diff --git a/testsuite/tests/singlecluster/defaults/__init__.py b/testsuite/tests/singlecluster/defaults/__init__.py new file mode 100644 index 00000000..e69de29b diff --git a/testsuite/tests/singlecluster/defaults/test_basic_authorization.py b/testsuite/tests/singlecluster/defaults/test_basic_authorization.py new file mode 100644 index 00000000..af535d2d --- /dev/null +++ b/testsuite/tests/singlecluster/defaults/test_basic_authorization.py @@ -0,0 +1,36 @@ +"""Test basic enforcement of the rules inside the 'defaults' block of the AuthPolicy""" + +import pytest + +from testsuite.httpx.auth import HttpxOidcClientAuth + +pytestmark = [pytest.mark.kuadrant_only] + + +@pytest.fixture(scope="module") +def authorization(authorization, oidc_provider): + """Add oidc identity to defaults block of AuthPolicy""" + authorization.defaults.identity.add_oidc("default", oidc_provider.well_known["issuer"]) + return authorization + + +@pytest.fixture(scope="module") +def auth(oidc_provider): + """Returns Authentication object for HTTPX""" + return HttpxOidcClientAuth(oidc_provider.get_token, "authorization") + + +@pytest.fixture(scope="module") +def rate_limit(): + """No RateLimitPolicy is required for this test""" + return None + + +@pytest.mark.parametrize("authorization", ["route", "gateway"], indirect=True) +def test_basic_authorization(authorization, route, client, auth): + """Test that default identity is applied successfully and shows affected status in the route""" + route.refresh() + assert route.is_affected_by(authorization) + + assert client.get("/get").status_code == 401 + assert client.get("/get", auth=auth).status_code == 200 # assert that AuthPolicy is enforced diff --git a/testsuite/tests/singlecluster/defaults/test_basic_rate_limit.py b/testsuite/tests/singlecluster/defaults/test_basic_rate_limit.py new file mode 100644 index 00000000..713bb5da --- /dev/null +++ b/testsuite/tests/singlecluster/defaults/test_basic_rate_limit.py @@ -0,0 +1,33 @@ +"""Test basic enforcement of the rules inside the 'defaults' block of the RateLimitPolicy""" + +import pytest + +from testsuite.kuadrant.policy.rate_limit import Limit + +pytestmark = [pytest.mark.kuadrant_only, pytest.mark.limitador] + +LIMIT = Limit(3, 5) + + +@pytest.fixture(scope="module") +def authorization(): + """No authorization is required for this test""" + return None + + +@pytest.fixture(scope="module") +def rate_limit(rate_limit): + """Add basic requests limit to defaults block of RateLimitPolicy""" + rate_limit.defaults.add_limit("basic", [LIMIT]) + return rate_limit + + +@pytest.mark.parametrize("rate_limit", ["route", "gateway"], indirect=True) +def test_basic_rate_limit(rate_limit, route, client): + """Test that default rate limit is applied successfully and shows affected status in the route""" + route.refresh() + assert route.is_affected_by(rate_limit) + + responses = client.get_many("/get", LIMIT.limit) + responses.assert_all(status_code=200) + assert client.get("/get").status_code == 429 # assert that RateLimitPolicy is enforced diff --git a/testsuite/tests/singlecluster/defaults/test_rules_exclusivity.py b/testsuite/tests/singlecluster/defaults/test_rules_exclusivity.py new file mode 100644 index 00000000..cfab0e90 --- /dev/null +++ b/testsuite/tests/singlecluster/defaults/test_rules_exclusivity.py @@ -0,0 +1,44 @@ +"""Test mutual exclusivity of defaults block and implicit defaults""" + +import pytest +from openshift_client import OpenShiftPythonException + +from testsuite.kuadrant.policy.rate_limit import Limit + +pytestmark = [pytest.mark.kuadrant_only, pytest.mark.limitador] + + +@pytest.fixture(scope="module") +def authorization(authorization, oidc_provider): + """Create AuthPolicy with basic oidc rules inside and outside defaults block""" + authorization.defaults.identity.add_oidc("inside-defaults", oidc_provider.well_known["issuer"]) + authorization.identity.add_oidc("outside-defaults", oidc_provider.well_known["issuer"]) + return authorization + + +@pytest.fixture(scope="module") +def rate_limit(rate_limit): + """Add basic rate limiting rules inside and outside defaults block""" + rate_limit.defaults.add_limit("inside-defaults", [Limit(2, 5)]) + rate_limit.add_limit("outside-defaults", [Limit(2, 5)]) + return rate_limit + + +@pytest.fixture(scope="module") +def commit(): + """We need to try to commit objects during the actual test""" + return None + + +@pytest.mark.parametrize( + "component_fixture", + [ + pytest.param("authorization", id="AuthPolicy"), + pytest.param("rate_limit", id="RateLimitPolicy"), + ], +) +def test_rules_exclusivity(request, component_fixture): + """Test that server will reject object with implicit and explicit defaults defined simultaneously""" + component = request.getfixturevalue(component_fixture) + with pytest.raises(OpenShiftPythonException, match="Implicit and explicit defaults are mutually exclusive"): + component.commit()