mirror of
https://github.com/microsoft/onefuzz.git
synced 2025-06-19 04:58:09 +00:00
e448947abe
Closes #2098. This cleans up the authentication a bit; after this change we have two stages in the middleware pipeline: - `AuthenticationMiddleware` reads the JWT token (it does not validate it, this is done by the Azure Functions service) and stores it in `FunctionContext.Items["ONEFUZZ_USER_INFO"]` - `AuthorizationMiddleware` checks the user info against the `[Authorize]` attribute to see if the user has the required permissions - Functions can read the user info from the `FunctionContext` if needed The authorize attribute can be `[Authorize(Allow.User)]` or `Allow.Agent` or `Allow.Admin`. The `Admin` case is new and allows this to be declaratively specified rather than being checked in code. We have several functions which could be changed to use this (e.g. Pool POST/DELETE/PATCH, Scaleset POST/DELETE/PATCH), but I have only changed one so far (JinjaToScriban). One of the benefits here is that this simplifies the test code a lot: we can set the desired user info directly onto our `(Test)FunctionContext` rather than having to supply a fake that pretends to parse the token from the HTTP request. This will also have benefits when running the service locally for testing purposes (refer to internal issue). The other benefit is the ability to programmatically read the required authentication for each function, which may help with Swagger generation.
56 lines
1.8 KiB
C#
56 lines
1.8 KiB
C#
using System;
|
|
using System.Net;
|
|
using FluentAssertions;
|
|
using IntegrationTests.Fakes;
|
|
using Microsoft.OneFuzz.Service;
|
|
using Microsoft.OneFuzz.Service.Functions;
|
|
using Xunit;
|
|
using Xunit.Abstractions;
|
|
using Async = System.Threading.Tasks;
|
|
|
|
namespace IntegrationTests;
|
|
|
|
[Trait("Category", "Live")]
|
|
public class AzureStorageAgentCommandsTest : AgentCommandsTestsBase {
|
|
public AzureStorageAgentCommandsTest(ITestOutputHelper output)
|
|
: base(output, Integration.AzureStorage.FromEnvironment()) { }
|
|
}
|
|
|
|
public class AzuriteAgentCommandsTest : AgentEventsTestsBase {
|
|
public AzuriteAgentCommandsTest(ITestOutputHelper output)
|
|
: base(output, new Integration.AzuriteStorage()) { }
|
|
}
|
|
|
|
public abstract class AgentCommandsTestsBase : FunctionTestBase {
|
|
public AgentCommandsTestsBase(ITestOutputHelper output, IStorage storage)
|
|
: base(output, storage) { }
|
|
|
|
|
|
[Fact]
|
|
public async Async.Task AgentCommand_GetsCommand() {
|
|
var machineId = Guid.NewGuid();
|
|
var messageId = Guid.NewGuid().ToString();
|
|
var command = new NodeCommand {
|
|
Stop = new StopNodeCommand()
|
|
};
|
|
await Context.InsertAll(new[] {
|
|
new NodeMessage (
|
|
machineId,
|
|
messageId,
|
|
command
|
|
),
|
|
});
|
|
|
|
var commandRequest = new NodeCommandGet(machineId);
|
|
var func = new AgentCommands(Logger, Context);
|
|
|
|
var result = await func.Run(TestHttpRequestData.FromJson("GET", commandRequest));
|
|
Assert.Equal(HttpStatusCode.OK, result.StatusCode);
|
|
|
|
var pendingNodeCommand = BodyAs<PendingNodeCommand>(result);
|
|
pendingNodeCommand.Envelope.Should().NotBeNull();
|
|
pendingNodeCommand.Envelope?.Command.Should().BeEquivalentTo(command);
|
|
pendingNodeCommand.Envelope?.MessageId.Should().Be(messageId);
|
|
}
|
|
}
|