47 lines
2.0 KiB
Go
47 lines
2.0 KiB
Go
package server
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
// The unauthenticated embedded single-user mode must not expose any account
|
|
// administration operation (R1), regardless of request fields.
|
|
func TestUnauthenticatedModeBlocksAccountAdministration(t *testing.T) {
|
|
srv, st := newTestServer(t)
|
|
if srv.Auth != nil && srv.Auth.Enabled {
|
|
t.Fatal("expected unauthenticated test server")
|
|
}
|
|
h := srv.Handler()
|
|
routes := []struct{ method, path, body string }{
|
|
{http.MethodGet, "/api/admin/users", ""},
|
|
{http.MethodGet, "/api/admin/users/search?q=a", ""},
|
|
{http.MethodPost, "/api/admin/users", `{"owner":"mallory","isAdmin":true,"role":"admin"}`},
|
|
{http.MethodGet, "/api/admin/users/usr_x", ""},
|
|
{http.MethodPatch, "/api/admin/users/usr_x/profile", `{"expectedProfileVersion":1,"patch":{"name":"x"}}`},
|
|
{http.MethodPut, "/api/admin/users/usr_x/state", `{"enabled":false}`},
|
|
{http.MethodPut, "/api/admin/users/usr_x/admin", `{"expectedStateVersion":1,"isAdmin":true}`},
|
|
{http.MethodPost, "/api/admin/users/root/one-time-password", `{}`},
|
|
{http.MethodGet, "/api/admin/permissions/catalog", ""},
|
|
{http.MethodGet, "/api/admin/roles", ""},
|
|
{http.MethodPost, "/api/admin/roles", `{"name":"x"}`},
|
|
{http.MethodPut, "/api/admin/users/usr_x/role", `{"roleId":"admin"}`},
|
|
{http.MethodGet, "/api/admin/users/usr_x/system-grants", ""},
|
|
{http.MethodPut, "/api/admin/users/usr_x/system-grants", `{"actions":["system.users.create"]}`},
|
|
}
|
|
for _, route := range routes {
|
|
req := httptest.NewRequest(route.method, route.path, strings.NewReader(route.body))
|
|
req.Header.Set("Content-Type", "application/json")
|
|
rec := httptest.NewRecorder()
|
|
h.ServeHTTP(rec, req)
|
|
if rec.Code != http.StatusForbidden {
|
|
t.Errorf("%s %s: status=%d body=%s; want 403", route.method, route.path, rec.Code, rec.Body.String())
|
|
}
|
|
}
|
|
if users, err := st.ListUsersAdmin(); err != nil || len(users) != 0 {
|
|
t.Fatalf("unauthenticated request created accounts: %d err=%v", len(users), err)
|
|
}
|
|
}
|