midas/ssh-jumphost
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

connectiopn fix round 2 1

Browse Source
This commit is contained in:
Midas Wollinger
2026-08-21 14:18:27 +02:00
parent ad728ba96c
commit 6b2c5ac8a2
11 changed files with 544 additions and 135 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
tests/test_phase13.py
View File

@ -106,13 +106,23 @@ async def test_rdp_credentials_delete(client):
hg_id, host_id = await _setup_hostgroup_and_host(conn, group_name="rd-group", hostname="rd-host", protocol="rdp")
await _login_full(client, "rd_admin", "Correct-Horse-Battery-Staple-R1")
resp = await client.put(f"/admin/hosts/{host_id}/rdp-credentials",
json={"username": "Administrator", "password": "s3hr-geheim!!"})
# Migration 0012: das Zugangsdaten-Objekt wird eigenstaendig angelegt und
# dann dem Host zugewiesen (POST .../rdp-credentials/{credential_id}),
# statt direkt am Host mit Passwort erzeugt zu werden.
resp = await client.post(
"/admin/rdp-credentials",
json={"label": "rd-cred", "username": "Administrator", "password": "s3hr-geheim!!", "tenant_id": 1},
)
assert resp.status_code == 201, resp.text
credential_id = resp.json()["id"]
resp = await client.post(f"/admin/hosts/{host_id}/rdp-credentials/{credential_id}", json={})
assert resp.status_code == 200, resp.text
resp = await client.get(f"/admin/hosts/{host_id}/credentials")
assert resp.json()["rdp_credentials_set"] is True
# Loeschen HIER entfernt nur die Zuordnung zum Host -- das Objekt selbst
# bleibt bestehen (siehe unassign_rdp_credential_from_host).
resp = await client.delete(f"/admin/hosts/{host_id}/rdp-credentials")
assert resp.status_code == 200, resp.text

27
tests/test_phase9.py
View File

@ -211,7 +211,17 @@ async def test_credentials_manage_role_grants_non_admin_write_access(client):
)
assert resp.status_code == 200, resp.text
# Rolleninhaber (kein Admin!) darf Zugangsdaten lesen UND setzen.
# Migration 0012: das Zugangsdaten-OBJEKT selbst legt weiterhin nur ein
# Admin an (analog SSH-Keys, require_admin_or_scope("rdp_credentials",
# "write")) -- der Rolleninhaber darf es aber einem Host ZUWEISEN.
resp = await client.post(
"/admin/rdp-credentials",
json={"label": "cr-test-cred", "username": "Administrator", "password": "s3hr-geheim!!", "tenant_id": 1},
)
assert resp.status_code == 201, resp.text
credential_id = resp.json()["id"]
# Rolleninhaber (kein Admin!) darf Zugangsdaten lesen UND zuweisen.
client.cookies.clear()
await _login_full(client, "cr_holder", "Correct-Horse-Battery-Staple-C2")
@ -219,12 +229,7 @@ async def test_credentials_manage_role_grants_non_admin_write_access(client):
assert resp.status_code == 200, resp.text
assert resp.json()["rdp_credentials_set"] is False
# Benutzername gehoert seit Migration 0010 zu den Zugangsdaten und ist
# beim Setzen Pflicht (siehe tests/test_phase12.py).
resp = await client.put(
f"/admin/hosts/{host_id}/rdp-credentials",
json={"password": "s3hr-geheim!!", "username": "Administrator"},
)
resp = await client.post(f"/admin/hosts/{host_id}/rdp-credentials/{credential_id}", json={})
assert resp.status_code == 200, resp.text
resp = await client.get(f"/admin/hosts/{host_id}/credentials")
@ -237,7 +242,7 @@ async def test_credentials_manage_role_grants_non_admin_write_access(client):
await _login_full(client, "cr_other", "Correct-Horse-Battery-Staple-C3")
resp = await client.get(f"/admin/hosts/{host_id}/credentials")
assert resp.status_code == 403, resp.text
resp = await client.put(f"/admin/hosts/{host_id}/rdp-credentials", json={"password": "andere-1234"})
resp = await client.post(f"/admin/hosts/{host_id}/rdp-credentials/{credential_id}", json={})
assert resp.status_code == 403, resp.text
@ -263,8 +268,10 @@ async def test_credentials_view_role_is_read_only(client):
resp = await client.get(f"/admin/hosts/{host_id}/credentials")
assert resp.status_code == 200, resp.text
# 'credentials_view' allein darf NICHT schreiben.
resp = await client.put(f"/admin/hosts/{host_id}/rdp-credentials", json={"password": "nope-12345"})
# 'credentials_view' allein darf NICHT schreiben (weder zuweisen noch entfernen).
resp = await client.post(f"/admin/hosts/{host_id}/rdp-credentials/1", json={})
assert resp.status_code == 403, resp.text
resp = await client.delete(f"/admin/hosts/{host_id}/rdp-credentials")
assert resp.status_code == 403, resp.text

17
tests/test_tenants.py
View File

@ -605,10 +605,16 @@ async def test_host_detail_endpoint_includes_ssh_keys_and_rdp_flag(client):
resp = await client.post(f"/admin/hosts/{host_id}/ssh-keys/{key_id}")
assert resp.status_code == 200, resp.text
resp = await client.put(
f"/admin/hosts/{host_id}/rdp-credentials",
json={"password": "Correct-Horse-Battery-Staple-O2", "username": "Administrator"},
# Migration 0012: RDP-Zugangsdaten sind ein eigenstaendiges Objekt, das
# separat angelegt und dann dem Host zugewiesen wird (wie ein SSH-Key).
resp = await client.post(
"/admin/rdp-credentials",
json={"label": "detail-cred", "username": "Administrator",
"password": "Correct-Horse-Battery-Staple-O2", "tenant_id": 1},
)
assert resp.status_code == 201, resp.text
credential_id = resp.json()["id"]
resp = await client.post(f"/admin/hosts/{host_id}/rdp-credentials/{credential_id}", json={})
assert resp.status_code == 200, resp.text
resp = await client.get(f"/admin/hosts/{host_id}")
@ -617,11 +623,12 @@ async def test_host_detail_endpoint_includes_ssh_keys_and_rdp_flag(client):
assert data["hostname"] == "win-srv"
assert any(k["id"] == key_id for k in data["ssh_keys"])
assert data["rdp_credentials_set"] is True
assert data["rdp_credentials_id"] == credential_id
resp = await client.get("/admin/rdp-credentials")
assert resp.status_code == 200, resp.text
row = next(r for r in resp.json() if r["host_id"] == host_id)
assert row["credentials_set"] is True
row = next(r for r in resp.json() if r["id"] == credential_id)
assert any(h["id"] == host_id for h in row["assigned_hosts"])
resp = await client.get("/admin/hosts/424242")
assert resp.status_code == 404