Jim
769416c2ff
* refactor (controller): Use a grpc server for the grpc-gateway This starts a grpc server for the grpc-gateway. The new gateway server uses an in-memory listener which also supports "dialing", so the http proxy can connect to the in-memory listener. This change allows us to use all grpc server features and was in part motivated by a need for an interceptor of inbound requests. With that said, having a "proper" grpc server for the gateway will provide a lot more flexibility and capabilities moving forward. The request context will still be verified via middleware in the http proxy (see wrapHandlerWithCommonFuncs). This verified context will be serialized into a protobuf and sent along to the grpc-gateway via metadata where an interceptor will add the verified request info to the request's context (see requestCtxInterceptor). The interceptor will verify the serialized request info via a shared ticket with it's companion in-memory http proxy. FYI: the ticket is simply random base62 string (see db.NewPrivateId). This change also necessitated a minor change to services. We need to return an empty response instead of nil, nil when there are no errors and the response is empty. * refactor (handlers): Rename gRPC Gateway filter Originally, this was called an OutgoingInterceptor, which is an unfortunate name since it's not an interceptor. Now that we're refactoring the gateway stuff and have proper interceptors, renaming this should remove ambiguity * refactor: Rework how 204 with empty msg is handled Recent changes to grpc gateway has necessitated a change to how 204s are handled by the gateway * tests (bats): Check status codes for delete operations
104 lines
2.6 KiB
Bash
104 lines
2.6 KiB
Bash
#!/usr/bin/env bats
|
|
|
|
load _auth
|
|
load _connect
|
|
load _targets
|
|
load _helpers
|
|
|
|
|
|
@test "boundary/login: can login as admin user" {
|
|
run login $DEFAULT_LOGIN
|
|
[ "$status" -eq 0 ]
|
|
}
|
|
|
|
@test "boundary/target/connect: admin user can connect to default target" {
|
|
run connect_nc $DEFAULT_TARGET
|
|
echo "$output"
|
|
[ "$status" -eq 0 ]
|
|
}
|
|
|
|
@test "boundary/target: admin user can read default target" {
|
|
run read_target $DEFAULT_TARGET
|
|
[ "$status" -eq 0 ]
|
|
}
|
|
|
|
@test "boundary/login: can login as unpriv user" {
|
|
run login $DEFAULT_UNPRIVILEGED_LOGIN
|
|
[ "$status" -eq 0 ]
|
|
}
|
|
|
|
@test "boundary/target/connect: unpriv user can connect to default target" {
|
|
run connect_nc $DEFAULT_TARGET
|
|
echo "$output"
|
|
[ "$status" -eq 0 ]
|
|
}
|
|
|
|
@test "boundary/target: unpriv user can not read default target" {
|
|
run read_target $DEFAULT_TARGET
|
|
[ "$status" -eq 1 ]
|
|
}
|
|
|
|
@test "boundary/login: login back in as admin user" {
|
|
run login $DEFAULT_LOGIN
|
|
[ "$status" -eq 0 ]
|
|
}
|
|
|
|
@test "boundary/target: admin user can create target" {
|
|
run create_tcp_target $DEFAULT_P_ID 22 $TGT_NAME
|
|
[ "$status" -eq 0 ]
|
|
}
|
|
|
|
@test "boundary/target: admin user can not create already created target" {
|
|
run create_tcp_target $DEFAULT_P_ID 22 $TGT_NAME
|
|
[ "$status" -eq 1 ]
|
|
}
|
|
|
|
@test "boundary/target: admin user can read created target" {
|
|
local id=$(target_id_from_name $DEFAULT_P_ID $TGT_NAME)
|
|
run read_target $id
|
|
[ "$status" -eq 0 ]
|
|
}
|
|
|
|
@test "boundary/target: the $TGT_NAME target contains default authorized-actions" {
|
|
local id=$(target_id_from_name $DEFAULT_P_ID $TGT_NAME)
|
|
local out=$(read_target $id)
|
|
|
|
run has_default_target_actions "$out"
|
|
echo "$output"
|
|
[ "$status" -eq 0 ]
|
|
}
|
|
|
|
@test "boundary/target: admin user can add default host set to created target" {
|
|
local id=$(target_id_from_name $DEFAULT_P_ID $TGT_NAME)
|
|
run assoc_host_sets $id $DEFAULT_HOST_SET
|
|
echo "$output"
|
|
[ "$status" -eq 0 ]
|
|
}
|
|
|
|
@test "boundary/target: created target has default host set" {
|
|
local id=$(target_id_from_name $DEFAULT_P_ID $TGT_NAME)
|
|
run target_has_host_set_id $id $DEFAULT_HOST_SET
|
|
echo "$output"
|
|
[ "$status" -eq 0 ]
|
|
}
|
|
|
|
@test "boundary/target/connect: default user can connect to created target" {
|
|
local id=$(target_id_from_name $DEFAULT_P_ID $TGT_NAME)
|
|
run connect_nc $id
|
|
echo "connecting to $id: $output"
|
|
[ "$status" -eq 0 ]
|
|
}
|
|
|
|
@test "boundary/target: default user can delete target" {
|
|
local id=$(target_id_from_name $DEFAULT_P_ID $TGT_NAME)
|
|
run delete_target $id
|
|
run has_status_code "$output" "204"
|
|
[ "$status" -eq 0 ]
|
|
}
|
|
|
|
@test "boundary/target: default user can not read deleted target" {
|
|
local id=$(target_id_from_name $DEFAULT_P_ID $TGT_NAME)
|
|
run read_target $id
|
|
[ "$status" -eq 1 ]
|
|
}
|