shadowdaoandClaude Sonnet 5.5
962d708fdd
Rename root, api and sdk module paths (imports, go.mod, go_package, ldflags, build scripts, buf configs) and regenerate protobuf/gateway code with the project's pinned toolchain. Wire identifiers unchanged. api gets a local replace for sdk; root/api/sdk require v0.1.0. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
97 lines
2.7 KiB
Go
97 lines
2.7 KiB
Go
// Copyright IBM Corp. 2020, 2026
|
|
// SPDX-License-Identifier: BUSL-1.1
|
|
|
|
package base_test
|
|
|
|
import (
|
|
"encoding/json"
|
|
"net/http"
|
|
"strings"
|
|
"testing"
|
|
|
|
"repo.anhonesthost.net/CyberCoveLLC/threshold/testing/internal/e2e"
|
|
"repo.anhonesthost.net/CyberCoveLLC/threshold/testing/internal/e2e/boundary"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
// TestCliUnauthenticatedUserAccess tests that a user that is not logged in is unable to
|
|
// run commands that require authentication
|
|
func TestCliUnauthenticatedUserAccess(t *testing.T) {
|
|
e2e.MaybeSkipTest(t)
|
|
|
|
ctx := t.Context()
|
|
boundary.AuthenticateAdminCli(t, ctx)
|
|
|
|
// Check one authenticated request
|
|
output := e2e.RunCommand(ctx, "boundary",
|
|
e2e.WithArgs(
|
|
"targets", "list",
|
|
"--recursive",
|
|
),
|
|
)
|
|
require.NoError(t, output.Err, string(output.Stderr))
|
|
|
|
// Logout
|
|
output = e2e.RunCommand(ctx, "boundary",
|
|
e2e.WithArgs(
|
|
"logout",
|
|
),
|
|
)
|
|
require.NoError(t, output.Err, string(output.Stderr))
|
|
|
|
// Attempt commands that unauthenticated users can make
|
|
output = e2e.RunCommand(ctx, "boundary",
|
|
e2e.WithArgs(
|
|
"scopes", "list",
|
|
),
|
|
)
|
|
require.NoError(t, output.Err, string(output.Stderr))
|
|
output = e2e.RunCommand(ctx, "boundary",
|
|
e2e.WithArgs(
|
|
"auth-methods", "list",
|
|
),
|
|
)
|
|
require.NoError(t, output.Err, string(output.Stderr))
|
|
|
|
// Check user cannot make requests that require authentication
|
|
output = e2e.RunCommand(ctx, "boundary",
|
|
e2e.WithArgs(
|
|
"targets", "list",
|
|
"--recursive",
|
|
"-format", "json",
|
|
),
|
|
)
|
|
require.Error(t, output.Err, "Unauthenticated user was able to access private resource")
|
|
fmtError := strings.Split(string(output.Stderr), "\n")[2]
|
|
var response boundary.CliError
|
|
err := json.Unmarshal([]byte(fmtError), &response)
|
|
require.NoError(t, err)
|
|
require.Equal(t, http.StatusForbidden, int(response.Status), "Incorrect error code was returned")
|
|
|
|
output = e2e.RunCommand(ctx, "boundary",
|
|
e2e.WithArgs(
|
|
"sessions", "list",
|
|
"--recursive",
|
|
"-format", "json",
|
|
),
|
|
)
|
|
require.Error(t, output.Err, "Unauthenticated user was able to access private resource")
|
|
fmtError = strings.Split(string(output.Stderr), "\n")[2]
|
|
err = json.Unmarshal([]byte(fmtError), &response)
|
|
require.NoError(t, err)
|
|
require.Equal(t, http.StatusForbidden, int(response.Status), "Incorrect error code was returned")
|
|
|
|
output = e2e.RunCommand(ctx, "boundary",
|
|
e2e.WithArgs(
|
|
"users", "list",
|
|
"--recursive",
|
|
"-format", "json",
|
|
),
|
|
)
|
|
require.Error(t, output.Err, "Unauthenticated user was able to access private resource")
|
|
fmtError = strings.Split(string(output.Stderr), "\n")[2]
|
|
err = json.Unmarshal([]byte(fmtError), &response)
|
|
require.NoError(t, err)
|
|
require.Equal(t, http.StatusForbidden, int(response.Status), "Incorrect error code was returned")
|
|
}
|