emqx_authn_mnesia_SUITE.erl

%%--------------------------------------------------------------------
%% Copyright (c) 2020-2024 EMQ Technologies Co., Ltd. All Rights Reserved.
%%
%% Licensed under the Apache License, Version 2.0 (the "License");
%% you may not use this file except in compliance with the License.
%% You may obtain a copy of the License at
%%
%%     http://www.apache.org/licenses/LICENSE-2.0
%%
%% Unless required by applicable law or agreed to in writing, software
%% distributed under the License is distributed on an "AS IS" BASIS,
%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
%% See the License for the specific language governing permissions and
%% limitations under the License.
%%--------------------------------------------------------------------

-module(emqx_authn_mnesia_SUITE).

-compile(export_all).
-compile(nowarn_export_all).

-include_lib("eunit/include/eunit.hrl").
-include_lib("common_test/include/ct.hrl").

-define(AUTHN_ID, <<"mechanism:backend">>).

all() ->
    emqx_common_test_helpers:all(?MODULE).

init_per_suite(Config) ->
    Apps = emqx_cth_suite:start([emqx, emqx_conf, emqx_auth, emqx_auth_mnesia], #{
        work_dir => ?config(priv_dir, Config)
    }),
    [{apps, Apps} | Config].

end_per_suite(Config) ->
    ok = emqx_cth_suite:stop(?config(apps, Config)),
    ok.

init_per_testcase(_Case, Config) ->
    mria:clear_table(emqx_authn_mnesia),
    Config.

end_per_testcase(_Case, Config) ->
    Config.

%%------------------------------------------------------------------------------
%% Tests
%%------------------------------------------------------------------------------

t_create(_) ->
    Config0 = config(),

    {ok, _} = emqx_authn_mnesia:create(?AUTHN_ID, Config0),

    Config1 = Config0#{password_hash_algorithm => #{name => sha256}},
    {ok, _} = emqx_authn_mnesia:create(?AUTHN_ID, Config1).

t_update(_) ->
    Config0 = config(),
    {ok, State} = emqx_authn_mnesia:create(?AUTHN_ID, Config0),

    Config1 = Config0#{password_hash_algorithm => #{name => sha256}},
    {ok, _} = emqx_authn_mnesia:update(Config1, State).

t_destroy(_) ->
    Config = config(),
    OtherConfig = Config#{user_group => <<"stomp:global">>},
    {ok, State0} = emqx_authn_mnesia:create(?AUTHN_ID, Config),
    {ok, StateOther} = emqx_authn_mnesia:create(?AUTHN_ID, OtherConfig),

    User = #{user_id => <<"u">>, password => <<"p">>},

    {ok, _} = emqx_authn_mnesia:add_user(User, State0),
    {ok, _} = emqx_authn_mnesia:add_user(User, StateOther),

    {ok, _} = emqx_authn_mnesia:lookup_user(<<"u">>, State0),
    {ok, _} = emqx_authn_mnesia:lookup_user(<<"u">>, StateOther),

    ok = emqx_authn_mnesia:destroy(State0),

    {ok, State1} = emqx_authn_mnesia:create(?AUTHN_ID, Config),
    {error, not_found} = emqx_authn_mnesia:lookup_user(<<"u">>, State1),
    {ok, _} = emqx_authn_mnesia:lookup_user(<<"u">>, StateOther).

t_authenticate(_) ->
    Config = config(),
    {ok, State} = emqx_authn_mnesia:create(?AUTHN_ID, Config),

    User = #{user_id => <<"u">>, password => <<"p">>},
    {ok, _} = emqx_authn_mnesia:add_user(User, State),

    {ok, _} = emqx_authn_mnesia:authenticate(
        #{username => <<"u">>, password => <<"p">>},
        State
    ),
    {error, bad_username_or_password} = emqx_authn_mnesia:authenticate(
        #{username => <<"u">>, password => <<"badpass">>},
        State
    ),
    ignore = emqx_authn_mnesia:authenticate(
        #{clientid => <<"u">>, password => <<"p">>},
        State
    ).

t_add_user(_) ->
    Config = config(),
    {ok, State} = emqx_authn_mnesia:create(?AUTHN_ID, Config),

    User = #{user_id => <<"u">>, password => <<"p">>},
    {ok, _} = emqx_authn_mnesia:add_user(User, State),
    {error, already_exist} = emqx_authn_mnesia:add_user(User, State).

t_delete_user(_) ->
    Config = config(),
    {ok, State} = emqx_authn_mnesia:create(?AUTHN_ID, Config),

    {error, not_found} = emqx_authn_mnesia:delete_user(<<"u">>, State),
    User = #{user_id => <<"u">>, password => <<"p">>},
    {ok, _} = emqx_authn_mnesia:add_user(User, State),

    ok = emqx_authn_mnesia:delete_user(<<"u">>, State),
    {error, not_found} = emqx_authn_mnesia:delete_user(<<"u">>, State).

t_update_user(_) ->
    Config = config(),
    {ok, State} = emqx_authn_mnesia:create(?AUTHN_ID, Config),

    User = #{user_id => <<"u">>, password => <<"p">>},
    {ok, _} = emqx_authn_mnesia:add_user(User, State),

    {error, not_found} = emqx_authn_mnesia:update_user(<<"u1">>, #{password => <<"p1">>}, State),
    {ok, #{
        user_id := <<"u">>,
        is_superuser := true
    }} = emqx_authn_mnesia:update_user(
        <<"u">>,
        #{password => <<"p1">>, is_superuser => true},
        State
    ),

    {ok, _} = emqx_authn_mnesia:authenticate(
        #{username => <<"u">>, password => <<"p1">>},
        State
    ),

    {ok, #{is_superuser := true}} = emqx_authn_mnesia:lookup_user(<<"u">>, State).

t_list_users(_) ->
    Config = config(),
    {ok, State} = emqx_authn_mnesia:create(?AUTHN_ID, Config),

    Users = [
        #{user_id => <<"u1">>, password => <<"p">>},
        #{user_id => <<"u2">>, password => <<"p">>},
        #{user_id => <<"u3">>, password => <<"p">>}
    ],

    lists:foreach(
        fun(U) -> {ok, _} = emqx_authn_mnesia:add_user(U, State) end,
        Users
    ),

    #{
        data := [
            #{is_superuser := false, user_id := _},
            #{is_superuser := false, user_id := _}
        ],
        meta := #{page := 1, limit := 2, count := 3, hasnext := true}
    } = emqx_authn_mnesia:list_users(
        #{<<"page">> => 1, <<"limit">> => 2},
        State
    ),

    #{
        data := [#{is_superuser := false, user_id := _}],
        meta := #{page := 2, limit := 2, count := 3, hasnext := false}
    } = emqx_authn_mnesia:list_users(
        #{<<"page">> => 2, <<"limit">> => 2},
        State
    ),

    #{
        data := [#{is_superuser := false, user_id := <<"u3">>}],
        meta := #{page := 1, limit := 20, hasnext := false}
    } = emqx_authn_mnesia:list_users(
        #{
            <<"page">> => 1,
            <<"limit">> => 20,
            <<"like_user_id">> => <<"3">>
        },
        State
    ).

t_import_users(_) ->
    Config0 = config(),
    Config = Config0#{password_hash_algorithm => #{name => sha256}},
    {ok, State} = emqx_authn_mnesia:create(?AUTHN_ID, Config),

    ?assertEqual(
        ok,
        emqx_authn_mnesia:import_users(
            sample_filename_and_data(<<"user-credentials.json">>),
            State
        )
    ),

    ?assertEqual(
        ok,
        emqx_authn_mnesia:import_users(
            sample_filename_and_data(<<"user-credentials.csv">>),
            State
        )
    ),

    ?assertMatch(
        {error, {unsupported_file_format, _}},
        emqx_authn_mnesia:import_users(
            {hash, <<"/file/with/unknown.extension">>, <<>>},
            State
        )
    ),

    ?assertEqual(
        {error, unknown_file_format},
        emqx_authn_mnesia:import_users(
            {hash, <<"/file/with/no/extension">>, <<>>},
            State
        )
    ),
    %% import plain.json with hash method
    ?assertEqual(
        {error, "hash_import_requires_password_hash_field"},
        emqx_authn_mnesia:import_users(
            sample_filename_and_data(hash, <<"user-credentials-plain.json">>),
            State
        )
    ),

    ?assertEqual(
        {error, bad_format},
        emqx_authn_mnesia:import_users(
            sample_filename_and_data(<<"user-credentials-malformed-0.json">>),
            State
        )
    ),

    ?assertMatch(
        {error, {_, invalid_json}},
        emqx_authn_mnesia:import_users(
            sample_filename_and_data(<<"user-credentials-malformed-1.json">>),
            State
        )
    ),

    ?assertEqual(
        {error, bad_format},
        emqx_authn_mnesia:import_users(
            sample_filename_and_data(<<"user-credentials-malformed.csv">>),
            State
        )
    ),

    ?assertEqual(
        {error, empty_users},
        emqx_authn_mnesia:import_users(
            {hash, <<"empty_users.json">>, <<"[]">>},
            State
        )
    ),

    ?assertEqual(
        {error, empty_users},
        emqx_authn_mnesia:import_users(
            {hash, <<"empty_users.csv">>, <<>>},
            State
        )
    ),

    ?assertEqual(
        {error, empty_users},
        emqx_authn_mnesia:import_users(
            {hash, prepared_user_list, []},
            State
        )
    ).

t_import_users_plain(_) ->
    Config0 = config(),
    Config = Config0#{password_hash_algorithm => #{name => sha256, salt_position => suffix}},
    {ok, State} = emqx_authn_mnesia:create(?AUTHN_ID, Config),

    ?assertEqual(
        ok,
        emqx_authn_mnesia:import_users(
            sample_filename_and_data(plain, <<"user-credentials-plain.json">>),
            State
        )
    ),
    %% import hash.json with plain method
    ?assertEqual(
        {error, "plain_import_requires_password_field"},
        emqx_authn_mnesia:import_users(
            sample_filename_and_data(plain, <<"user-credentials.json">>),
            State
        )
    ),

    ?assertEqual(
        ok,
        emqx_authn_mnesia:import_users(
            sample_filename_and_data(plain, <<"user-credentials-plain.csv">>),
            State
        )
    ).

t_import_users_prepared_list(_) ->
    Config0 = config(),
    Config = Config0#{password_hash_algorithm => #{name => sha256, salt_position => suffix}},
    {ok, State} = emqx_authn_mnesia:create(?AUTHN_ID, Config),

    Users1 = [
        #{<<"user_id">> => <<"u1">>, <<"password">> => <<"p1">>, <<"is_superuser">> => true},
        #{<<"user_id">> => <<"u2">>, <<"password">> => <<"p2">>, <<"is_superuser">> => true}
    ],
    Users2 = [
        #{
            <<"user_id">> => <<"u3">>,
            <<"password_hash">> =>
                <<"c5e46903df45e5dc096dc74657610dbee8deaacae656df88a1788f1847390242">>,
            <<"salt">> => <<"e378187547bf2d6f0545a3f441aa4d8a">>,
            <<"is_superuser">> => true
        },
        #{
            <<"user_id">> => <<"u4">>,
            <<"password_hash">> =>
                <<"f4d17f300b11e522fd33f497c11b126ef1ea5149c74d2220f9a16dc876d4567b">>,
            <<"salt">> => <<"6d3f9bd5b54d94b98adbcfe10b6d181f">>,
            <<"is_superuser">> => true
        }
    ],

    ?assertEqual(
        ok,
        emqx_authn_mnesia:import_users(
            {plain, prepared_user_list, Users1},
            State
        )
    ),

    ?assertEqual(
        ok,
        emqx_authn_mnesia:import_users(
            {hash, prepared_user_list, Users2},
            State
        )
    ).

t_import_users_duplicated_records(_) ->
    Config0 = config(),
    Config = Config0#{password_hash_algorithm => #{name => plain, salt_position => disable}},
    {ok, State} = emqx_authn_mnesia:create(?AUTHN_ID, Config),

    ?assertEqual(
        ok,
        emqx_authn_mnesia:import_users(
            sample_filename_and_data(plain, <<"user-credentials-plain-dup.json">>),
            State
        )
    ),
    ?assertEqual(
        ok,
        emqx_authn_mnesia:import_users(
            sample_filename_and_data(plain, <<"user-credentials-plain-dup.csv">>),
            State
        )
    ),
    Users1 = [
        #{
            <<"user_id">> => <<"myuser5">>,
            <<"password">> => <<"password5">>,
            <<"is_superuser">> => true
        },
        #{
            <<"user_id">> => <<"myuser5">>,
            <<"password">> => <<"password6">>,
            <<"is_superuser">> => false
        }
    ],
    ?assertEqual(
        ok,
        emqx_authn_mnesia:import_users(
            {plain, prepared_user_list, Users1},
            State
        )
    ),

    %% assert: the last record overwrites the previous one
    ?assertMatch(
        [
            {user_info, {_, <<"myuser1">>}, <<"password2">>, _, false},
            {user_info, {_, <<"myuser3">>}, <<"password4">>, _, false},
            {user_info, {_, <<"myuser5">>}, <<"password6">>, _, false}
        ],
        ets:tab2list(emqx_authn_mnesia)
    ).

%%------------------------------------------------------------------------------
%% Helpers
%%------------------------------------------------------------------------------

sample_filename(Name) ->
    Dir = code:lib_dir(emqx_auth, test),
    filename:join([Dir, <<"data">>, Name]).

sample_filename_and_data(Name) ->
    sample_filename_and_data(hash, Name).

sample_filename_and_data(Type, Name) ->
    Filename = sample_filename(Name),
    {ok, Data} = file:read_file(Filename),
    {Type, Filename, Data}.

config() ->
    #{
        user_id_type => username,
        password_hash_algorithm => #{
            name => bcrypt,
            salt_rounds => 8
        },
        user_group => <<"global:mqtt">>
    }.