139 lines
4.6 KiB
Ruby
139 lines
4.6 KiB
Ruby
# frozen_string_literal: true
|
|
|
|
require 'spec_helper'
|
|
|
|
describe '/api/v2/auth CSRF functionality test' do
|
|
include_context 'geoip mock'
|
|
|
|
before do
|
|
allow_any_instance_of(Barong::Authorize).to receive(:validate_csrf!).and_call_original
|
|
end
|
|
let(:uri) { '/api/v2/identity/sessions' }
|
|
let!(:create_permissions) do
|
|
create :permission, role: 'admin'
|
|
create :permission, role: 'member', action: 'ACCEPT', verb: 'all', path: 'not_in_the_rules_path'
|
|
create :permission, role: 'member', action: 'ACCEPT', verb: 'get', path: '/api/v2/resource/users/me'
|
|
create :permission, role: 'accountant'
|
|
end
|
|
let!(:user) { create(:user) }
|
|
let(:params) do
|
|
{
|
|
email: user.email,
|
|
password: user.password
|
|
}
|
|
end
|
|
|
|
let(:do_create_session_request) { post uri, params: params }
|
|
let(:auth_request) { '/api/v2/auth/not_in_the_rules_path' }
|
|
let(:protected_request) { '/api/v2/resource/users/me' }
|
|
|
|
describe 'testing workability with session' do
|
|
context 'without CSRF token' do
|
|
before do
|
|
Rails.cache.delete('permissions')
|
|
do_create_session_request
|
|
end
|
|
|
|
it 'doesnt return bearer token on valid session without CSRF' do
|
|
post auth_request
|
|
|
|
expect(response.status).to eq(401)
|
|
expect(response.headers['Authorization']).to be_nil
|
|
expect(response.body).to eq("{\"errors\":[\"authz.missing_csrf_token\"]}")
|
|
end
|
|
|
|
it 'works with any type of changing state verb request' do
|
|
available_types = %w[post put delete patch]
|
|
available_types.each do |ping|
|
|
method("#{ping}").call auth_request
|
|
|
|
expect(response.status).to eq(401)
|
|
expect(response.headers['Authorization']).to be_nil
|
|
expect(response.body).to eq("{\"errors\":[\"authz.missing_csrf_token\"]}")
|
|
|
|
get protected_request, headers: { 'Authorization' => response.headers['Authorization'] }
|
|
expect(response.status).to eq(401)
|
|
end
|
|
end
|
|
|
|
it 'works without CSRF token on any type of safe verb request' do
|
|
available_types = %w[get head]
|
|
available_types.each do |ping|
|
|
method("#{ping}").call auth_request
|
|
|
|
expect(response.status).to eq(200)
|
|
expect(response.headers['Authorization']).not_to be_nil
|
|
|
|
get protected_request, headers: { 'Authorization' => response.headers['Authorization'] }
|
|
expect(response.status).to eq(200)
|
|
end
|
|
end
|
|
end
|
|
|
|
context 'with CSRF token' do
|
|
before do
|
|
Rails.cache.delete('permissions')
|
|
do_create_session_request
|
|
@csrf = json_body[:csrf_token]
|
|
end
|
|
|
|
it 'doesnt return bearer token on valid session without CSRF' do
|
|
get auth_request, headers: { 'X-CSRF-Token': @csrf }
|
|
|
|
expect(response.status).to eq(200)
|
|
expect(response.headers['Authorization']).not_to be_nil
|
|
end
|
|
|
|
it 'doesnt work on any type of request without csrf' do
|
|
available_types = %w[post get put delete patch]
|
|
available_types.each do |ping|
|
|
method("#{ping}").call auth_request, headers: { 'X-CSRF-Token': @csrf }
|
|
|
|
expect(response.status).to eq(200)
|
|
expect(response.headers['Authorization']).not_to be_nil
|
|
|
|
get protected_request, headers: { 'Authorization' => response.headers['Authorization'] }
|
|
expect(response.status).to eq(200)
|
|
end
|
|
end
|
|
end
|
|
end
|
|
|
|
describe 'testing workability with api keys' do
|
|
let!(:test_user) { create(:user, otp: otp_enabled) }
|
|
let(:otp_enabled) { true }
|
|
let!(:api_key) { create :api_key, key_holder_account: test_user }
|
|
let(:otp_code) { '1357' }
|
|
let(:nonce) { (Time.now.to_f * 1000).to_i }
|
|
let(:kid) { api_key.kid }
|
|
let(:secret) { api_key.secret }
|
|
let(:data) { nonce.to_s + kid }
|
|
let(:algorithm) { 'SHA' + api_key.algorithm[2..4]}
|
|
let(:signature) { OpenSSL::HMAC.hexdigest(algorithm, secret, data) }
|
|
|
|
before do
|
|
Rails.cache.delete('permissions')
|
|
SecretStorage.store_secret(secret, api_key.kid)
|
|
allow(TOTPService).to receive(:validate?)
|
|
.with(test_user.uid, otp_code) { true }
|
|
end
|
|
|
|
context 'with valid api keys' do
|
|
it 'works without CSRF' do
|
|
get auth_request, headers: {
|
|
'X-Auth-Apikey' => kid,
|
|
'X-Auth-Nonce' => nonce,
|
|
'X-Auth-Signature' => signature
|
|
}
|
|
expect(response.status).to eq(200)
|
|
expect(response.body).to be_empty
|
|
expect(response.headers['Authorization']).to include 'Bearer'
|
|
expect(response.headers['Authorization']).not_to be_nil
|
|
|
|
get protected_request, headers: { 'Authorization' => response.headers['Authorization'] }
|
|
expect(response.status).to eq(200)
|
|
end
|
|
end
|
|
end
|
|
end
|