| |
| -- Copyright (c) 2016 IBM. All rights reserved. |
| -- |
| -- Permission is hereby granted, free of charge, to any person obtaining a |
| -- copy of this software and associated documentation files (the "Software"), |
| -- to deal in the Software without restriction, including without limitation |
| -- the rights to use, copy, modify, merge, publish, distribute, sublicense, |
| -- and/or sell copies of the Software, and to permit persons to whom the |
| -- Software is furnished to do so, subject to the following conditions: |
| -- |
| -- The above copyright notice and this permission notice shall be included in |
| -- all copies or substantial portions of the Software. |
| -- |
| -- THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR |
| -- IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, |
| -- FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE |
| -- AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER |
| -- LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING |
| -- FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER |
| -- DEALINGS IN THE SOFTWARE. |
| |
| local fakengx = require 'fakengx' |
| local fakeredis = require 'fakeredis' |
| local apikey = require 'policies/security/apiKey' |
| local oauth = require 'policies/security/oauth2' |
| local cjson = require "cjson" |
| |
| describe('API Key module', function() |
| it('Checks an apiKey correctly', function() |
| local red = fakeredis.new() |
| local ngx = fakengx.new() |
| local ds = require "lib/dataStore" |
| local dataStore = ds.initWithDriver(red) |
| local ngxattrs = cjson.decode([[ |
| { |
| "tenant":"abcd", |
| "gatewayPath":"v1/test", |
| "http_x_api_key":"a1234" |
| } |
| ]]) |
| ngx.var = ngxattrs |
| ngx.req = { get_uri_args = function() return {} end } |
| _G.ngx = ngx |
| local securityObj = cjson.decode([[ |
| { |
| "scope":"api", |
| "type":"apikey" |
| } |
| ]]) |
| red:hset('resources:abcd:v1/test', 'resources', '{"apiId":"bnez"}') |
| red:set('subscriptions:tenant:abcd:api:bnez:key:a1234', 'true') |
| local key = apikey.process(dataStore, securityObj, function() return "fakehash" end) |
| assert.same(key, 'a1234') |
| end) |
| it('Checks an apiKey correctly in a query string', function() |
| local red = fakeredis.new() |
| local ngx = fakengx.new() |
| |
| local ds = require "lib/dataStore" |
| local dataStore = ds.initWithDriver(red) |
| local ngxattrs = cjson.decode([[ |
| { |
| "tenant":"abcd", |
| "gatewayPath":"v1/test" |
| } |
| ]]) |
| ngx.var = ngxattrs |
| ngx.req = { get_uri_args = function() return { apiKey = "a1234" } end } |
| _G.ngx = ngx |
| local securityObj = cjson.decode([[ |
| { |
| "scope":"api", |
| "type":"apikey", |
| "name":"apiKey", |
| "location":"query" |
| } |
| ]]) |
| red:hset('resources:abcd:v1/test', 'resources', '{"apiId":"bnez"}') |
| red:set('subscriptions:tenant:abcd:api:bnez:key:a1234', 'true') |
| local key = apikey.process(dataStore, securityObj, function() return "fakehash" end) |
| assert.same(key, 'a1234') |
| end) |
| it('Returns nil with a bad apikey', function() |
| local red = fakeredis.new() |
| local ds = require "lib/dataStore" |
| local dataStore = ds.initWithDriver(red) |
| local ngx = fakengx.new() |
| local ngxattrs = cjson.decode([[ |
| { |
| "tenant":"abcd", |
| "gatewayPath":"v1/test", |
| "http_x_api_key":"a1234" |
| } |
| ]]) |
| ngx.var = ngxattrs |
| ngx.req = { get_uri_args = function() return { apiKey = "a1234" } end } |
| _G.ngx = ngx |
| local securityObj = cjson.decode([[ |
| { |
| "scope":"api", |
| "type":"apikey" |
| } |
| ]]) |
| red:hset('resources:abcd:v1/test', 'resources', '{"apiId":"bnez"}') |
| local key = apikey.process(dataStore, securityObj, function() return "fakehash" end) |
| assert.falsy(key) |
| end) |
| it('Checks for a key with a custom header', function() |
| local red = fakeredis.new() |
| local ds = require "lib/dataStore" |
| local dataStore = ds.initWithDriver(red) |
| local ngx = fakengx.new() |
| local ngxattrs = cjson.decode([[ |
| { |
| "tenant":"abcd", |
| "gatewayPath":"v1/test", |
| "http_x_test_key":"a1234" |
| } |
| ]]) |
| ngx.var = ngxattrs |
| ngx.req = { get_uri_args = function() return {} end} |
| _G.ngx = ngx |
| local securityObj = cjson.decode([[ |
| { |
| "scope":"api", |
| "type":"apikey", |
| "name":"x-test-key" |
| } |
| ]]) |
| red:hset('resources:abcd:v1/test', 'resources', '{"apiId":"bnez"}') |
| red:set('subscriptions:tenant:abcd:api:bnez:key:a1234', 'true') |
| local key = apikey.process(dataStore, securityObj, function() return "fakehash" end) |
| assert.same(key, 'a1234') |
| end) |
| it('Checks for a key with a custom name in the query string', function() |
| local red = fakeredis.new() |
| local ds = require "lib/dataStore" |
| local dataStore = ds.initWithDriver(red) |
| local ngx = fakengx.new() |
| local ngxattrs = cjson.decode([[ |
| { |
| "tenant":"abcd", |
| "gatewayPath":"v1/test" |
| } |
| ]]) |
| ngx.var = ngxattrs |
| ngx.req = { get_uri_args = function () return { xtestkey = "a1234" } end } |
| _G.ngx = ngx |
| local securityObj = cjson.decode([[ |
| { |
| "scope":"api", |
| "type":"apikey", |
| "name":"xtestkey", |
| "location":"query" |
| } |
| ]]) |
| red:hset('resources:abcd:v1/test', 'resources', '{"apiId":"bnez"}') |
| red:set('subscriptions:tenant:abcd:api:bnez:key:a1234', 'true') |
| local key = apikey.process(dataStore, securityObj, function() return "fakehash" end) |
| assert.same(key, 'a1234') |
| end) |
| it('Checks for a key with a custom header and hash configuration', function() |
| local red = fakeredis.new() |
| local ds = require "lib/dataStore" |
| local dataStore = ds.initWithDriver(red) |
| local ngx = fakengx.new() |
| local ngxattrs = cjson.decode([[ |
| { |
| "tenant":"abcd", |
| "gatewayPath":"v1/test", |
| "http_x_test_key":"a1234" |
| } |
| ]]) |
| ngx.req = { get_uri_args = function() return {} end } |
| ngx.var = ngxattrs |
| _G.ngx = ngx |
| local securityObj = cjson.decode([[ |
| { |
| "scope":"api", |
| "type":"apikey", |
| "name":"x-test-key", |
| "hashed":true |
| } |
| ]]) |
| red:hset('resources:abcd:v1/test', 'resources', '{"apiId":"bnez"}') |
| red:set('subscriptions:tenant:abcd:api:bnez:key:fakehash', 'true') |
| local key = apikey.processWithHashFunction(dataStore, securityObj, function() return "fakehash" end) |
| assert.same(key, 'fakehash') |
| end) |
| end) |
| describe('OAuth security module', function() |
| it('Exchanges a good secret', function () |
| local red = fakeredis.new() |
| local token = "test" |
| local ngxattrs = [[ |
| { |
| "http_Authorization":"]] .. token .. [[", |
| "tenant":"1234", |
| "gatewayPath":"v1/test" |
| } |
| ]] |
| local ngx = fakengx.new() |
| ngx.var = cjson.decode(ngxattrs) |
| _G.ngx = ngx |
| local securityObj = [[ |
| { |
| "type":"oauth", |
| "provider":"mock", |
| "scope":"resource" |
| } |
| ]] |
| local result = oauth.process(red, cjson.decode(securityObj)) |
| assert.same(red:exists('oauth:providers:mock:tokens:test'), 1) |
| assert(result) |
| end) |
| it('Exchanges a bad token, doesn\'t cache it and returns false', function() |
| local red = fakeredis.new() |
| local token = "bad" |
| local ngxattrs = [[ |
| { |
| "http_Authorization":"]] .. token .. [[", |
| "tenant":"1234", |
| "gatewayPath":"v1/test" |
| } |
| ]] |
| local ngx = fakengx.new() |
| ngx.var = cjson.decode(ngxattrs) |
| _G.ngx = ngx |
| local securityObj = [[ |
| { |
| "type":"oauth", |
| "provider":"mock", |
| "scope":"resource" |
| } |
| ]] |
| local result = oauth.process(red, cjson.decode(securityObj)) |
| assert.same(red:exists('oauth:providers:mock:tokens:bad'), 0) |
| assert.falsy(result) |
| end) |
| it('Loads a facebook token from the cache without a valid app id', function() |
| local red = fakeredis.new() |
| local ds = require "lib/dataStore" |
| local dataStore = ds.initWithDriver(red) |
| local token = "test" |
| local ngxattrs = [[ |
| { |
| "http_Authorization":"]] .. token .. [[", |
| "http_x_facebook_app_token":"nothing", |
| "tenant":"1234", |
| "gatewayPath":"v1/test" |
| } |
| ]] |
| local ngx = fakengx.new() |
| ngx.var = cjson.decode(ngxattrs) |
| _G.ngx = ngx |
| local securityObj = [[ |
| { |
| "type":"oauth2", |
| "provider":"facebook", |
| "scope":"resource" |
| } |
| ]] |
| red:set('oauth:providers:facebook:tokens:test', '{ "token":"good"}') |
| local result = oauth.process(dataStore, cjson.decode(securityObj)) |
| assert.truthy(result) |
| end) |
| it('Loads a facebook token from the cache with a valid app id', function() |
| local red = fakeredis.new() |
| local ds = require "lib/dataStore" |
| local dataStore = ds.initWithDriver(red) |
| local token = "test" |
| local appid = "app" |
| local ngxattrs = [[ |
| { |
| "http_Authorization":"]] .. token .. [[", |
| "http_x_facebook_app_token":"]] .. appid .. [[", |
| "tenant":"1234", |
| "gatewayPath":"v1/test" |
| } |
| ]] |
| local ngx = fakengx.new() |
| ngx.var = cjson.decode(ngxattrs) |
| _G.ngx = ngx |
| local securityObj = [[ |
| { |
| "type":"oauth2", |
| "provider":"facebook", |
| "scope":"resource" |
| } |
| ]] |
| red:set('oauth:providers:facebook:tokens:testapp', '{"token":"good"}') |
| local result = oauth.process(dataStore, cjson.decode(securityObj)) |
| assert.truthy(result) |
| end) |
| end) |
| describe('Client Secret Module', function() |
| local clientSecret = require 'policies/security/clientSecret' |
| it('Validates a client secret pair with default names', function() |
| local ngx = fakengx.new() |
| local red = fakeredis.new() |
| local ngxattrs = [[ |
| { |
| "http_X_Client_ID":"abcd", |
| "http_X_Client_Secret":"1234", |
| "tenant":"1234", |
| "gatewayPath":"v1/test" |
| } |
| ]] |
| ngx.req = { get_uri_args = function() return {} end } |
| ngx.var = cjson.decode(ngxattrs) |
| _G.ngx = ngx |
| local securityObj = [[ |
| { |
| "type":"clientsecret", |
| "scope":"resource" |
| } |
| ]] |
| red:set("subscriptions:tenant:1234:resource:v1/test:clientsecret:abcd:fakehash", "true") |
| local result = clientSecret.processWithHashFunction(red, cjson.decode(securityObj), function() return "fakehash" end) |
| assert(result) |
| end) |
| it('Validates a client secret pair with new names', function() |
| local ngx = fakengx.new() |
| local red = fakeredis.new() |
| local ngxattrs = [[ |
| { |
| "http_test_id":"abcd", |
| "http_test_secret":"1234", |
| "tenant":"1234", |
| "gatewayPath":"v1/test" |
| } |
| ]] |
| ngx.req = { get_uri_args = function() return {} end } |
| ngx.var = cjson.decode(ngxattrs) |
| _G.ngx = ngx |
| local securityObj = [[ |
| { |
| "type":"clientsecret", |
| "scope":"resource", |
| "idFieldName":"test-id", |
| "secretFieldName":"test-secret" |
| } |
| ]] |
| red:set("subscriptions:tenant:1234:resource:v1/test:clientsecret:abcd:fakehash", "true") |
| local result = clientSecret.processWithHashFunction(red, cjson.decode(securityObj), function() return "fakehash" end) |
| assert(result) |
| end) |
| it('Doesn\'t work without a client id', function() |
| local ngx = fakengx.new() |
| local red = fakeredis.new() |
| local ngxattrs = [[ |
| { |
| "http_X_Client_Secret":"1234", |
| "tenant":"1234", |
| "gatewayPath":"v1/test" |
| } |
| ]] |
| ngx.req = { get_uri_args = function() return {} end } |
| ngx.var = cjson.decode(ngxattrs) |
| _G.ngx = ngx |
| local securityObj = [[ |
| { |
| "type":"clientsecret", |
| "scope":"resource" |
| } |
| ]] |
| end) |
| it('Doesn\'t work without a Client Secret', function() |
| local ngx = fakengx.new() |
| local red = fakeredis.new() |
| local ngxattrs = [[ |
| { |
| "http_X_Client_ID":"abcd", |
| "tenant":"1234", |
| "gatewayPath":"v1/test" |
| } |
| ]] |
| ngx.req = { get_uri_args = function() return {} end} |
| ngx.var = cjson.decode(ngxattrs) |
| _G.ngx = ngx |
| local securityObj = [[ |
| { |
| "type":"clientsecret", |
| "scope":"resource" |
| } |
| ]] |
| red:set("subscriptions:tenant:1234:resource:v1/test:clientsecret:abcd:fakehash", "true") |
| local result = clientSecret.processWithHashFunction(red, cjson.decode(securityObj), function() return "fakehash" end) |
| assert.falsy(result) |
| end) |
| end) |
