test: Add identity provider integration tests

tests/integration/src/identity.rs

@@ -25,6 +25,7 @@ use openstack_keystone_core_types::identity::*;
 use crate::common::*;
 use crate::impl_deleter;
 
+mod group;
 mod service_account;
 mod user;
 mod user_group;

tests/integration/src/identity/group.rs

@@ -0,0 +1,18 @@
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// SPDX-License-Identifier: Apache-2.0
+
+mod create;
+mod delete;
+mod get;
+mod list;

tests/integration/src/identity/group/create.rs

@@ -0,0 +1,34 @@
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// SPDX-License-Identifier: Apache-2.0
+//! Test create group functionality.
+
+use eyre::Result;
+use tracing_test::traced_test;
+
+use crate::common::get_state;
+use crate::{create_domain, create_group};
+
+#[tokio::test]
+#[traced_test]
+async fn test_create() -> Result<()> {
+    let (state, _tmp) = get_state().await?;
+    let domain = create_domain!(state)?;
+
+    let group = create_group!(state, domain.id.clone())?;
+
+    assert!(!group.id.is_empty(), "an id was generated");
+    assert!(!group.name.is_empty());
+    assert_eq!(group.domain_id, domain.id);
+    Ok(())
+}

tests/integration/src/identity/group/delete.rs

@@ -0,0 +1,57 @@
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// SPDX-License-Identifier: Apache-2.0
+//! Test delete group functionality.
+
+use eyre::Result;
+use tracing_test::traced_test;
+
+use openstack_keystone::identity::IdentityApi;
+
+use crate::common::get_state;
+use crate::{create_domain, create_group};
+
+#[tokio::test]
+#[traced_test]
+async fn test_delete() -> Result<()> {
+    let (state, _tmp) = get_state().await?;
+    let domain = create_domain!(state)?;
+    let group = create_group!(state, domain.id.clone())?;
+
+    state
+        .provider
+        .get_identity_provider()
+        .delete_group(&state, &group.id)
+        .await?;
+
+    let fetched = state
+        .provider
+        .get_identity_provider()
+        .get_group(&state, &group.id)
+        .await?;
+    assert!(fetched.is_none(), "group is gone after delete");
+    Ok(())
+}
+
+#[tokio::test]
+#[traced_test]
+async fn test_delete_not_found() -> Result<()> {
+    let (state, _tmp) = get_state().await?;
+    let result = state
+        .provider
+        .get_identity_provider()
+        .delete_group(&state, "does-not-exist")
+        .await;
+    assert!(result.is_err(), "deleting a missing group errors");
+    Ok(())
+}

tests/integration/src/identity/group/get.rs

@@ -0,0 +1,54 @@
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// SPDX-License-Identifier: Apache-2.0
+//! Test get group functionality.
+
+use eyre::Result;
+use tracing_test::traced_test;
+
+use openstack_keystone::identity::IdentityApi;
+
+use crate::common::get_state;
+use crate::{create_domain, create_group};
+
+#[tokio::test]
+#[traced_test]
+async fn test_get() -> Result<()> {
+    let (state, _tmp) = get_state().await?;
+    let domain = create_domain!(state)?;
+    let group = create_group!(state, domain.id.clone())?;
+
+    let fetched = state
+        .provider
+        .get_identity_provider()
+        .get_group(&state, &group.id)
+        .await?
+        .expect("group found");
+    assert_eq!(fetched.id, group.id);
+    assert_eq!(fetched.name, group.name);
+    assert_eq!(fetched.domain_id, group.domain_id);
+    Ok(())
+}
+
+#[tokio::test]
+#[traced_test]
+async fn test_get_not_found() -> Result<()> {
+    let (state, _tmp) = get_state().await?;
+    let result = state
+        .provider
+        .get_identity_provider()
+        .get_group(&state, "missing")
+        .await?;
+    assert!(result.is_none(), "a missing group returns None");
+    Ok(())
+}

tests/integration/src/identity/group/list.rs

@@ -0,0 +1,78 @@
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// SPDX-License-Identifier: Apache-2.0
+//! Test list groups functionality.
+
+use eyre::Result;
+use tracing_test::traced_test;
+
+use openstack_keystone::identity::IdentityApi;
+use openstack_keystone_core_types::identity::GroupListParameters;
+
+use crate::common::get_state;
+use crate::{create_domain, create_group};
+
+#[tokio::test]
+#[traced_test]
+async fn test_list() -> Result<()> {
+    let (state, _tmp) = get_state().await?;
+    let domain = create_domain!(state)?;
+    let group_a = create_group!(state, domain.id.clone())?;
+    let group_b = create_group!(state, domain.id.clone())?;
+
+    let groups = state
+        .provider
+        .get_identity_provider()
+        .list_groups(&state, &GroupListParameters::default())
+        .await?;
+
+    assert!(
+        groups.iter().any(|g| g.id == group_a.id),
+        "first group is listed"
+    );
+    assert!(
+        groups.iter().any(|g| g.id == group_b.id),
+        "second group is listed"
+    );
+    Ok(())
+}
+
+#[tokio::test]
+#[traced_test]
+async fn test_list_by_domain() -> Result<()> {
+    let (state, _tmp) = get_state().await?;
+    let domain = create_domain!(state)?;
+    let group = create_group!(state, domain.id.clone())?;
+
+    let groups = state
+        .provider
+        .get_identity_provider()
+        .list_groups(
+            &state,
+            &GroupListParameters {
+                domain_id: Some(domain.id.clone()),
+                name: None,
+            },
+        )
+        .await?;
+
+    assert!(
+        groups.iter().any(|g| g.id == group.id),
+        "group is listed for its domain"
+    );
+    assert!(
+        groups.iter().all(|g| g.domain_id == domain.id),
+        "only groups from the requested domain are returned"
+    );
+    Ok(())
+}

tests/integration/src/identity/user.rs

@@ -15,6 +15,9 @@
 pub(crate) mod helpers;
 
 mod create;
+mod delete;
+mod federated;
 mod get;
+mod get_domain_id;
 mod list;
 mod update;

tests/integration/src/identity/user/create.rs

@@ -404,3 +404,28 @@ async fn test_create_with_expiry_and_unique_count() -> Result<()> {
 
     Ok(())
 }
+
+#[tokio::test]
+#[traced_test]
+async fn test_create_invalid_name_too_long() -> Result<()> {
+    let (state, _tmp) = get_state().await?;
+    let domain = create_domain!(state)?;
+
+    let result = state
+        .provider
+        .get_identity_provider()
+        .create_user(
+            &state,
+            UserCreateBuilder::default()
+                .name("x".repeat(256))
+                .domain_id(domain.id.clone())
+                .enabled(true)
+                .build()?,
+        )
+        .await;
+    assert!(
+        result.is_err(),
+        "creating a user with an over-length name is rejected"
+    );
+    Ok(())
+}

tests/integration/src/identity/user/delete.rs

@@ -0,0 +1,57 @@
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// SPDX-License-Identifier: Apache-2.0
+//! Test delete user functionality.
+
+use eyre::Result;
+use tracing_test::traced_test;
+
+use openstack_keystone::identity::IdentityApi;
+
+use crate::common::get_state;
+use crate::{create_domain, create_user};
+
+#[tokio::test]
+#[traced_test]
+async fn test_delete() -> Result<()> {
+    let (state, _tmp) = get_state().await?;
+    let domain = create_domain!(state)?;
+    let user = create_user!(state, domain.id.clone())?;
+
+    state
+        .provider
+        .get_identity_provider()
+        .delete_user(&state, &user.id)
+        .await?;
+
+    let fetched = state
+        .provider
+        .get_identity_provider()
+        .get_user(&state, &user.id)
+        .await?;
+    assert!(fetched.is_none(), "user is gone after delete");
+    Ok(())
+}
+
+#[tokio::test]
+#[traced_test]
+async fn test_delete_not_found() -> Result<()> {
+    let (state, _tmp) = get_state().await?;
+    let result = state
+        .provider
+        .get_identity_provider()
+        .delete_user(&state, "does-not-exist")
+        .await;
+    assert!(result.is_err(), "deleting a missing user errors");
+    Ok(())
+}