debian-mirror-gitlab/spec/requests/jwt_controller_spec.rb
2023-05-27 22:25:52 +05:30

348 lines
12 KiB
Ruby

# frozen_string_literal: true
require 'spec_helper'
RSpec.describe JwtController, feature_category: :system_access do
include_context 'parsed logs'
let(:service) { double(execute: {} ) }
let(:service_class) { Auth::ContainerRegistryAuthenticationService }
let(:service_name) { 'container_registry' }
let(:parameters) { { service: service_name } }
before do
allow(service_class).to receive(:new).and_return(service)
end
shared_examples 'user logging' do
it 'logs username and ID' do
expect(log_data['username']).to eq(user.username)
expect(log_data['user_id']).to eq(user.id)
expect(log_data['meta.user']).to eq(user.username)
end
end
shared_examples 'a token that expires today' do
let(:pat) { create(:personal_access_token, user: user, scopes: ['api'], expires_at: Date.today ) }
let(:headers) { { authorization: credentials('personal_access_token', pat.token) } }
it 'fails authentication' do
expect(::Gitlab::AuthLogger).to receive(:warn).with(
hash_including(message: 'JWT authentication failed',
http_user: 'personal_access_token')).and_call_original
get '/jwt/auth', params: parameters, headers: headers
expect(response).to have_gitlab_http_status(:unauthorized)
end
end
shared_examples "with invalid credentials" do
it "returns a generic error message" do
subject
expect(response).to have_gitlab_http_status(:unauthorized)
expect(json_response).to eq(
{
"errors" => [{
"code" => "UNAUTHORIZED",
"message" => "HTTP Basic: Access denied. The provided password or token is incorrect or your account has 2FA enabled and you must use a personal access token instead of a password. See http://www.example.com/help/user/profile/account/two_factor_authentication#troubleshooting"
}]
}
)
end
end
context 'POST /jwt/auth' do
it 'returns 404' do
post '/jwt/auth'
expect(response).to have_gitlab_http_status(:not_found)
end
end
context 'authenticating against container registry' do
context 'existing service' do
subject! { get '/jwt/auth', params: parameters }
it { expect(response).to have_gitlab_http_status(:ok) }
context 'returning custom http code' do
let(:service) { double(execute: { http_status: 505 }) }
it { expect(response).to have_gitlab_http_status(:http_version_not_supported) }
end
end
context 'when using authenticated request' do
shared_examples 'rejecting a blocked user' do
context 'with blocked user' do
let(:user) { create(:user, :blocked) }
it_behaves_like 'with invalid credentials'
end
end
context 'using CI token' do
let(:user) { create(:user) }
let(:build) { create(:ci_build, :running, user: user) }
let(:project) { build.project }
let(:headers) { { authorization: credentials('gitlab-ci-token', build.token) } }
context 'project with enabled CI' do
subject! { get '/jwt/auth', params: parameters, headers: headers }
it { expect(service_class).to have_received(:new).with(project, user, ActionController::Parameters.new(parameters.merge(auth_type: :build)).permit!) }
it_behaves_like 'user logging'
end
context 'project with disabled CI' do
before do
project.project_feature.update_attribute(:builds_access_level, ProjectFeature::DISABLED)
end
subject! { get '/jwt/auth', params: parameters, headers: headers }
it { expect(response).to have_gitlab_http_status(:unauthorized) }
end
context 'using deploy tokens' do
let(:deploy_token) { create(:deploy_token, read_registry: true, projects: [project]) }
let(:headers) { { authorization: credentials(deploy_token.username, deploy_token.token) } }
subject! { get '/jwt/auth', params: parameters, headers: headers }
it 'authenticates correctly' do
expect(response).to have_gitlab_http_status(:ok)
expect(service_class).to have_received(:new)
.with(
nil,
nil,
ActionController::Parameters.new(parameters.merge(deploy_token: deploy_token, auth_type: :deploy_token)).permit!
)
end
it 'does not log a user' do
expect(log_data.keys).not_to include(%w(username user_id))
end
end
context 'using personal access tokens' do
let(:pat) { create(:personal_access_token, user: user, scopes: ['read_registry']) }
let(:headers) { { authorization: credentials('personal_access_token', pat.token) } }
before do
stub_container_registry_config(enabled: true)
end
subject! { get '/jwt/auth', params: parameters, headers: headers }
it 'authenticates correctly' do
expect(response).to have_gitlab_http_status(:ok)
expect(service_class).to have_received(:new)
.with(
nil,
user,
ActionController::Parameters.new(parameters.merge(auth_type: :personal_access_token)).permit!
)
end
it_behaves_like 'rejecting a blocked user'
it_behaves_like 'user logging'
it_behaves_like 'a token that expires today'
end
end
context 'using User login' do
let(:user) { create(:user) }
let(:headers) { { authorization: credentials(user.username, user.password) } }
subject! { get '/jwt/auth', params: parameters, headers: headers }
it { expect(service_class).to have_received(:new).with(nil, user, ActionController::Parameters.new(parameters.merge(auth_type: :gitlab_or_ldap)).permit!) }
it_behaves_like 'rejecting a blocked user'
context 'when passing a flat array of scopes' do
# We use this trick to make rails to generate a query_string:
# scope=scope1&scope=scope2
# It works because :scope and 'scope' are the same as string, but different objects
let(:parameters) do
{
:service => service_name,
:scope => 'scope1',
'scope' => 'scope2'
}
end
let(:service_parameters) do
ActionController::Parameters.new({ service: service_name, scopes: %w(scope1 scope2) }).permit!
end
it { expect(service_class).to have_received(:new).with(nil, user, service_parameters.merge(auth_type: :gitlab_or_ldap)) }
it_behaves_like 'user logging'
end
context 'when user has 2FA enabled' do
let(:user) { create(:user, :two_factor) }
context 'without personal token' do
it_behaves_like 'with invalid credentials'
end
context 'with personal token' do
let(:access_token) { create(:personal_access_token, user: user) }
let(:headers) { { authorization: credentials(user.username, access_token.token) } }
it 'accepts the authorization attempt' do
expect(response).to have_gitlab_http_status(:ok)
end
end
end
it 'does not cause session based checks to be activated' do
expect(Gitlab::Session).not_to receive(:with_session)
get '/jwt/auth', params: parameters, headers: headers
expect(response).to have_gitlab_http_status(:ok)
end
end
context 'using invalid login' do
let(:headers) { { authorization: credentials('invalid', 'password') } }
let(:subject) { get '/jwt/auth', params: parameters, headers: headers }
context 'when internal auth is enabled' do
it_behaves_like 'with invalid credentials'
end
context 'when internal auth is disabled' do
before do
stub_application_setting(password_authentication_enabled_for_git: false)
end
it_behaves_like 'with invalid credentials'
end
end
end
context 'when using unauthenticated request' do
it 'accepts the authorization attempt' do
get '/jwt/auth', params: parameters
expect(response).to have_gitlab_http_status(:ok)
end
it 'allows read access' do
expect(service).to receive(:execute).with(authentication_abilities: Gitlab::Auth.read_only_authentication_abilities)
get '/jwt/auth', params: parameters
end
end
context 'unknown service' do
subject! { get '/jwt/auth', params: { service: 'unknown' } }
it { expect(response).to have_gitlab_http_status(:not_found) }
end
def credentials(login, password)
ActionController::HttpAuthentication::Basic.encode_credentials(login, password)
end
end
context 'authenticating against dependency proxy' do
let_it_be(:user) { create(:user) }
let_it_be(:personal_access_token) { create(:personal_access_token, user: user) }
let_it_be(:group) { create(:group) }
let_it_be(:project) { create(:project, :private, group: group) }
let_it_be(:group_deploy_token) { create(:deploy_token, :group, :dependency_proxy_scopes) }
let_it_be(:gdeploy_token) { create(:group_deploy_token, deploy_token: group_deploy_token, group: group) }
let_it_be(:project_deploy_token) { create(:deploy_token, :project, :dependency_proxy_scopes) }
let_it_be(:pdeploy_token) { create(:project_deploy_token, deploy_token: project_deploy_token, project: project) }
let_it_be(:service_name) { 'dependency_proxy' }
let(:headers) { { authorization: credentials(credential_user, credential_password) } }
let(:params) { { account: credential_user, client_id: 'docker', offline_token: true, service: service_name } }
before do
stub_config(dependency_proxy: { enabled: true })
end
subject { get '/jwt/auth', params: params, headers: headers }
shared_examples 'with valid credentials' do
it 'returns token successfully' do
subject
expect(response).to have_gitlab_http_status(:success)
expect(json_response['token']).to be_present
end
end
context 'with personal access token' do
let(:credential_user) { nil }
let(:credential_password) { personal_access_token.token }
it_behaves_like 'with valid credentials'
it_behaves_like 'a token that expires today'
end
context 'with user credentials token' do
let(:credential_user) { user.username }
let(:credential_password) { user.password }
it_behaves_like 'with valid credentials'
end
context 'with group deploy token' do
let(:credential_user) { group_deploy_token.username }
let(:credential_password) { group_deploy_token.token }
it_behaves_like 'with valid credentials'
end
context 'with project deploy token' do
let(:credential_user) { project_deploy_token.username }
let(:credential_password) { project_deploy_token.token }
it_behaves_like 'returning response status', :forbidden
end
context 'with revoked group deploy token' do
let(:credential_user) { group_deploy_token.username }
let(:credential_password) { project_deploy_token.token }
before do
group_deploy_token.update_column(:revoked, true)
end
it_behaves_like 'returning response status', :unauthorized
end
context 'with group deploy token with insufficient scopes' do
let(:credential_user) { group_deploy_token.username }
let(:credential_password) { project_deploy_token.token }
before do
group_deploy_token.update_column(:write_registry, false)
end
it_behaves_like 'returning response status', :unauthorized
end
context 'with invalid credentials' do
let(:credential_user) { 'foo' }
let(:credential_password) { 'bar' }
it_behaves_like 'returning response status', :unauthorized
end
end
def credentials(login, password)
ActionController::HttpAuthentication::Basic.encode_credentials(login, password)
end
end