80 lines
2.6 KiB
Go
80 lines
2.6 KiB
Go
package vault
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"net/url"
|
|
"os"
|
|
"path/filepath"
|
|
"sync/atomic"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestIssuerLifetimeEncodingAndCleanup(t *testing.T) {
|
|
for _, test := range []struct {
|
|
name string
|
|
identityTTL, databaseTTL int
|
|
reject bool
|
|
wantError bool
|
|
}{
|
|
{"identity limits lease", 4, 20, false, false},
|
|
{"database limits lease", 20, 4, false, false},
|
|
{"invalid identity", 0, 20, false, true},
|
|
{"invalid database lifetime", 20, 0, false, true},
|
|
{"rejected issuance", 20, 20, true, true},
|
|
} {
|
|
t.Run(test.name, func(t *testing.T) {
|
|
var revoked atomic.Bool
|
|
server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
switch r.URL.Path {
|
|
case "/v1/auth/approle/login":
|
|
_ = json.NewEncoder(w).Encode(map[string]any{"auth": map[string]any{"client_token": "private-token", "lease_duration": test.identityTTL}})
|
|
case "/v1/database/creds/bff":
|
|
if test.reject {
|
|
http.Error(w, "private-password", 403)
|
|
return
|
|
}
|
|
_ = json.NewEncoder(w).Encode(map[string]any{"lease_id": "lease", "lease_duration": test.databaseTTL, "data": map[string]string{"username": "user@host", "password": "p@ss:/?#"}})
|
|
case "/v1/auth/token/revoke-self":
|
|
if r.Header.Get("X-Vault-Token") == "private-token" {
|
|
revoked.Store(true)
|
|
}
|
|
w.WriteHeader(204)
|
|
default:
|
|
w.WriteHeader(404)
|
|
}
|
|
}))
|
|
defer server.Close()
|
|
directory := t.TempDir()
|
|
identity, secret := filepath.Join(directory, "identity"), filepath.Join(directory, "secret")
|
|
require.NoError(t, os.WriteFile(identity, []byte("identity"), 0600))
|
|
require.NoError(t, os.WriteFile(secret, []byte("secret"), 0600))
|
|
issuer, err := New(Config{Address: server.URL, DatabaseRole: "bff", RoleIDFile: identity, SecretIDFile: secret}, "mongodb://localhost/db?authSource=admin")
|
|
require.NoError(t, err)
|
|
started := time.Now()
|
|
lease, err := issuer.Issue(context.Background())
|
|
if test.wantError {
|
|
require.Error(t, err)
|
|
require.NotContains(t, err.Error(), "private-")
|
|
require.True(t, revoked.Load())
|
|
return
|
|
}
|
|
require.NoError(t, err)
|
|
require.WithinDuration(t, started.Add(4*time.Second), lease.ExpiresAt, time.Second)
|
|
parsed, err := url.Parse(lease.URI)
|
|
require.NoError(t, err)
|
|
require.Equal(t, "user@host", parsed.User.Username())
|
|
password, _ := parsed.User.Password()
|
|
require.Equal(t, "p@ss:/?#", password)
|
|
require.False(t, revoked.Load())
|
|
require.NoError(t, lease.Revoke(context.Background()))
|
|
require.True(t, revoked.Load())
|
|
})
|
|
}
|
|
}
|