Test /api/user/get with varying group memberships

integrationtest/integration_test.go

@@ -59,9 +59,8 @@ type testClient struct {
 	signer sso.Signer
 }
 
-func (c *testClient) ssoTicket(username string) string {
-	var groups []string
-	if username == testAdminUser {
+func (c *testClient) ssoTicket(username string, groups ...string) string {
+	if len(groups) == 0 && username == testAdminUser {
 		groups = append(groups, testAdminGroup)
 	}
 	signed, err := c.signer.Sign(sso.NewTicket(username, testSSOService, testSSODomain, "", groups, 1*time.Hour))
@@ -164,19 +163,25 @@ func TestIntegration_GetUser_Auth(t *testing.T) {
 
 	testdata := []struct {
 		authUser   string
+		authGroup  string
 		expectedOk bool
 	}{
-		{"uno@investici.org", true},
-		{"due@investici.org", false},
-		{testAdminUser, true},
+		{"uno@investici.org", "", true},
+		{"uno@investici.org", "users", true},
+		{"due@investici.org", "users", false},
+		{testAdminUser, testAdminGroup, true},
 	}
 
 	for _, td := range testdata {
 		var user accountserver.User
+		var groups []string
+		if td.authGroup != "" {
+			groups = append(groups, td.authGroup)
+		}
 		err := c.request("/api/user/get", &accountserver.GetUserRequest{
 			RequestBase: accountserver.RequestBase{
 				Username: "uno@investici.org",
-				SSO:      c.ssoTicket(td.authUser),
+				SSO:      c.ssoTicket(td.authUser, groups...),
 			},
 		}, &user)
 		if td.expectedOk && err != nil {