Jim
769416c2ff
* refactor (controller): Use a grpc server for the grpc-gateway This starts a grpc server for the grpc-gateway. The new gateway server uses an in-memory listener which also supports "dialing", so the http proxy can connect to the in-memory listener. This change allows us to use all grpc server features and was in part motivated by a need for an interceptor of inbound requests. With that said, having a "proper" grpc server for the gateway will provide a lot more flexibility and capabilities moving forward. The request context will still be verified via middleware in the http proxy (see wrapHandlerWithCommonFuncs). This verified context will be serialized into a protobuf and sent along to the grpc-gateway via metadata where an interceptor will add the verified request info to the request's context (see requestCtxInterceptor). The interceptor will verify the serialized request info via a shared ticket with it's companion in-memory http proxy. FYI: the ticket is simply random base62 string (see db.NewPrivateId). This change also necessitated a minor change to services. We need to return an empty response instead of nil, nil when there are no errors and the response is empty. * refactor (handlers): Rename gRPC Gateway filter Originally, this was called an OutgoingInterceptor, which is an unfortunate name since it's not an interceptor. Now that we're refactoring the gateway stuff and have proper interceptors, renaming this should remove ambiguity * refactor: Rework how 204 with empty msg is handled Recent changes to grpc gateway has necessitated a change to how 204s are handled by the gateway * tests (bats): Check status codes for delete operations
316 lines
9.2 KiB
Go
316 lines
9.2 KiB
Go
package scopeids_test
|
|
|
|
import (
|
|
"context"
|
|
"testing"
|
|
|
|
"github.com/hashicorp/boundary/internal/authtoken"
|
|
"github.com/hashicorp/boundary/internal/db"
|
|
pbs "github.com/hashicorp/boundary/internal/gen/controller/api/services"
|
|
authpb "github.com/hashicorp/boundary/internal/gen/controller/auth"
|
|
"github.com/hashicorp/boundary/internal/iam"
|
|
"github.com/hashicorp/boundary/internal/kms"
|
|
"github.com/hashicorp/boundary/internal/servers"
|
|
"github.com/hashicorp/boundary/internal/servers/controller/auth"
|
|
"github.com/hashicorp/boundary/internal/servers/controller/handlers"
|
|
"github.com/hashicorp/boundary/internal/servers/controller/handlers/groups"
|
|
"github.com/hashicorp/boundary/internal/servers/controller/handlers/sessions"
|
|
"github.com/hashicorp/boundary/internal/session"
|
|
"github.com/hashicorp/boundary/internal/types/scope"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
// This test validates that we can perform recursive listing when there are no
|
|
// permissions on the parent scope against which the query is being run, but
|
|
// there are on child scopes. We use groups because groups are (one type of
|
|
// resource) valid in projects and we want to validate that the initial bugged
|
|
// behavior that used role permissions instead of the resource type under test
|
|
// is fixed.
|
|
func TestListingScopeIds(t *testing.T) {
|
|
conn, _ := db.TestSetup(t, "postgres")
|
|
rw := db.New(conn)
|
|
wrap := db.TestWrapper(t)
|
|
kms := kms.TestKms(t, conn, wrap)
|
|
iamRepo := iam.TestRepo(t, conn, wrap)
|
|
iamRepoFn := func() (*iam.Repository, error) {
|
|
return iamRepo, nil
|
|
}
|
|
authTokenRepoFn := func() (*authtoken.Repository, error) {
|
|
return authtoken.NewRepository(rw, rw, kms)
|
|
}
|
|
serversRepoFn := func() (*servers.Repository, error) {
|
|
return servers.NewRepository(rw, rw, kms)
|
|
}
|
|
s, err := groups.NewService(iamRepoFn)
|
|
require.NoError(t, err)
|
|
|
|
sessionsRepoFn := func() (*session.Repository, error) {
|
|
return session.NewRepository(rw, rw, kms)
|
|
}
|
|
sess, err := sessions.NewService(sessionsRepoFn, iamRepoFn)
|
|
require.NoError(t, err)
|
|
|
|
tcs := []struct {
|
|
name string
|
|
globalGrants []string
|
|
orgGrants []string
|
|
projGrants []string
|
|
globalGroups int
|
|
orgGroups int
|
|
projGroups int
|
|
users []string
|
|
wantErr error
|
|
expCount int
|
|
recurseFrom string
|
|
}{
|
|
{
|
|
name: "no perms, start at global",
|
|
recurseFrom: "global",
|
|
wantErr: handlers.ForbiddenError(),
|
|
},
|
|
{
|
|
name: "no perms, start at org",
|
|
recurseFrom: "org",
|
|
wantErr: handlers.ForbiddenError(),
|
|
},
|
|
{
|
|
name: "no perms, start at project",
|
|
recurseFrom: "project",
|
|
wantErr: handlers.ForbiddenError(),
|
|
},
|
|
{
|
|
name: "perms on global, no groups",
|
|
globalGrants: []string{"id=*;type=group;actions=list,no-op"},
|
|
projGrants: []string{"id=*;type=group;actions=read"},
|
|
recurseFrom: "global",
|
|
},
|
|
{
|
|
name: "perms on org, no groups",
|
|
orgGrants: []string{"id=*;type=group;actions=list,no-op"},
|
|
projGrants: []string{"id=*;type=group;actions=read"},
|
|
recurseFrom: "org",
|
|
},
|
|
{
|
|
name: "perms on project, no groups",
|
|
projGrants: []string{"id=*;type=group;actions=list,no-op"},
|
|
recurseFrom: "project",
|
|
},
|
|
{
|
|
name: "perms on global, none in org",
|
|
globalGrants: []string{"id=*;type=group;actions=list,no-op"},
|
|
projGrants: []string{"id=*;type=group;actions=read"},
|
|
globalGroups: 1,
|
|
orgGroups: 3,
|
|
projGroups: 5,
|
|
expCount: 6,
|
|
recurseFrom: "global",
|
|
},
|
|
{
|
|
name: "perms on global, none in org, start at org",
|
|
globalGrants: []string{"id=*;type=group;actions=list,no-op"},
|
|
projGrants: []string{"id=*;type=group;actions=read"},
|
|
globalGroups: 1,
|
|
orgGroups: 3,
|
|
projGroups: 5,
|
|
expCount: 5,
|
|
recurseFrom: "org",
|
|
},
|
|
{
|
|
name: "perms on global, with org",
|
|
globalGrants: []string{"id=*;type=group;actions=list,no-op"},
|
|
orgGrants: []string{"id=*;type=group;actions=read"},
|
|
projGrants: []string{"id=*;type=group;actions=read"},
|
|
globalGroups: 1,
|
|
orgGroups: 3,
|
|
projGroups: 5,
|
|
expCount: 9,
|
|
recurseFrom: "global",
|
|
},
|
|
{
|
|
name: "perms on global, with org, start at org",
|
|
globalGrants: []string{"id=*;type=group;actions=list,no-op"},
|
|
orgGrants: []string{"id=*;type=group;actions=read"},
|
|
projGrants: []string{"id=*;type=group;actions=read"},
|
|
globalGroups: 1,
|
|
orgGroups: 3,
|
|
projGroups: 5,
|
|
expCount: 8,
|
|
recurseFrom: "org",
|
|
},
|
|
{
|
|
name: "perms on global, start at project",
|
|
globalGrants: []string{"id=*;type=group;actions=list,no-op"},
|
|
orgGrants: []string{"id=*;type=group;actions=read"},
|
|
projGrants: []string{"id=*;type=group;actions=read"},
|
|
globalGroups: 1,
|
|
orgGroups: 3,
|
|
projGroups: 5,
|
|
expCount: 5,
|
|
recurseFrom: "project",
|
|
},
|
|
{
|
|
name: "perms on org, start at global, no read on org",
|
|
orgGrants: []string{"id=*;type=group;actions=list"},
|
|
projGrants: []string{"id=*;type=group;actions=read"},
|
|
globalGroups: 1,
|
|
orgGroups: 3,
|
|
projGroups: 5,
|
|
expCount: 5,
|
|
recurseFrom: "global",
|
|
},
|
|
{
|
|
name: "perms on org, start at global, read on org",
|
|
orgGrants: []string{"id=*;type=group;actions=list,no-op"},
|
|
projGrants: []string{"id=*;type=group;actions=read"},
|
|
globalGroups: 1,
|
|
orgGroups: 3,
|
|
projGroups: 5,
|
|
expCount: 8,
|
|
recurseFrom: "global",
|
|
},
|
|
{
|
|
name: "perms on org, start at org",
|
|
orgGrants: []string{"id=*;type=group;actions=list,no-op"},
|
|
projGrants: []string{"id=*;type=group;actions=read"},
|
|
globalGroups: 1,
|
|
orgGroups: 3,
|
|
projGroups: 5,
|
|
expCount: 8,
|
|
recurseFrom: "org",
|
|
},
|
|
{
|
|
name: "perms on org, start at project",
|
|
orgGrants: []string{"id=*;type=group;actions=list,no-op"},
|
|
projGrants: []string{"id=*;type=group;actions=read"},
|
|
globalGroups: 1,
|
|
orgGroups: 3,
|
|
projGroups: 5,
|
|
expCount: 5,
|
|
recurseFrom: "project",
|
|
},
|
|
{
|
|
name: "perms on proj",
|
|
projGrants: []string{"id=*;type=group;actions=list,no-op"},
|
|
globalGroups: 1,
|
|
orgGroups: 3,
|
|
projGroups: 5,
|
|
expCount: 5,
|
|
recurseFrom: "project",
|
|
},
|
|
{
|
|
name: "perms on proj, start at org",
|
|
projGrants: []string{"id=*;type=group;actions=list,no-op"},
|
|
globalGroups: 1,
|
|
orgGroups: 3,
|
|
projGroups: 5,
|
|
expCount: 5,
|
|
recurseFrom: "org",
|
|
},
|
|
{
|
|
name: "perms on proj, start at global",
|
|
projGrants: []string{"id=*;type=group;actions=list,no-op"},
|
|
globalGroups: 1,
|
|
orgGroups: 3,
|
|
projGroups: 5,
|
|
expCount: 5,
|
|
recurseFrom: "global",
|
|
},
|
|
}
|
|
// Each test starts with a new set of scopes and new users/roles, which
|
|
// ensures we don't clash and doesn't require us to deal with cleanup. Plus
|
|
// it means subsequent tests are ensuring that only the scopes that the
|
|
// current user should see are seen.
|
|
for _, tc := range tcs {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
require := require.New(t)
|
|
o, p := iam.TestScopes(t, iamRepo)
|
|
at := authtoken.TestAuthToken(t, conn, kms, o.GetPublicId())
|
|
ctx := auth.NewVerifierContext(context.Background(),
|
|
iamRepoFn,
|
|
authTokenRepoFn,
|
|
serversRepoFn,
|
|
kms,
|
|
&authpb.RequestInfo{
|
|
Token: at.GetToken(),
|
|
TokenFormat: uint32(auth.AuthTokenTypeBearer),
|
|
PublicId: at.GetPublicId(),
|
|
})
|
|
|
|
// Clean up scopes between tests
|
|
defer func() {
|
|
_, err := iamRepo.DeleteScope(ctx, o.GetPublicId())
|
|
require.NoError(err)
|
|
}()
|
|
|
|
for i := 0; i < tc.globalGroups; i++ {
|
|
g := iam.TestGroup(t, conn, scope.Global.String())
|
|
defer func() {
|
|
_, err := iamRepo.DeleteGroup(ctx, g.GetPublicId())
|
|
require.NoError(err)
|
|
}()
|
|
}
|
|
for i := 0; i < tc.orgGroups; i++ {
|
|
iam.TestGroup(t, conn, o.GetPublicId())
|
|
}
|
|
for i := 0; i < tc.projGroups; i++ {
|
|
iam.TestGroup(t, conn, p.GetPublicId())
|
|
}
|
|
|
|
for i, grants := range [][]string{tc.globalGrants, tc.orgGrants, tc.projGrants} {
|
|
if len(grants) > 0 {
|
|
pubId := scope.Global.String()
|
|
switch i {
|
|
case 1:
|
|
pubId = o.GetPublicId()
|
|
case 2:
|
|
pubId = p.GetPublicId()
|
|
}
|
|
role := iam.TestRole(t, conn, pubId)
|
|
// Clean up global between tests
|
|
if pubId == scope.Global.String() {
|
|
defer func() {
|
|
_, err := iamRepo.DeleteRole(ctx, role.GetPublicId())
|
|
require.NoError(err)
|
|
}()
|
|
}
|
|
for _, grant := range grants {
|
|
iam.TestRoleGrant(t, conn, role.GetPublicId(), grant)
|
|
}
|
|
iam.TestUserRole(t, conn, role.GetPublicId(), at.GetIamUserId())
|
|
}
|
|
}
|
|
var startScope string
|
|
switch tc.recurseFrom {
|
|
case "global":
|
|
startScope = scope.Global.String()
|
|
case "org":
|
|
startScope = o.GetPublicId()
|
|
case "project":
|
|
startScope = p.GetPublicId()
|
|
default:
|
|
t.Fatal("unknown start scope")
|
|
}
|
|
out, err := s.ListGroups(ctx, &pbs.ListGroupsRequest{
|
|
Recursive: true,
|
|
ScopeId: startScope,
|
|
})
|
|
if tc.wantErr != nil {
|
|
require.Error(err)
|
|
require.Nil(out)
|
|
require.Equal(tc.wantErr.Error(), err.Error())
|
|
} else {
|
|
require.NoError(err)
|
|
require.NotNil(out)
|
|
require.Len(out.Items, tc.expCount)
|
|
}
|
|
|
|
sessOut, err := sess.ListSessions(ctx, &pbs.ListSessionsRequest{
|
|
Recursive: true,
|
|
ScopeId: startScope,
|
|
})
|
|
require.NoError(err)
|
|
require.NotNil(sessOut)
|
|
})
|
|
}
|
|
}
|