Michael Li
4eec5ce0e1
* test(bats): Fix flaky connect helper methods * test(bats): Add more debug * chore: Fix copywrite headers
120 lines
3.2 KiB
Bash
120 lines
3.2 KiB
Bash
#!/usr/bin/env bats
|
|
|
|
load _auth
|
|
load _connect
|
|
load _sessions
|
|
load _helpers
|
|
|
|
@test "boundary/session: admin user can connect to default target" {
|
|
run login $DEFAULT_LOGIN
|
|
echo "$output"
|
|
[ "$status" -eq 0 ]
|
|
|
|
run connect_nc $DEFAULT_TARGET
|
|
echo "connecting: $output"
|
|
echo "status: $status"
|
|
[ "$status" -eq 0 ]
|
|
|
|
# Run twice so we have two values for later testing
|
|
run connect_nc $DEFAULT_TARGET
|
|
echo "connecting: $output"
|
|
echo "status: $status"
|
|
[ "$status" -eq 0 ]
|
|
}
|
|
|
|
@test "boundary/session/connect: unpriv user can connect to default target" {
|
|
run login $DEFAULT_UNPRIVILEGED_LOGIN
|
|
echo "$output"
|
|
[ "$status" -eq 0 ]
|
|
|
|
run connect_nc $DEFAULT_TARGET
|
|
echo "connecting: $output"
|
|
echo "status: $status"
|
|
[ "$status" -eq 0 ]
|
|
|
|
# Run twice so we have two values for later testing
|
|
run connect_nc $DEFAULT_TARGET
|
|
echo "connecting: $output"
|
|
echo "status: $status"
|
|
[ "$status" -eq 0 ]
|
|
}
|
|
|
|
# Note: there seems to be an issue with jq's length calculation -- an increase
|
|
# in the returned array by 2 shows up as a 4 or more increase in jq's length count.
|
|
# So for now, verify they're not the same.
|
|
@test "boundary/session: verify admin and unpriv user see different counts" {
|
|
run login $DEFAULT_UNPRIVILEGED_LOGIN
|
|
echo "$output"
|
|
[ "$status" -eq 0 ]
|
|
|
|
run count_sessions_include_terminated $DEFAULT_P_ID
|
|
echo "Number of sessions (unpriv): $output"
|
|
[ "$status" -eq 0 ]
|
|
unpriv_sessions="$output"
|
|
|
|
run login $DEFAULT_LOGIN
|
|
[ "$status" -eq 0 ]
|
|
run count_sessions_include_terminated $DEFAULT_P_ID
|
|
echo "Number of sessions (admin): $output"
|
|
[ "$status" -eq 0 ]
|
|
admin_sessions="$output"
|
|
|
|
[ "$unpriv_sessions" -lt "$admin_sessions" ]
|
|
}
|
|
|
|
@test "boundary/session: verify read and cancellation permissions on admin session" {
|
|
# Find an admin session
|
|
run login $DEFAULT_LOGIN
|
|
echo "$output"
|
|
[ "$status" -eq 0 ]
|
|
run list_sessions_include_terminated $DEFAULT_P_ID
|
|
echo "$output"
|
|
[ "$status" -eq 0 ]
|
|
id=$(echo "$output" | jq -r "[.items[]|select(.user_id == \"$DEFAULT_USER\")][0].id")
|
|
|
|
# Check unpriv cannot read or cancel an admin's session
|
|
run login $DEFAULT_UNPRIVILEGED_LOGIN
|
|
[ "$status" -eq 0 ]
|
|
run read_session $id
|
|
[ "$status" -eq 1 ]
|
|
run cancel_session $id
|
|
[ "$status" -eq 1 ]
|
|
|
|
# Check that admin _can_
|
|
run login $DEFAULT_LOGIN
|
|
[ "$status" -eq 0 ]
|
|
run read_session $id
|
|
echo "$output"
|
|
[ "$status" -eq 0 ]
|
|
echo "$output"
|
|
run cancel_session $id
|
|
[ "$status" -eq 0 ]
|
|
echo "$output"
|
|
}
|
|
|
|
@test "boundary/session: verify read and cancellation permissions on unpriv session" {
|
|
# Find an unpriv session
|
|
run login $DEFAULT_UNPRIVILEGED_LOGIN
|
|
[ "$status" -eq 0 ]
|
|
run list_sessions_include_terminated $DEFAULT_P_ID
|
|
echo "$output"
|
|
[ "$status" -eq 0 ]
|
|
id=$(echo "$output" | jq -r "[.items[]|select(.user_id == \"$DEFAULT_UNPRIVILEGED_USER\")][0].id")
|
|
|
|
# Check unpriv can read and cancel their own session
|
|
run login $DEFAULT_UNPRIVILEGED_LOGIN
|
|
[ "$status" -eq 0 ]
|
|
run read_session $id
|
|
[ "$status" -eq 0 ]
|
|
run cancel_session $id
|
|
[ "$status" -eq 0 ]
|
|
|
|
# Check that admin can too
|
|
run login $DEFAULT_LOGIN
|
|
[ "$status" -eq 0 ]
|
|
run read_session $id
|
|
[ "$status" -eq 0 ]
|
|
run cancel_session $id
|
|
[ "$status" -eq 0 ]
|
|
}
|