scriptoriumadmin/featurebase
1
0
Fork 0
mirror of https://github.com/featurebasedb/featurebase.git synced 2026-09-07 00:55:55 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

add test cases

Browse source
This commit is contained in:
Samir Patel 2022-01-03 11:49:38 -06:00
parent c0fe253ce2
commit d18b739402
2 changed files with 128 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
http/handler.go
View file

@ -550,7 +550,7 @@ func (h *Handler) chkAuthN(handler http.HandlerFunc) http.HandlerFunc {
func (h *Handler) chkAuthZ(handler http.HandlerFunc, perm authz.Permission) http.HandlerFunc {
return func(w http.ResponseWriter, r *http.Request) {
if h.auth != nil {
fmt.Println("a")
groups, err := h.auth.Authenticate(w, r)
if err != nil {
http.Error(w, errors.Wrap(err, "authenticating").Error(), http.StatusBadRequest)
@ -562,6 +562,9 @@ func (h *Handler) chkAuthZ(handler http.HandlerFunc, perm authz.Permission) http
indexName = ""
}
if h.permissions == nil {
panic("authentication is turned on without authorization permissions set")
}
p, err := h.permissions.GetPermissions(groups, indexName)
// err is being checked later, after logging
@ -587,7 +590,7 @@ func (h *Handler) chkAuthZ(handler http.HandlerFunc, perm authz.Permission) http
if r.Method == "POST" {
h.querylogger.Infof("User ID: %s, User Name: %s, Endpoint: %s, Index: %s, Query: %s, Err: %v", uinfo.UserID, uinfo.UserName, r.URL.Path, indexName, queryString, err)
}
if err != nil || !p.Satisfies(perm.String()) {
if err != nil || !p.Satisfies(perm) {
w.Header().Add("Content-Type", "text/plain")
w.WriteHeader(http.StatusForbidden)
return
@ -596,6 +599,7 @@ func (h *Handler) chkAuthZ(handler http.HandlerFunc, perm authz.Permission) http
ctx := context.WithValue(r.Context(), contextKeyGroupMembership, groups)
handler.ServeHTTP(w, r.WithContext(ctx))
} else {
fmt.Println("z")
handler.ServeHTTP(w, r)
}
@ -778,7 +782,7 @@ func (h *Handler) filterResponse(w http.ResponseWriter, r *http.Request, schema
w.WriteHeader(http.StatusForbidden)
return nil
}
indexes := h.permissions.GetAuthorizedIndexList(g.([]authn.Group), authz.Read.String())
indexes := h.permissions.GetAuthorizedIndexList(g.([]authn.Group), authz.Read)
var new []*pilosa.IndexInfo
for _, s := range schema {
for _, index := range indexes {
@ -956,6 +960,7 @@ var DoPerQueryProfiling = false
// handlePostQuery handles /query requests.
func (h *Handler) handlePostQuery(w http.ResponseWriter, r *http.Request) {
// Read previouly parsed request from context
fmt.Println("hi")
qreq := r.Context().Value(contextKeyQueryRequest)
qerr := r.Context().Value(contextKeyQueryError)
req, ok := qreq.(*pilosa.QueryRequest)

129
http/handler_internal_test.go
View file

@ -5,6 +5,7 @@ import (
"bytes"
"encoding/hex"
"encoding/json"
"fmt"
"io/ioutil"
gohttp "net/http"
"net/http/httptest"
@ -18,6 +19,8 @@ import (
"github.com/gorilla/securecookie"
pilosa "github.com/molecula/featurebase/v2"
"github.com/molecula/featurebase/v2/authn"
"github.com/molecula/featurebase/v2/authz"
"github.com/molecula/featurebase/v2/logger"
"github.com/molecula/featurebase/v2/pql"
"golang.org/x/oauth2"
@ -184,7 +187,7 @@ func readResponse(w *httptest.ResponseRecorder) ([]byte, error) {
return ioutil.ReadAll(res.Body)
}
func TestHandlerAuth(t *testing.T) {
func TestAuthentication(t *testing.T) {
type evaluate func(w *httptest.ResponseRecorder, data []byte)
type endpoint func(w gohttp.ResponseWriter, r *gohttp.Request)
var (
@ -259,7 +262,7 @@ func TestHandlerAuth(t *testing.T) {
expiredCV := authn.CookieValue{
UserID: "narcissus",
UserName: "Caravaggio",
GroupMembership: []authn.Group{},
GroupMembership: []authn.Group{grp},
Token: &expiredToken,
}
@ -309,13 +312,37 @@ func TestHandlerAuth(t *testing.T) {
Expires: token.Expiry,
}
// permissions1 := `"user-groups":
// "dca35310-ecda-4f23-86cd-876aee55906b":
// "test": "read"
// admin: "ac97c9e2-346b-42a2-b6da-18bcb61a32fe"`
permissions2 := `"user-groups":
"dca35310-ecda-4f23-86cd-876aee559900":
"test": "write"
admin: "ac97c9e2-346b-42a2-b6da-18bcb61a32fe"`
// permissions3 := `"user-groups":
// "dca35310-ecda-4f23-86cd-876aee55906b":
// "test": "write"
// "test2": "read"
// "dca35310-ecda-4f23-86cd-876aee559900":
// "test": "read"
// admin: "ac97c9e2-346b-42a2-b6da-18bcb61a32fe"`
// permissions4 := `"user-groups":
// "dca35310-ecda-4f23-86cd-876aee559900":
// "test": ""
// admin: "ac97c9e2-346b-42a2-b6da-18bcb61a32fe"`
tests := []struct {
name string
path string
kind string
cookie *gohttp.Cookie
handler endpoint
fn evaluate
name string
path string
kind string
yamlData string
cookie *gohttp.Cookie
handler endpoint
fn evaluate
}{
{
name: "Login",
@ -538,6 +565,71 @@ func TestHandlerAuth(t *testing.T) {
}
},
},
//Tests:
// auth off
//. bad authentication cookie
//. no index name
//. no permissions
// not authorized
// authorized w/o query string
// authorized w/ query
//. test handlePostQuery
// test handleGetSchema
{
name: "MW-AuthOff",
path: "/index/{index}/query",
kind: "middleware",
cookie: validCookie,
handler: func(w gohttp.ResponseWriter, r *gohttp.Request) {
f := hOff.chkAuthZ(hOff.handlePostQuery, authz.Admin)
f(w, r)
},
fn: func(w *httptest.ResponseRecorder, data []byte) {
if w.Result().StatusCode != 400 {
t.Errorf("expected http code 400, got: %+v", w.Result().StatusCode)
}
},
},
{
name: "MW-ExpiredAuth",
path: "/index/{index}/query",
kind: "middleware",
cookie: expiredCookie,
handler: func(w gohttp.ResponseWriter, r *gohttp.Request) {
f := h.chkAuthZ(h.handlePostQuery, authz.Admin)
f(w, r)
},
fn: func(w *httptest.ResponseRecorder, data []byte) {
if w.Result().StatusCode != 307 {
t.Errorf("expected http code 307, got: %+v", w.Result().StatusCode)
}
},
},
{
name: "MW-NoIndexNoAdmin",
path: "/index/{index}/query",
kind: "middleware",
cookie: validCookie,
handler: func(w gohttp.ResponseWriter, r *gohttp.Request) {
h := h
permFile := strings.NewReader(permissions2)
var p authz.GroupPermissions
if err := p.ReadPermissionsFile(permFile); err != nil {
t.Errorf("Error: %s", err)
}
h.permissions = &p
fmt.Printf("%+v\n", h)
f := h.chkAuthZ(h.handlePostQuery, authz.Write)
f(w, r)
},
fn: func(w *httptest.ResponseRecorder, data []byte) {
if w.Result().StatusCode != 403 {
t.Errorf("expected http code 403, got: %+v", w.Result().StatusCode)
}
},
},
}
for _, test := range tests {
@ -546,7 +638,9 @@ func TestHandlerAuth(t *testing.T) {
t.Run(test.name, func(t *testing.T) {
r := httptest.NewRequest(gohttp.MethodGet, test.path, nil)
w := httptest.NewRecorder()
r.AddCookie(test.cookie)
if test.cookie != nil {
r.AddCookie(test.cookie)
}
test.handler(w, r)
data, err := readResponse(w)
if err != nil {
@ -571,6 +665,23 @@ func TestHandlerAuth(t *testing.T) {
test.fn(w, data)
})
case "middleware":
t.Run(test.name, func(t *testing.T) {
r := httptest.NewRequest(gohttp.MethodGet, test.path, nil)
w := httptest.NewRecorder()
if test.cookie != nil {
r.AddCookie(test.cookie)
}
test.handler(w, r)
fmt.Println("hey")
data, err := readResponse(w)
if err != nil {
t.Errorf("expected no errors reading response, got: %+v", err)
}
test.fn(w, data)
})
}
}