jcoffey-dev
3eb0f4c589
RBAC (api/internal/authz) is live on /query and /dashboards, backed by a new enterprise/ module (session issuance, audit logging, RBAC storage, OIDC/SAML protocol wiring) that core never imports -- only calls over HTTP. Found and fixed a real cross-tenant vulnerability in dashboards (no tenant_id filtering at all) while writing the threat model doc. Two things are explicitly NOT done, documented rather than hidden: tenant isolation for log data itself (/query still shares one ClickHouse connection and Tantivy index across every tenant -- RBAC controls who can query, not what a query can see), and human SSO login (protocol wiring exists, no HTTP handler calls it yet). See docs/security/threat-model.md and docs/phase-4-runbook.md. Also adds deploy/ (Go Operator + Helm chart, validated offline only -- no cluster was reachable in this environment).
97 lines
3.5 KiB
Go
97 lines
3.5 KiB
Go
package authz
|
|
|
|
import (
|
|
"errors"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
)
|
|
|
|
type fakeAuthorizer struct {
|
|
identity Identity
|
|
err error
|
|
}
|
|
|
|
func (f *fakeAuthorizer) Authorize(_ *http.Request) (Identity, error) {
|
|
return f.identity, f.err
|
|
}
|
|
|
|
func okHandler(w http.ResponseWriter, r *http.Request) {
|
|
id, ok := IdentityFromContext(r.Context())
|
|
if ok {
|
|
w.Header().Set("X-Test-Tenant", id.TenantID)
|
|
}
|
|
w.WriteHeader(http.StatusOK)
|
|
}
|
|
|
|
func TestRequireRoleNilAuthorizerIsNoOp(t *testing.T) {
|
|
h := RequireRole(nil, RoleAdmin, okHandler)
|
|
rec := httptest.NewRecorder()
|
|
h(rec, httptest.NewRequest(http.MethodGet, "/", nil))
|
|
if rec.Code != http.StatusOK {
|
|
t.Fatalf("status = %d, want 200 (nil authorizer must be a no-op, matching single-tenant Phase 0-3 behavior)", rec.Code)
|
|
}
|
|
}
|
|
|
|
func TestRequireRoleRejectsUnauthenticated(t *testing.T) {
|
|
h := RequireRole(&fakeAuthorizer{err: errors.New("no session")}, RoleViewer, okHandler)
|
|
rec := httptest.NewRecorder()
|
|
h(rec, httptest.NewRequest(http.MethodGet, "/", nil))
|
|
if rec.Code != http.StatusUnauthorized {
|
|
t.Fatalf("status = %d, want 401", rec.Code)
|
|
}
|
|
}
|
|
|
|
func TestRequireRoleRejectsInsufficientRole(t *testing.T) {
|
|
h := RequireRole(&fakeAuthorizer{identity: Identity{Role: RoleViewer}}, RoleAdmin, okHandler)
|
|
rec := httptest.NewRecorder()
|
|
h(rec, httptest.NewRequest(http.MethodGet, "/", nil))
|
|
if rec.Code != http.StatusForbidden {
|
|
t.Fatalf("status = %d, want 403", rec.Code)
|
|
}
|
|
}
|
|
|
|
func TestRequireRoleAllowsSufficientRoleAndAttachesIdentity(t *testing.T) {
|
|
h := RequireRole(&fakeAuthorizer{identity: Identity{TenantID: "acme", Role: RoleAdmin}}, RoleEditor, okHandler)
|
|
rec := httptest.NewRecorder()
|
|
h(rec, httptest.NewRequest(http.MethodGet, "/", nil))
|
|
if rec.Code != http.StatusOK {
|
|
t.Fatalf("status = %d, want 200", rec.Code)
|
|
}
|
|
if got := rec.Header().Get("X-Test-Tenant"); got != "acme" {
|
|
t.Fatalf("expected the resolved identity to be attached to the request context, got tenant=%q", got)
|
|
}
|
|
}
|
|
|
|
func TestRequireRoleOrServiceAllowsServiceIdentity(t *testing.T) {
|
|
h := RequireRoleOrService(&fakeAuthorizer{identity: Identity{Role: RoleService}}, RoleAdmin, okHandler)
|
|
rec := httptest.NewRecorder()
|
|
h(rec, httptest.NewRequest(http.MethodGet, "/", nil))
|
|
if rec.Code != http.StatusOK {
|
|
t.Fatalf("status = %d, want 200 -- RoleService must satisfy RequireRoleOrService regardless of minRole", rec.Code)
|
|
}
|
|
}
|
|
|
|
func TestRequireRoleOrServiceStillRejectsInsufficientHumanRole(t *testing.T) {
|
|
h := RequireRoleOrService(&fakeAuthorizer{identity: Identity{Role: RoleViewer}}, RoleAdmin, okHandler)
|
|
rec := httptest.NewRecorder()
|
|
h(rec, httptest.NewRequest(http.MethodGet, "/", nil))
|
|
if rec.Code != http.StatusForbidden {
|
|
t.Fatalf("status = %d, want 403 -- allowing RoleService must not loosen the human-role check", rec.Code)
|
|
}
|
|
}
|
|
|
|
// TestRequireRolePlainDoesNotAllowService pins down the narrow-by-default
|
|
// property middleware.go's doc comment claims: an endpoint using plain
|
|
// RequireRole (not RequireRoleOrService) must reject a RoleService
|
|
// identity even if the minRole would technically be satisfiable on the
|
|
// human scale -- RoleService never satisfies anything but itself.
|
|
func TestRequireRolePlainDoesNotAllowService(t *testing.T) {
|
|
h := RequireRole(&fakeAuthorizer{identity: Identity{Role: RoleService}}, RoleViewer, okHandler)
|
|
rec := httptest.NewRecorder()
|
|
h(rec, httptest.NewRequest(http.MethodGet, "/", nil))
|
|
if rec.Code != http.StatusForbidden {
|
|
t.Fatalf("status = %d, want 403 -- plain RequireRole must never admit a service identity", rec.Code)
|
|
}
|
|
}
|