From 4ba319a0d30319d36471a63d822faf4cb68d3352 Mon Sep 17 00:00:00 2001 From: Kristoffer Dalby Date: Sun, 17 Nov 2024 18:19:23 -0700 Subject: [PATCH] ensure provider id is found out of order Signed-off-by: Kristoffer Dalby --- hscontrol/policy/acls.go | 5 ++++- hscontrol/policy/acls_test.go | 28 ++++++++++++++++++++++++++-- 2 files changed, 30 insertions(+), 3 deletions(-) diff --git a/hscontrol/policy/acls.go b/hscontrol/policy/acls.go index 8e2d1961..2dcbb88a 100644 --- a/hscontrol/policy/acls.go +++ b/hscontrol/policy/acls.go @@ -991,7 +991,10 @@ func filterNodesByUser(nodes types.Nodes, users []types.User, userToken string) var potentialUsers []types.User for _, user := range users { if user.ProviderIdentifier == userToken { - potentialUsers = append(potentialUsers, user) + // If a user is matching with a known unique field, + // disgard all other users and only keep the current + // user. + potentialUsers = []types.User{user} break } diff --git a/hscontrol/policy/acls_test.go b/hscontrol/policy/acls_test.go index f13d7f42..1e1a5860 100644 --- a/hscontrol/policy/acls_test.go +++ b/hscontrol/policy/acls_test.go @@ -869,13 +869,18 @@ func Test_expandPorts(t *testing.T) { } } -func Test_listNodesInUser(t *testing.T) { +func Test_filterNodesByUser(t *testing.T) { users := []types.User{ {Model: gorm.Model{ID: 1}, Name: "marc"}, {Model: gorm.Model{ID: 2}, Name: "joe", Email: "joe@headscale.net"}, {Model: gorm.Model{ID: 3}, Name: "mikael", Email: "mikael@headscale.net", ProviderIdentifier: "http://oidc.org/1234"}, {Model: gorm.Model{ID: 4}, Name: "mikael2", Email: "mikael@headscale.net"}, {Model: gorm.Model{ID: 5}, Name: "mikael", Email: "mikael2@headscale.net"}, + {Model: gorm.Model{ID: 6}, Name: "http://oidc.org/1234", Email: "mikael@headscale.net"}, + {Model: gorm.Model{ID: 7}, Name: "1"}, + {Model: gorm.Model{ID: 8}, Name: "alex", Email: "alex@headscale.net"}, + {Model: gorm.Model{ID: 9}, Name: "alex@headscale.net"}, + {Model: gorm.Model{ID: 10}, Email: "http://oidc.org/1234"}, } type args struct { @@ -947,6 +952,7 @@ func Test_listNodesInUser(t *testing.T) { nodes: types.Nodes{ &types.Node{ID: 1, User: users[1]}, &types.Node{ID: 2, User: users[2]}, + &types.Node{ID: 8, User: users[7]}, }, user: "joe@headscale.net", }, @@ -1057,6 +1063,7 @@ func Test_listNodesInUser(t *testing.T) { &types.Node{ID: 3, User: users[2]}, &types.Node{ID: 4, User: users[3]}, &types.Node{ID: 5, User: users[4]}, + &types.Node{ID: 8, User: users[7]}, }, user: "joe@headscale.net", }, @@ -1064,6 +1071,17 @@ func Test_listNodesInUser(t *testing.T) { &types.Node{ID: 2, User: users[1]}, }, }, + { + name: "email-as-username-duplicate", + args: args{ + nodes: types.Nodes{ + &types.Node{ID: 1, User: users[7]}, + &types.Node{ID: 2, User: users[8]}, + }, + user: "alex@headscale.net", + }, + want: nil, + }, { name: "all-users-no-email-random-order", args: args{ @@ -1087,6 +1105,7 @@ func Test_listNodesInUser(t *testing.T) { &types.Node{ID: 3, User: users[2]}, &types.Node{ID: 4, User: users[3]}, &types.Node{ID: 5, User: users[4]}, + &types.Node{ID: 6, User: users[5]}, }, user: "http://oidc.org/1234", }, @@ -1103,6 +1122,7 @@ func Test_listNodesInUser(t *testing.T) { &types.Node{ID: 3, User: users[2]}, &types.Node{ID: 4, User: users[3]}, &types.Node{ID: 5, User: users[4]}, + &types.Node{ID: 6, User: users[5]}, }, user: "http://oidc.org/4321", }, @@ -1116,7 +1136,11 @@ func Test_listNodesInUser(t *testing.T) { rand.Shuffle(len(ns), func(i, j int) { ns[i], ns[j] = ns[j], ns[i] }) - got := filterNodesByUser(ns, users, test.args.user) + us := users + rand.Shuffle(len(us), func(i, j int) { + us[i], us[j] = us[j], us[i] + }) + got := filterNodesByUser(ns, us, test.args.user) sort.Slice(got, func(i, j int) bool { return got[i].ID < got[j].ID })