Michael Li
16e90ddd35
The sessions.bats tests were seeing some flaky behavior when listing sessions but not getting the expected amount back. This is due to the connect_nc command that is currently used, which will immediately set the session to be "canceled" once it returns. This can cause subsequent operations to get unexpected results (sometimes, listing sessions would return an empty list if the created sessions go to a "terminated" state).
116 lines
3.0 KiB
Bash
116 lines
3.0 KiB
Bash
#!/usr/bin/env bats
|
|
|
|
load _auth
|
|
load _connect
|
|
load _sessions
|
|
load _helpers
|
|
|
|
@test "boundary/session: admin user can connect to default target" {
|
|
run login $DEFAULT_LOGIN
|
|
echo "$output"
|
|
[ "$status" -eq 0 ]
|
|
|
|
run connect_nc $DEFAULT_TARGET
|
|
echo "$output"
|
|
[ "$status" -eq 0 ]
|
|
|
|
# Run twice so we have two values for later testing
|
|
run connect_nc $DEFAULT_TARGET
|
|
echo "$output"
|
|
[ "$status" -eq 0 ]
|
|
}
|
|
|
|
@test "boundary/session/connect: unpriv user can connect to default target" {
|
|
run login $DEFAULT_UNPRIVILEGED_LOGIN
|
|
echo "$output"
|
|
[ "$status" -eq 0 ]
|
|
|
|
run connect_nc $DEFAULT_TARGET
|
|
echo "$output"
|
|
[ "$status" -eq 0 ]
|
|
|
|
# Run twice so we have two values for later testing
|
|
run connect_nc $DEFAULT_TARGET
|
|
echo "$output"
|
|
[ "$status" -eq 0 ]
|
|
}
|
|
|
|
# Note: there seems to be an issue with jq's length calculation -- an increase
|
|
# in the returned array by 2 shows up as a 4 or more increase in jq's length count.
|
|
# So for now, verify they're not the same.
|
|
@test "boundary/session: verify admin and unpriv user see different counts" {
|
|
run login $DEFAULT_UNPRIVILEGED_LOGIN
|
|
echo "$output"
|
|
[ "$status" -eq 0 ]
|
|
|
|
run count_sessions_include_terminated $DEFAULT_P_ID
|
|
echo "Number of sessions (unpriv): $output"
|
|
[ "$status" -eq 0 ]
|
|
unpriv_sessions="$output"
|
|
|
|
run login $DEFAULT_LOGIN
|
|
[ "$status" -eq 0 ]
|
|
run count_sessions_include_terminated $DEFAULT_P_ID
|
|
echo "Number of sessions (admin): $output"
|
|
[ "$status" -eq 0 ]
|
|
admin_sessions="$output"
|
|
|
|
[ "$unpriv_sessions" -lt "$admin_sessions" ]
|
|
}
|
|
|
|
@test "boundary/session: verify read and cancellation permissions on admin session" {
|
|
# Find an admin session
|
|
run login $DEFAULT_LOGIN
|
|
echo "$output"
|
|
[ "$status" -eq 0 ]
|
|
run list_sessions_include_terminated $DEFAULT_P_ID
|
|
echo "$output"
|
|
[ "$status" -eq 0 ]
|
|
id=$(echo "$output" | jq -r "[.items[]|select(.user_id == \"$DEFAULT_USER\")][0].id")
|
|
|
|
# Check unpriv cannot read or cancel an admin's session
|
|
run login $DEFAULT_UNPRIVILEGED_LOGIN
|
|
[ "$status" -eq 0 ]
|
|
run read_session $id
|
|
[ "$status" -eq 1 ]
|
|
run cancel_session $id
|
|
[ "$status" -eq 1 ]
|
|
|
|
# Check that admin _can_
|
|
run login $DEFAULT_LOGIN
|
|
[ "$status" -eq 0 ]
|
|
run read_session $id
|
|
echo "$output"
|
|
[ "$status" -eq 0 ]
|
|
echo "$output"
|
|
run cancel_session $id
|
|
[ "$status" -eq 0 ]
|
|
echo "$output"
|
|
}
|
|
|
|
@test "boundary/session: verify read and cancellation permissions on unpriv session" {
|
|
# Find an unpriv session
|
|
run login $DEFAULT_UNPRIVILEGED_LOGIN
|
|
[ "$status" -eq 0 ]
|
|
run list_sessions_include_terminated $DEFAULT_P_ID
|
|
echo "$output"
|
|
[ "$status" -eq 0 ]
|
|
id=$(echo "$output" | jq -r "[.items[]|select(.user_id == \"$DEFAULT_UNPRIVILEGED_USER\")][0].id")
|
|
|
|
# Check unpriv can read and cancel their own session
|
|
run login $DEFAULT_UNPRIVILEGED_LOGIN
|
|
[ "$status" -eq 0 ]
|
|
run read_session $id
|
|
[ "$status" -eq 0 ]
|
|
run cancel_session $id
|
|
[ "$status" -eq 0 ]
|
|
|
|
# Check that admin can too
|
|
run login $DEFAULT_LOGIN
|
|
[ "$status" -eq 0 ]
|
|
run read_session $id
|
|
[ "$status" -eq 0 ]
|
|
run cancel_session $id
|
|
[ "$status" -eq 0 ]
|
|
}
|