404 lines
13 KiB
Go
404 lines
13 KiB
Go
package api
|
|
|
|
import (
|
|
"bytes"
|
|
"encoding/json"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
|
|
"codeberg.org/SquidSE/ClusterCanvas/service/internal/settings"
|
|
)
|
|
|
|
type actionsResponseTest struct {
|
|
Actions []settings.Action `json:"actions"`
|
|
}
|
|
|
|
func TestActionsGetSeedsBuiltins(t *testing.T) {
|
|
configDir := t.TempDir()
|
|
cookie := seedCompletedSetup(t, configDir)
|
|
router := NewRouter(configDir)
|
|
|
|
request := withSession(httptest.NewRequest(http.MethodGet, "/api/v1/actions", nil), cookie)
|
|
recorder := httptest.NewRecorder()
|
|
router.ServeHTTP(recorder, request)
|
|
|
|
if recorder.Code != http.StatusOK {
|
|
t.Fatalf("expected status %d, got %d body=%s", http.StatusOK, recorder.Code, recorder.Body.String())
|
|
}
|
|
|
|
var payload actionsResponseTest
|
|
if err := json.NewDecoder(recorder.Body).Decode(&payload); err != nil {
|
|
t.Fatalf("decode response: %v", err)
|
|
}
|
|
if len(payload.Actions) != 4 {
|
|
t.Fatalf("expected 4 builtins, got %d", len(payload.Actions))
|
|
}
|
|
for _, action := range payload.Actions {
|
|
if !action.Builtin {
|
|
t.Fatalf("expected builtin, got %#v", action)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestActionsCreatePatchDelete(t *testing.T) {
|
|
configDir := t.TempDir()
|
|
cookie := seedCompletedSetup(t, configDir)
|
|
router := NewRouter(configDir)
|
|
|
|
createBody := []byte(`{
|
|
"name": "Echo host",
|
|
"description": "Print the target IP",
|
|
"kind": "shell",
|
|
"body": "echo {{node.ip}}",
|
|
"env": [{"name": "APP_HOME", "value": "/opt/app"}],
|
|
"requires_sudo": true
|
|
}`)
|
|
createReq := withSession(httptest.NewRequest(http.MethodPost, "/api/v1/actions", bytes.NewReader(createBody)), cookie)
|
|
createRec := httptest.NewRecorder()
|
|
router.ServeHTTP(createRec, createReq)
|
|
if createRec.Code != http.StatusOK {
|
|
t.Fatalf("create status %d body=%s", createRec.Code, createRec.Body.String())
|
|
}
|
|
|
|
var created actionsResponseTest
|
|
if err := json.NewDecoder(createRec.Body).Decode(&created); err != nil {
|
|
t.Fatalf("decode create: %v", err)
|
|
}
|
|
if len(created.Actions) != 5 {
|
|
t.Fatalf("expected 5 actions after create, got %d", len(created.Actions))
|
|
}
|
|
custom := created.Actions[4]
|
|
if custom.Builtin || custom.Name != "Echo host" || custom.Kind != settings.ActionKindShell {
|
|
t.Fatalf("custom = %#v", custom)
|
|
}
|
|
if !custom.RequiresSudo {
|
|
t.Fatalf("expected requires_sudo true, got %#v", custom)
|
|
}
|
|
|
|
patchBody := []byte(`{"name":"Echo target","body":"echo {{node.host}}","requires_sudo":false}`)
|
|
patchReq := withSession(
|
|
httptest.NewRequest(http.MethodPatch, "/api/v1/actions?id="+custom.ID, bytes.NewReader(patchBody)),
|
|
cookie,
|
|
)
|
|
patchRec := httptest.NewRecorder()
|
|
router.ServeHTTP(patchRec, patchReq)
|
|
if patchRec.Code != http.StatusOK {
|
|
t.Fatalf("patch status %d body=%s", patchRec.Code, patchRec.Body.String())
|
|
}
|
|
|
|
var patched actionsResponseTest
|
|
if err := json.NewDecoder(patchRec.Body).Decode(&patched); err != nil {
|
|
t.Fatalf("decode patch: %v", err)
|
|
}
|
|
found := false
|
|
for _, action := range patched.Actions {
|
|
if action.ID == custom.ID {
|
|
found = true
|
|
if action.Name != "Echo target" || action.Body != "echo {{node.host}}" {
|
|
t.Fatalf("patched = %#v", action)
|
|
}
|
|
if action.RequiresSudo {
|
|
t.Fatalf("expected requires_sudo false after patch, got %#v", action)
|
|
}
|
|
}
|
|
}
|
|
if !found {
|
|
t.Fatal("patched action missing")
|
|
}
|
|
|
|
deleteReq := withSession(
|
|
httptest.NewRequest(http.MethodDelete, "/api/v1/actions?id="+custom.ID, nil),
|
|
cookie,
|
|
)
|
|
deleteRec := httptest.NewRecorder()
|
|
router.ServeHTTP(deleteRec, deleteReq)
|
|
if deleteRec.Code != http.StatusOK {
|
|
t.Fatalf("delete status %d body=%s", deleteRec.Code, deleteRec.Body.String())
|
|
}
|
|
|
|
var deleted actionsResponseTest
|
|
if err := json.NewDecoder(deleteRec.Body).Decode(&deleted); err != nil {
|
|
t.Fatalf("decode delete: %v", err)
|
|
}
|
|
if len(deleted.Actions) != 4 {
|
|
t.Fatalf("expected 4 after delete, got %d", len(deleted.Actions))
|
|
}
|
|
}
|
|
|
|
func TestActionsRejectBuiltinMutationAndInvalidInput(t *testing.T) {
|
|
configDir := t.TempDir()
|
|
cookie := seedCompletedSetup(t, configDir)
|
|
router := NewRouter(configDir)
|
|
|
|
getReq := withSession(httptest.NewRequest(http.MethodGet, "/api/v1/actions", nil), cookie)
|
|
getRec := httptest.NewRecorder()
|
|
router.ServeHTTP(getRec, getReq)
|
|
var listed actionsResponseTest
|
|
if err := json.NewDecoder(getRec.Body).Decode(&listed); err != nil {
|
|
t.Fatalf("decode list: %v", err)
|
|
}
|
|
builtinID := listed.Actions[0].ID
|
|
|
|
patchBody := []byte(`{"name":"Nope"}`)
|
|
patchReq := withSession(
|
|
httptest.NewRequest(http.MethodPatch, "/api/v1/actions?id="+builtinID, bytes.NewReader(patchBody)),
|
|
cookie,
|
|
)
|
|
patchRec := httptest.NewRecorder()
|
|
router.ServeHTTP(patchRec, patchReq)
|
|
if patchRec.Code != http.StatusBadRequest {
|
|
t.Fatalf("expected builtin patch 400, got %d", patchRec.Code)
|
|
}
|
|
|
|
widgetBody := []byte(`{"show_widget":true,"widget_type":"raw"}`)
|
|
widgetReq := withSession(
|
|
httptest.NewRequest(http.MethodPatch, "/api/v1/actions?id="+builtinID, bytes.NewReader(widgetBody)),
|
|
cookie,
|
|
)
|
|
widgetRec := httptest.NewRecorder()
|
|
router.ServeHTTP(widgetRec, widgetReq)
|
|
if widgetRec.Code != http.StatusOK {
|
|
t.Fatalf("expected builtin widget patch 200, got %d body=%s", widgetRec.Code, widgetRec.Body.String())
|
|
}
|
|
var widgetPatched actionsResponseTest
|
|
if err := json.NewDecoder(widgetRec.Body).Decode(&widgetPatched); err != nil {
|
|
t.Fatalf("decode widget patch: %v", err)
|
|
}
|
|
foundWidget := false
|
|
for _, action := range widgetPatched.Actions {
|
|
if action.ID == builtinID {
|
|
foundWidget = true
|
|
if !action.ShowWidget || action.WidgetType != settings.ActionWidgetTypeRaw {
|
|
t.Fatalf("widget patched = %#v", action)
|
|
}
|
|
}
|
|
}
|
|
if !foundWidget {
|
|
t.Fatal("builtin missing after widget patch")
|
|
}
|
|
|
|
deleteReq := withSession(
|
|
httptest.NewRequest(http.MethodDelete, "/api/v1/actions?id="+builtinID, nil),
|
|
cookie,
|
|
)
|
|
deleteRec := httptest.NewRecorder()
|
|
router.ServeHTTP(deleteRec, deleteReq)
|
|
if deleteRec.Code != http.StatusBadRequest {
|
|
t.Fatalf("expected builtin delete 400, got %d", deleteRec.Code)
|
|
}
|
|
|
|
badCreate := []byte(`{"name":"x","kind":"shell","body":"echo","env":[{"name":"bad-name","value":"1"}]}`)
|
|
badReq := withSession(httptest.NewRequest(http.MethodPost, "/api/v1/actions", bytes.NewReader(badCreate)), cookie)
|
|
badRec := httptest.NewRecorder()
|
|
router.ServeHTTP(badRec, badReq)
|
|
if badRec.Code != http.StatusBadRequest {
|
|
t.Fatalf("expected invalid env 400, got %d", badRec.Code)
|
|
}
|
|
|
|
invalidKind := []byte(`{"name":"x","kind":"nope","body":"echo"}`)
|
|
kindReq := withSession(httptest.NewRequest(http.MethodPost, "/api/v1/actions", bytes.NewReader(invalidKind)), cookie)
|
|
kindRec := httptest.NewRecorder()
|
|
router.ServeHTTP(kindRec, kindReq)
|
|
if kindRec.Code != http.StatusBadRequest {
|
|
t.Fatalf("expected invalid kind 400, got %d", kindRec.Code)
|
|
}
|
|
}
|
|
|
|
func TestActionsMutationsRequirePermissions(t *testing.T) {
|
|
configDir := t.TempDir()
|
|
cookie := seedCompletedSetup(t, configDir)
|
|
router := NewRouter(configDir)
|
|
|
|
// Strip action permissions from Administrators.
|
|
settingsPayload, err := settings.LoadSettings(configDir)
|
|
if err != nil {
|
|
t.Fatalf("LoadSettings: %v", err)
|
|
}
|
|
for index := range settingsPayload.Groups {
|
|
if settingsPayload.Groups[index].Name != settings.AdministratorsGroupName {
|
|
continue
|
|
}
|
|
filtered := make([]string, 0, len(settingsPayload.Groups[index].Permissions))
|
|
for _, permission := range settingsPayload.Groups[index].Permissions {
|
|
if permission == "actions.create" || permission == "actions.update" || permission == "actions.delete" {
|
|
continue
|
|
}
|
|
filtered = append(filtered, permission)
|
|
}
|
|
settingsPayload.Groups[index].Permissions = filtered
|
|
}
|
|
if err := settings.SaveSettings(configDir, settingsPayload); err != nil {
|
|
t.Fatalf("SaveSettings: %v", err)
|
|
}
|
|
|
|
createBody := []byte(`{"name":"x","kind":"shell","body":"echo"}`)
|
|
createReq := withSession(httptest.NewRequest(http.MethodPost, "/api/v1/actions", bytes.NewReader(createBody)), cookie)
|
|
createRec := httptest.NewRecorder()
|
|
router.ServeHTTP(createRec, createReq)
|
|
if createRec.Code != http.StatusForbidden {
|
|
t.Fatalf("expected create 403, got %d body=%s", createRec.Code, createRec.Body.String())
|
|
}
|
|
|
|
patchReq := withSession(
|
|
httptest.NewRequest(http.MethodPatch, "/api/v1/actions?id=custom", bytes.NewReader([]byte(`{"name":"y"}`))),
|
|
cookie,
|
|
)
|
|
patchRec := httptest.NewRecorder()
|
|
router.ServeHTTP(patchRec, patchReq)
|
|
if patchRec.Code != http.StatusForbidden {
|
|
t.Fatalf("expected patch 403, got %d", patchRec.Code)
|
|
}
|
|
|
|
deleteReq := withSession(httptest.NewRequest(http.MethodDelete, "/api/v1/actions?id=custom", nil), cookie)
|
|
deleteRec := httptest.NewRecorder()
|
|
router.ServeHTTP(deleteRec, deleteReq)
|
|
if deleteRec.Code != http.StatusForbidden {
|
|
t.Fatalf("expected delete 403, got %d", deleteRec.Code)
|
|
}
|
|
}
|
|
|
|
func TestActionsDeleteBlockedWhenLibraryReferenced(t *testing.T) {
|
|
configDir := t.TempDir()
|
|
cookie := seedCompletedSetup(t, configDir)
|
|
node := seedNodeForActions(t, configDir)
|
|
router := NewRouter(configDir)
|
|
|
|
createBody := []byte(`{"name":"Echo host","kind":"shell","body":"echo hi"}`)
|
|
createReq := withSession(httptest.NewRequest(http.MethodPost, "/api/v1/actions", bytes.NewReader(createBody)), cookie)
|
|
createRec := httptest.NewRecorder()
|
|
router.ServeHTTP(createRec, createReq)
|
|
if createRec.Code != http.StatusOK {
|
|
t.Fatalf("create status %d body=%s", createRec.Code, createRec.Body.String())
|
|
}
|
|
var created actionsResponseTest
|
|
if err := json.NewDecoder(createRec.Body).Decode(&created); err != nil {
|
|
t.Fatalf("decode create: %v", err)
|
|
}
|
|
customID := ""
|
|
for _, action := range created.Actions {
|
|
if !action.Builtin {
|
|
customID = action.ID
|
|
break
|
|
}
|
|
}
|
|
if customID == "" {
|
|
t.Fatal("custom action missing")
|
|
}
|
|
|
|
groupBody, _ := json.Marshal(map[string]any{
|
|
"name": "Nightly",
|
|
"schedule": map[string]any{
|
|
"enabled": false,
|
|
"kind": "interval",
|
|
"every_seconds": 3600,
|
|
"times": []any{},
|
|
},
|
|
})
|
|
groupReq := withSession(
|
|
httptest.NewRequest(http.MethodPost, "/api/v1/nodes/"+node.ID+"/action-groups", bytes.NewReader(groupBody)),
|
|
cookie,
|
|
)
|
|
groupRec := httptest.NewRecorder()
|
|
router.ServeHTTP(groupRec, groupReq)
|
|
if groupRec.Code != http.StatusOK {
|
|
t.Fatalf("create group status=%d body=%s", groupRec.Code, groupRec.Body.String())
|
|
}
|
|
var groupResp actionGroupResponse
|
|
if err := json.Unmarshal(groupRec.Body.Bytes(), &groupResp); err != nil {
|
|
t.Fatalf("decode group: %v", err)
|
|
}
|
|
groupID := groupResp.Group.ID
|
|
|
|
addBody, _ := json.Marshal(map[string]any{
|
|
"source": "library",
|
|
"library_action_id": customID,
|
|
})
|
|
addReq := withSession(
|
|
httptest.NewRequest(
|
|
http.MethodPost,
|
|
"/api/v1/nodes/"+node.ID+"/action-groups/"+groupID+"/items",
|
|
bytes.NewReader(addBody),
|
|
),
|
|
cookie,
|
|
)
|
|
addRec := httptest.NewRecorder()
|
|
router.ServeHTTP(addRec, addReq)
|
|
if addRec.Code != http.StatusOK {
|
|
t.Fatalf("add item status=%d body=%s", addRec.Code, addRec.Body.String())
|
|
}
|
|
var withItem actionGroupResponse
|
|
if err := json.Unmarshal(addRec.Body.Bytes(), &withItem); err != nil {
|
|
t.Fatalf("decode add: %v", err)
|
|
}
|
|
itemID := withItem.Group.Items[0].ID
|
|
|
|
blockedReq := withSession(
|
|
httptest.NewRequest(http.MethodDelete, "/api/v1/actions?id="+customID, nil),
|
|
cookie,
|
|
)
|
|
blockedRec := httptest.NewRecorder()
|
|
router.ServeHTTP(blockedRec, blockedReq)
|
|
if blockedRec.Code != http.StatusConflict {
|
|
t.Fatalf("expected delete conflict %d, got %d body=%s", http.StatusConflict, blockedRec.Code, blockedRec.Body.String())
|
|
}
|
|
var blockedErr apiErrorResponse
|
|
if err := json.NewDecoder(blockedRec.Body).Decode(&blockedErr); err != nil {
|
|
t.Fatalf("decode conflict: %v", err)
|
|
}
|
|
if blockedErr.Error != errActionInUse.Error() {
|
|
t.Fatalf("conflict error = %q, want %q", blockedErr.Error, errActionInUse.Error())
|
|
}
|
|
|
|
listReq := withSession(httptest.NewRequest(http.MethodGet, "/api/v1/actions", nil), cookie)
|
|
listRec := httptest.NewRecorder()
|
|
router.ServeHTTP(listRec, listReq)
|
|
var listed actionsResponseTest
|
|
if err := json.NewDecoder(listRec.Body).Decode(&listed); err != nil {
|
|
t.Fatalf("decode list: %v", err)
|
|
}
|
|
stillPresent := false
|
|
for _, action := range listed.Actions {
|
|
if action.ID == customID {
|
|
stillPresent = true
|
|
break
|
|
}
|
|
}
|
|
if !stillPresent {
|
|
t.Fatal("action should remain after blocked delete")
|
|
}
|
|
|
|
cloneReq := withSession(
|
|
httptest.NewRequest(
|
|
http.MethodPost,
|
|
"/api/v1/nodes/"+node.ID+"/action-groups/"+groupID+"/items/"+itemID+"/clone",
|
|
nil,
|
|
),
|
|
cookie,
|
|
)
|
|
cloneRec := httptest.NewRecorder()
|
|
router.ServeHTTP(cloneRec, cloneReq)
|
|
if cloneRec.Code != http.StatusOK {
|
|
t.Fatalf("clone status=%d body=%s", cloneRec.Code, cloneRec.Body.String())
|
|
}
|
|
|
|
deleteReq := withSession(
|
|
httptest.NewRequest(http.MethodDelete, "/api/v1/actions?id="+customID, nil),
|
|
cookie,
|
|
)
|
|
deleteRec := httptest.NewRecorder()
|
|
router.ServeHTTP(deleteRec, deleteReq)
|
|
if deleteRec.Code != http.StatusOK {
|
|
t.Fatalf("delete after clone status %d body=%s", deleteRec.Code, deleteRec.Body.String())
|
|
}
|
|
var deleted actionsResponseTest
|
|
if err := json.NewDecoder(deleteRec.Body).Decode(&deleted); err != nil {
|
|
t.Fatalf("decode delete: %v", err)
|
|
}
|
|
for _, action := range deleted.Actions {
|
|
if action.ID == customID {
|
|
t.Fatal("custom action should be gone after delete")
|
|
}
|
|
}
|
|
}
|