75 lines
3.3 KiB
TypeScript
75 lines
3.3 KiB
TypeScript
import { expect, test } from "vitest";
|
|
import Fastify from "fastify";
|
|
import { authPreHandler, getPrincipal } from "../src/auth/auth.js";
|
|
import { hasPermission, requireSameOriginOrNonBrowser } from "../src/auth/authorization.js";
|
|
import type { PrincipalContext } from "../src/auth/principal.js";
|
|
import type { Permission } from "../src/auth/types.js";
|
|
|
|
const noRole: PrincipalContext = {
|
|
issuer: "oidc", subject: "no-role", roles: [], permissions: [], isAdmin: false,
|
|
};
|
|
const user: PrincipalContext = {
|
|
issuer: "oidc", subject: "user", roles: ["user"], permissions: ["session.use"], isAdmin: false,
|
|
};
|
|
const admin: PrincipalContext = {
|
|
issuer: "oidc", subject: "admin", roles: ["admin"],
|
|
permissions: [
|
|
"session.use", "session.read_all", "session.manage_all", "settings.manage",
|
|
"workspace.manage", "workspace.secrets.manage", "database.manage", "pi.manage", "auth.diagnostics.read",
|
|
],
|
|
isAdmin: true,
|
|
};
|
|
|
|
const catalog: readonly Permission[] = [
|
|
"session.use", "session.read_all", "session.manage_all", "settings.manage",
|
|
"workspace.manage", "workspace.secrets.manage", "database.manage", "pi.manage", "auth.diagnostics.read",
|
|
];
|
|
|
|
test("permission matrix gives role-less identities no access, users session use, and admins every catalog permission", () => {
|
|
for (const permission of catalog) {
|
|
expect(hasPermission(noRole, permission)).toBe(false);
|
|
expect(hasPermission(user, permission)).toBe(permission === "session.use");
|
|
expect(hasPermission(admin, permission)).toBe(true);
|
|
}
|
|
});
|
|
|
|
test("compatibility adapters derive roles and permissions before routes inspect a principal", async () => {
|
|
const app = Fastify();
|
|
app.addHook("preHandler", authPreHandler("mock"));
|
|
app.get("/me", async (request) => getPrincipal(request));
|
|
|
|
const response = await app.inject({ method: "GET", url: "/me", headers: { "x-mock-user": "alice" } });
|
|
|
|
expect(response.json()).toEqual({
|
|
issuer: "mock", subject: "alice", displayName: "alice",
|
|
roles: ["user"], permissions: ["session.use"], isAdmin: false,
|
|
});
|
|
|
|
const elevated = await app.inject({
|
|
method: "GET", url: "/me", headers: { "x-mock-user": "operator", "x-thoth-is-admin": "true" },
|
|
});
|
|
const malformed = await app.inject({
|
|
method: "GET", url: "/me", headers: { "x-mock-user": "mallory", "x-thoth-is-admin": "yes" },
|
|
});
|
|
expect(elevated.json()).toMatchObject({ roles: ["admin"], isAdmin: true });
|
|
expect(malformed.json()).toMatchObject({ roles: ["user"], isAdmin: false });
|
|
});
|
|
|
|
test("same-origin guard permits non-browser and same-origin calls but rejects a cross-origin browser", async () => {
|
|
const app = Fastify();
|
|
app.get("/guard", async (request, reply) => {
|
|
const denied = requireSameOriginOrNonBrowser(request, reply);
|
|
return denied ?? { ok: true };
|
|
});
|
|
|
|
expect((await app.inject({ method: "GET", url: "/guard" })).statusCode).toBe(200);
|
|
expect((await app.inject({
|
|
method: "GET", url: "/guard", headers: { host: "127.0.0.1:8080", origin: "http://127.0.0.1:8080" },
|
|
})).statusCode).toBe(200);
|
|
const denied = await app.inject({
|
|
method: "GET", url: "/guard", headers: { host: "127.0.0.1:8080", origin: "https://evil.example" },
|
|
});
|
|
expect(denied.statusCode).toBe(403);
|
|
expect(denied.json()).toEqual({ code: "auth_forbidden", error: "This operation is not permitted" });
|
|
});
|