205 lines
10 KiB
Python
205 lines
10 KiB
Python
import pytest
|
|
from fastapi.testclient import TestClient
|
|
from sqlmodel import Session, SQLModel, create_engine
|
|
|
|
|
|
@pytest.fixture
|
|
def identity_client(tmp_path, monkeypatch):
|
|
from backend.app.core.config import settings
|
|
from backend.app.db import session as database
|
|
from backend.app.main import app
|
|
|
|
engine = create_engine(f"sqlite:///{tmp_path / 'identities.db'}", connect_args={"check_same_thread": False})
|
|
monkeypatch.setattr(database, "engine", engine)
|
|
monkeypatch.setenv("APPOPS_REQUIRE_OPERATOR_AUTH", "false")
|
|
monkeypatch.setattr(settings, "operator_proxy_auth_enabled", False)
|
|
monkeypatch.setattr(settings, "auth_admin_subjects", ["authentik:owner"], raising=False)
|
|
monkeypatch.setattr(settings, "auth_admin_emails", ["jens@example.com"], raising=False)
|
|
SQLModel.metadata.create_all(engine)
|
|
# Avoid unrelated schedulers and external connectors in boundary tests.
|
|
from backend.app.db.init_db import init_db
|
|
init_db()
|
|
yield TestClient(app, client=("198.18.10.20", 42000))
|
|
engine.dispose()
|
|
|
|
|
|
def sign_in(client, subject, **claims):
|
|
from backend.app.db import session as database
|
|
from backend.app.services.user_access import issue_session, provision_user
|
|
|
|
with Session(database.engine) as db:
|
|
user = provision_user(db, "authentik", "https://auth.example/application/o/appops/", {
|
|
"sub": subject, "email": f"{subject}@example.com", **claims,
|
|
})
|
|
cookie = issue_session(db, user)
|
|
user_id = user.id
|
|
client.cookies.set("appops_user_session", cookie)
|
|
return user_id
|
|
|
|
|
|
def test_shared_token_and_disabled_operator_switch_do_not_grant_access(identity_client):
|
|
client = identity_client
|
|
assert client.get("/api/apps").status_code == 401
|
|
assert client.post("/api/actions/plan", json={}, headers={"X-AppOps-Operator-Token": "old-shared-token"}).status_code == 401
|
|
assert client.get("/api/auth/session").json()["authenticated"] is False
|
|
assert client.get("/api/health").status_code == 200
|
|
|
|
|
|
def test_new_user_is_read_only_and_cannot_change_permissions(identity_client):
|
|
user_id = sign_in(identity_client, "reader")
|
|
assert identity_client.get("/api/apps").status_code == 200
|
|
status = identity_client.get("/api/auth/session").json()
|
|
assert status["user"]["role"] == "read_only"
|
|
assert status["permissions"] == ["read"]
|
|
for path in ["/api/actions/execute", "/api/voice/execute", "/api/settings/connectors/portainer", f"/api/auth/users/{user_id}"]:
|
|
assert identity_client.post(path, json={}, headers={"X-AppOps-Session-CSRF": "1"}).status_code == 403
|
|
assert identity_client.get("/api/auth/users").status_code == 403
|
|
|
|
|
|
def test_admin_can_manage_users_without_unlock_and_changes_apply_immediately(identity_client):
|
|
reader_id = sign_in(identity_client, "reader")
|
|
sign_in(identity_client, "owner")
|
|
status = identity_client.get("/api/auth/session").json()
|
|
assert status["user"]["role"] == "admin"
|
|
assert "users.manage" in status["permissions"]
|
|
assert identity_client.get("/api/auth/users").status_code == 200
|
|
update = identity_client.patch(f"/api/auth/users/{reader_id}", json={"role": "custom", "permissions": ["read", "inventory.manage"], "enabled": True}, headers={"X-AppOps-Session-CSRF": "1"})
|
|
assert update.status_code == 200
|
|
sign_in(identity_client, "reader")
|
|
assert identity_client.get("/api/auth/session").json()["permissions"] == ["inventory.manage", "read"]
|
|
assert identity_client.post("/api/actions/execute", json={}, headers={"X-AppOps-Session-CSRF": "1"}).status_code == 403
|
|
|
|
|
|
def test_csrf_logout_revocation_and_last_admin_protection(identity_client):
|
|
admin_id = sign_in(identity_client, "owner")
|
|
assert identity_client.patch(f"/api/auth/users/{admin_id}", json={"role": "read_only", "permissions": [], "enabled": True}, headers={"X-AppOps-Session-CSRF": "1"}).status_code == 409
|
|
assert identity_client.post("/api/auth/logout").status_code == 403
|
|
assert identity_client.post("/api/auth/logout", headers={"X-AppOps-Session-CSRF": "1"}).status_code == 200
|
|
assert identity_client.get("/api/apps").status_code == 401
|
|
|
|
|
|
def test_last_enabled_admin_guard_counts_another_enabled_admin(identity_client):
|
|
admin_id = sign_in(identity_client, "owner")
|
|
second_id = sign_in(identity_client, "second-admin")
|
|
sign_in(identity_client, "owner")
|
|
headers = {"X-AppOps-Session-CSRF": "1"}
|
|
|
|
promoted = identity_client.patch(
|
|
f"/api/auth/users/{second_id}",
|
|
json={"role": "admin", "enabled": True, "permissions": []},
|
|
headers=headers,
|
|
)
|
|
assert promoted.status_code == 200
|
|
|
|
disabled = identity_client.patch(
|
|
f"/api/auth/users/{second_id}",
|
|
json={"role": "admin", "enabled": False, "permissions": []},
|
|
headers=headers,
|
|
)
|
|
assert disabled.status_code == 200
|
|
|
|
last_admin = identity_client.patch(
|
|
f"/api/auth/users/{admin_id}",
|
|
json={"role": "admin", "enabled": False, "permissions": []},
|
|
headers=headers,
|
|
)
|
|
assert last_admin.status_code == 409
|
|
|
|
|
|
def test_session_expiration_and_forgery_fail_closed(identity_client):
|
|
from backend.app.db import session as database
|
|
from backend.app.db.models import UserSession
|
|
from backend.app.services.user_access import digest
|
|
sign_in(identity_client, "reader")
|
|
with Session(database.engine) as db:
|
|
record = db.get(UserSession, digest(identity_client.cookies.get("appops_user_session")))
|
|
record.expires_at = 1
|
|
db.add(record)
|
|
db.commit()
|
|
assert identity_client.get("/api/apps").status_code == 401
|
|
identity_client.cookies.set("appops_user_session", "forged")
|
|
assert identity_client.get("/api/apps").status_code == 401
|
|
|
|
|
|
def test_email_bootstrap_requires_verified_claim_and_is_pinned(identity_client):
|
|
sign_in(identity_client, "username-only", email=None, preferred_username="jens@example.com", email_verified=True)
|
|
assert identity_client.get("/api/auth/session").json()["user"]["role"] == "read_only"
|
|
sign_in(identity_client, "unverified", email="jens@example.com")
|
|
assert identity_client.get("/api/auth/session").json()["user"]["role"] == "read_only"
|
|
|
|
sign_in(identity_client, "verified", email="jens@example.com", email_verified=True)
|
|
assert identity_client.get("/api/auth/session").json()["user"]["role"] == "admin"
|
|
sign_in(identity_client, "replacement", email="jens@example.com", email_verified=True)
|
|
assert identity_client.get("/api/auth/session").json()["user"]["role"] == "read_only"
|
|
|
|
|
|
def test_bootstrap_recovers_early_login_without_restoring_demoted_admin(identity_client, monkeypatch):
|
|
from backend.app.core.config import settings
|
|
user_id = sign_in(identity_client, "early")
|
|
monkeypatch.setattr(settings, "auth_admin_subjects", ["authentik:early", "authentik:owner"])
|
|
sign_in(identity_client, "early")
|
|
assert identity_client.get("/api/auth/session").json()["user"]["role"] == "admin"
|
|
sign_in(identity_client, "owner")
|
|
response = identity_client.patch(f"/api/auth/users/{user_id}", json={"role": "read_only", "enabled": True, "permissions": []}, headers={"X-AppOps-Session-CSRF": "1"})
|
|
assert response.status_code == 200
|
|
sign_in(identity_client, "early")
|
|
assert identity_client.get("/api/auth/session").json()["user"]["role"] == "read_only"
|
|
|
|
monkeypatch.setattr(settings, "auth_admin_subjects", ["authentik:owner"])
|
|
sign_in(identity_client, "early", email="jens@example.com", email_verified=True)
|
|
assert identity_client.get("/api/auth/session").json()["user"]["role"] == "read_only"
|
|
|
|
|
|
def test_expired_disabled_and_forged_sessions_fail_closed(identity_client):
|
|
from backend.app.db import session as database
|
|
from backend.app.db.models import GatewayUser
|
|
user_id = sign_in(identity_client, "reader")
|
|
with Session(database.engine) as db:
|
|
user = db.get(GatewayUser, user_id)
|
|
user.enabled = False
|
|
db.add(user)
|
|
db.commit()
|
|
assert identity_client.get("/api/apps").status_code == 401
|
|
|
|
|
|
def test_proxy_headers_require_trusted_peer_and_fixed_uid(identity_client, monkeypatch):
|
|
from fastapi import HTTPException
|
|
from starlette.requests import Request
|
|
|
|
from backend.app.core.config import settings
|
|
from backend.app.services.user_access import current_user
|
|
monkeypatch.setattr(settings, "operator_proxy_auth_enabled", True)
|
|
monkeypatch.setattr(settings, "operator_proxy_trusted_networks", ["203.0.113.8/32"])
|
|
headers = [(b"x-authentik-uid", b"owner"), (b"x-authentik-username", b"jens"), (b"x-authentik-email", b"jens@example.com")]
|
|
def request(peer, supplied_headers):
|
|
return Request({"type": "http", "method": "GET", "path": "/api/apps", "headers": supplied_headers, "client": (peer, 1234)})
|
|
with pytest.raises(HTTPException) as rejected:
|
|
current_user(request("198.18.10.20", headers))
|
|
assert rejected.value.status_code == 401
|
|
assert current_user(request("203.0.113.8", headers)).role == "admin"
|
|
with pytest.raises(HTTPException) as rejected:
|
|
current_user(request("203.0.113.8", headers[1:]))
|
|
assert rejected.value.status_code == 401
|
|
|
|
|
|
def test_custom_voice_and_approval_permissions_do_not_grant_execution(identity_client):
|
|
reader_id = sign_in(identity_client, "reader")
|
|
sign_in(identity_client, "owner")
|
|
response = identity_client.patch(f"/api/auth/users/{reader_id}", json={"role": "custom", "enabled": True, "permissions": ["voice.use", "approvals.manage"]}, headers={"X-AppOps-Session-CSRF": "1"})
|
|
assert response.status_code == 200
|
|
sign_in(identity_client, "reader")
|
|
for path in ["/api/voice/actions/container/plex/restart", "/api/approvals/approval-1/execute", "/api/connectors/portainer/bind", "/api/ai/rag/reindex"]:
|
|
assert identity_client.post(path, json={}, headers={"X-AppOps-Session-CSRF": "1"}).status_code == 403
|
|
|
|
|
|
def test_operational_users_cannot_change_enrollment_trust(identity_client):
|
|
reader_id = sign_in(identity_client, "reader")
|
|
sign_in(identity_client, "owner")
|
|
headers = {"X-AppOps-Session-CSRF": "1"}
|
|
assert identity_client.patch(f"/api/auth/users/{reader_id}", json={"role": "operator", "enabled": True}, headers=headers).status_code == 200
|
|
sign_in(identity_client, "reader")
|
|
assert identity_client.put("/api/enrollments/trust", json={}, headers=headers).status_code == 403
|
|
sign_in(identity_client, "owner")
|
|
# Administrator reaches schema validation; an operator is rejected first.
|
|
assert identity_client.put("/api/enrollments/trust", json={}, headers=headers).status_code == 422
|