unkin-agent
9161558334
ci/woodpecker/tag/docker Pipeline was successful
Remote and virtual configuration writes are unauthenticated, so anything that can reach the API can repoint or delete repos. Vault identity OIDC tokens give callers a verifiable identity. - add `ARTIFACTAPI_OIDC_ISSUER`/`ARTIFACTAPI_OIDC_AUDIENCE`; unset issuer keeps auth off - require a JWKS-verified bearer token on POST/PUT/DELETE of `/api/v2/remotes` and `/api/v2/virtuals`, 401 otherwise - leave uploads, object deletes, probe, reads and `/v2` open - discover the issuer lazily with a 10s client timeout; fail fast with 503 for 15s after a failed discovery - log the verified `sub`; allow `Authorization` in CORS Reviewed-on: #136 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
81 lines
2.6 KiB
Go
81 lines
2.6 KiB
Go
package server
|
|
|
|
import (
|
|
"io"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
|
|
"git.unkin.net/unkin/artifactapi/internal/testsupport"
|
|
)
|
|
|
|
func TestServerOIDCWriteAuth(t *testing.T) {
|
|
requireStack(t)
|
|
iss := testsupport.NewOIDCIssuer()
|
|
defer iss.Close()
|
|
|
|
cfg := *testSrv.cfg
|
|
cfg.OIDCIssuer = iss.URL
|
|
cfg.OIDCAudiences = []string{"artifactapi"}
|
|
s := *testSrv
|
|
s.cfg = &cfg
|
|
ts := httptest.NewServer(s.routes())
|
|
defer ts.Close()
|
|
|
|
good := iss.Token(nil, "artifactapi", "ci", time.Hour)
|
|
do := func(method, path, body, token string) int {
|
|
t.Helper()
|
|
rq, _ := http.NewRequest(method, ts.URL+path, strings.NewReader(body))
|
|
rq.Header.Set("Content-Type", "application/json")
|
|
if token != "" {
|
|
rq.Header.Set("Authorization", "Bearer "+token)
|
|
}
|
|
resp, err := http.DefaultClient.Do(rq)
|
|
if err != nil {
|
|
t.Fatalf("%s %s: %v", method, path, err)
|
|
}
|
|
_, _ = io.Copy(io.Discard, resp.Body)
|
|
_ = resp.Body.Close()
|
|
return resp.StatusCode
|
|
}
|
|
expect := func(want int, method, path, body, token string) {
|
|
t.Helper()
|
|
if got := do(method, path, body, token); got != want {
|
|
t.Errorf("%s %s: status %d, want %d", method, path, got, want)
|
|
}
|
|
}
|
|
|
|
remote := `{"name":"srv-oidc","package_type":"generic","repo_type":"local"}`
|
|
virtual := `{"name":"srv-oidc-v","package_type":"generic","members":["srv-oidc"]}`
|
|
|
|
expect(401, "POST", "/api/v2/remotes", remote, "")
|
|
expect(401, "POST", "/api/v2/remotes", remote, iss.Token(nil, "other", "ci", time.Hour))
|
|
expect(201, "POST", "/api/v2/remotes", remote, good)
|
|
expect(401, "PUT", "/api/v2/remotes/srv-oidc", `{"package_type":"generic"}`, "")
|
|
expect(401, "DELETE", "/api/v2/remotes/srv-oidc", "", "")
|
|
expect(401, "POST", "/api/v2/virtuals", virtual, "")
|
|
expect(201, "POST", "/api/v2/virtuals", virtual, good)
|
|
expect(401, "PUT", "/api/v2/virtuals/srv-oidc-v", virtual, "")
|
|
expect(401, "DELETE", "/api/v2/virtuals/srv-oidc-v", "", "")
|
|
|
|
expect(200, "GET", "/api/v2/remotes", "", "")
|
|
expect(200, "GET", "/api/v2/remotes/srv-oidc", "", "")
|
|
expect(200, "GET", "/api/v2/virtuals/srv-oidc-v", "", "")
|
|
expect(201, "PUT", "/api/v2/remotes/srv-oidc/files/a.bin", "payload", "")
|
|
expect(200, "GET", "/api/v2/remotes/srv-oidc/files/a.bin", "", "")
|
|
if got := do("DELETE", "/api/v2/remotes/srv-oidc/files/a.bin", "", ""); got >= 400 {
|
|
t.Errorf("delete file: status %d", got)
|
|
}
|
|
if got := do("POST", "/api/v2/probe", `{}`, ""); got == 401 {
|
|
t.Error("probe gated")
|
|
}
|
|
if got := do("GET", "/v2/", "", ""); got == 401 {
|
|
t.Error("docker /v2 gated")
|
|
}
|
|
|
|
expect(204, "DELETE", "/api/v2/virtuals/srv-oidc-v", "", good)
|
|
expect(204, "DELETE", "/api/v2/remotes/srv-oidc", "", good)
|
|
}
|