midas/ssh-jumphost
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

connectiopn fix round 2 1

Browse Source
This commit is contained in:
Midas Wollinger
2026-08-21 14:18:27 +02:00
parent ad728ba96c
commit 6b2c5ac8a2
11 changed files with 544 additions and 135 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
tests/test_phase9.py
View File

@ -211,7 +211,17 @@ async def test_credentials_manage_role_grants_non_admin_write_access(client):
)
assert resp.status_code == 200, resp.text
# Rolleninhaber (kein Admin!) darf Zugangsdaten lesen UND setzen.
# Migration 0012: das Zugangsdaten-OBJEKT selbst legt weiterhin nur ein
# Admin an (analog SSH-Keys, require_admin_or_scope("rdp_credentials",
# "write")) -- der Rolleninhaber darf es aber einem Host ZUWEISEN.
resp = await client.post(
"/admin/rdp-credentials",
json={"label": "cr-test-cred", "username": "Administrator", "password": "s3hr-geheim!!", "tenant_id": 1},
)
assert resp.status_code == 201, resp.text
credential_id = resp.json()["id"]
# Rolleninhaber (kein Admin!) darf Zugangsdaten lesen UND zuweisen.
client.cookies.clear()
await _login_full(client, "cr_holder", "Correct-Horse-Battery-Staple-C2")
@ -219,12 +229,7 @@ async def test_credentials_manage_role_grants_non_admin_write_access(client):
assert resp.status_code == 200, resp.text
assert resp.json()["rdp_credentials_set"] is False
# Benutzername gehoert seit Migration 0010 zu den Zugangsdaten und ist
# beim Setzen Pflicht (siehe tests/test_phase12.py).
resp = await client.put(
f"/admin/hosts/{host_id}/rdp-credentials",
json={"password": "s3hr-geheim!!", "username": "Administrator"},
)
resp = await client.post(f"/admin/hosts/{host_id}/rdp-credentials/{credential_id}", json={})
assert resp.status_code == 200, resp.text
resp = await client.get(f"/admin/hosts/{host_id}/credentials")
@ -237,7 +242,7 @@ async def test_credentials_manage_role_grants_non_admin_write_access(client):
await _login_full(client, "cr_other", "Correct-Horse-Battery-Staple-C3")
resp = await client.get(f"/admin/hosts/{host_id}/credentials")
assert resp.status_code == 403, resp.text
resp = await client.put(f"/admin/hosts/{host_id}/rdp-credentials", json={"password": "andere-1234"})
resp = await client.post(f"/admin/hosts/{host_id}/rdp-credentials/{credential_id}", json={})
assert resp.status_code == 403, resp.text
@ -263,8 +268,10 @@ async def test_credentials_view_role_is_read_only(client):
resp = await client.get(f"/admin/hosts/{host_id}/credentials")
assert resp.status_code == 200, resp.text
# 'credentials_view' allein darf NICHT schreiben.
resp = await client.put(f"/admin/hosts/{host_id}/rdp-credentials", json={"password": "nope-12345"})
# 'credentials_view' allein darf NICHT schreiben (weder zuweisen noch entfernen).
resp = await client.post(f"/admin/hosts/{host_id}/rdp-credentials/1", json={})
assert resp.status_code == 403, resp.text
resp = await client.delete(f"/admin/hosts/{host_id}/rdp-credentials")
assert resp.status_code == 403, resp.text