Skip to content
Snippets Groups Projects
Commit 3cefbf45 authored by Fabian Seidl's avatar Fabian Seidl
Browse files

more test cases + fixed a bug where permissions where not checked

parent b54739d1
No related branches found
No related tags found
1 merge request!308Improve test coverage of rbac stuff
This commit is part of merge request !308. Comments created here will be created in the context of that merge request.
Hide whitespace changes
Inline Side-by-side
controller/northbound/server/auth_interceptor.go
+ 8
− 1
View file @ 3cefbf45
......@@ -125,16 +125,23 @@ func (auth *AuthInterceptor) verifyUserRoleAndRequestedCall(userRole, requestedM
return err
}
foundRoleInStorage := false
for _, storedRole := range storedRoles {
if userRole == storedRole.Name() {
foundRoleInStorage = true
err := auth.compareRequestedPermissionWithRolePermissions(requestedMethod, storedRole.GetPermissions())
if err != nil {
return err
}
}
if foundRoleInStorage {
return nil
}
}
return nil
return status.Errorf(codes.PermissionDenied, "wrong permissions")
}
func (auth *AuthInterceptor) compareRequestedPermissionWithRolePermissions(requestedMethod string, storedRolePermissions []string) error {
......
controller/northbound/server/auth_interceptor_test.go
+ 172
− 4
View file @ 3cefbf45
......@@ -4,6 +4,7 @@ import (
"context"
"log"
"net"
"reflect"
"testing"
apb "code.fbi.h-da.de/danet/gosdn/api/go/gosdn/rbac"
......@@ -35,7 +36,12 @@ func dialer() func(context.Context, string) (net.Conn, error) {
}
func TestAuthInterceptor_Unary(t *testing.T) {
token, err := jwt.GenerateToken(rbac.User{UserName: "testAdmin"})
validToken, err := jwt.GenerateToken(rbac.User{UserName: "testAdmin"})
if err != nil {
log.Fatal(err)
}
wrongUserToken, err := jwt.GenerateToken(rbac.User{UserName: "foo"})
if err != nil {
log.Fatal(err)
}
......@@ -44,14 +50,14 @@ func TestAuthInterceptor_Unary(t *testing.T) {
if err != nil {
log.Fatal(err)
}
user.SetToken(token)
user.SetToken(validToken)
err = userc.Update(user)
if err != nil {
log.Fatal(err)
}
md := metadata.Pairs("authorize", token)
md := metadata.Pairs("authorize", validToken)
type args struct {
ctx context.Context
......@@ -74,6 +80,33 @@ func TestAuthInterceptor_Unary(t *testing.T) {
},
wantErr: false,
},
{
name: "error unary invalid user token",
args: args{
ctx: metadata.NewOutgoingContext(context.Background(), metadata.Pairs("authorize", wrongUserToken)),
request: &apb.GetUsersRequest{},
},
want: nil,
wantErr: true,
},
{
name: "error unary invalid token string",
args: args{
ctx: metadata.NewOutgoingContext(context.Background(), metadata.Pairs("authorize", "foo")),
request: &apb.GetUsersRequest{},
},
want: nil,
wantErr: true,
},
{
name: "error unary no token in metadata",
args: args{
ctx: metadata.NewOutgoingContext(context.Background(), metadata.Pairs("foo", "foo")),
request: &apb.GetUsersRequest{},
},
want: nil,
wantErr: true,
},
}
ctx := context.Background()
......@@ -93,10 +126,145 @@ func TestAuthInterceptor_Unary(t *testing.T) {
return
}
if got.Status != tt.want.Status {
if got != nil && got.Status != tt.want.Status {
t.Errorf("AuthInterceptor.Unary() = %v, wantErr %v", err, tt.wantErr)
return
}
})
}
}
func TestAuthInterceptor_Stream(t *testing.T) {
type fields struct {
jwtManager *rbac.JWTManager
}
tests := []struct {
name string
fields fields
want grpc.StreamServerInterceptor
}{
// TODO: Add test cases.
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
auth := &AuthInterceptor{
jwtManager: tt.fields.jwtManager,
}
if got := auth.Stream(); !reflect.DeepEqual(got, tt.want) {
t.Errorf("AuthInterceptor.Stream() = %v, want %v", got, tt.want)
}
})
}
}
func TestAuthInterceptor_authorize(t *testing.T) {
type fields struct {
jwtManager *rbac.JWTManager
}
type args struct {
ctx context.Context
method string
}
tests := []struct {
name string
fields fields
args args
wantErr bool
}{
// TODO: Add test cases.
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
auth := &AuthInterceptor{
jwtManager: tt.fields.jwtManager,
}
if err := auth.authorize(tt.args.ctx, tt.args.method); (err != nil) != tt.wantErr {
t.Errorf("AuthInterceptor.authorize() error = %v, wantErr %v", err, tt.wantErr)
}
})
}
}
func TestAuthInterceptor_verifyPermisisonForRequestedCall(t *testing.T) {
type fields struct {
jwtManager *rbac.JWTManager
}
type args struct {
userRoles map[string]string
requestedMethod string
}
tests := []struct {
name string
fields fields
args args
wantErr bool
}{
// TODO: Add test cases.
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
auth := &AuthInterceptor{
jwtManager: tt.fields.jwtManager,
}
if err := auth.verifyPermisisonForRequestedCall(tt.args.userRoles, tt.args.requestedMethod); (err != nil) != tt.wantErr {
t.Errorf("AuthInterceptor.verifyPermisisonForRequestedCall() error = %v, wantErr %v", err, tt.wantErr)
}
})
}
}
func TestAuthInterceptor_verifyUserRoleAndRequestedCall(t *testing.T) {
type fields struct {
jwtManager *rbac.JWTManager
}
type args struct {
userRole string
requestedMethod string
}
tests := []struct {
name string
fields fields
args args
wantErr bool
}{
// TODO: Add test cases.
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
auth := &AuthInterceptor{
jwtManager: tt.fields.jwtManager,
}
if err := auth.verifyUserRoleAndRequestedCall(tt.args.userRole, tt.args.requestedMethod); (err != nil) != tt.wantErr {
t.Errorf("AuthInterceptor.verifyUserRoleAndRequestedCall() error = %v, wantErr %v", err, tt.wantErr)
}
})
}
}
func TestAuthInterceptor_compareRequestedPermissionWithRolePermissions(t *testing.T) {
type fields struct {
jwtManager *rbac.JWTManager
}
type args struct {
requestedMethod string
storedRolePermissions []string
}
tests := []struct {
name string
fields fields
args args
wantErr bool
}{
// TODO: Add test cases.
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
auth := &AuthInterceptor{
jwtManager: tt.fields.jwtManager,
}
if err := auth.compareRequestedPermissionWithRolePermissions(tt.args.requestedMethod, tt.args.storedRolePermissions); (err != nil) != tt.wantErr {
t.Errorf("AuthInterceptor.compareRequestedPermissionWithRolePermissions() error = %v, wantErr %v", err, tt.wantErr)
}
})
}
}
controller/northbound/server/role_test.go
+ 1
− 0
View file @ 3cefbf45
......@@ -147,6 +147,7 @@ func TestRole_GetRoles(t *testing.T) {
Permissions: []string{
"/gosdn.core.CoreService/GetPnd",
"/gosdn.core.CoreService/GetPndList",
"/gosdn.rbac.UserService/GetUsers",
}},
{
Name: "userTestRole",
......
controller/northbound/server/test_util_test.go
+ 3
− 2
View file @ 3cefbf45
......@@ -17,8 +17,8 @@ const userID = "57005d13-7a4d-493d-a02b-50ca51c40197"
const adminRoleID = "126683ae-5ff2-43ee-92f7-0e2b936f8c77"
const randomRoleName = "bertram"
var adminRoleMap = map[string]string{pndID: "admin"}
var userRoleMap = map[string]string{pndID: "user"}
var adminRoleMap = map[string]string{pndID: "adminTestRole"}
var userRoleMap = map[string]string{pndID: "userTestRole"}
var jwt *rbac.JWTManager
func clearAndCreateAuthTestSetup() error {
......@@ -88,6 +88,7 @@ func createTestRoles() error {
Permissions: []string{
"/gosdn.core.CoreService/GetPnd",
"/gosdn.core.CoreService/GetPndList",
"/gosdn.rbac.UserService/GetUsers",
},
},
{
......
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment