debian-mirror-gitlab/spec/models/concerns/token_authenticatable_strategies/encrypted_spec.rb

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

268 lines
8.5 KiB
Ruby
Raw Normal View History

2019-07-07 11:18:12 +05:30
# frozen_string_literal: true
2019-02-15 15:39:39 +05:30
require 'spec_helper'
2020-07-28 23:09:34 +05:30
RSpec.describe TokenAuthenticatableStrategies::Encrypted do
2019-02-15 15:39:39 +05:30
let(:model) { double(:model) }
let(:instance) { double(:instance) }
let(:encrypted) do
2021-04-29 21:17:54 +05:30
TokenAuthenticatableStrategies::EncryptionHelper.encrypt_token('my-value')
end
let(:encrypted_with_static_iv) do
2019-02-15 15:39:39 +05:30
Gitlab::CryptoHelper.aes256_gcm_encrypt('my-value')
end
2022-05-07 20:08:51 +05:30
subject(:strategy) do
2019-02-15 15:39:39 +05:30
described_class.new(model, 'some_field', options)
end
2022-05-07 20:08:51 +05:30
describe '#token_fields' do
let(:options) { { encrypted: :required } }
it 'includes the encrypted field' do
expect(strategy.token_fields).to contain_exactly('some_field', 'some_field_encrypted')
end
end
2019-02-15 15:39:39 +05:30
describe '#find_token_authenticatable' do
2021-04-29 21:17:54 +05:30
context 'when encryption is required' do
let(:options) { { encrypted: :required } }
it 'finds the encrypted resource by cleartext' do
2022-04-04 11:22:00 +05:30
allow(model).to receive(:where)
.and_return(model)
2021-04-29 21:17:54 +05:30
allow(model).to receive(:find_by)
.with('some_field_encrypted' => [encrypted, encrypted_with_static_iv])
.and_return('encrypted resource')
expect(subject.find_token_authenticatable('my-value'))
.to eq 'encrypted resource'
end
2022-02-27 12:50:16 +05:30
context 'when a prefix is required' do
let(:options) { { encrypted: :required, prefix: 'GR1348941' } }
it 'finds the encrypted resource by cleartext' do
allow(model).to receive(:where)
.and_return(model)
allow(model).to receive(:find_by)
.with('some_field_encrypted' => [encrypted, encrypted_with_static_iv])
.and_return('encrypted resource')
expect(subject.find_token_authenticatable('my-value'))
.to be_nil
end
end
2021-04-29 21:17:54 +05:30
end
context 'when encryption is optional' do
2019-07-07 11:18:12 +05:30
let(:options) { { encrypted: :optional } }
2019-02-15 15:39:39 +05:30
it 'finds the encrypted resource by cleartext' do
2022-04-04 11:22:00 +05:30
allow(model).to receive(:where)
.and_return(model)
2019-02-15 15:39:39 +05:30
allow(model).to receive(:find_by)
2021-04-29 21:17:54 +05:30
.with('some_field_encrypted' => [encrypted, encrypted_with_static_iv])
2019-02-15 15:39:39 +05:30
.and_return('encrypted resource')
expect(subject.find_token_authenticatable('my-value'))
.to eq 'encrypted resource'
end
it 'uses insecure strategy when encrypted token cannot be found' do
allow(subject.send(:insecure_strategy))
.to receive(:find_token_authenticatable)
.and_return('plaintext resource')
2022-04-04 11:22:00 +05:30
allow(model).to receive(:where)
.and_return(model)
2019-02-15 15:39:39 +05:30
allow(model).to receive(:find_by)
2021-04-29 21:17:54 +05:30
.with('some_field_encrypted' => [encrypted, encrypted_with_static_iv])
2019-02-15 15:39:39 +05:30
.and_return(nil)
expect(subject.find_token_authenticatable('my-value'))
.to eq 'plaintext resource'
end
2022-02-27 12:50:16 +05:30
context 'when a prefix is required' do
let(:options) { { encrypted: :optional, prefix: 'GR1348941' } }
it 'finds the encrypted resource by cleartext' do
allow(model).to receive(:where)
.and_return(model)
allow(model).to receive(:find_by)
.with('some_field_encrypted' => [encrypted, encrypted_with_static_iv])
.and_return('encrypted resource')
expect(subject.find_token_authenticatable('my-value'))
.to be_nil
end
end
2019-02-15 15:39:39 +05:30
end
2021-04-29 21:17:54 +05:30
context 'when encryption is migrating' do
2019-07-07 11:18:12 +05:30
let(:options) { { encrypted: :migrating } }
2019-02-15 15:39:39 +05:30
it 'finds the cleartext resource by cleartext' do
2022-04-04 11:22:00 +05:30
allow(model).to receive(:where)
.and_return(model)
2019-02-15 15:39:39 +05:30
allow(model).to receive(:find_by)
.with('some_field' => 'my-value')
.and_return('cleartext resource')
expect(subject.find_token_authenticatable('my-value'))
.to eq 'cleartext resource'
end
it 'returns nil if resource cannot be found' do
2022-04-04 11:22:00 +05:30
allow(model).to receive(:where)
.and_return(model)
2019-02-15 15:39:39 +05:30
allow(model).to receive(:find_by)
.with('some_field' => 'my-value')
.and_return(nil)
expect(subject.find_token_authenticatable('my-value'))
.to be_nil
end
2022-02-27 12:50:16 +05:30
context 'when a prefix is required' do
let(:options) { { encrypted: :migrating, prefix: 'GR1348941' } }
it 'finds the encrypted resource by cleartext' do
allow(model).to receive(:where)
.and_return(model)
allow(model).to receive(:find_by)
.with('some_field' => 'my-value')
.and_return('cleartext resource')
expect(subject.find_token_authenticatable('my-value'))
.to be_nil
end
end
2019-02-15 15:39:39 +05:30
end
end
describe '#get_token' do
2021-04-29 21:17:54 +05:30
context 'when encryption is required' do
let(:options) { { encrypted: :required } }
it 'returns decrypted token when an encrypted with static iv token is present' do
allow(instance).to receive(:read_attribute)
.with('some_field_encrypted')
.and_return(Gitlab::CryptoHelper.aes256_gcm_encrypt('my-test-value'))
expect(subject.get_token(instance)).to eq 'my-test-value'
end
it 'returns decrypted token when an encrypted token is present' do
allow(instance).to receive(:read_attribute)
.with('some_field_encrypted')
.and_return(encrypted)
2019-02-15 15:39:39 +05:30
2021-04-29 21:17:54 +05:30
expect(subject.get_token(instance)).to eq 'my-value'
2021-03-11 19:13:27 +05:30
end
2021-04-29 21:17:54 +05:30
end
context 'when encryption is optional' do
let(:options) { { encrypted: :optional } }
2021-03-11 19:13:27 +05:30
2019-02-15 15:39:39 +05:30
it 'returns decrypted token when an encrypted token is present' do
allow(instance).to receive(:read_attribute)
.with('some_field_encrypted')
.and_return(encrypted)
expect(subject.get_token(instance)).to eq 'my-value'
end
2021-04-29 21:17:54 +05:30
it 'returns decrypted token when an encrypted with static iv token is present' do
allow(instance).to receive(:read_attribute)
.with('some_field_encrypted')
.and_return(Gitlab::CryptoHelper.aes256_gcm_encrypt('my-test-value'))
expect(subject.get_token(instance)).to eq 'my-test-value'
end
2019-02-15 15:39:39 +05:30
it 'returns the plaintext token when encrypted token is not present' do
allow(instance).to receive(:read_attribute)
.with('some_field_encrypted')
.and_return(nil)
allow(instance).to receive(:read_attribute)
.with('some_field')
.and_return('cleartext value')
expect(subject.get_token(instance)).to eq 'cleartext value'
end
end
2021-04-29 21:17:54 +05:30
context 'when encryption is migrating' do
2019-07-07 11:18:12 +05:30
let(:options) { { encrypted: :migrating } }
2019-02-15 15:39:39 +05:30
it 'returns cleartext token when an encrypted token is present' do
allow(instance).to receive(:read_attribute)
.with('some_field_encrypted')
.and_return(encrypted)
allow(instance).to receive(:read_attribute)
.with('some_field')
.and_return('my-cleartext-value')
expect(subject.get_token(instance)).to eq 'my-cleartext-value'
end
it 'returns the cleartext token when encrypted token is not present' do
allow(instance).to receive(:read_attribute)
.with('some_field_encrypted')
.and_return(nil)
allow(instance).to receive(:read_attribute)
.with('some_field')
.and_return('cleartext value')
expect(subject.get_token(instance)).to eq 'cleartext value'
end
end
end
describe '#set_token' do
2021-04-29 21:17:54 +05:30
context 'when encryption is required' do
let(:options) { { encrypted: :required } }
it 'writes encrypted token and returns it' do
expect(instance).to receive(:[]=)
.with('some_field_encrypted', encrypted)
expect(subject.set_token(instance, 'my-value')).to eq 'my-value'
end
end
2023-03-04 22:38:38 +05:30
2021-04-29 21:17:54 +05:30
context 'when encryption is optional' do
2019-07-07 11:18:12 +05:30
let(:options) { { encrypted: :optional } }
2019-02-15 15:39:39 +05:30
it 'writes encrypted token and removes plaintext token and returns it' do
expect(instance).to receive(:[]=)
2021-04-29 21:17:54 +05:30
.with('some_field_encrypted', encrypted)
2019-02-15 15:39:39 +05:30
expect(instance).to receive(:[]=)
.with('some_field', nil)
expect(subject.set_token(instance, 'my-value')).to eq 'my-value'
end
end
2021-04-29 21:17:54 +05:30
context 'when encryption is migrating' do
2019-07-07 11:18:12 +05:30
let(:options) { { encrypted: :migrating } }
2019-02-15 15:39:39 +05:30
it 'writes encrypted token and writes plaintext token' do
expect(instance).to receive(:[]=)
2021-04-29 21:17:54 +05:30
.with('some_field_encrypted', encrypted)
2019-02-15 15:39:39 +05:30
expect(instance).to receive(:[]=)
.with('some_field', 'my-value')
expect(subject.set_token(instance, 'my-value')).to eq 'my-value'
end
end
end
end