Initial commit

spec/api/v2/auth/rbac_spec.rb

@@ -0,0 +1,144 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe '/api/v2/auth functionality test' do
+  include_context 'geoip mock'
+
+  let(:do_protected_request) { get '/api/v2/auth/api/v2/resource/users/me' }
+
+  describe 'testing rbac workability' do
+    before(:example) do
+      Thread.list.last.kill if Thread.list.last.to_s.include?('activity')
+    end
+    let!(:create_permissions) do
+      Permission.create(role: 'superadmin', action: 'ACCEPT', verb: 'get', path: 'api/v2/admin/users/list')
+      Rails.cache.delete('permissions')
+      @admin = User.create(email: 'superadmin@admin.io', password: 'Tecohvi0', role: 'superadmin', state: 'active')
+    end
+
+    context 'with cookies' do
+      let(:do_create_session_request_superadm) { post  '/api/v2/identity/sessions', params: { email: 'superadmin@admin.io', password: 'Tecohvi0' }}
+
+      context 'not enough permissions' do
+        it 'denies access for user with missing cookies' do
+          do_protected_request
+          expect(response.status).to eq(401)
+          expect(response.body).to eq("{\"errors\":[\"authz.invalid_session\"]}")
+        end
+
+        it 'denies access for non-accountant user with valid cookies trying to GET accountant api' do
+          do_create_session_request_superadm
+
+          get '/api/v2/auth/api/v2/accountant/documents'
+
+          expect(response.status).to eq(401)
+          expect(response.body).to eq("{\"errors\":[\"authz.invalid_permission\"]}")
+          expect(response.headers['Authorization']).to be_nil
+        end
+
+        it 'denies POST for endpoint but allowing GET for admin user according to permissions' do
+          do_create_session_request_superadm
+
+          post '/api/v2/auth/api/v2/admin/users/list'
+          expect(response.status).to eq(401)
+          expect(response.body).to eq("{\"errors\":[\"authz.invalid_permission\"]}")
+          expect(response.headers['Authorization']).to be_nil
+
+          get '/api/v2/auth/api/v2/admin/users/list'
+          expect(response.status).to eq(200)
+          expect(response.headers['Authorization']).not_to be_nil
+          expect(response.headers['Authorization']).to include "Bearer"
+        end
+
+        it 'denies access because of the typo in the path' do
+          do_create_session_request_superadm
+          get '/api/v2/auth/api/v2/admon/users/list'
+          expect(response.status).to eq(401)
+          expect(response.body).to eq("{\"errors\":[\"authz.invalid_permission\"]}")
+        end
+      end
+
+      context 'enough permissions' do
+        it 'allowes access with for user with valid cookies, verb, role and path' do
+          do_create_session_request_superadm
+
+          get '/api/v2/auth/api/v2/admin/users/list'
+          expect(response.status).to eq(200)
+          expect(response.headers['Authorization']).not_to be_nil
+          expect(response.headers['Authorization']).to include "Bearer"
+        end
+      end
+    end
+
+    context 'with api_keys' do
+      let!(:admin_api_key) { create :api_key, key_holder_account: @admin }
+      let(:nonce) { (Time.now.to_f * 1000).to_i }
+      let(:secret) { admin_api_key.secret }
+      let(:signature) { OpenSSL::HMAC.hexdigest('SHA256', secret, nonce.to_s + admin_api_key.kid ) }
+      let!(:turn_on_2fa) { @admin.update(otp: true) }
+
+      context 'with valid api key headers' do
+        context 'enough permissions' do
+          it 'allowes access with for api key owner for valid verb, owner role and path' do
+            allow(TOTPService).to receive(:validate?)
+              .with(@admin.uid, '1357') { true }
+
+            get '/api/v2/auth/api/v2/admin/users/list', headers: {
+              'X-Auth-Apikey' => admin_api_key.kid,
+              'X-Auth-Nonce' => nonce,
+              'X-Auth-Signature' => signature
+            }
+            expect(response.status).to eq(200)
+
+            expect(response.headers['Authorization']).not_to be_nil
+            expect(response.headers['Authorization']).to include "Bearer"
+          end
+        end
+
+        context 'not enough permissions' do
+          it 'denies access for non-accountant api key owner with valid api_key trying to POST accountant api' do
+           allow(TOTPService).to receive(:validate?)
+             .with(@admin.uid, '1357') { true }
+           allow(SecretStorage).to receive(:get_secret)
+             .with(admin_api_key.kid) { Vault::Secret.new(data: { value: secret }) }
+
+            post '/api/v2/auth/api/v2/accountant/documents', headers: {
+              'X-Auth-Apikey' => admin_api_key.kid,
+              'X-Auth-Nonce' => nonce,
+              'X-Auth-Signature' => signature
+            }
+            expect(response.status).to eq(401)
+            expect(response.body).to eq("{\"errors\":[\"authz.invalid_permission\"]}")
+          end
+
+          it 'denies POST for endpoint but allowing GET for api key owner according to permissions' do
+            allow(TOTPService).to receive(:validate?)
+              .with(@admin.uid, '1357') { true }
+            allow(SecretStorage).to receive(:get_secret)
+              .with(admin_api_key.kid) { Vault::Secret.new(data: { value: secret }) }
+
+              post '/api/v2/auth/api/v2/accountant/documents', headers: {
+                'X-Auth-Apikey' => admin_api_key.kid,
+                'X-Auth-Nonce' => nonce,
+                'X-Auth-Signature' => signature
+              }
+              Rails.cache.delete(admin_api_key.kid)
+              expect(response.status).to eq(401)
+              expect(response.body).to eq("{\"errors\":[\"authz.invalid_permission\"]}")
+
+              get '/api/v2/auth/api/v2/admin/users/list', headers: {
+                'X-Auth-Apikey' => admin_api_key.kid,
+                'X-Auth-Nonce' => nonce,
+                'X-Auth-Signature' => signature
+              }
+
+              expect(response.status).to eq(200)
+              expect(response.headers['Authorization']).not_to be_nil
+              expect(response.headers['Authorization']).to include "Bearer"
+          end
+        end
+      end
+    end
+  end
+end