-
Notifications
You must be signed in to change notification settings - Fork 2
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* Update iam-runtime dependency to v0.3.0 This commit updates iam-runtime-static to use v0.3.0 of the IAM runtime spec. Signed-off-by: John Schaeffer <[email protected]> * Update runtime implementation to match v0.3.0 interface This commit updates iam-runtime-static to use the v0.3.0 IAM runtime interface, returning authentication and authorization errors as result fields in the response rather than riding on gRPC errors. Signed-off-by: John Schaeffer <[email protected]> * Add proper linting, fix Makefile This commit adds a proper linter to the project and fixes the Makefile to be generally better at being a Makefile. Signed-off-by: John Schaeffer <[email protected]> * Remove reference to args in RunE to satisfy linter This commit makes some fixes to keep the linter happy. Signed-off-by: John Schaeffer <[email protected]> * Add tests This commit adds tests to iam-runtime-static. Signed-off-by: John Schaeffer <[email protected]> * Fix whitespace linting error This commit fixes a whitespace linting error in code. Signed-off-by: John Schaeffer <[email protected]> --------- Signed-off-by: John Schaeffer <[email protected]>
- Loading branch information
1 parent
691761b
commit ae7851f
Showing
8 changed files
with
275 additions
and
29 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,2 +1,4 @@ | ||
| *~ | ||
| bin/* | ||
| bin/* | ||
| coverage.out | ||
| .tools/* |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,61 @@ | ||
| linters-settings: | ||
| goimports: | ||
| local-prefixes: github.com/metal-toolbox/iam-runtime-static | ||
|
|
||
| run: | ||
| # default timeout is 1m | ||
| timeout: 3m | ||
|
|
||
| linters: | ||
| enable: | ||
| # default linters | ||
| - errcheck | ||
| - gosimple | ||
| - govet | ||
| - ineffassign | ||
| - staticcheck | ||
| - typecheck | ||
| - unused | ||
|
|
||
| # additional linters | ||
| - bodyclose | ||
| - gocritic | ||
| - gocyclo | ||
| - goerr113 | ||
| - gofmt | ||
| - goimports | ||
| - gomnd | ||
| - govet | ||
| - misspell | ||
| - noctx | ||
| - revive | ||
| - stylecheck | ||
| - whitespace | ||
| - wsl | ||
| - paralleltest | ||
|
|
||
| # - bod | ||
| issues: | ||
| exclude: | ||
| # Default excludes from `golangci-lint run --help` with EXC0002 removed | ||
| # EXC0001 errcheck: Almost all programs ignore errors on these functions and in most cases it's ok | ||
| - Error return value of .((os\.)?std(out|err)\..*|.*Close|.*Flush|os\.Remove(All)?|.*print(f|ln)?|os\.(Un)?Setenv). is not checked | ||
| # EXC0002 golint: Annoying issue about not having a comment. The rare codebase has such comments | ||
| # - (comment on exported (method|function|type|const)|should have( a package)? comment|comment should be of the form) | ||
| # EXC0003 golint: False positive when tests are defined in package 'test' | ||
| - func name will be used as test\.Test.* by other packages, and that stutters; consider calling this | ||
| # EXC0004 govet: Common false positives | ||
| - (possible misuse of unsafe.Pointer|should have signature) | ||
| # EXC0005 staticcheck: Developers tend to write in C-style with an explicit 'break' in a 'switch', so it's ok to ignore | ||
| - ineffective break statement. Did you mean to break out of the outer loop | ||
| # EXC0006 gosec: Too many false-positives on 'unsafe' usage | ||
| - Use of unsafe calls should be audited | ||
| # EXC0007 gosec: Too many false-positives for parametrized shell calls | ||
| - Subprocess launch(ed with variable|ing should be audited) | ||
| # EXC0008 gosec: Duplicated errcheck checks | ||
| - (G104|G307) | ||
| # EXC0009 gosec: Too many issues in popular repos | ||
| - (Expect directory permissions to be 0750 or less|Expect file permissions to be 0600 or less) | ||
| # EXC0010 gosec: False positive is triggered by 'src, err := ioutil.ReadFile(filename)' | ||
| - Potential file inclusion via variable | ||
| exclude-use-default: false |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,26 +1,36 @@ | ||
| all: lint test | ||
| PHONY: test coverage lint golint clean vendor docker-up docker-down unit-test | ||
| ROOT_DIR := $(shell dirname $(realpath $(firstword $(MAKEFILE_LIST)))) | ||
| TOOLS_DIR := .tools | ||
| GOOS ?= linux | ||
| GOARCH ?= amd64 | ||
|
|
||
| GOLANGCI_LINT_REPO = github.com/golangci/golangci-lint | ||
| GOLANGCI_LINT_VERSION = v1.56.1 | ||
|
|
||
| # use the working dir as the app name, this should be the repo name | ||
| APP_NAME=$(shell basename $(CURDIR)) | ||
|
|
||
| test: | unit-test | ||
| PHONY: all test lint build go-dependencies | ||
|
|
||
| unit-test: | lint | ||
| @echo Running unit tests... | ||
| @go test -cover -short -tags testtools ./... | ||
| all: go-dependencies test build | ||
|
|
||
| coverage: | ||
| @echo Generating coverage report... | ||
| test: lint | ||
| @echo Running unit tests... | ||
| @go test ./... -race -coverprofile=coverage.out -covermode=atomic -tags testtools -p 1 | ||
| @go tool cover -func=coverage.out | ||
| @go tool cover -html=coverage.out | ||
|
|
||
| lint: golint | ||
|
|
||
| golint: | vendor | ||
| lint: $(TOOLS_DIR)/golangci-lint | ||
| @echo Linting Go files... | ||
| @golangci-lint run --build-tags "-tags testtools" | ||
| @$(TOOLS_DIR)/golangci-lint run --modules-download-mode=readonly | ||
|
|
||
| build: | ||
| @go mod download | ||
| @CGO_ENABLED=0 go build -mod=readonly -v -o bin/${APP_NAME} | ||
|
|
||
| go-dependencies: | ||
| @go mod download | ||
| @go mod tidy | ||
|
|
||
| $(TOOLS_DIR): | ||
| mkdir -p $(TOOLS_DIR) | ||
|
|
||
| $(TOOLS_DIR)/golangci-lint: | $(TOOLS_DIR) | ||
| @echo "Installing $(GOLANGCI_LINT_REPO)/cmd/golangci-lint@$(GOLANGCI_LINT_VERSION)" | ||
| @GOBIN=$(ROOT_DIR)/$(TOOLS_DIR) go install $(GOLANGCI_LINT_REPO)/cmd/golangci-lint@$(GOLANGCI_LINT_VERSION) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,159 @@ | ||
| package server | ||
|
|
||
| import ( | ||
| "context" | ||
| "os" | ||
| "testing" | ||
|
|
||
| "github.com/metal-toolbox/iam-runtime/pkg/iam/runtime/authentication" | ||
| "github.com/metal-toolbox/iam-runtime/pkg/iam/runtime/authorization" | ||
|
|
||
| "github.com/stretchr/testify/require" | ||
| "go.uber.org/zap" | ||
| "google.golang.org/grpc/codes" | ||
| "google.golang.org/grpc/status" | ||
| ) | ||
|
|
||
| func TestServer(t *testing.T) { | ||
| // Run everything in parallel | ||
| t.Parallel() | ||
|
|
||
| // Set up a server with a simple policy. | ||
| subjectAlice := "alice" | ||
| subjectBob := "bob" | ||
|
|
||
| envVarAlice := "IAM_ALICE_TOKEN" | ||
| envVarBob := "IAM_BOB_TOKEN" | ||
|
|
||
| tokenAlice := "alic3!" | ||
| tokenBob := "b0b" | ||
| tokenDNE := "doesnotexist" | ||
|
|
||
| actionGreet := "greet" | ||
|
|
||
| resourceWorld := "resourc-world" | ||
|
|
||
| // In this policy, Alice has the ability to greet the world, but Bob does not. | ||
| authPolicy := policy{ | ||
| Subjects: []policySubject{ | ||
| { | ||
| ID: subjectAlice, | ||
| Tokens: []policyToken{ | ||
| { | ||
| EnvVar: envVarAlice, | ||
| }, | ||
| }, | ||
| Resources: []policyResource{ | ||
| { | ||
| ID: resourceWorld, | ||
| Actions: []string{ | ||
| actionGreet, | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| { | ||
| ID: subjectBob, | ||
| Tokens: []policyToken{ | ||
| { | ||
| EnvVar: envVarBob, | ||
| }, | ||
| }, | ||
| Resources: []policyResource{}, | ||
| }, | ||
| }, | ||
| } | ||
|
|
||
| // Set the environment variables for the test | ||
| os.Setenv(envVarAlice, tokenAlice) | ||
| os.Setenv(envVarBob, tokenBob) | ||
|
|
||
| logger := zap.NewNop().Sugar() | ||
|
|
||
| srv, err := newFromPolicy(authPolicy, logger) | ||
|
|
||
| require.NoError(t, err) | ||
|
|
||
| t.Run("ValidateCredentialSuccess", func(t *testing.T) { | ||
| t.Parallel() | ||
|
|
||
| req := &authentication.ValidateCredentialRequest{ | ||
| Credential: tokenAlice, | ||
| } | ||
| resp, err := srv.ValidateCredential(context.Background(), req) | ||
|
|
||
| require.NoError(t, err) | ||
| require.Equal(t, authentication.ValidateCredentialResponse_RESULT_VALID, resp.Result) | ||
| require.Equal(t, subjectAlice, resp.Subject.SubjectId) | ||
| }) | ||
|
|
||
| t.Run("ValidateCredentialFail", func(t *testing.T) { | ||
| t.Parallel() | ||
|
|
||
| req := &authentication.ValidateCredentialRequest{ | ||
| Credential: tokenDNE, | ||
| } | ||
| resp, err := srv.ValidateCredential(context.Background(), req) | ||
|
|
||
| require.NoError(t, err) | ||
| require.Equal(t, authentication.ValidateCredentialResponse_RESULT_INVALID, resp.Result) | ||
| }) | ||
|
|
||
| t.Run("CheckAccessSuccess", func(t *testing.T) { | ||
| t.Parallel() | ||
|
|
||
| req := &authorization.CheckAccessRequest{ | ||
| Credential: tokenAlice, | ||
| Actions: []*authorization.AccessRequestAction{ | ||
| { | ||
| ResourceId: resourceWorld, | ||
| Action: actionGreet, | ||
| }, | ||
| }, | ||
| } | ||
| resp, err := srv.CheckAccess(context.Background(), req) | ||
|
|
||
| require.NoError(t, err) | ||
| require.Equal(t, authorization.CheckAccessResponse_RESULT_ALLOWED, resp.Result) | ||
| }) | ||
|
|
||
| t.Run("CheckAccessUnauthenticated", func(t *testing.T) { | ||
| t.Parallel() | ||
|
|
||
| req := &authorization.CheckAccessRequest{ | ||
| Credential: tokenDNE, | ||
| Actions: []*authorization.AccessRequestAction{ | ||
| { | ||
| ResourceId: resourceWorld, | ||
| Action: actionGreet, | ||
| }, | ||
| }, | ||
| } | ||
|
|
||
| _, err := srv.CheckAccess(context.Background(), req) | ||
|
|
||
| errStatus, ok := status.FromError(err) | ||
|
|
||
| require.Equal(t, true, ok) | ||
| require.Equal(t, codes.InvalidArgument, errStatus.Code()) | ||
| }) | ||
|
|
||
| t.Run("CheckAccessUnauthorized", func(t *testing.T) { | ||
| t.Parallel() | ||
|
|
||
| req := &authorization.CheckAccessRequest{ | ||
| Credential: tokenBob, | ||
| Actions: []*authorization.AccessRequestAction{ | ||
| { | ||
| ResourceId: resourceWorld, | ||
| Action: actionGreet, | ||
| }, | ||
| }, | ||
| } | ||
|
|
||
| resp, err := srv.CheckAccess(context.Background(), req) | ||
|
|
||
| require.NoError(t, err) | ||
| require.Equal(t, authorization.CheckAccessResponse_RESULT_DENIED, resp.Result) | ||
| }) | ||
| } |