CyberCoveLLC/threshold
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor: make secrets optional for storage bucket (#3353)

Browse Source
This commit is contained in:
Damian Debkowski authored and GitHub committed 2023-07-19 14:32:33 -07:00
1 parent 86b2f4b90a
commit e285a8ef6f
7 files changed
+379 -69
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

internal/plugin/loopback/storage_test.go
+284 -18
View File
@@ -63,7 +63,7 @@ func TestLoopbackOnCreateStorageBucket(t *testing.T) {
expectedErr: codes.InvalidArgument,
},
{
name: "missing secrets",
name: "missing attributes",
request: &plgpb.OnCreateStorageBucketRequest{
Bucket: &storagebuckets.StorageBucket{
BucketName: "aws_s3_mock",
@@ -77,6 +77,11 @@ func TestLoopbackOnCreateStorageBucket(t *testing.T) {
Bucket: &storagebuckets.StorageBucket{
BucketName: "bucket_dne",
Secrets: secrets,
Attributes: &structpb.Struct{
Fields: map[string]*structpb.Value{
"endpoint": structpb.NewStringValue("0.0.0.0"),
},
},
},
},
expectedErr: codes.NotFound,
@@ -87,16 +92,39 @@ func TestLoopbackOnCreateStorageBucket(t *testing.T) {
Bucket: &storagebuckets.StorageBucket{
BucketName: "aws_s3_err",
Secrets: secrets,
Attributes: &structpb.Struct{
Fields: map[string]*structpb.Value{
"endpoint": structpb.NewStringValue("0.0.0.0"),
},
},
},
},
expectedErr: codes.PermissionDenied,
},
{
name: "valid credentials",
name: "valid without credentials",
request: &plgpb.OnCreateStorageBucketRequest{
Bucket: &storagebuckets.StorageBucket{
BucketName: "aws_s3_mock",
Attributes: &structpb.Struct{
Fields: map[string]*structpb.Value{
"endpoint": structpb.NewStringValue("0.0.0.0"),
},
},
},
},
},
{
name: "valid with credentials",
request: &plgpb.OnCreateStorageBucketRequest{
Bucket: &storagebuckets.StorageBucket{
BucketName: "aws_s3_mock",
Secrets: secrets,
Attributes: &structpb.Struct{
Fields: map[string]*structpb.Value{
"endpoint": structpb.NewStringValue("0.0.0.0"),
},
},
},
},
},
@@ -164,11 +192,10 @@ func TestLoopbackOnUpdateStorageBucket(t *testing.T) {
expectedErr: codes.InvalidArgument,
},
{
name: "missing secrets",
name: "missing attributes",
request: &plgpb.OnUpdateStorageBucketRequest{
NewBucket: &storagebuckets.StorageBucket{
BucketName: "aws_s3_mock",
Secrets: secrets,
},
},
expectedErr: codes.InvalidArgument,
@@ -179,6 +206,11 @@ func TestLoopbackOnUpdateStorageBucket(t *testing.T) {
NewBucket: &storagebuckets.StorageBucket{
BucketName: "bucket_dne",
Secrets: secrets,
Attributes: &structpb.Struct{
Fields: map[string]*structpb.Value{
"endpoint": structpb.NewStringValue("0.0.0.0"),
},
},
},
Persisted: persisted,
},
@@ -190,17 +222,40 @@ func TestLoopbackOnUpdateStorageBucket(t *testing.T) {
NewBucket: &storagebuckets.StorageBucket{
BucketName: "aws_s3_err",
Secrets: secrets,
Attributes: &structpb.Struct{
Fields: map[string]*structpb.Value{
"endpoint": structpb.NewStringValue("0.0.0.0"),
},
},
},
Persisted: persisted,
},
expectedErr: codes.PermissionDenied,
},
{
name: "valid credentials",
name: "valid without credentials",
request: &plgpb.OnUpdateStorageBucketRequest{
NewBucket: &storagebuckets.StorageBucket{
BucketName: "aws_s3_mock",
Attributes: &structpb.Struct{
Fields: map[string]*structpb.Value{
"endpoint": structpb.NewStringValue("0.0.0.0"),
},
},
},
},
},
{
name: "valid with credentials",
request: &plgpb.OnUpdateStorageBucketRequest{
NewBucket: &storagebuckets.StorageBucket{
BucketName: "aws_s3_mock",
Secrets: secrets,
Attributes: &structpb.Struct{
Fields: map[string]*structpb.Value{
"endpoint": structpb.NewStringValue("0.0.0.0"),
},
},
},
Persisted: persisted,
},
@@ -259,21 +314,38 @@ func TestLoopbackOnDeleteStorageBucket(t *testing.T) {
expectedErr: codes.InvalidArgument,
},
{
name: "missing secrets",
name: "missing attributes",
request: &plgpb.OnDeleteStorageBucketRequest{
Bucket: &storagebuckets.StorageBucket{
BucketName: "aws_s3_mock",
Secrets: secrets,
},
},
expectedErr: codes.InvalidArgument,
},
{
name: "valid credentials",
name: "valid without credentials",
request: &plgpb.OnDeleteStorageBucketRequest{
Bucket: &storagebuckets.StorageBucket{
BucketName: "aws_s3_mock",
Attributes: &structpb.Struct{
Fields: map[string]*structpb.Value{
"endpoint": structpb.NewStringValue("0.0.0.0"),
},
},
},
},
},
{
name: "valid with credentials",
request: &plgpb.OnDeleteStorageBucketRequest{
Bucket: &storagebuckets.StorageBucket{
BucketName: "aws_s3_mock",
Secrets: secrets,
Attributes: &structpb.Struct{
Fields: map[string]*structpb.Value{
"endpoint": structpb.NewStringValue("0.0.0.0"),
},
},
},
Persisted: persisted,
},
@@ -336,7 +408,7 @@ func TestLoopbackValidatePermissions(t *testing.T) {
expectedErr: codes.InvalidArgument,
},
{
name: "missing secrets",
name: "missing attributes",
request: &plgpb.ValidatePermissionsRequest{
Bucket: &storagebuckets.StorageBucket{
BucketName: "aws_s3_mock",
@@ -350,6 +422,11 @@ func TestLoopbackValidatePermissions(t *testing.T) {
Bucket: &storagebuckets.StorageBucket{
BucketName: "bucket_dne",
Secrets: secrets,
Attributes: &structpb.Struct{
Fields: map[string]*structpb.Value{
"endpoint": structpb.NewStringValue("0.0.0.0"),
},
},
},
},
expectedErr: codes.NotFound,
@@ -360,16 +437,39 @@ func TestLoopbackValidatePermissions(t *testing.T) {
Bucket: &storagebuckets.StorageBucket{
BucketName: "aws_s3_err",
Secrets: secrets,
Attributes: &structpb.Struct{
Fields: map[string]*structpb.Value{
"endpoint": structpb.NewStringValue("0.0.0.0"),
},
},
},
},
expectedErr: codes.PermissionDenied,
},
{
name: "valid credentials",
name: "valid without credentials",
request: &plgpb.ValidatePermissionsRequest{
Bucket: &storagebuckets.StorageBucket{
BucketName: "aws_s3_mock",
Attributes: &structpb.Struct{
Fields: map[string]*structpb.Value{
"endpoint": structpb.NewStringValue("0.0.0.0"),
},
},
},
},
},
{
name: "valid with credentials",
request: &plgpb.ValidatePermissionsRequest{
Bucket: &storagebuckets.StorageBucket{
BucketName: "aws_s3_mock",
Secrets: secrets,
Attributes: &structpb.Struct{
Fields: map[string]*structpb.Value{
"endpoint": structpb.NewStringValue("0.0.0.0"),
},
},
},
},
},
@@ -443,8 +543,9 @@ func TestLoopbackHeadObject(t *testing.T) {
expectedErr: codes.InvalidArgument,
},
{
name: "missing secrets",
name: "missing attributes",
request: &plgpb.HeadObjectRequest{
Key: "mock_object",
Bucket: &storagebuckets.StorageBucket{
BucketName: "aws_s3_mock",
},
@@ -457,6 +558,11 @@ func TestLoopbackHeadObject(t *testing.T) {
Bucket: &storagebuckets.StorageBucket{
BucketName: "aws_s3_mock",
Secrets: secrets,
Attributes: &structpb.Struct{
Fields: map[string]*structpb.Value{
"endpoint": structpb.NewStringValue("0.0.0.0"),
},
},
},
},
expectedErr: codes.InvalidArgument,
@@ -468,6 +574,11 @@ func TestLoopbackHeadObject(t *testing.T) {
Bucket: &storagebuckets.StorageBucket{
BucketName: "invalid_bucket",
Secrets: secrets,
Attributes: &structpb.Struct{
Fields: map[string]*structpb.Value{
"endpoint": structpb.NewStringValue("0.0.0.0"),
},
},
},
},
expectedErr: codes.NotFound,
@@ -479,6 +590,11 @@ func TestLoopbackHeadObject(t *testing.T) {
Bucket: &storagebuckets.StorageBucket{
BucketName: "aws_s3_mock",
Secrets: secrets,
Attributes: &structpb.Struct{
Fields: map[string]*structpb.Value{
"endpoint": structpb.NewStringValue("0.0.0.0"),
},
},
},
},
expectedErr: codes.NotFound,
@@ -490,10 +606,30 @@ func TestLoopbackHeadObject(t *testing.T) {
Bucket: &storagebuckets.StorageBucket{
BucketName: "aws_s3_err",
Secrets: secrets,
Attributes: &structpb.Struct{
Fields: map[string]*structpb.Value{
"endpoint": structpb.NewStringValue("0.0.0.0"),
},
},
},
},
expectedErr: codes.PermissionDenied,
},
{
name: "head retrieved without secrets",
request: &plgpb.HeadObjectRequest{
Key: "mock_object",
Bucket: &storagebuckets.StorageBucket{
BucketName: "aws_s3_mock",
Attributes: &structpb.Struct{
Fields: map[string]*structpb.Value{
"endpoint": structpb.NewStringValue("0.0.0.0"),
},
},
},
},
expectedObj: mockStorageMapData["aws_s3_mock"]["mock_object"],
},
{
name: "head retrieved",
request: &plgpb.HeadObjectRequest{
@@ -501,6 +637,11 @@ func TestLoopbackHeadObject(t *testing.T) {
Bucket: &storagebuckets.StorageBucket{
BucketName: "aws_s3_mock",
Secrets: secrets,
Attributes: &structpb.Struct{
Fields: map[string]*structpb.Value{
"endpoint": structpb.NewStringValue("0.0.0.0"),
},
},
},
},
expectedObj: mockStorageMapData["aws_s3_mock"]["mock_object"],
@@ -578,8 +719,9 @@ func TestLoopbackGetObject(t *testing.T) {
expectedErr: codes.InvalidArgument,
},
{
name: "missing secrets",
name: "missing attributes",
request: &plgpb.GetObjectRequest{
Key: "mock_object",
Bucket: &storagebuckets.StorageBucket{
BucketName: "aws_s3_mock",
},
@@ -592,6 +734,11 @@ func TestLoopbackGetObject(t *testing.T) {
Bucket: &storagebuckets.StorageBucket{
BucketName: "aws_s3_mock",
Secrets: secrets,
Attributes: &structpb.Struct{
Fields: map[string]*structpb.Value{
"endpoint": structpb.NewStringValue("0.0.0.0"),
},
},
},
},
expectedErr: codes.InvalidArgument,
@@ -603,6 +750,11 @@ func TestLoopbackGetObject(t *testing.T) {
Bucket: &storagebuckets.StorageBucket{
BucketName: "invalid_bucket",
Secrets: secrets,
Attributes: &structpb.Struct{
Fields: map[string]*structpb.Value{
"endpoint": structpb.NewStringValue("0.0.0.0"),
},
},
},
},
expectedErr: codes.NotFound,
@@ -614,6 +766,11 @@ func TestLoopbackGetObject(t *testing.T) {
Bucket: &storagebuckets.StorageBucket{
BucketName: "aws_s3_mock",
Secrets: secrets,
Attributes: &structpb.Struct{
Fields: map[string]*structpb.Value{
"endpoint": structpb.NewStringValue("0.0.0.0"),
},
},
},
},
expectedErr: codes.NotFound,
@@ -625,6 +782,11 @@ func TestLoopbackGetObject(t *testing.T) {
Bucket: &storagebuckets.StorageBucket{
BucketName: "aws_s3_err",
Secrets: secrets,
Attributes: &structpb.Struct{
Fields: map[string]*structpb.Value{
"endpoint": structpb.NewStringValue("0.0.0.0"),
},
},
},
},
expectedErr: codes.PermissionDenied,
@@ -636,11 +798,31 @@ func TestLoopbackGetObject(t *testing.T) {
Bucket: &storagebuckets.StorageBucket{
BucketName: "aws_s3_mock",
Secrets: secrets,
Attributes: &structpb.Struct{
Fields: map[string]*structpb.Value{
"endpoint": structpb.NewStringValue("0.0.0.0"),
},
},
},
ChunkSize: 3,
},
expectedObj: mockStorageMapData["aws_s3_mock"]["mock_object"],
},
{
name: "object retrieved without secrets",
request: &plgpb.GetObjectRequest{
Key: "mock_object",
Bucket: &storagebuckets.StorageBucket{
BucketName: "aws_s3_mock",
Attributes: &structpb.Struct{
Fields: map[string]*structpb.Value{
"endpoint": structpb.NewStringValue("0.0.0.0"),
},
},
},
},
expectedObj: mockStorageMapData["aws_s3_mock"]["mock_object"],
},
{
name: "object retrieved",
request: &plgpb.GetObjectRequest{
@@ -648,6 +830,11 @@ func TestLoopbackGetObject(t *testing.T) {
Bucket: &storagebuckets.StorageBucket{
BucketName: "aws_s3_mock",
Secrets: secrets,
Attributes: &structpb.Struct{
Fields: map[string]*structpb.Value{
"endpoint": structpb.NewStringValue("0.0.0.0"),
},
},
},
},
expectedObj: mockStorageMapData["aws_s3_mock"]["mock_object"],
@@ -733,17 +920,19 @@ func TestLoopbackPutObject(t *testing.T) {
expectedErr: codes.InvalidArgument,
},
{
name: "missing-bucket-name",
request: &plgpb.PutObjectRequest{
Bucket: &storagebuckets.StorageBucket{},
},
name: "missing attributes",
expectedErr: codes.InvalidArgument,
},
{
name: "missing-secrets",
name: "missing-bucket-name",
request: &plgpb.PutObjectRequest{
Bucket: &storagebuckets.StorageBucket{
BucketName: "object_store",
Attributes: &structpb.Struct{
Fields: map[string]*structpb.Value{
"endpoint": structpb.NewStringValue("0.0.0.0"),
},
},
},
},
expectedErr: codes.InvalidArgument,
@@ -758,6 +947,11 @@ func TestLoopbackPutObject(t *testing.T) {
"SECRET_KEY_ID": structpb.NewStringValue("secret_key_id"),
},
},
Attributes: &structpb.Struct{
Fields: map[string]*structpb.Value{
"endpoint": structpb.NewStringValue("0.0.0.0"),
},
},
},
},
expectedErr: codes.InvalidArgument,
@@ -772,6 +966,11 @@ func TestLoopbackPutObject(t *testing.T) {
"SECRET_KEY_ID": structpb.NewStringValue("secret_key_id"),
},
},
Attributes: &structpb.Struct{
Fields: map[string]*structpb.Value{
"endpoint": structpb.NewStringValue("0.0.0.0"),
},
},
},
Key: "test-file",
},
@@ -787,6 +986,11 @@ func TestLoopbackPutObject(t *testing.T) {
"SECRET_KEY_ID": structpb.NewStringValue("secret_key_id"),
},
},
Attributes: &structpb.Struct{
Fields: map[string]*structpb.Value{
"endpoint": structpb.NewStringValue("0.0.0.0"),
},
},
},
Key: "test-file",
Path: path.Join(td, "test-file"),
@@ -803,6 +1007,11 @@ func TestLoopbackPutObject(t *testing.T) {
"SECRET_KEY_ID": structpb.NewStringValue("secret_key_id"),
},
},
Attributes: &structpb.Struct{
Fields: map[string]*structpb.Value{
"endpoint": structpb.NewStringValue("0.0.0.0"),
},
},
},
Key: "test-directory",
Path: path.Join(td, "test-directory"),
@@ -824,6 +1033,11 @@ func TestLoopbackPutObject(t *testing.T) {
"SECRET_KEY_ID": structpb.NewStringValue("secret_key_id"),
},
},
Attributes: &structpb.Struct{
Fields: map[string]*structpb.Value{
"endpoint": structpb.NewStringValue("0.0.0.0"),
},
},
},
Key: "test-bucket-not-found",
Path: path.Join(td, "test-bucket-not-found"),
@@ -845,6 +1059,11 @@ func TestLoopbackPutObject(t *testing.T) {
"SECRET_KEY_ID": structpb.NewStringValue("secret_key_id"),
},
},
Attributes: &structpb.Struct{
Fields: map[string]*structpb.Value{
"endpoint": structpb.NewStringValue("0.0.0.0"),
},
},
},
Key: "mock_object",
Path: path.Join(td, "test-bucket-not-found"),
@@ -866,6 +1085,11 @@ func TestLoopbackPutObject(t *testing.T) {
"SECRET_KEY_ID": structpb.NewStringValue("secret_key_id"),
},
},
Attributes: &structpb.Struct{
Fields: map[string]*structpb.Value{
"endpoint": structpb.NewStringValue("0.0.0.0"),
},
},
},
Key: "test-empty-object-data",
Path: path.Join(td, "test-empty-object-data"),
@@ -888,6 +1112,11 @@ func TestLoopbackPutObject(t *testing.T) {
"SECRET_KEY_ID": structpb.NewStringValue("secret_key_id"),
},
},
Attributes: &structpb.Struct{
Fields: map[string]*structpb.Value{
"endpoint": structpb.NewStringValue("0.0.0.0"),
},
},
},
Key: "foo/bar/zoo/mocked_object",
Path: path.Join(td, "test-valid-object-dir-in-key"),
@@ -903,6 +1132,32 @@ func TestLoopbackPutObject(t *testing.T) {
}(),
expectedContent: "TEST OBJ WITH DIR IN KEY!",
},
{
name: "valid object without credentials",
request: &plgpb.PutObjectRequest{
Bucket: &storagebuckets.StorageBucket{
BucketName: "object_store",
BucketPrefix: "/filtered/",
Attributes: &structpb.Struct{
Fields: map[string]*structpb.Value{
"endpoint": structpb.NewStringValue("0.0.0.0"),
},
},
},
Key: "mocked_object_no_credentials",
Path: path.Join(td, "test-valid-without-credentials"),
},
file: func() *os.File {
file, err := os.Create(path.Join(td, "test-valid-without-credentials"))
require.NoError(err)
n, err := file.WriteString("TEST OBJ WITH NO CREDENTIALS!")
require.NoError(err)
require.Equal(len("TEST OBJ WITH NO CREDENTIALS!"), n)
require.NoError(file.Close())
return file
}(),
expectedContent: "TEST OBJ WITH NO CREDENTIALS!",
},
{
name: "valid object w/ prefix",
request: &plgpb.PutObjectRequest{
@@ -914,6 +1169,11 @@ func TestLoopbackPutObject(t *testing.T) {
"SECRET_KEY_ID": structpb.NewStringValue("secret_key_id"),
},
},
Attributes: &structpb.Struct{
Fields: map[string]*structpb.Value{
"endpoint": structpb.NewStringValue("0.0.0.0"),
},
},
},
Key: "mocked_object",
Path: path.Join(td, "test-valid-object-prefix"),
@@ -984,12 +1244,18 @@ func TestLoopbackStoragePlugin(t *testing.T) {
"SECRET_ACCESS_KEY": structpb.NewStringValue("secret_access_key"),
},
}
attributes := &structpb.Struct{
Fields: map[string]*structpb.Value{
"endpoint": structpb.NewStringValue("0.0.0.0"),
},
}
objectData := "THIS IS A MOCKED OBJECT"
bucket := &storagebuckets.StorageBucket{
BucketName: "aws_s3_mock",
BucketPrefix: "/filtered/path/",
Secrets: secrets,
Attributes: attributes,
}
file, err := os.Create(path.Join(td, "test-put-object"))