Merge branch 'main' into bug/429_light_dark_mode

test/mv_web/controllers/auth_controller_test.exs

@@ -2,11 +2,15 @@ defmodule MvWeb.AuthControllerTest do
   use MvWeb.ConnCase, async: true
   import Phoenix.LiveViewTest
   import Phoenix.ConnTest
+  import ExUnit.CaptureLog
 
   # Helper to create an unauthenticated conn (preserves sandbox metadata)
   defp build_unauthenticated_conn(authenticated_conn) do
     # Create new conn but preserve sandbox metadata for database access
-    new_conn = build_conn()
+    new_conn =
+      build_conn()
+      |> init_test_session(%{})
+      |> fetch_flash()
 
     # Copy sandbox metadata from authenticated conn
     if authenticated_conn.private[:ecto_sandbox] do
@@ -248,4 +252,159 @@ defmodule MvWeb.AuthControllerTest do
 
     assert to =~ "/auth/user/password/sign_in_with_token"
   end
+
+  # OIDC/Rauthy error handling tests
+  describe "handle_rauthy_failure/2" do
+    test "Assent.ServerUnreachableError redirects to sign-in with error flash", %{
+      conn: authenticated_conn
+    } do
+      conn = build_unauthenticated_conn(authenticated_conn)
+      # Create a mock Assent.ServerUnreachableError struct with required fields
+      error = %Assent.ServerUnreachableError{
+        http_adapter: Assent.HTTPAdapter.Finch,
+        request_url: "https://auth.example.com/callback?token=secret123",
+        reason: %Mint.TransportError{reason: :econnrefused}
+      }
+
+      conn = MvWeb.AuthController.failure(conn, {:rauthy, :callback}, error)
+
+      assert redirected_to(conn) == ~p"/sign-in"
+
+      assert Phoenix.Flash.get(conn.assigns.flash, :error) ==
+               "The authentication server is currently unavailable. Please try again later."
+    end
+
+    test "Assent.InvalidResponseError redirects to sign-in with error flash", %{
+      conn: authenticated_conn
+    } do
+      conn = build_unauthenticated_conn(authenticated_conn)
+      # Create a mock Assent.InvalidResponseError struct with required field
+      # InvalidResponseError only has :response field (HTTPResponse struct)
+      error = %Assent.InvalidResponseError{
+        response: %Assent.HTTPAdapter.HTTPResponse{
+          status: 400,
+          headers: [],
+          body: "invalid_request"
+        }
+      }
+
+      conn = MvWeb.AuthController.failure(conn, {:rauthy, :callback}, error)
+
+      assert redirected_to(conn) == ~p"/sign-in"
+
+      assert Phoenix.Flash.get(conn.assigns.flash, :error) ==
+               "Authentication configuration error. Please contact the administrator."
+    end
+
+    test "unknown reason triggers catch-all and redirects to sign-in with error flash", %{
+      conn: authenticated_conn
+    } do
+      conn = build_unauthenticated_conn(authenticated_conn)
+      unknown_reason = :oops
+
+      conn = MvWeb.AuthController.failure(conn, {:rauthy, :callback}, unknown_reason)
+
+      assert redirected_to(conn) == ~p"/sign-in"
+
+      assert Phoenix.Flash.get(conn.assigns.flash, :error) ==
+               "Unable to authenticate with OIDC. Please try again."
+    end
+  end
+
+  # Logging security tests - ensure no sensitive data is logged
+  describe "failure/3 logging security" do
+    test "does not log full URL with query params for Assent.ServerUnreachableError", %{
+      conn: authenticated_conn
+    } do
+      conn = build_unauthenticated_conn(authenticated_conn)
+
+      error = %Assent.ServerUnreachableError{
+        http_adapter: Assent.HTTPAdapter.Finch,
+        request_url: "https://auth.example.com/callback?token=secret123&code=abc456",
+        reason: %Mint.TransportError{reason: :econnrefused}
+      }
+
+      log =
+        capture_log(fn ->
+          MvWeb.AuthController.failure(conn, {:rauthy, :callback}, error)
+        end)
+
+      # Should log redacted URL (only scheme and host)
+      assert log =~ "https://auth.example.com"
+      # Should NOT log query parameters or tokens
+      refute log =~ "token=secret123"
+      refute log =~ "code=abc456"
+      refute log =~ "callback?token"
+    end
+
+    test "does not log sensitive data for Assent.InvalidResponseError", %{
+      conn: authenticated_conn
+    } do
+      conn = build_unauthenticated_conn(authenticated_conn)
+
+      error = %Assent.InvalidResponseError{
+        response: %Assent.HTTPAdapter.HTTPResponse{
+          status: 400,
+          headers: [],
+          body: "invalid_request"
+        }
+      }
+
+      log =
+        capture_log(fn ->
+          MvWeb.AuthController.failure(conn, {:rauthy, :callback}, error)
+        end)
+
+      # Should log error type but not full error details
+      assert log =~ "Authentication failure"
+      assert log =~ "rauthy"
+      # Should not log full error struct with inspect
+      refute log =~ "Assent.InvalidResponseError"
+    end
+
+    test "does not log full reason for unknown rauthy errors", %{
+      conn: authenticated_conn
+    } do
+      conn = build_unauthenticated_conn(authenticated_conn)
+      # Simulate an error that might contain sensitive data
+      error_with_sensitive_data = %{
+        token: "secret_token_123",
+        url: "https://example.com/callback?access_token=abc123",
+        error: :something_went_wrong
+      }
+
+      log =
+        capture_log(fn ->
+          MvWeb.AuthController.failure(conn, {:rauthy, :callback}, error_with_sensitive_data)
+        end)
+
+      # Should log error type but not full error details
+      assert log =~ "Authentication failure"
+      assert log =~ "rauthy"
+      # Should NOT log sensitive data
+      refute log =~ "secret_token_123"
+      refute log =~ "access_token=abc123"
+      refute log =~ "callback?access_token"
+    end
+
+    test "logs full reason for non-rauthy activities (password auth)", %{
+      conn: authenticated_conn
+    } do
+      conn = build_unauthenticated_conn(authenticated_conn)
+
+      reason = %AshAuthentication.Errors.AuthenticationFailed{
+        caused_by: %Ash.Error.Forbidden{errors: []}
+      }
+
+      log =
+        capture_log(fn ->
+          MvWeb.AuthController.failure(conn, {:password, :sign_in}, reason)
+        end)
+
+      # For non-rauthy activities, full reason is safe to log
+      assert log =~ "Authentication failure"
+      assert log =~ "password"
+      assert log =~ "AuthenticationFailed"
+    end
+  end
 end