| #!/usr/bin/env vpython |
| # Copyright 2016 The LUCI Authors. All rights reserved. |
| # Use of this source code is governed under the Apache License, Version 2.0 |
| # that can be found in the LICENSE file. |
| |
| import logging |
| import sys |
| import unittest |
| |
| import test_env |
| test_env.setup_test_env() |
| |
| # from components.auth import api |
| from components import auth |
| from components import auth_testing |
| from components import utils |
| from server import config |
| from test_support import test_case |
| |
| from proto.config import config_pb2 |
| |
| from server import acl |
| from server import task_request |
| |
| |
| # Default names of authorization groups. |
| ADMINS_GROUP = 'administrators' |
| PRIVILEGED_USERS_GROUP = ADMINS_GROUP |
| USERS_GROUP = ADMINS_GROUP |
| BOT_BOOTSTRAP_GROUP = ADMINS_GROUP |
| |
| |
| class AclTest(test_case.TestCase): |
| def setUp(self): |
| super(AclTest, self).setUp() |
| auth_testing.reset_local_state() |
| auth_testing.mock_get_current_identity(self) |
| |
| def settings(): |
| return config_pb2.SettingsCfg( |
| auth=config_pb2.AuthSettings( |
| admins_group='admins', |
| bot_bootstrap_group='bot_bootstrap', |
| privileged_users_group='privileged_users', |
| users_group='users', |
| view_all_bots_group='view_all_bots', |
| view_all_tasks_group='view_all_tasks')) |
| self.mock(config, 'settings', settings) |
| |
| @staticmethod |
| def _add_to_group(group): |
| auth.bootstrap_group(group, [auth.get_current_identity()]) |
| auth_testing.reset_local_state() |
| |
| def test_nobody(self): |
| auth_testing.mock_get_current_identity(self, auth.Anonymous) |
| self.assertFalse(acl.is_ip_whitelisted_machine()) |
| self.assertFalse(acl.can_access()) |
| self.assertFalse(acl.can_view_config()) |
| self.assertFalse(acl.can_edit_config()) |
| self.assertFalse(acl.can_create_bot()) |
| self.assertFalse(acl.can_edit_bot()) |
| self.assertFalse(acl.can_delete_bot()) |
| self.assertFalse(acl.can_view_bot()) |
| self.assertFalse(acl.can_create_task()) |
| self.assertFalse(acl.can_schedule_high_priority_tasks()) |
| self.assertFalse(acl.can_edit_one_task()) |
| self.assertFalse(acl.can_edit_all_tasks()) |
| self.assertFalse(acl.can_view_all_tasks()) |
| |
| def test_instance_admin(self): |
| auth_testing.mock_is_admin(self, True) |
| self.assertFalse(acl.is_ip_whitelisted_machine()) |
| self.assertTrue(acl.can_access()) |
| self.assertTrue(acl.can_view_config()) |
| self.assertTrue(acl.can_edit_config()) |
| self.assertTrue(acl.can_create_bot()) |
| self.assertTrue(acl.can_edit_bot()) |
| self.assertTrue(acl.can_delete_bot()) |
| self.assertTrue(acl.can_view_bot()) |
| self.assertTrue(acl.can_create_task()) |
| self.assertTrue(acl.can_schedule_high_priority_tasks()) |
| self.assertTrue(acl.can_edit_one_task()) |
| self.assertTrue(acl.can_edit_all_tasks()) |
| self.assertTrue(acl.can_view_all_tasks()) |
| |
| def test_ip_whitelisted(self): |
| self.mock(auth, 'is_in_ip_whitelist', lambda _name, _ip, _warn: True) |
| self.assertTrue(acl.is_ip_whitelisted_machine()) |
| self.assertFalse(acl.can_access()) |
| self.assertFalse(acl.can_view_config()) |
| self.assertFalse(acl.can_edit_config()) |
| self.assertFalse(acl.can_create_bot()) |
| self.assertFalse(acl.can_edit_bot()) |
| self.assertFalse(acl.can_delete_bot()) |
| self.assertFalse(acl.can_view_bot()) |
| self.assertFalse(acl.can_create_task()) |
| self.assertFalse(acl.can_schedule_high_priority_tasks()) |
| self.assertFalse(acl.can_edit_one_task()) |
| self.assertFalse(acl.can_edit_all_tasks()) |
| self.assertFalse(acl.can_view_all_tasks()) |
| |
| def test_admins(self): |
| self._add_to_group('admins') |
| self.assertFalse(acl.is_ip_whitelisted_machine()) |
| self.assertTrue(acl.can_access()) |
| self.assertTrue(acl.can_view_config()) |
| self.assertTrue(acl.can_edit_config()) |
| self.assertTrue(acl.can_create_bot()) |
| self.assertTrue(acl.can_edit_bot()) |
| self.assertTrue(acl.can_delete_bot()) |
| self.assertTrue(acl.can_view_bot()) |
| self.assertTrue(acl.can_create_task()) |
| self.assertTrue(acl.can_schedule_high_priority_tasks()) |
| self.assertTrue(acl.can_edit_one_task()) |
| self.assertTrue(acl.can_edit_all_tasks()) |
| self.assertTrue(acl.can_view_all_tasks()) |
| |
| def test_bot_bootstrap(self): |
| self._add_to_group('bot_bootstrap') |
| self.assertFalse(acl.is_ip_whitelisted_machine()) |
| self.assertFalse(acl.can_access()) |
| self.assertFalse(acl.can_view_config()) |
| self.assertFalse(acl.can_edit_config()) |
| self.assertTrue(acl.can_create_bot()) |
| self.assertFalse(acl.can_edit_bot()) |
| self.assertFalse(acl.can_delete_bot()) |
| self.assertFalse(acl.can_view_bot()) |
| self.assertFalse(acl.can_create_task()) |
| self.assertFalse(acl.can_schedule_high_priority_tasks()) |
| self.assertFalse(acl.can_edit_one_task()) |
| self.assertFalse(acl.can_edit_all_tasks()) |
| self.assertFalse(acl.can_view_all_tasks()) |
| |
| def test_privileged_users(self): |
| self._add_to_group('privileged_users') |
| self.assertFalse(acl.is_ip_whitelisted_machine()) |
| self.assertTrue(acl.can_access()) |
| self.assertFalse(acl.can_view_config()) |
| self.assertFalse(acl.can_edit_config()) |
| self.assertFalse(acl.can_create_bot()) |
| self.assertTrue(acl.can_edit_bot()) |
| self.assertFalse(acl.can_delete_bot()) |
| self.assertTrue(acl.can_view_bot()) |
| self.assertTrue(acl.can_create_task()) |
| self.assertFalse(acl.can_schedule_high_priority_tasks()) |
| self.assertTrue(acl.can_edit_one_task()) |
| self.assertFalse(acl.can_edit_all_tasks()) |
| self.assertTrue(acl.can_view_all_tasks()) |
| |
| def test_users(self): |
| self._add_to_group('users') |
| self.assertFalse(acl.is_ip_whitelisted_machine()) |
| self.assertTrue(acl.can_access()) |
| self.assertFalse(acl.can_view_config()) |
| self.assertFalse(acl.can_edit_config()) |
| self.assertFalse(acl.can_create_bot()) |
| self.assertFalse(acl.can_edit_bot()) |
| self.assertFalse(acl.can_delete_bot()) |
| self.assertFalse(acl.can_view_bot()) |
| self.assertTrue(acl.can_create_task()) |
| self.assertFalse(acl.can_schedule_high_priority_tasks()) |
| self.assertFalse(acl.can_edit_one_task()) |
| self.assertFalse(acl.can_edit_all_tasks()) |
| self.assertFalse(acl.can_view_all_tasks()) |
| |
| def test_view_all_bots(self): |
| self._add_to_group('view_all_bots') |
| self.assertFalse(acl.is_ip_whitelisted_machine()) |
| self.assertTrue(acl.can_access()) |
| self.assertFalse(acl.can_view_config()) |
| self.assertFalse(acl.can_edit_config()) |
| self.assertFalse(acl.can_create_bot()) |
| self.assertFalse(acl.can_edit_bot()) |
| self.assertFalse(acl.can_delete_bot()) |
| self.assertTrue(acl.can_view_bot()) |
| self.assertFalse(acl.can_create_task()) |
| self.assertFalse(acl.can_schedule_high_priority_tasks()) |
| self.assertFalse(acl.can_edit_one_task()) |
| self.assertFalse(acl.can_edit_all_tasks()) |
| self.assertFalse(acl.can_view_all_tasks()) |
| |
| def test_view_all_tasks(self): |
| self._add_to_group('view_all_tasks') |
| self.assertFalse(acl.is_ip_whitelisted_machine()) |
| self.assertTrue(acl.can_access()) |
| self.assertFalse(acl.can_view_config()) |
| self.assertFalse(acl.can_edit_config()) |
| self.assertFalse(acl.can_create_bot()) |
| self.assertFalse(acl.can_edit_bot()) |
| self.assertFalse(acl.can_delete_bot()) |
| self.assertFalse(acl.can_view_bot()) |
| self.assertFalse(acl.can_create_task()) |
| self.assertFalse(acl.can_schedule_high_priority_tasks()) |
| self.assertFalse(acl.can_edit_one_task()) |
| self.assertFalse(acl.can_edit_all_tasks()) |
| self.assertTrue(acl.can_view_all_tasks()) |
| |
| |
| if __name__ == '__main__': |
| if '-v' in sys.argv: |
| unittest.TestCase.maxDiff = None |
| logging.basicConfig( |
| level=logging.DEBUG if '-v' in sys.argv else logging.CRITICAL) |
| unittest.main() |
