OAuth authentication module.

Core Functionality Tests

  • OAuth provider configuration and validation (GitHub, Google)
  • OAuth login redirect flow with authorization URL generation
  • OAuth callback processing and token exchange
  • User information retrieval and account linking
  • Account creation and registration flow handling
  • Workspace and tenant management for new users
  • Error handling for network failures and API errors

Security-Focused Tests

  • Account status validation: Ensures BANNED accounts are properly rejected during OAuth callback
  • Cross-tenant isolation: Validates proper tenant separation in account creation flow
  • Registration control: Tests behavior when user registration is disabled vs enabled
  • Token validation: Verifies proper handling of invalid or expired OAuth tokens
  • Input sanitization: Tests handling of malformed OAuth responses and edge cases

Defensive Security Tests

  • CLOSED account status vulnerability: Documents and tests the current security gap where CLOSED accounts can still authenticate via OAuth. This defensive test explicitly captures the expected vs actual behavior, serving as both documentation of the issue and a guard against regressions when the fix is implemented.

Edge Cases

  • Empty and null invitation tokens during OAuth flow
  • Missing OAuth provider configurations
  • Network timeouts and connection errors
  • Malformed user data from OAuth providers
  • GitHub users without public email addresses (fallback to noreply email)
  • Google OAuth responses with missing user name fields
  • Account creation when workspace creation is disabled
  • Multiple OAuth providers with different configuration states

The extensive test coverage is intentional given the critical nature of authentication and authorization functionality in the system. OAuth serves as a primary entry point for users, making thorough testing essential for both security and reliability.

Checklist

  • This change requires a documentation update, included: Dify Document
  • I understand that this PR may be closed in case there was no previous discussion or issues. (This doesn't apply to typos!)
  • I've added a test for each change that was introduced, and I tried as much as possible to make a single atomic change.
  • I've updated the documentation accordingly.
  • I ran dev/reformat(backend) and cd web && npx lint-staged(frontend) to appease the lint gods
**Original Pull Request:** https://github.com/langgenius/dify/pull/22528 **State:** closed **Merged:** Yes --- ## PR Description ### Add comprehensive unit tests for OAuth authentication module. ### Core Functionality Tests - OAuth provider configuration and validation (GitHub, Google) - OAuth login redirect flow with authorization URL generation - OAuth callback processing and token exchange - User information retrieval and account linking - Account creation and registration flow handling - Workspace and tenant management for new users - Error handling for network failures and API errors ### Security-Focused Tests - Account status validation: Ensures BANNED accounts are properly rejected during OAuth callback - Cross-tenant isolation: Validates proper tenant separation in account creation flow - Registration control: Tests behavior when user registration is disabled vs enabled - Token validation: Verifies proper handling of invalid or expired OAuth tokens - Input sanitization: Tests handling of malformed OAuth responses and edge cases ### Defensive Security Tests - CLOSED account status vulnerability: Documents and tests the current security gap where CLOSED accounts can still authenticate via OAuth. This defensive test explicitly captures the expected vs actual behavior, serving as both documentation of the issue and a guard against regressions when the fix is implemented. ### Edge Cases - Empty and null invitation tokens during OAuth flow - Missing OAuth provider configurations - Network timeouts and connection errors - Malformed user data from OAuth providers - GitHub users without public email addresses (fallback to noreply email) - Google OAuth responses with missing user name fields - Account creation when workspace creation is disabled - Multiple OAuth providers with different configuration states ### The extensive test coverage is intentional given the critical nature of authentication and authorization functionality in the system. OAuth serves as a primary entry point for users, making thorough testing essential for both security and reliability. ## Checklist - [ ] This change requires a documentation update, included: [Dify Document](https://github.com/langgenius/dify-docs) - [x] I understand that this PR may be closed in case there was no previous discussion or issues. (This doesn't apply to typos!) - [x] I've added a test for each change that was introduced, and I tried as much as possible to make a single atomic change. - [x] I've updated the documentation accordingly. - [x] I ran `dev/reformat`(backend) and `cd web && npx lint-staged`(frontend) to appease the lint gods
yindo added the pull-request label 2026-02-21 20:46:34 -05:00
yindo closed this issue 2026-02-21 20:46:34 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Knowledge Pipeline
Proposal
WIP
cloud
dependencies
feat:webapp
good first issue
outdated
performance
pull-request
Mirrored from GitHub Pull Request
 python:uv
refactor
size:L
stale
status: accepting prs
status: blocked
status: in discussion
stt & tts
vulnerablity
web
wont-fix
🌊 feat:workflow
🌚 invalid
🐞 bug
👻 feat:rag
💪 enhancement
📚 documentation
🔨 feat:tools
🙋‍♂️ question
🙏 help wanted
🤔 cant-reproduce
🤖 feat:agent
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify#29959
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?