345 lines
14 KiB
Python
345 lines
14 KiB
Python
"""
|
|
Tests fuer die Erweiterung des RBAC-Modells um Benutzergruppen (Teams) mit
|
|
voller Rollen-Vererbung ("Verbindungen mit einer Gruppe teilen", siehe
|
|
app/rbac.py, app/db/migrations/0004_user_groups.sql) sowie fuer API-Tokens
|
|
mit granularem ro/rw-Scope je Ressource (app/security/api_tokens.py,
|
|
app/db/migrations/0005_api_tokens.sql).
|
|
|
|
Deckt ab:
|
|
1) Gruppenmitgliedschaft gewaehrt/entzieht Katalog-Zugriff ohne
|
|
individuellen Grant.
|
|
2) Nur Admins duerfen Gruppen/Rollen/Tokens verwalten.
|
|
3) Token-Scope wird durchgesetzt (read/write je Ressource, write impliziert
|
|
read), abgelaufene/widerrufene Tokens werden abgelehnt.
|
|
4) Tokens koennen sich NICHT selbst weitere Tokens ausstellen
|
|
(Privilege-Escalation-Schutz) -- Token-Verwaltung bleibt reine
|
|
Session-Admin-Aktion.
|
|
5) /docs und /openapi.json sind admin-only (kein oeffentliches Swagger-UI).
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
import pyotp
|
|
import pytest
|
|
|
|
|
|
async def _create_user(conn, username: str, password: str, *, is_admin: bool = False) -> int:
|
|
from app.security.passwords import hash_password
|
|
|
|
cursor = await conn.execute(
|
|
"INSERT INTO users (username, password_hash, is_admin, must_change_password) "
|
|
"VALUES (?, ?, ?, 0)",
|
|
(username, hash_password(password), int(is_admin)),
|
|
)
|
|
await conn.commit()
|
|
return cursor.lastrowid
|
|
|
|
|
|
async def _login_full(client, username: str, password: str) -> str:
|
|
resp = await client.post("/auth/login", json={"username": username, "password": password})
|
|
assert resp.status_code == 200, resp.text
|
|
pending = resp.json()["pending_token"]
|
|
resp = await client.post("/auth/totp/enroll/start", json={"pending_token": pending})
|
|
assert resp.status_code == 200, resp.text
|
|
provisioning_uri = resp.json()["provisioning_uri"]
|
|
secret = dict(part.split("=") for part in provisioning_uri.split("?", 1)[1].split("&"))["secret"]
|
|
code = pyotp.TOTP(secret).now()
|
|
resp = await client.post("/auth/totp/enroll/confirm", json={"pending_token": pending, "code": code})
|
|
assert resp.status_code == 200, resp.text
|
|
return resp.cookies.get("jh_session")
|
|
|
|
|
|
async def _setup_hostgroup_and_host(conn, *, group_name="team-a", hostname="srv-a"):
|
|
cursor = await conn.execute("INSERT INTO host_groups (name) VALUES (?)", (group_name,))
|
|
hg_id = cursor.lastrowid
|
|
cursor = await conn.execute(
|
|
"INSERT INTO hosts (host_group_id, hostname, address, protocol, port, os_type) "
|
|
"VALUES (?, ?, '10.0.0.9', 'ssh', 22, 'linux')",
|
|
(hg_id, hostname),
|
|
)
|
|
await conn.commit()
|
|
return hg_id, cursor.lastrowid
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# 1) Benutzergruppen: volle Rollen-Vererbung
|
|
# ---------------------------------------------------------------------------
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_group_role_grant_gives_catalog_access_without_individual_grant(client):
|
|
from app.db import get_db
|
|
|
|
conn = get_db()
|
|
admin_id = await _create_user(conn, "grp_admin", "Correct-Horse-Battery-Staple-G1", is_admin=True)
|
|
member_id = await _create_user(conn, "grp_member", "Correct-Horse-Battery-Staple-G2")
|
|
hg_id, host_id = await _setup_hostgroup_and_host(conn)
|
|
|
|
await _login_full(client, "grp_admin", "Correct-Horse-Battery-Staple-G1")
|
|
|
|
resp = await client.post("/admin/user-groups", json={"name": "netzwerk-team", "description": None})
|
|
assert resp.status_code == 201, resp.text
|
|
group_id = resp.json()["id"]
|
|
|
|
resp = await client.post(f"/admin/user-groups/{group_id}/members", json={"user_id": member_id})
|
|
assert resp.status_code == 201, resp.text
|
|
|
|
resp = await client.post(
|
|
"/admin/group-roles/grant",
|
|
json={"user_group_id": group_id, "host_group_id": hg_id, "role_name": "ssh_connect"},
|
|
)
|
|
assert resp.status_code == 200, resp.text
|
|
|
|
# Als Gruppenmitglied einloggen: KEIN individueller user_hostgroup_roles-Eintrag existiert.
|
|
client.cookies.clear()
|
|
await _login_full(client, "grp_member", "Correct-Horse-Battery-Staple-G2")
|
|
|
|
resp = await client.get("/catalog/hosts")
|
|
assert resp.status_code == 200, resp.text
|
|
hosts = resp.json()
|
|
assert any(h["id"] == host_id for h in hosts), "Gruppenmitglied sollte den geteilten Host sehen"
|
|
assert next(h for h in hosts if h["id"] == host_id)["can_connect"] is True
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_removing_group_member_revokes_inherited_catalog_access(client):
|
|
from app.db import get_db
|
|
|
|
conn = get_db()
|
|
await _create_user(conn, "grp_admin2", "Correct-Horse-Battery-Staple-G3", is_admin=True)
|
|
member_id = await _create_user(conn, "grp_member2", "Correct-Horse-Battery-Staple-G4")
|
|
hg_id, host_id = await _setup_hostgroup_and_host(conn, group_name="team-b", hostname="srv-b")
|
|
|
|
await _login_full(client, "grp_admin2", "Correct-Horse-Battery-Staple-G3")
|
|
resp = await client.post("/admin/user-groups", json={"name": "devops-team", "description": None})
|
|
group_id = resp.json()["id"]
|
|
await client.post(f"/admin/user-groups/{group_id}/members", json={"user_id": member_id})
|
|
await client.post(
|
|
"/admin/group-roles/grant",
|
|
json={"user_group_id": group_id, "host_group_id": hg_id, "role_name": "ssh_connect"},
|
|
)
|
|
|
|
# Mitgliedschaft wieder entfernen, BEVOR sich der User einloggt.
|
|
resp = await client.delete(f"/admin/user-groups/{group_id}/members/{member_id}")
|
|
assert resp.status_code == 200, resp.text
|
|
|
|
client.cookies.clear()
|
|
await _login_full(client, "grp_member2", "Correct-Horse-Battery-Staple-G4")
|
|
resp = await client.get("/catalog/hosts")
|
|
assert resp.status_code == 200, resp.text
|
|
assert all(h["id"] != host_id for h in resp.json()), "Entferntes Mitglied darf Host nicht mehr sehen"
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_non_admin_cannot_manage_user_groups_or_group_roles(client):
|
|
from app.db import get_db
|
|
|
|
conn = get_db()
|
|
await _create_user(conn, "plain_user", "Correct-Horse-Battery-Staple-P1", is_admin=False)
|
|
await _login_full(client, "plain_user", "Correct-Horse-Battery-Staple-P1")
|
|
|
|
resp = await client.post("/admin/user-groups", json={"name": "sollte-nicht-klappen"})
|
|
assert resp.status_code == 403
|
|
resp = await client.get("/admin/user-groups")
|
|
assert resp.status_code == 403
|
|
resp = await client.post(
|
|
"/admin/group-roles/grant",
|
|
json={"user_group_id": 1, "host_group_id": 1, "role_name": "ssh_connect"},
|
|
)
|
|
assert resp.status_code == 403
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# 2) API-Tokens: Scope-Durchsetzung
|
|
# ---------------------------------------------------------------------------
|
|
|
|
async def _create_admin_and_token(client, conn, *, scopes, username="tok_admin", pw="Correct-Horse-Battery-Staple-T1", expires_at=None):
|
|
admin_id = await _create_user(conn, username, pw, is_admin=True)
|
|
await _login_full(client, username, pw)
|
|
resp = await client.post(
|
|
"/admin/tokens",
|
|
json={"label": "ci-token", "user_id": admin_id, "scopes": scopes, "expires_at": expires_at},
|
|
)
|
|
assert resp.status_code == 201, resp.text
|
|
return resp.json()["token"], resp.json()["id"], admin_id
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_token_with_read_scope_allows_get_but_not_write(client):
|
|
from app.db import get_db
|
|
|
|
conn = get_db()
|
|
token, _token_id, _admin_id = await _create_admin_and_token(client, conn, scopes=["hosts:read"])
|
|
|
|
resp = await client.get("/admin/hosts", headers={"Authorization": f"Bearer {token}"})
|
|
assert resp.status_code == 200, resp.text
|
|
|
|
resp = await client.post(
|
|
"/admin/host-groups",
|
|
json={"name": "sollte-nicht-klappen"},
|
|
headers={"Authorization": f"Bearer {token}"},
|
|
)
|
|
# host_groups:write ist nicht im Scope enthalten -> abgelehnt.
|
|
assert resp.status_code == 401, resp.text
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_token_with_write_scope_implies_read(client):
|
|
from app.db import get_db
|
|
|
|
conn = get_db()
|
|
token, _token_id, _admin_id = await _create_admin_and_token(
|
|
client, conn, scopes=["host_groups:write"], username="tok_admin2", pw="Correct-Horse-Battery-Staple-T2"
|
|
)
|
|
|
|
resp = await client.get("/admin/host-groups", headers={"Authorization": f"Bearer {token}"})
|
|
assert resp.status_code == 200, resp.text
|
|
|
|
resp = await client.post(
|
|
"/admin/host-groups", json={"name": "per-token-angelegt"},
|
|
headers={"Authorization": f"Bearer {token}"},
|
|
)
|
|
assert resp.status_code == 201, resp.text
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_revoked_token_rejected(client):
|
|
from app.db import get_db
|
|
|
|
conn = get_db()
|
|
token, token_id, _admin_id = await _create_admin_and_token(
|
|
client, conn, scopes=["hosts:read"], username="tok_admin3", pw="Correct-Horse-Battery-Staple-T3"
|
|
)
|
|
|
|
resp = await client.post(f"/admin/tokens/{token_id}/revoke")
|
|
assert resp.status_code == 200, resp.text
|
|
|
|
resp = await client.get("/admin/hosts", headers={"Authorization": f"Bearer {token}"})
|
|
assert resp.status_code == 401, resp.text
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_expired_token_rejected(client):
|
|
from app.db import get_db
|
|
|
|
conn = get_db()
|
|
past = "2000-01-01T00:00:00.000000Z"
|
|
token, _token_id, _admin_id = await _create_admin_and_token(
|
|
client, conn, scopes=["hosts:read"], username="tok_admin4",
|
|
pw="Correct-Horse-Battery-Staple-T4", expires_at=past,
|
|
)
|
|
|
|
resp = await client.get("/admin/hosts", headers={"Authorization": f"Bearer {token}"})
|
|
assert resp.status_code == 401, resp.text
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_unknown_scope_rejected_on_token_creation(client):
|
|
from app.db import get_db
|
|
|
|
conn = get_db()
|
|
admin_id = await _create_user(conn, "tok_admin5", "Correct-Horse-Battery-Staple-T5", is_admin=True)
|
|
await _login_full(client, "tok_admin5", "Correct-Horse-Battery-Staple-T5")
|
|
|
|
resp = await client.post(
|
|
"/admin/tokens",
|
|
json={"label": "bad-scope", "user_id": admin_id, "scopes": ["hosts:delete-everything"]},
|
|
)
|
|
assert resp.status_code == 400, resp.text
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_token_cannot_be_used_to_create_or_list_other_tokens(client):
|
|
"""Privilege-Escalation-Schutz: /admin/tokens/* laeuft ausschliesslich
|
|
ueber require_global_admin (Session), niemals ueber require_admin_or_scope
|
|
-- ein geleaktes Token darf sich selbst keine weiteren/staerkeren Tokens
|
|
ausstellen, selbst wenn ein (in diesem Scope-Modell gar nicht existierender)
|
|
'tokens'-Scope faelschlich mitgeschickt wuerde."""
|
|
from app.db import get_db
|
|
|
|
conn = get_db()
|
|
token, _token_id, admin_id = await _create_admin_and_token(
|
|
client, conn, scopes=["users:read", "users:write", "hosts:read", "hosts:write"],
|
|
username="tok_admin6", pw="Correct-Horse-Battery-Staple-T6",
|
|
)
|
|
# Session-Cookie bewusst entfernen: es soll ausschliesslich das Token als
|
|
# Credential vorliegen (sonst wuerde die noch gueltige Admin-Session der
|
|
# Token-Erzeugung die /admin/tokens-Endpunkte -- die NUR Cookies pruefen
|
|
# -- unabhaengig vom Token-Test durchwinken und der Test taeuschend gruen sein).
|
|
client.cookies.clear()
|
|
|
|
resp = await client.get("/admin/tokens", headers={"Authorization": f"Bearer {token}"})
|
|
assert resp.status_code == 401, resp.text
|
|
|
|
resp = await client.post(
|
|
"/admin/tokens",
|
|
json={"label": "self-issued", "user_id": admin_id, "scopes": ["users:read"]},
|
|
headers={"Authorization": f"Bearer {token}"},
|
|
)
|
|
assert resp.status_code == 401, resp.text
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_non_admin_cannot_create_tokens(client):
|
|
from app.db import get_db
|
|
|
|
conn = get_db()
|
|
user_id = await _create_user(conn, "tok_plain", "Correct-Horse-Battery-Staple-T7")
|
|
await _login_full(client, "tok_plain", "Correct-Horse-Battery-Staple-T7")
|
|
|
|
resp = await client.post(
|
|
"/admin/tokens", json={"label": "x", "user_id": user_id, "scopes": ["hosts:read"]}
|
|
)
|
|
assert resp.status_code == 403
|
|
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# 3) API-Dokumentation: admin-only, kein oeffentliches Swagger-UI
|
|
# ---------------------------------------------------------------------------
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_docs_and_openapi_require_admin(client):
|
|
resp = await client.get("/docs")
|
|
assert resp.status_code == 401
|
|
resp = await client.get("/openapi.json")
|
|
assert resp.status_code == 401
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_docs_and_openapi_reject_non_admin(client):
|
|
from app.db import get_db
|
|
|
|
conn = get_db()
|
|
await _create_user(conn, "docs_plain", "Correct-Horse-Battery-Staple-D1", is_admin=False)
|
|
await _login_full(client, "docs_plain", "Correct-Horse-Battery-Staple-D1")
|
|
|
|
resp = await client.get("/docs")
|
|
assert resp.status_code == 403
|
|
resp = await client.get("/openapi.json")
|
|
assert resp.status_code == 403
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_docs_and_openapi_accessible_to_admin(client):
|
|
from app.db import get_db
|
|
|
|
conn = get_db()
|
|
await _create_user(conn, "docs_admin", "Correct-Horse-Battery-Staple-D2", is_admin=True)
|
|
await _login_full(client, "docs_admin", "Correct-Horse-Battery-Staple-D2")
|
|
|
|
resp = await client.get("/openapi.json")
|
|
assert resp.status_code == 200, resp.text
|
|
spec = resp.json()
|
|
assert "/admin/tokens" in spec["paths"]
|
|
|
|
resp = await client.get("/docs")
|
|
assert resp.status_code == 200, resp.text
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_admin_page_serves_static_markup_without_serverside_gate(client):
|
|
"""Wie /dashboard: die Seite selbst enthaelt keine Secrets, die
|
|
Admin-Pruefung erfolgt clientseitig via /auth/me + serverseitig hart auf
|
|
jedem einzelnen /admin/*-API-Call."""
|
|
resp = await client.get("/admin")
|
|
assert resp.status_code == 200, resp.text
|
|
assert "Jumphost" in resp.text
|