test: drive the whole application over HTTP, and serialise migrations
The behaviour suite in internal/behaviour installs the application into an empty database through the web installer, signs in, walks every flow, and then replaces the process to confirm the state was persisted rather than held in memory. It found four defects, each fixed here or in the preceding commit: - Migrate was not safe to run from two instances at once. CREATE TABLE IF NOT EXISTS is not race free in PostgreSQL and collided on the pg_type unique index, and two replicas could apply the same file. The run now holds a session-level advisory lock, so a rolling deployment waits instead of failing. - Bootstrap refused ownership whenever a tenant held any member, so installing with the demonstration seed and then setting a local administrator password produced an account that could never reach the console. It now grants ownership only while the tenant has no owner, which still never takes a tenant over from one that does. Three of the fixes are covered by store-level regression tests in the same commit: the ownership rule, the duplicate tenant slug conflict, and concurrent migration runs. The suite is skipped by go test ./... because it needs a scratch database and the Google credentials for the installer. Run it with make behaviour-test, which also resets the database afterwards. make test no longer inherits the database variables, so unit runs need nothing. Completes the earlier correction to the docs: the role matrix lives in the database rather than in internal/role, and a local administrator claims the system administrator role when no Google account has.
This commit is contained in:
Daniel Noulet
parent
c7c81fb65c
commit
8d8970d5a7
18 changed files with 3050 additions and 4 deletions
162
internal/behaviour/security_test.go
Normal file
162
internal/behaviour/security_test.go
Normal file
|
|
@ -0,0 +1,162 @@
|
|||
package behaviour
|
||||
|
||||
import (
|
||||
"net/http"
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
// securityPhases checks the defences that sit in front of every flow above.
|
||||
func securityPhases(t *testing.T, j *journey) {
|
||||
t.Helper()
|
||||
host := j.adminHost()
|
||||
|
||||
phase(t, "a write from another origin is refused", func(t *testing.T) {
|
||||
// The Origin header is what a browser sets and an attacker cannot forge, so
|
||||
// this is the check that stops a cross-site form post.
|
||||
for _, target := range []struct {
|
||||
method string
|
||||
path string
|
||||
}{
|
||||
{http.MethodPost, "/api/v1/tenants"},
|
||||
{http.MethodPut, "/api/v1/profile"},
|
||||
{http.MethodPost, "/api/v1/permissions"},
|
||||
{http.MethodPost, "/api/v1/applications/" + j.applicationID + "/client-config"},
|
||||
} {
|
||||
response := j.admin.request(target.method, host, target.path,
|
||||
strings.NewReader(`{"slug":"csrf","name":"CSRF"}`), map[string]string{
|
||||
"Content-Type": "application/json", "Origin": "https://evil.test",
|
||||
})
|
||||
if response.StatusCode != http.StatusForbidden {
|
||||
t.Errorf("%s %s from a foreign origin = %d, want 403", target.method, target.path, response.StatusCode)
|
||||
}
|
||||
bodyOf(t, response)
|
||||
}
|
||||
})
|
||||
|
||||
phase(t, "a write with no origin or referrer is refused", func(t *testing.T) {
|
||||
response := j.admin.request(http.MethodPost, host, "/api/v1/tenants",
|
||||
strings.NewReader(`{"slug":"noorigin","name":"No Origin"}`), map[string]string{
|
||||
"Content-Type": "application/json", "Origin": "", "Referer": "",
|
||||
})
|
||||
statusOnly(t, response, http.StatusForbidden)
|
||||
})
|
||||
|
||||
phase(t, "the configured base URL is also accepted as its own origin", func(t *testing.T) {
|
||||
// A deployment reached through a different hostname must still be able to
|
||||
// write, or every legitimate form post fails.
|
||||
response := j.admin.request(http.MethodPost, host, "/api/v1/tenants",
|
||||
strings.NewReader(`{"slug":"viabaseurl","name":"Via Base URL"}`), map[string]string{
|
||||
"Content-Type": "application/json", "Origin": j.h.baseURL,
|
||||
})
|
||||
if response.StatusCode != http.StatusCreated {
|
||||
t.Fatalf("status = %d, want 201: %s", response.StatusCode, bodyOf(t, response))
|
||||
}
|
||||
})
|
||||
|
||||
phase(t, "responses carry the hardening headers", func(t *testing.T) {
|
||||
response := j.admin.get(host, "/", nil)
|
||||
bodyOf(t, response)
|
||||
policy := response.Header.Get("Content-Security-Policy")
|
||||
for _, want := range []string{"default-src 'self'", "connect-src 'self'", "img-src 'self'"} {
|
||||
if !strings.Contains(policy, want) {
|
||||
t.Errorf("Content-Security-Policy lacks %q: %s", want, policy)
|
||||
}
|
||||
}
|
||||
if got := response.Header.Get("X-Content-Type-Options"); got != "nosniff" {
|
||||
t.Errorf("X-Content-Type-Options = %q", got)
|
||||
}
|
||||
// Clickjacking is blocked with X-Frame-Options rather than frame-ancestors.
|
||||
if got := response.Header.Get("X-Frame-Options"); got != "DENY" {
|
||||
t.Errorf("X-Frame-Options = %q, want DENY", got)
|
||||
}
|
||||
if got := response.Header.Get("Referrer-Policy"); got != "same-origin" {
|
||||
t.Errorf("Referrer-Policy = %q", got)
|
||||
}
|
||||
if got := response.Header.Get("Permissions-Policy"); !strings.Contains(got, "camera=()") {
|
||||
t.Errorf("Permissions-Policy = %q", got)
|
||||
}
|
||||
})
|
||||
|
||||
phase(t, "the health check needs no session", func(t *testing.T) {
|
||||
response := j.browser().get(j.h.apex(), "/healthz", nil)
|
||||
if response.StatusCode != http.StatusOK {
|
||||
t.Fatalf("status = %d", response.StatusCode)
|
||||
}
|
||||
bodyOf(t, response)
|
||||
})
|
||||
|
||||
phase(t, "a console API call without a session answers 401 rather than a redirect", func(t *testing.T) {
|
||||
// An XHR that receives a 303 to the login page cannot tell it apart from a
|
||||
// real result, so the API answers with a status the caller can act on.
|
||||
for _, path := range []string{"/api/v1/dashboard", "/api/v1/profile", "/api/v1/permissions"} {
|
||||
response := j.browser().get(host, path, nil)
|
||||
statusOnly(t, response, http.StatusUnauthorized)
|
||||
}
|
||||
})
|
||||
|
||||
phase(t, "a console page without a session redirects to sign in", func(t *testing.T) {
|
||||
for _, path := range []string{"/", "/profile", "/roles"} {
|
||||
response := j.browser().get(host, path, nil)
|
||||
if response.StatusCode != http.StatusSeeOther || location(t, response) != "/login" {
|
||||
t.Errorf("GET %s = %d %q, want 303 to /login", path, response.StatusCode, response.Header.Get("Location"))
|
||||
}
|
||||
response.Body.Close()
|
||||
}
|
||||
})
|
||||
|
||||
phase(t, "signing out ends the management session", func(t *testing.T) {
|
||||
browser := j.browser()
|
||||
token := csrfFrom(t, bodyOf(t, browser.get(host, "/login", nil)))
|
||||
response := browser.form(host, "/auth/password", neturlValues(map[string]string{
|
||||
"csrf_token": token, "email": localAdminMail, "password": localAdminPass,
|
||||
}), nil)
|
||||
if response.StatusCode != http.StatusSeeOther {
|
||||
t.Fatalf("sign-in = %d", response.StatusCode)
|
||||
}
|
||||
response.Body.Close()
|
||||
statusOnly(t, browser.get(host, "/api/v1/dashboard", nil), http.StatusOK)
|
||||
|
||||
response = browser.form(host, "/auth/logout", neturlValues(map[string]string{}), nil)
|
||||
if response.StatusCode != http.StatusSeeOther {
|
||||
t.Fatalf("sign-out = %d: %s", response.StatusCode, bodyOf(t, response))
|
||||
}
|
||||
statusOnly(t, browser.get(host, "/api/v1/dashboard", nil), http.StatusUnauthorized)
|
||||
})
|
||||
|
||||
phase(t, "signing out ends the session when the provider has no logout endpoint", func(t *testing.T) {
|
||||
// Google does not advertise end_session_endpoint, so the documented fallback
|
||||
// applies: the local sign-out still happens and the browser returns to the
|
||||
// sign-in page rather than to the provider.
|
||||
browser := j.browser()
|
||||
host := j.adminHost()
|
||||
token := csrfFrom(t, bodyOf(t, browser.get(host, "/login", nil)))
|
||||
response := browser.form(host, "/auth/password", neturlValues(map[string]string{
|
||||
"csrf_token": token, "email": localAdminMail, "password": localAdminPass,
|
||||
}), nil)
|
||||
if response.StatusCode != http.StatusSeeOther {
|
||||
t.Fatalf("sign-in = %d: %s", response.StatusCode, bodyOf(t, response))
|
||||
}
|
||||
response = browser.form(host, "/auth/logout", neturlValues(map[string]string{}), nil)
|
||||
if response.StatusCode != http.StatusSeeOther {
|
||||
t.Fatalf("sign-out = %d: %s", response.StatusCode, bodyOf(t, response))
|
||||
}
|
||||
target := location(t, response)
|
||||
if target != "/login" && !strings.Contains(target, "accounts.google.com") {
|
||||
t.Errorf("sign-out redirect = %q, want the sign-in page or the provider", target)
|
||||
}
|
||||
if target == "/login" {
|
||||
// The session must really be gone.
|
||||
statusOnly(t, browser.get(host, "/api/v1/dashboard", nil), http.StatusUnauthorized)
|
||||
}
|
||||
})
|
||||
|
||||
phase(t, "an oversized profile upload is refused", func(t *testing.T) {
|
||||
big := strings.Repeat("A", 5<<20)
|
||||
response := j.admin.json(http.MethodPut, host, "/api/v1/profile", map[string]string{"avatar": big})
|
||||
if response.StatusCode != http.StatusBadRequest {
|
||||
t.Errorf("status = %d, want 400", response.StatusCode)
|
||||
}
|
||||
bodyOf(t, response)
|
||||
})
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue