From d18b73940227640ceb1a5e7345b331e5aaa009e2 Mon Sep 17 00:00:00 2001 From: Samir Patel <48686912+54mir@users.noreply.github.com> Date: Mon, 3 Jan 2022 11:49:38 -0600 Subject: [PATCH] add test cases --- http/handler.go | 11 ++- http/handler_internal_test.go | 129 +++++++++++++++++++++++++++++++--- 2 files changed, 128 insertions(+), 12 deletions(-) diff --git a/http/handler.go b/http/handler.go index 8aea55f22..33375ad5a 100644 --- a/http/handler.go +++ b/http/handler.go @@ -550,7 +550,7 @@ func (h *Handler) chkAuthN(handler http.HandlerFunc) http.HandlerFunc { func (h *Handler) chkAuthZ(handler http.HandlerFunc, perm authz.Permission) http.HandlerFunc { return func(w http.ResponseWriter, r *http.Request) { if h.auth != nil { - + fmt.Println("a") groups, err := h.auth.Authenticate(w, r) if err != nil { http.Error(w, errors.Wrap(err, "authenticating").Error(), http.StatusBadRequest) @@ -562,6 +562,9 @@ func (h *Handler) chkAuthZ(handler http.HandlerFunc, perm authz.Permission) http indexName = "" } + if h.permissions == nil { + panic("authentication is turned on without authorization permissions set") + } p, err := h.permissions.GetPermissions(groups, indexName) // err is being checked later, after logging @@ -587,7 +590,7 @@ func (h *Handler) chkAuthZ(handler http.HandlerFunc, perm authz.Permission) http if r.Method == "POST" { h.querylogger.Infof("User ID: %s, User Name: %s, Endpoint: %s, Index: %s, Query: %s, Err: %v", uinfo.UserID, uinfo.UserName, r.URL.Path, indexName, queryString, err) } - if err != nil || !p.Satisfies(perm.String()) { + if err != nil || !p.Satisfies(perm) { w.Header().Add("Content-Type", "text/plain") w.WriteHeader(http.StatusForbidden) return @@ -596,6 +599,7 @@ func (h *Handler) chkAuthZ(handler http.HandlerFunc, perm authz.Permission) http ctx := context.WithValue(r.Context(), contextKeyGroupMembership, groups) handler.ServeHTTP(w, r.WithContext(ctx)) } else { + fmt.Println("z") handler.ServeHTTP(w, r) } @@ -778,7 +782,7 @@ func (h *Handler) filterResponse(w http.ResponseWriter, r *http.Request, schema w.WriteHeader(http.StatusForbidden) return nil } - indexes := h.permissions.GetAuthorizedIndexList(g.([]authn.Group), authz.Read.String()) + indexes := h.permissions.GetAuthorizedIndexList(g.([]authn.Group), authz.Read) var new []*pilosa.IndexInfo for _, s := range schema { for _, index := range indexes { @@ -956,6 +960,7 @@ var DoPerQueryProfiling = false // handlePostQuery handles /query requests. func (h *Handler) handlePostQuery(w http.ResponseWriter, r *http.Request) { // Read previouly parsed request from context + fmt.Println("hi") qreq := r.Context().Value(contextKeyQueryRequest) qerr := r.Context().Value(contextKeyQueryError) req, ok := qreq.(*pilosa.QueryRequest) diff --git a/http/handler_internal_test.go b/http/handler_internal_test.go index e9cfee87a..2bcc02f97 100644 --- a/http/handler_internal_test.go +++ b/http/handler_internal_test.go @@ -5,6 +5,7 @@ import ( "bytes" "encoding/hex" "encoding/json" + "fmt" "io/ioutil" gohttp "net/http" "net/http/httptest" @@ -18,6 +19,8 @@ import ( "github.com/gorilla/securecookie" pilosa "github.com/molecula/featurebase/v2" "github.com/molecula/featurebase/v2/authn" + + "github.com/molecula/featurebase/v2/authz" "github.com/molecula/featurebase/v2/logger" "github.com/molecula/featurebase/v2/pql" "golang.org/x/oauth2" @@ -184,7 +187,7 @@ func readResponse(w *httptest.ResponseRecorder) ([]byte, error) { return ioutil.ReadAll(res.Body) } -func TestHandlerAuth(t *testing.T) { +func TestAuthentication(t *testing.T) { type evaluate func(w *httptest.ResponseRecorder, data []byte) type endpoint func(w gohttp.ResponseWriter, r *gohttp.Request) var ( @@ -259,7 +262,7 @@ func TestHandlerAuth(t *testing.T) { expiredCV := authn.CookieValue{ UserID: "narcissus", UserName: "Caravaggio", - GroupMembership: []authn.Group{}, + GroupMembership: []authn.Group{grp}, Token: &expiredToken, } @@ -309,13 +312,37 @@ func TestHandlerAuth(t *testing.T) { Expires: token.Expiry, } + // permissions1 := `"user-groups": + // "dca35310-ecda-4f23-86cd-876aee55906b": + // "test": "read" + // admin: "ac97c9e2-346b-42a2-b6da-18bcb61a32fe"` + + permissions2 := `"user-groups": + "dca35310-ecda-4f23-86cd-876aee559900": + "test": "write" +admin: "ac97c9e2-346b-42a2-b6da-18bcb61a32fe"` + + // permissions3 := `"user-groups": + // "dca35310-ecda-4f23-86cd-876aee55906b": + // "test": "write" + // "test2": "read" + // "dca35310-ecda-4f23-86cd-876aee559900": + // "test": "read" + // admin: "ac97c9e2-346b-42a2-b6da-18bcb61a32fe"` + + // permissions4 := `"user-groups": + // "dca35310-ecda-4f23-86cd-876aee559900": + // "test": "" + // admin: "ac97c9e2-346b-42a2-b6da-18bcb61a32fe"` + tests := []struct { - name string - path string - kind string - cookie *gohttp.Cookie - handler endpoint - fn evaluate + name string + path string + kind string + yamlData string + cookie *gohttp.Cookie + handler endpoint + fn evaluate }{ { name: "Login", @@ -538,6 +565,71 @@ func TestHandlerAuth(t *testing.T) { } }, }, + //Tests: + // auth off + //. bad authentication cookie + //. no index name + //. no permissions + // not authorized + // authorized w/o query string + // authorized w/ query + //. test handlePostQuery + // test handleGetSchema + { + name: "MW-AuthOff", + path: "/index/{index}/query", + kind: "middleware", + cookie: validCookie, + handler: func(w gohttp.ResponseWriter, r *gohttp.Request) { + f := hOff.chkAuthZ(hOff.handlePostQuery, authz.Admin) + f(w, r) + }, + fn: func(w *httptest.ResponseRecorder, data []byte) { + if w.Result().StatusCode != 400 { + t.Errorf("expected http code 400, got: %+v", w.Result().StatusCode) + } + }, + }, + { + name: "MW-ExpiredAuth", + path: "/index/{index}/query", + kind: "middleware", + cookie: expiredCookie, + handler: func(w gohttp.ResponseWriter, r *gohttp.Request) { + f := h.chkAuthZ(h.handlePostQuery, authz.Admin) + f(w, r) + }, + fn: func(w *httptest.ResponseRecorder, data []byte) { + if w.Result().StatusCode != 307 { + t.Errorf("expected http code 307, got: %+v", w.Result().StatusCode) + } + + }, + }, + { + name: "MW-NoIndexNoAdmin", + path: "/index/{index}/query", + kind: "middleware", + cookie: validCookie, + handler: func(w gohttp.ResponseWriter, r *gohttp.Request) { + h := h + permFile := strings.NewReader(permissions2) + var p authz.GroupPermissions + if err := p.ReadPermissionsFile(permFile); err != nil { + t.Errorf("Error: %s", err) + } + h.permissions = &p + fmt.Printf("%+v\n", h) + f := h.chkAuthZ(h.handlePostQuery, authz.Write) + f(w, r) + }, + fn: func(w *httptest.ResponseRecorder, data []byte) { + if w.Result().StatusCode != 403 { + t.Errorf("expected http code 403, got: %+v", w.Result().StatusCode) + } + + }, + }, } for _, test := range tests { @@ -546,7 +638,9 @@ func TestHandlerAuth(t *testing.T) { t.Run(test.name, func(t *testing.T) { r := httptest.NewRequest(gohttp.MethodGet, test.path, nil) w := httptest.NewRecorder() - r.AddCookie(test.cookie) + if test.cookie != nil { + r.AddCookie(test.cookie) + } test.handler(w, r) data, err := readResponse(w) if err != nil { @@ -571,6 +665,23 @@ func TestHandlerAuth(t *testing.T) { test.fn(w, data) }) + case "middleware": + t.Run(test.name, func(t *testing.T) { + r := httptest.NewRequest(gohttp.MethodGet, test.path, nil) + w := httptest.NewRecorder() + if test.cookie != nil { + r.AddCookie(test.cookie) + } + + test.handler(w, r) + fmt.Println("hey") + data, err := readResponse(w) + if err != nil { + t.Errorf("expected no errors reading response, got: %+v", err) + } + + test.fn(w, data) + }) } }