CyberCoveLLC/threshold
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(authtokens): Add classification to all fields (#1996)

Browse Source
This commit is contained in:
Johan Brandhorst-Satzkorn committed 2022-04-20 13:32:31 -04:00
1 parent d51ce41db8
commit fc6cddfc7f
8 files changed
+144 -44
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

internal/tests/api/authmethods/authenticate_test.go
+1 -5
View File
@@ -81,16 +81,13 @@ func TestAuthenticate(t *testing.T) {
got := tests_api.CloudEventFromFile(t, eventConfig.AuditEvents.Name())
// All attribute fields are classified for now.
// TODO(johanbrandhorst): revert this when classification is done for auth methods
reqDetails := tests_api.GetEventDetails(t, got, "request")
tests_api.AssertRedactedValues(t, reqDetails)
tests_api.AssertRedactedValues(t, reqDetails["Attrs"])
tests_api.AssertRedactedValues(t, reqDetails["Attrs"].(map[string]interface{})["PasswordLoginAttributes"], "password", "login_name")
respDetails := tests_api.GetEventDetails(t, got, "response")
tests_api.AssertRedactedValues(t, respDetails)
tests_api.AssertRedactedValues(t, respDetails["Attrs"])
tests_api.AssertRedactedValues(t, respDetails["Attrs"].(map[string]interface{})["AuthTokenResponse"], "token", "token_type", "user_id", "account_id", "auth_method_id", "authorized_actions", "id", "scope_id")
tests_api.AssertRedactedValues(t, respDetails["Attrs"].(map[string]interface{})["AuthTokenResponse"], "token")
_ = os.WriteFile(eventConfig.AuditEvents.Name(), nil, 0o666) // clean out audit events from previous calls
tok, err = methods.Authenticate(tc.Context(), tc.Server().DevPasswordAuthMethodId, "login", map[string]interface{}{"login_name": "user", "password": "bad-pass"})
@@ -100,6 +97,5 @@ func TestAuthenticate(t *testing.T) {
reqDetails = tests_api.GetEventDetails(t, got, "request")
tests_api.AssertRedactedValues(t, reqDetails)
tests_api.AssertRedactedValues(t, reqDetails["Attrs"])
tests_api.AssertRedactedValues(t, reqDetails["Attrs"].(map[string]interface{})["PasswordLoginAttributes"], "password", "login_name")
}
internal/tests/api/authmethods/service_classification_test.go
+6 -6
View File
@@ -76,16 +76,16 @@ func TestAuthenticate_Tags(t *testing.T) {
// TODO(johanbrandhorst): update redaction once typed attributes are available
Attrs: &services.AuthenticateResponse_AuthTokenResponse{
AuthTokenResponse: &authtokens.AuthToken{
AccountId: encrypt.RedactedData,
AccountId: "public-account_id",
ApproximateLastUsedTime: timestamppb.New(now),
AuthMethodId: encrypt.RedactedData,
AuthMethodId: "public-auth_method_id",
AuthorizedActions: []string{
encrypt.RedactedData,
"public-authorized_actions",
},
CreatedTime: timestamppb.New(now),
ExpirationTime: timestamppb.New(now),
Id: encrypt.RedactedData,
ScopeId: encrypt.RedactedData,
Id: "public-id",
ScopeId: "public-scope_id",
Scope: &scopes.ScopeInfo{
Id: "public-scope_id",
Type: "public-scope_type",
@@ -94,7 +94,7 @@ func TestAuthenticate_Tags(t *testing.T) {
ParentScopeId: "public-parent_scope_id",
},
UpdatedTime: timestamppb.New(now),
UserId: encrypt.RedactedData,
UserId: "public-user_id",
Token: encrypt.RedactedData,
},
},
internal/tests/api/authtokens/classification_test.go
+102
View File
@@ -0,0 +1,102 @@
package authtokens_test
import (
"context"
"encoding/json"
"testing"
"time"
"github.com/hashicorp/boundary/sdk/pbs/controller/api"
pb "github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/authtokens"
"github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/scopes"
"github.com/hashicorp/boundary/sdk/wrapper"
"github.com/hashicorp/eventlogger"
"github.com/hashicorp/eventlogger/filters/encrypt"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
"google.golang.org/protobuf/types/known/timestamppb"
)
func TestAuthtokenClassification(t *testing.T) {
ctx := context.Background()
now := time.Now()
wrapper := wrapper.TestWrapper(t)
testEncryptingFilter := api.NewEncryptFilter(t, wrapper)
tests := []struct {
name string
testEvent *eventlogger.Event
wantEvent *eventlogger.Event
}{
{
name: "validate-authtoken-filtering",
testEvent: &eventlogger.Event{
Type: "test",
CreatedAt: now,
Payload: &pb.AuthToken{
AccountId: "public-account_id",
ApproximateLastUsedTime: timestamppb.New(now),
AuthMethodId: "public-auth_method_id",
AuthorizedActions: []string{
"public-authorized_actions",
},
CreatedTime: timestamppb.New(now),
ExpirationTime: timestamppb.New(now),
Id: "public-id",
ScopeId: "public-scope_id",
Scope: &scopes.ScopeInfo{
Id: "public-scope_id",
Type: "public-scope_type",
Name: "public-scope_name",
Description: "public-scope_description",
ParentScopeId: "public-parent_scope_id",
},
UpdatedTime: timestamppb.New(now),
UserId: "public-user_id",
Token: "secret-token",
},
},
wantEvent: &eventlogger.Event{
Type: "test",
CreatedAt: now,
Payload: &pb.AuthToken{
AccountId: "public-account_id",
ApproximateLastUsedTime: timestamppb.New(now),
AuthMethodId: "public-auth_method_id",
AuthorizedActions: []string{
"public-authorized_actions",
},
CreatedTime: timestamppb.New(now),
ExpirationTime: timestamppb.New(now),
Id: "public-id",
ScopeId: "public-scope_id",
Scope: &scopes.ScopeInfo{
Id: "public-scope_id",
Type: "public-scope_type",
Name: "public-scope_name",
Description: "public-scope_description",
ParentScopeId: "public-parent_scope_id",
},
UpdatedTime: timestamppb.New(now),
UserId: "public-user_id",
Token: encrypt.RedactedData,
},
},
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
assert, require := assert.New(t), require.New(t)
got, err := testEncryptingFilter.Process(ctx, tt.testEvent)
require.NoError(err)
require.NotNil(got)
actualJson, err := json.Marshal(got)
require.NoError(err)
t.Log(string(actualJson))
wantJson, err := json.Marshal(tt.wantEvent)
require.NoError(err)
assert.JSONEq(string(wantJson), string(actualJson))
})
}
}