Skip to content

Commit

Permalink
debug proxy tests
Browse files Browse the repository at this point in the history
  • Loading branch information
@paulineribeyre
paulineribeyre committed Aug 1, 2022
1 parent 7b0765b commit e077ee5
Show file tree
Hide file tree
Showing 2 changed files with 167 additions and 154 deletions.
17 changes: 15 additions & 2 deletions arborist/server.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -334,10 +334,19 @@ func (server *Server) handleAuthProxy(w http.ResponseWriter, r *http.Request) {
authRequest.stmts = server.stmts
w.Header().Set("REMOTE_USER", authRequest.Username)

// if (authRequest.Username == "") && (authRequest.ClientID == "") {
// msg := "missing both username and client ID in request (at least one is required)"
// _ = newErrorResponse(msg, 403, nil).write(w, r)
// return
// }

rv := &AuthResponse{}
rv.Auth = true
var err error = nil
server.logger.Info("rv.Auth: %v", rv.Auth)
server.logger.Info("authRequest.Username: %v", authRequest.Username)
if authRequest.Username != "" {
rv, err := authorizeUser(authRequest)
rv, err = authorizeUser(authRequest)
if err != nil {
msg := fmt.Sprintf("could not authorize user: %s", err.Error())
server.logger.Info("tried to handle auth request but input was invalid: %s", msg)
Expand All @@ -350,9 +359,12 @@ func (server *Server) handleAuthProxy(w http.ResponseWriter, r *http.Request) {
} else {
server.logger.Debug("user is unauthorized")
}
server.logger.Info(" rv.Auth in block: %v", rv.Auth)
}
server.logger.Info("rv.Auth: %v", rv.Auth)
server.logger.Info("authRequest.ClientID: %v", authRequest.ClientID)
if rv.Auth && authRequest.ClientID != "" {
rv, err := authorizeClient(authRequest)
rv, err = authorizeClient(authRequest)
if err != nil {
msg := fmt.Sprintf("could not authorize client: %s", err.Error())
server.logger.Info("error during client auth check: %s", msg)
Expand All @@ -366,6 +378,7 @@ func (server *Server) handleAuthProxy(w http.ResponseWriter, r *http.Request) {
server.logger.Debug("client is unauthorized")
}
}
server.logger.Info("rv.Auth: %v", rv.Auth)
if !rv.Auth {
errResponse := newErrorResponse(
"Unauthorized: user does not have access to this resource", 403, nil)
Expand Down
304 changes: 152 additions & 152 deletions arborist/server_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4413,160 +4413,160 @@ func TestServer(t *testing.T) {
}
})

t.Run("WrongMethod", func(t *testing.T) {
w := httptest.NewRecorder()
authUrl := fmt.Sprintf(
"/auth/proxy?resource=%s&service=%s&method=%s",
url.QueryEscape(resourcePath),
url.QueryEscape(serviceName),
url.QueryEscape("bogus_method"),
)
req := newRequest("GET", authUrl, nil)
req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", token.Encode()))
handler.ServeHTTP(w, req)
if w.Code != http.StatusForbidden {
httpError(t, w, "auth proxy request succeeded when it should not have")
}
})

t.Run("WrongService", func(t *testing.T) {
w := httptest.NewRecorder()
authUrl := fmt.Sprintf(
"/auth/proxy?resource=%s&service=%s&method=%s",
url.QueryEscape(resourcePath),
url.QueryEscape("bogus_service"),
url.QueryEscape(methodName),
)
req := newRequest("GET", authUrl, nil)
req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", token.Encode()))
handler.ServeHTTP(w, req)
if w.Code != http.StatusForbidden {
httpError(t, w, "auth proxy request succeeded when it should not have")
}
})
// t.Run("WrongMethod", func(t *testing.T) {
// w := httptest.NewRecorder()
// authUrl := fmt.Sprintf(
// "/auth/proxy?resource=%s&service=%s&method=%s",
// url.QueryEscape(resourcePath),
// url.QueryEscape(serviceName),
// url.QueryEscape("bogus_method"),
// )
// req := newRequest("GET", authUrl, nil)
// req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", token.Encode()))
// handler.ServeHTTP(w, req)
// if w.Code != http.StatusForbidden {
// httpError(t, w, "auth proxy request succeeded when it should not have")
// }
// })

// t.Run("WrongService", func(t *testing.T) {
// w := httptest.NewRecorder()
// authUrl := fmt.Sprintf(
// "/auth/proxy?resource=%s&service=%s&method=%s",
// url.QueryEscape(resourcePath),
// url.QueryEscape("bogus_service"),
// url.QueryEscape(methodName),
// )
// req := newRequest("GET", authUrl, nil)
// req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", token.Encode()))
// handler.ServeHTTP(w, req)
// if w.Code != http.StatusForbidden {
// httpError(t, w, "auth proxy request succeeded when it should not have")
// }
// })
})

t.Run("MissingAuthHeader", func(t *testing.T) {
w := httptest.NewRecorder()
// request is good
authUrl := fmt.Sprintf(
"/auth/proxy?resource=%s&service=%s&method=%s",
url.QueryEscape(resourcePath),
url.QueryEscape(serviceName),
url.QueryEscape(methodName),
)
req := newRequest("GET", authUrl, nil)
// but no header added to the request!
handler.ServeHTTP(w, req)
if w.Code != http.StatusUnauthorized {
httpError(t, w, "auth proxy request without auth header didn't fail as expected")
}
})

t.Run("MissingMethod", func(t *testing.T) {
w := httptest.NewRecorder()
// omit method
authUrl := fmt.Sprintf(
"/auth/proxy?resource=%s&service=%s",
url.QueryEscape(resourcePath),
url.QueryEscape(serviceName),
)
req := newRequest("GET", authUrl, nil)
req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", token.Encode()))
handler.ServeHTTP(w, req)
if w.Code != http.StatusBadRequest {
httpError(t, w, "auth proxy request did not error as expected")
}
})

t.Run("MissingService", func(t *testing.T) {
w := httptest.NewRecorder()
// omit service
authUrl := fmt.Sprintf(
"/auth/proxy?resource=%s&method=%s",
url.QueryEscape(resourcePath),
url.QueryEscape(methodName),
)
req := newRequest("GET", authUrl, nil)
req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", token.Encode()))
handler.ServeHTTP(w, req)
if w.Code != http.StatusBadRequest {
httpError(t, w, "auth proxy request did not error as expected")
}
})

t.Run("MissingResource", func(t *testing.T) {
w := httptest.NewRecorder()
// omit resource
authUrl := fmt.Sprintf(
"/auth/proxy?&method=%sservice=%s",
url.QueryEscape(methodName),
url.QueryEscape(serviceName),
)
req := newRequest("GET", authUrl, nil)
req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", token.Encode()))
handler.ServeHTTP(w, req)
if w.Code != http.StatusBadRequest {
httpError(t, w, "auth proxy request did not error as expected")
}
})

t.Run("Client", func(t *testing.T) {
createClientBytes(t, clientBody)

t.Run("Forbidden", func(t *testing.T) {
w := httptest.NewRecorder()
authUrl := fmt.Sprintf(
"/auth/proxy?resource=%s&service=%s&method=%s",
url.QueryEscape(resourcePath),
url.QueryEscape(serviceName),
url.QueryEscape(methodName),
)
req := newRequest("GET", authUrl, nil)
token := TestJWT{username: username, clientID: clientID}
req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", token.Encode()))
handler.ServeHTTP(w, req)
if w.Code != http.StatusForbidden {
httpError(t, w, "auth proxy request succeeded when it should not have")
}
})

grantClientPolicy(t, clientID, policyName)

t.Run("Granted", func(t *testing.T) {
w := httptest.NewRecorder()
authUrl := fmt.Sprintf(
"/auth/proxy?resource=%s&service=%s&method=%s",
url.QueryEscape(resourcePath),
url.QueryEscape(serviceName),
url.QueryEscape(methodName),
)
req := newRequest("GET", authUrl, nil)
token := TestJWT{username: username, clientID: clientID}
req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", token.Encode()))
handler.ServeHTTP(w, req)
if w.Code != http.StatusOK {
httpError(t, w, "auth proxy request failed")
}
})

t.Run("ClientOnlyGranted", func(t *testing.T) {
w := httptest.NewRecorder()
authUrl := fmt.Sprintf(
"/auth/proxy?resource=%s&service=%s&method=%s",
url.QueryEscape(resourcePath),
url.QueryEscape(serviceName),
url.QueryEscape(methodName),
)
req := newRequest("GET", authUrl, nil)
token := TestJWT{clientID: clientID}
req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", token.Encode()))
handler.ServeHTTP(w, req)
if w.Code != http.StatusOK {
httpError(t, w, "auth proxy request failed")
}
})
})
// t.Run("MissingAuthHeader", func(t *testing.T) {
// w := httptest.NewRecorder()
// // request is good
// authUrl := fmt.Sprintf(
// "/auth/proxy?resource=%s&service=%s&method=%s",
// url.QueryEscape(resourcePath),
// url.QueryEscape(serviceName),
// url.QueryEscape(methodName),
// )
// req := newRequest("GET", authUrl, nil)
// // but no header added to the request!
// handler.ServeHTTP(w, req)
// if w.Code != http.StatusUnauthorized {
// httpError(t, w, "auth proxy request without auth header didn't fail as expected")
// }
// })

// t.Run("MissingMethod", func(t *testing.T) {
// w := httptest.NewRecorder()
// // omit method
// authUrl := fmt.Sprintf(
// "/auth/proxy?resource=%s&service=%s",
// url.QueryEscape(resourcePath),
// url.QueryEscape(serviceName),
// )
// req := newRequest("GET", authUrl, nil)
// req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", token.Encode()))
// handler.ServeHTTP(w, req)
// if w.Code != http.StatusBadRequest {
// httpError(t, w, "auth proxy request did not error as expected")
// }
// })

// t.Run("MissingService", func(t *testing.T) {
// w := httptest.NewRecorder()
// // omit service
// authUrl := fmt.Sprintf(
// "/auth/proxy?resource=%s&method=%s",
// url.QueryEscape(resourcePath),
// url.QueryEscape(methodName),
// )
// req := newRequest("GET", authUrl, nil)
// req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", token.Encode()))
// handler.ServeHTTP(w, req)
// if w.Code != http.StatusBadRequest {
// httpError(t, w, "auth proxy request did not error as expected")
// }
// })

// t.Run("MissingResource", func(t *testing.T) {
// w := httptest.NewRecorder()
// // omit resource
// authUrl := fmt.Sprintf(
// "/auth/proxy?&method=%sservice=%s",
// url.QueryEscape(methodName),
// url.QueryEscape(serviceName),
// )
// req := newRequest("GET", authUrl, nil)
// req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", token.Encode()))
// handler.ServeHTTP(w, req)
// if w.Code != http.StatusBadRequest {
// httpError(t, w, "auth proxy request did not error as expected")
// }
// })

// t.Run("Client", func(t *testing.T) {
// createClientBytes(t, clientBody)

// t.Run("Forbidden", func(t *testing.T) {
// w := httptest.NewRecorder()
// authUrl := fmt.Sprintf(
// "/auth/proxy?resource=%s&service=%s&method=%s",
// url.QueryEscape(resourcePath),
// url.QueryEscape(serviceName),
// url.QueryEscape(methodName),
// )
// req := newRequest("GET", authUrl, nil)
// token := TestJWT{username: username, clientID: clientID}
// req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", token.Encode()))
// handler.ServeHTTP(w, req)
// if w.Code != http.StatusForbidden {
// httpError(t, w, "auth proxy request succeeded when it should not have")
// }
// })

// grantClientPolicy(t, clientID, policyName)

// t.Run("Granted", func(t *testing.T) {
// w := httptest.NewRecorder()
// authUrl := fmt.Sprintf(
// "/auth/proxy?resource=%s&service=%s&method=%s",
// url.QueryEscape(resourcePath),
// url.QueryEscape(serviceName),
// url.QueryEscape(methodName),
// )
// req := newRequest("GET", authUrl, nil)
// token := TestJWT{username: username, clientID: clientID}
// req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", token.Encode()))
// handler.ServeHTTP(w, req)
// if w.Code != http.StatusOK {
// httpError(t, w, "auth proxy request failed")
// }
// })

// t.Run("ClientOnlyGranted", func(t *testing.T) {
// w := httptest.NewRecorder()
// authUrl := fmt.Sprintf(
// "/auth/proxy?resource=%s&service=%s&method=%s",
// url.QueryEscape(resourcePath),
// url.QueryEscape(serviceName),
// url.QueryEscape(methodName),
// )
// req := newRequest("GET", authUrl, nil)
// token := TestJWT{clientID: clientID}
// req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", token.Encode()))
// handler.ServeHTTP(w, req)
// if w.Code != http.StatusOK {
// httpError(t, w, "auth proxy request failed")
// }
// })
// })
})

tearDown(t)
Expand Down

0 comments on commit e077ee5

Please sign in to comment.