Import upstream v0.16.22, stripped

Upstream commit: 474dd0229cb20cf513036619781ed97bd8073c3f Enterprise-only files removed or emptied: 63 Enterprise-only snippets removed: 117 in 50 files Dangling module declarations removed: 5 Cargo edits turning enterprise off: 14 Verification: clean Enterprise feature gates left for rebuilt features: 19 in 18 files Produced by tools/fork/strip.py. The full report is in docs/fork/strip-reports/ on main.
2026-09-18 10:21:56 -07:00
commit 7dae9b29fd
1650 changed files with 485521 additions and 0 deletions
@@ -0,0 +1,78 @@
+/*
+ * SPDX-FileCopyrightText: 2020 Stalwart Labs LLC <[email protected]>
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL
+ */
+
+use directory::{Credentials, Directory, UnavailableDirectory, backend::oidc::OpenIdDirectory};
+use registry::{
+    schema::{enums::DirectoryType, structs},
+    types::map::Map,
+};
+use std::time::{Duration, Instant};
+
+const DISCOVERY_RETRY_FOR: Duration = Duration::from_secs(30);
+
+pub async fn test() {
+    println!("Running unavailable directory tests...");
+
+    let started_at = Instant::now();
+    let error = OpenIdDirectory::open(structs::OidcDirectory {
+        description: "Unreachable OIDC directory".to_string(),
+        issuer_url: "http://localhost:59999/realms/stalwart".to_string(),
+        claim_username: "preferred_username".to_string(),
+        claim_name: None,
+        claim_groups: None,
+        username_domain: None,
+        require_audience: None,
+        require_scopes: Map::new(vec![]),
+        member_tenant_id: None,
+    })
+    .await
+    .expect_err("Discovery against an unreachable issuer must fail");
+    let elapsed = started_at.elapsed();
+    assert!(
+        elapsed >= DISCOVERY_RETRY_FOR,
+        "Discovery gave up after {elapsed:?}: {error}"
+    );
+
+    let oidc = Directory::Unavailable(UnavailableDirectory::new(DirectoryType::Oidc, error));
+    assert!(
+        oidc.authenticate(&Credentials::Basic {
+            username: "[email protected]".to_string(),
+            secret: "this is an OIDC password".to_string(),
+            mfa_token: None,
+        })
+        .await
+        .is_err(),
+        "Password authentication must not fall back to internal credentials"
+    );
+    assert!(
+        oidc.authenticate(&Credentials::Bearer {
+            username: None,
+            token: "not a token".to_string(),
+        })
+        .await
+        .is_err()
+    );
+    assert!(oidc.has_bearer_token_support());
+    assert!(!oidc.can_lookup_recipients());
+    assert!(oidc.oidc_discovery_document().is_none());
+
+    let ldap = Directory::Unavailable(UnavailableDirectory::new(
+        DirectoryType::Ldap,
+        "LDAP bind password is required when bind DN is set",
+    ));
+    assert!(
+        ldap.authenticate(&Credentials::Basic {
+            username: "[email protected]".to_string(),
+            secret: "this is John's LDAP password".to_string(),
+            mfa_token: None,
+        })
+        .await
+        .is_err()
+    );
+    assert!(ldap.recipient("[email protected]").await.is_err());
+    assert!(ldap.can_lookup_recipients());
+    assert!(!ldap.has_bearer_token_support());
+}