hasura · tirumaraiselvan · Apr 21, 2020 · Apr 20, 2020 · Apr 20, 2020 · Apr 20, 2020
diff --git a/.circleci/test-server.sh b/.circleci/test-server.sh
@@ -322,7 +322,32 @@ unset HASURA_GRAPHQL_JWT_SECRET
 echo -e "\n$(time_elapsed): <########## TEST GRAPHQL-ENGINE WITH ADMIN SECRET AND JWT (with claims_namespace_path) #####################################>\n"
 TEST_TYPE="jwt-with-claims-namespace-path"
 
-export HASURA_GRAPHQL_JWT_SECRET="$(jq -n --arg key "$(cat $OUTPUT_FOLDER/ssl/jwt_public.key)" '{ type: "RS512", key: $key , claims_namespace_path: "$.hasuraClaims"}')"
+# hasura claims at one level of nesting
+export HASURA_GRAPHQL_JWT_SECRET="$(jq -n --arg key "$(cat $OUTPUT_FOLDER/ssl/jwt_public.key)" '{ type: "RS512", key: $key , claims_namespace_path: "$.hasura_claims"}')"
+
+run_hge_with_args serve
+wait_for_port 8080
+
+pytest -n 1 -vv --hge-urls "$HGE_URL" --pg-urls "$HASURA_GRAPHQL_DATABASE_URL" --hge-key="$HASURA_GRAPHQL_ADMIN_SECRET" --hge-jwt-key-file="$OUTPUT_FOLDER/ssl/jwt_private.key" --hge-jwt-conf="$HASURA_GRAPHQL_JWT_SECRET" test_jwt.py
+
+kill_hge_servers
+
+unset HASURA_GRAPHQL_JWT_SECRET
+
+# hasura claims at two levels of nesting with claims_namespace_path containing special character
+export HASURA_GRAPHQL_JWT_SECRET="$(jq -n --arg key "$(cat $OUTPUT_FOLDER/ssl/jwt_public.key)" '{ type: "RS512", key: $key , claims_namespace_path: "$.hasura['\''claims%'\'']"}')"
+
+run_hge_with_args serve
+wait_for_port 8080
+
+pytest -n 1 -vv --hge-urls "$HGE_URL" --pg-urls "$HASURA_GRAPHQL_DATABASE_URL" --hge-key="$HASURA_GRAPHQL_ADMIN_SECRET" --hge-jwt-key-file="$OUTPUT_FOLDER/ssl/jwt_private.key" --hge-jwt-conf="$HASURA_GRAPHQL_JWT_SECRET" test_jwt.py
+
+kill_hge_servers
+
+unset HASURA_GRAPHQL_JWT_SECRET
+
+# hasura claims at the root of the JWT token
+export HASURA_GRAPHQL_JWT_SECRET="$(jq -n --arg key "$(cat $OUTPUT_FOLDER/ssl/jwt_public.key)" '{ type: "RS512", key: $key , claims_namespace_path: "$"}')"
 
 run_hge_with_args serve
 wait_for_port 8080

@@ -54,4 +54,3 @@ bracketElement = do
       pure result
 
     charOrEscape delimiter = (char '\\' *> anyChar) <|> notChar delimiter
-
@@ -122,18 +122,22 @@ def test_forbidden_webhook(hge_ctx, conf):
         'request id': resp_hdrs.get('x-request-id')
     })
 
-
 def mk_claims_with_namespace_path(claims,hasura_claims,namespace_path):
-        if namespace_path is None:
-            claims['https://hasura.io/jwt/claims'] = hasura_claims
-        elif namespace_path == "$.hasuraClaims":
-            claims['hasuraClaims'] = hasura_claims
-        else:
-            raise Exception(
+    if namespace_path is None:
+        claims['https://hasura.io/jwt/claims'] = hasura_claims
+    elif namespace_path == "$":
+        claims.update(hasura_claims)
+    elif namespace_path == "$.hasura_claims":
+        claims['hasura_claims'] = hasura_claims
+    elif namespace_path == "$.hasura['claims%']":
+        claims['hasura'] = {}
+        claims['hasura']['claims%'] = hasura_claims
+    else:
+        raise Exception(
                 '''claims_namespace_path should not be anything
-                other than $.hasuraClaims for testing. The
+                other than $.hasura_claims, $.hasura['claims%'] or $ for testing. The
                 value of claims_namespace_path was {}'''.format(namespace_path))
-        return claims
+    return claims
 
 # Returns the response received and a bool indicating whether the test passed
 # or not (this will always be True unless we are `--accepting`)
Original file line number	Diff line number	Diff line change
Expand Up		@@ -54,4 +54,3 @@ bracketElement = do
		pure result

		charOrEscape delimiter = (char '\\' *> anyChar) <\|> notChar delimiter