116 lines
4.3 KiB
Ruby
116 lines
4.3 KiB
Ruby
# frozen_string_literal: true
|
|
|
|
require 'rails_helper'
|
|
|
|
describe API::V2::Management::JWTAuthenticationMiddleware, type: :request do
|
|
let(:member) { create(:member, :verified_identity) }
|
|
let(:config) { management_api_v2_security_configuration }
|
|
|
|
before do
|
|
defaults_for_management_api_v2_security_configuration!
|
|
config.merge! \
|
|
scopes: {
|
|
tools: { permitted_signers: %i[alex jeff], mandatory_signers: %i[alex] }
|
|
}
|
|
end
|
|
|
|
it 'works in standard conditions' do
|
|
post_json '/api/v2/management/timestamp', multisig_jwt_management_api_v2({}, :alex)
|
|
expect(response).to be_successful
|
|
end
|
|
# FIXME fix swagger_doc
|
|
# it 'allows GET and doesn\'t require authentication for documentation' do
|
|
# get '/api/v2/management/swagger_doc'
|
|
# expect(response).to be_successful
|
|
# end
|
|
|
|
it 'doesn\'t allow query parameters' do
|
|
post '/api/v2/management/timestamp?foo=baz&baz=qux'
|
|
expect(response).to have_http_status(400)
|
|
expect(response.body).to match(/query parameters/i)
|
|
end
|
|
|
|
it 'requires JSON in the request body' do
|
|
post '/api/v2/management/timestamp', params: 'foo=baz&baz=qux'
|
|
expect(response).to have_http_status(400)
|
|
expect(response.body).to match(/only json/i)
|
|
end
|
|
|
|
it 'denies access when not enough signatures are supplied' do
|
|
post_json '/api/v2/management/timestamp', multisig_jwt_management_api_v2({})
|
|
expect(response).to have_http_status(401)
|
|
expect(response.body).to match(/not enough signatures/i)
|
|
end
|
|
|
|
it 'denies access when token is expired' do
|
|
config[:jwt][:verify_expiration] = true
|
|
post_json '/api/v2/management/timestamp', multisig_jwt_management_api_v2({ exp: 1.minute.ago.to_i }, :alex)
|
|
expect(response).to have_http_status(401)
|
|
expect(response.body).to match(/failed to verify jwt/i)
|
|
end
|
|
|
|
context 'valid issuer' do
|
|
before { config[:jwt][:verify_iss] = true }
|
|
before { config[:jwt].merge!(iss: 'qux') }
|
|
it 'validates issuer' do
|
|
post_json '/api/v2/management/timestamp', multisig_jwt_management_api_v2({ iss: 'qux' }, :alex)
|
|
expect(response).to be_successful
|
|
end
|
|
end
|
|
|
|
context 'invalid issuer' do
|
|
before { config[:jwt][:verify_iss] = true }
|
|
before { config[:jwt].merge!(iss: 'qux') }
|
|
it 'validates issuer' do
|
|
post_json '/api/v2/management/timestamp', multisig_jwt_management_api_v2({ iss: 'hacker' }, :alex)
|
|
expect(response).to have_http_status(401)
|
|
expect(response.body).to match(/failed to verify jwt/i)
|
|
end
|
|
end
|
|
|
|
context 'valid audience' do
|
|
before { config[:jwt][:verify_aud] = true }
|
|
before { config[:jwt].merge!(aud: 'qux') }
|
|
it 'validates audience' do
|
|
post_json '/api/v2/management/timestamp', multisig_jwt_management_api_v2({ aud: 'qux' }, :alex)
|
|
expect(response).to be_successful
|
|
end
|
|
end
|
|
|
|
context 'invalid audience' do
|
|
before { config[:jwt][:verify_aud] = true }
|
|
before { config[:jwt].merge!(aud: 'qux') }
|
|
it 'validates audience' do
|
|
post_json '/api/v2/management/timestamp', multisig_jwt_management_api_v2({ aud: 'hacker' }, :alex)
|
|
expect(response).to have_http_status(401)
|
|
expect(response.body).to match(/failed to verify jwt/i)
|
|
end
|
|
end
|
|
|
|
context 'missing JWT ID' do
|
|
before { config[:jwt][:verify_jti] = true }
|
|
it 'requires JTI' do
|
|
post_json '/api/v2/management/timestamp', multisig_jwt_management_api_v2({}, :alex)
|
|
expect(response).to have_http_status(401)
|
|
expect(response.body).to match(/failed to verify jwt/i)
|
|
end
|
|
end
|
|
|
|
context 'issued at in future' do
|
|
before { config[:jwt][:verify_iat] = true }
|
|
it 'denies access' do
|
|
post_json '/api/v2/management/timestamp', multisig_jwt_management_api_v2({ iat: 200.seconds.from_now.to_i }, :alex)
|
|
expect(response).to have_http_status(401)
|
|
expect(response.body).to match(/failed to verify jwt/i)
|
|
end
|
|
end
|
|
|
|
context 'issued at before future' do
|
|
before { config[:jwt][:verify_iat] = true }
|
|
it 'allows access' do
|
|
post_json '/api/v2/management/timestamp', multisig_jwt_management_api_v2({ iat: 3.seconds.ago.to_i }, :alex)
|
|
expect(response).to have_http_status(200)
|
|
end
|
|
end
|
|
end
|