58 lines
2.1 KiB
Go
58 lines
2.1 KiB
Go
|
package auth
|
||
|
|
|
||
|
|
import (
|
||
|
|
"context"
|
||
|
|
"crypto/sha256"
|
||
|
|
"encoding/hex"
|
||
|
|
"os"
|
||
|
|
"path/filepath"
|
||
|
|
"strings"
|
||
|
|
"testing"
|
||
|
|
)
|
||
|
|
|
||
|
|
func TestStaticSHA256AuthenticatesScopedPrincipal(t *testing.T) {
|
||
|
|
token := "0123456789abcdef0123456789abcdef"
|
||
|
|
digest := sha256.Sum256([]byte(token))
|
||
|
|
path := filepath.Join(t.TempDir(), "auth.json")
|
||
|
|
document := `{"version":1,"principals":[{` +
|
||
|
|
`"token_sha256":"` + hex.EncodeToString(digest[:]) + `",` +
|
||
|
|
`"subject_id":"operator-1","actor_type":"user","tenant_id":"tenant-a",` +
|
||
|
|
`"site_ids":["site-a"],"permissions":["sense.devices.read"]}]}`
|
||
|
|
if err := os.WriteFile(path, []byte(document), 0o600); err != nil {
|
||
|
|
t.Fatal(err)
|
||
|
|
}
|
||
|
|
authenticator, err := LoadStaticSHA256(path)
|
||
|
|
if err != nil {
|
||
|
|
t.Fatal(err)
|
||
|
|
}
|
||
|
|
principal, err := authenticator.Authenticate(context.Background(), token)
|
||
|
|
if err != nil {
|
||
|
|
t.Fatal(err)
|
||
|
|
}
|
||
|
|
if principal.TenantID != "tenant-a" || !principal.AllowsSite("site-a") ||
|
||
|
|
principal.AllowsSite("site-b") || !principal.Has(PermissionDevicesRead) {
|
||
|
|
t.Fatalf("unexpected principal: %+v", principal)
|
||
|
|
}
|
||
|
|
if _, err := authenticator.Authenticate(context.Background(), strings.Repeat("x", 32)); err == nil {
|
||
|
|
t.Fatal("unknown token authenticated")
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestStaticSHA256RejectsUnsafeRegistry(t *testing.T) {
|
||
|
|
tests := []string{
|
||
|
|
`{"version":1,"principals":[]}`,
|
||
|
|
`{"version":1,"principals":[{"token_sha256":"ABC","subject_id":"x","actor_type":"service","tenant_id":"tenant","site_ids":["*"],"permissions":["sense.devices.read"]}]}`,
|
||
|
|
`{"version":1,"principals":[{"token_sha256":"` + strings.Repeat("0", 64) + `","subject_id":"x","actor_type":"system","tenant_id":"tenant","site_ids":["*"],"permissions":["sense.devices.read"]}]}`,
|
||
|
|
`{"version":1,"principals":[{"token_sha256":"` + strings.Repeat("0", 64) + `","subject_id":"x","actor_type":"service","tenant_id":"tenant","site_ids":["*"],"permissions":["admin"]}]}`,
|
||
|
|
}
|
||
|
|
for index, document := range tests {
|
||
|
|
path := filepath.Join(t.TempDir(), "auth.json")
|
||
|
|
if err := os.WriteFile(path, []byte(document), 0o600); err != nil {
|
||
|
|
t.Fatal(err)
|
||
|
|
}
|
||
|
|
if _, err := LoadStaticSHA256(path); err == nil {
|
||
|
|
t.Fatalf("unsafe registry %d was accepted", index)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|