Initial commit

spec/api/v2/auth/csrf_spec.rb

@@ -0,0 +1,138 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe '/api/v2/auth CSRF functionality test' do
+  include_context 'geoip mock'
+
+  before do
+    allow_any_instance_of(Barong::Authorize).to receive(:validate_csrf!).and_call_original
+  end
+  let(:uri) { '/api/v2/identity/sessions' }
+  let!(:create_permissions) do
+    create :permission, role: 'admin'
+    create :permission, role: 'member', action: 'ACCEPT', verb: 'all', path: 'not_in_the_rules_path'
+    create :permission, role: 'member', action: 'ACCEPT', verb: 'get', path: '/api/v2/resource/users/me'
+    create :permission, role: 'accountant'
+  end
+  let!(:user) { create(:user) }
+  let(:params) do
+    {
+      email: user.email,
+      password: user.password
+    }
+  end
+
+  let(:do_create_session_request) { post uri, params: params }
+  let(:auth_request) { '/api/v2/auth/not_in_the_rules_path' }
+  let(:protected_request) { '/api/v2/resource/users/me' }
+
+  describe 'testing workability with session' do
+    context 'without CSRF token' do
+      before do
+        Rails.cache.delete('permissions')
+        do_create_session_request
+      end
+
+      it 'doesnt return bearer token on valid session without CSRF' do
+        post auth_request
+
+        expect(response.status).to eq(401)
+        expect(response.headers['Authorization']).to be_nil
+        expect(response.body).to eq("{\"errors\":[\"authz.missing_csrf_token\"]}")
+      end
+
+      it 'works with any type of changing state verb request' do
+        available_types = %w[post put delete patch]
+        available_types.each do |ping|
+          method("#{ping}").call auth_request
+
+          expect(response.status).to eq(401)
+          expect(response.headers['Authorization']).to be_nil
+          expect(response.body).to eq("{\"errors\":[\"authz.missing_csrf_token\"]}")
+
+          get protected_request, headers: { 'Authorization' => response.headers['Authorization'] }
+          expect(response.status).to eq(401)
+        end
+      end
+
+      it 'works without CSRF token on any type of safe verb request' do
+        available_types = %w[get head]
+        available_types.each do |ping|
+          method("#{ping}").call auth_request
+
+         expect(response.status).to eq(200)
+          expect(response.headers['Authorization']).not_to be_nil
+
+          get protected_request, headers: { 'Authorization' => response.headers['Authorization'] }
+          expect(response.status).to eq(200)
+        end
+      end
+    end
+
+    context 'with CSRF token' do
+      before do
+        Rails.cache.delete('permissions')
+        do_create_session_request
+        @csrf = json_body[:csrf_token]
+      end
+
+      it 'doesnt return bearer token on valid session without CSRF' do
+        get auth_request, headers: { 'X-CSRF-Token': @csrf }
+
+        expect(response.status).to eq(200)
+        expect(response.headers['Authorization']).not_to be_nil
+      end
+
+      it 'doesnt work on any type of request without csrf' do
+        available_types = %w[post get put delete patch]
+        available_types.each do |ping|
+          method("#{ping}").call auth_request, headers: { 'X-CSRF-Token': @csrf }
+
+          expect(response.status).to eq(200)
+          expect(response.headers['Authorization']).not_to be_nil
+
+          get protected_request, headers: { 'Authorization' => response.headers['Authorization'] }
+          expect(response.status).to eq(200)
+        end
+      end
+    end
+  end
+
+  describe 'testing workability with api keys' do
+    let!(:test_user) { create(:user, otp: otp_enabled) }
+    let(:otp_enabled) { true }
+    let!(:api_key) { create :api_key, key_holder_account: test_user }
+    let(:otp_code) { '1357' }
+    let(:nonce) { (Time.now.to_f * 1000).to_i }
+    let(:kid) { api_key.kid }
+    let(:secret) { api_key.secret }
+    let(:data) { nonce.to_s + kid }
+    let(:algorithm) { 'SHA' + api_key.algorithm[2..4]}
+    let(:signature) { OpenSSL::HMAC.hexdigest(algorithm, secret, data) }
+
+    before do
+      Rails.cache.delete('permissions')
+      SecretStorage.store_secret(secret, api_key.kid)
+      allow(TOTPService).to receive(:validate?)
+        .with(test_user.uid, otp_code) { true }
+    end
+
+    context 'with valid api keys' do
+      it 'works without CSRF' do
+        get auth_request, headers: {
+          'X-Auth-Apikey' => kid,
+          'X-Auth-Nonce' => nonce,
+          'X-Auth-Signature' => signature
+        }
+        expect(response.status).to eq(200)
+        expect(response.body).to be_empty
+        expect(response.headers['Authorization']).to include 'Bearer'
+        expect(response.headers['Authorization']).not_to be_nil
+
+        get protected_request, headers: { 'Authorization' => response.headers['Authorization'] }
+        expect(response.status).to eq(200)
+      end
+    end
+  end
+end