# # Licensed to the Apache Software Foundation (ASF) under one or more # contributor license agreements. See the NOTICE file distributed with # this work for additional information regarding copyright ownership. # The ASF licenses this file to You under the Apache License, Version 2.0 # (the "License"); you may not use this file except in compliance with # the License. You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # BEGIN { $ENV{VAULT_TOKEN} = "root"; } use t::APISIX 'no_plan'; repeat_each(1); no_long_string(); no_root_location(); no_shuffle(); add_block_preprocessor(sub { my ($block) = @_; if (!defined $block->request) { $block->set_value("request", "GET /t"); } }); run_tests; __DATA__ === TEST 1: sanity --- config location /t { content_by_lua_block { local plugin = require("apisix.plugins.wolf-rbac") local conf = {} local ok, err = plugin.check_schema(conf) if not ok then ngx.say(err) end ngx.say(require("toolkit.json").encode(conf)) } } --- response_body_like eval qr/\{"appid":"unset","header_prefix":"X-","server":"http:\/\/127\.0\.0\.1:12180"\}/ === TEST 2: wrong type of string --- config location /t { content_by_lua_block { local plugin = require("apisix.plugins.wolf-rbac") local ok, err = plugin.check_schema({appid = 123}) if not ok then ngx.say(err) end ngx.say("done") } } --- response_body property "appid" validation failed: wrong type: expected string, got number done === TEST 3: setup public API route --- config location /t { content_by_lua_block { local data = { { url = "/apisix/admin/routes/wolf-login", data = [[{ "plugins": { "public-api": {} }, "uri": "/apisix/plugin/wolf-rbac/login" }]] }, { url = "/apisix/admin/routes/wolf-userinfo", data = [[{ "plugins": { "public-api": {} }, "uri": "/apisix/plugin/wolf-rbac/user_info" }]] }, { url = "/apisix/admin/routes/wolf-change-pwd", data = [[{ "plugins": { "public-api": {} }, "uri": "/apisix/plugin/wolf-rbac/change_pwd" }]] }, } local t = require("lib.test_admin").test for _, data in ipairs(data) do local code, body = t(data.url, ngx.HTTP_PUT, data.data) ngx.say(body) end } } --- response_body eval "passed\n" x 3 === TEST 4: add consumer with username and plugins --- config location /t { content_by_lua_block { local t = require("lib.test_admin").test local code, body = t('/apisix/admin/consumers', ngx.HTTP_PUT, [[{ "username": "wolf_rbac_unit_test", "plugins": { "wolf-rbac": { "appid": "wolf-rbac-app", "server": "http://127.0.0.1:1982" } } }]] ) if code >= 300 then ngx.status = code end ngx.say(body) } } --- response_body passed === TEST 5: enable wolf rbac plugin using admin api --- config location /t { content_by_lua_block { local t = require("lib.test_admin").test local code, body = t('/apisix/admin/routes/1', ngx.HTTP_PUT, [[{ "plugins": { "wolf-rbac": {} }, "upstream": { "nodes": { "127.0.0.1:1982": 1 }, "type": "roundrobin" }, "uris": ["/hello*","/wolf/rbac/*"] }]] ) if code >= 300 then ngx.status = code end ngx.say(body) } } --- response_body passed === TEST 6: login failed, appid is missing --- request POST /apisix/plugin/wolf-rbac/login username=admin&password=123456 --- more_headers Content-Type: application/x-www-form-urlencoded --- error_code: 400 --- response_body_like eval qr/appid is missing/ === TEST 7: login failed, appid not found --- request POST /apisix/plugin/wolf-rbac/login appid=not-found&username=admin&password=123456 --- more_headers Content-Type: application/x-www-form-urlencoded --- error_code: 400 --- response_body_like eval qr/appid not found/ === TEST 8: login failed, username missing --- request POST /apisix/plugin/wolf-rbac/login appid=wolf-rbac-app&password=123456 --- more_headers Content-Type: application/x-www-form-urlencoded --- error_code: 200 --- response_body {"message":"request to wolf-server failed!"} --- grep_error_log eval qr/ERR_USERNAME_MISSING/ --- grep_error_log_out eval qr/ERR_USERNAME_MISSING/ === TEST 9: login failed, password missing --- request POST /apisix/plugin/wolf-rbac/login appid=wolf-rbac-app&username=admin --- more_headers Content-Type: application/x-www-form-urlencoded --- error_code: 200 --- response_body {"message":"request to wolf-server failed!"} --- grep_error_log eval qr/ERR_PASSWORD_MISSING/ --- grep_error_log_out eval qr/ERR_PASSWORD_MISSING/ === TEST 10: login failed, username not found --- request POST /apisix/plugin/wolf-rbac/login appid=wolf-rbac-app&username=not-found&password=123456 --- more_headers Content-Type: application/x-www-form-urlencoded --- error_code: 200 --- response_body {"message":"request to wolf-server failed!"} --- grep_error_log eval qr/ERR_USER_NOT_FOUND/ --- grep_error_log_out eval qr/ERR_USER_NOT_FOUND/ === TEST 11: login failed, wrong password --- request POST /apisix/plugin/wolf-rbac/login appid=wolf-rbac-app&username=admin&password=wrong-password --- more_headers Content-Type: application/x-www-form-urlencoded --- error_code: 200 --- response_body {"message":"request to wolf-server failed!"} --- grep_error_log eval qr/ERR_PASSWORD_ERROR/ --- grep_error_log_out eval qr/ERR_PASSWORD_ERROR/ === TEST 12: login successfully --- config location /t { content_by_lua_block { local t = require("lib.test_admin").test local code, body = t('/apisix/plugin/wolf-rbac/login', ngx.HTTP_POST, [[ {"appid": "wolf-rbac-app", "username": "admin","password": "123456"} ]], [[ {"rbac_token":"V1#wolf-rbac-app#wolf-rbac-token","user_info":{"nickname":"administrator","username":"admin","id":"100"}} ]], {["Content-Type"] = "application/json"} ) ngx.status = code } } === TEST 13: verify, missing token --- request GET /hello --- error_code: 401 --- response_body {"message":"Missing rbac token in request"} === TEST 14: verify: invalid rbac token --- request GET /hello --- error_code: 401 --- more_headers x-rbac-token: invalid-rbac-token --- response_body {"message":"invalid rbac token: parse failed"} === TEST 15: verify: invalid appid in rbac token --- request GET /hello --- error_code: 401 --- more_headers x-rbac-token: V1#invalid-appid#rbac-token --- response_body {"message":"Invalid appid in rbac token"} --- error_log consumer [invalid-appid] not found === TEST 16: verify: failed --- request GET /hello1 --- error_code: 403 --- more_headers x-rbac-token: V1#wolf-rbac-app#wolf-rbac-token --- response_body {"message":"ERR_ACCESS_DENIED"} --- grep_error_log eval qr/ERR_ACCESS_DENIED */ --- grep_error_log_out ERR_ACCESS_DENIED ERR_ACCESS_DENIED ERR_ACCESS_DENIED === TEST 17: verify (in argument) --- request GET /hello?rbac_token=V1%23wolf-rbac-app%23wolf-rbac-token --- response_headers X-UserId: 100 X-Username: admin X-Nickname: administrator --- response_body hello world === TEST 18: verify (in header Authorization) --- request GET /hello --- more_headers Authorization: V1#wolf-rbac-app#wolf-rbac-token --- response_headers X-UserId: 100 X-Username: admin X-Nickname: administrator --- response_body hello world === TEST 19: verify (in header x-rbac-token) --- request GET /hello --- more_headers x-rbac-token: V1#wolf-rbac-app#wolf-rbac-token --- response_headers X-UserId: 100 X-Username: admin X-Nickname: administrator --- response_body hello world === TEST 20: verify (in cookie) --- request GET /hello --- more_headers Cookie: x-rbac-token=V1#wolf-rbac-app#wolf-rbac-token --- response_headers X-UserId: 100 X-Username: admin X-Nickname: administrator --- response_body hello world === TEST 21: get userinfo failed, missing token --- request GET /apisix/plugin/wolf-rbac/user_info --- error_code: 401 --- response_body {"message":"Missing rbac token in request"} === TEST 22: get userinfo failed, invalid rbac token --- request GET /apisix/plugin/wolf-rbac/user_info --- error_code: 401 --- more_headers x-rbac-token: invalid-rbac-token --- response_body {"message":"invalid rbac token: parse failed"} === TEST 23: get userinfo --- config location /t { content_by_lua_block { local t = require("lib.test_admin").test local code, body = t('/apisix/plugin/wolf-rbac/user_info', ngx.HTTP_GET, nil, [[ {"user_info":{"username":"admin","id":"100","nickname":"administrator"}} ]], {Cookie = "x-rbac-token=V1#wolf-rbac-app#wolf-rbac-token"} ) ngx.status = code } } === TEST 24: change password failed, old password incorrect --- request PUT /apisix/plugin/wolf-rbac/change_pwd {"oldPassword": "error", "newPassword": "abcdef"} --- more_headers Content-Type: application/json Cookie: x-rbac-token=V1#wolf-rbac-app#wolf-rbac-token --- error_code: 200 --- response_body {"message":"request to wolf-server failed!"} --- grep_error_log eval qr/ERR_OLD_PASSWORD_INCORRECT/ --- grep_error_log_out eval qr/ERR_OLD_PASSWORD_INCORRECT/ === TEST 25: change password --- request PUT /apisix/plugin/wolf-rbac/change_pwd {"oldPassword":"123456", "newPassword": "abcdef"} --- more_headers Content-Type: application/json Cookie: x-rbac-token=V1#wolf-rbac-app#wolf-rbac-token --- error_code: 200 --- response_body_like eval qr/success to change password/ === TEST 26: custom headers in request headers --- request GET /wolf/rbac/custom/headers?rbac_token=V1%23wolf-rbac-app%23wolf-rbac-token --- response_headers X-UserId: 100 X-Username: admin X-Nickname: administrator --- response_body id:100,username:admin,nickname:administrator === TEST 27: change password by post raw args --- request PUT /apisix/plugin/wolf-rbac/change_pwd oldPassword=123456&newPassword=abcdef --- more_headers Cookie: x-rbac-token=V1#wolf-rbac-app#wolf-rbac-token --- error_code: 200 --- response_body_like eval qr/success to change password/ === TEST 28: change password by post raw args, greater than 100 args is ok --- config location /t { content_by_lua_block { local t = require("lib.test_admin") local headers = { ["Cookie"] = "x-rbac-token=V1#wolf-rbac-app#wolf-rbac-token" } local tbl = {} for i=1, 100 do tbl[i] = "test"..tostring(i).."=test&" end tbl[101] = "oldPassword=123456&newPassword=abcdef" local code, _, real_body = t.test('/apisix/plugin/wolf-rbac/change_pwd', ngx.HTTP_PUT, table.concat(tbl, ""), nil, headers ) ngx.status = 200 ngx.say(real_body) } } --- response_body_like eval qr/success to change password/ === TEST 29: verify: failed, server internal error --- request GET /hello/500 --- error_code: 500 --- more_headers x-rbac-token: V1#wolf-rbac-app#wolf-rbac-token --- response_body {"message":"request to wolf-server failed, status:500"} --- grep_error_log eval qr/request to wolf-server failed, status:500 */ --- grep_error_log_out request to wolf-server failed, status:500 request to wolf-server failed, status:500 === TEST 30: verify: failed, token is expired --- request GET /hello/401 --- error_code: 401 --- more_headers x-rbac-token: V1#wolf-rbac-app#wolf-rbac-token --- response_body {"message":"ERR_TOKEN_INVALID"} --- grep_error_log eval qr/ERR_TOKEN_INVALID */ --- grep_error_log_out ERR_TOKEN_INVALID ERR_TOKEN_INVALID ERR_TOKEN_INVALID === TEST 31: set hmac-auth conf: appid uses secret ref --- config location /t { content_by_lua_block { local t = require("lib.test_admin").test -- put secret vault config local code, body = t('/apisix/admin/secrets/vault/test1', ngx.HTTP_PUT, [[{ "uri": "http://127.0.0.1:8200", "prefix" : "kv/apisix", "token" : "root" }]] ) if code >= 300 then ngx.status = code return ngx.say(body) end code, body = t('/apisix/admin/consumers', ngx.HTTP_PUT, [[{ "username": "wolf_rbac_unit_test", "plugins": { "wolf-rbac": { "appid": "$secret://vault/test1/wolf_rbac_unit_test/appid", "server": "http://127.0.0.1:1982" } } }]] ) if code >= 300 then ngx.status = code end ngx.say(body) } } --- response_body passed === TEST 32: store secret into vault --- exec VAULT_TOKEN='root' VAULT_ADDR='http://0.0.0.0:8200' vault kv put kv/apisix/wolf_rbac_unit_test appid=wolf-rbac-app --- response_body Success! Data written to: kv/apisix/wolf_rbac_unit_test === TEST 33: login successfully --- config location /t { content_by_lua_block { local t = require("lib.test_admin").test local code, body = t('/apisix/plugin/wolf-rbac/login', ngx.HTTP_POST, [[ {"appid": "wolf-rbac-app", "username": "admin","password": "123456"} ]], [[ {"rbac_token":"V1#wolf-rbac-app#wolf-rbac-token","user_info":{"nickname":"administrator","username":"admin","id":"100"}} ]], {["Content-Type"] = "application/json"} ) ngx.status = code } } === TEST 34: set hmac-auth conf with the token in an env var: appid uses secret ref --- config location /t { content_by_lua_block { local t = require("lib.test_admin").test -- put secret vault config local code, body = t('/apisix/admin/secrets/vault/test1', ngx.HTTP_PUT, [[{ "uri": "http://127.0.0.1:8200", "prefix" : "kv/apisix", "token" : "$ENV://VAULT_TOKEN" }]] ) if code >= 300 then ngx.status = code return ngx.say(body) end code, body = t('/apisix/admin/consumers', ngx.HTTP_PUT, [[{ "username": "wolf_rbac_unit_test", "plugins": { "wolf-rbac": { "appid": "$secret://vault/test1/wolf_rbac_unit_test/appid", "server": "http://127.0.0.1:1982" } } }]] ) if code >= 300 then ngx.status = code end ngx.say(body) } } --- response_body passed === TEST 35: login successfully --- config location /t { content_by_lua_block { local t = require("lib.test_admin").test local code, body = t('/apisix/plugin/wolf-rbac/login', ngx.HTTP_POST, [[ {"appid": "wolf-rbac-app", "username": "admin","password": "123456"} ]], [[ {"rbac_token":"V1#wolf-rbac-app#wolf-rbac-token","user_info":{"nickname":"administrator","username":"admin","id":"100"}} ]], {["Content-Type"] = "application/json"} ) ngx.status = code } } === TEST 36: add consumer with echo plugin --- config location /t { content_by_lua_block { local t = require("lib.test_admin").test local code, body = t('/apisix/admin/consumers', ngx.HTTP_PUT, [[{ "username": "wolf_rbac_with_other_plugins", "plugins": { "wolf-rbac": { "appid": "wolf-rbac-app", "server": "http://127.0.0.1:1982" }, "echo": { "body": "consumer merge echo plugins\n" } } }]] ) if code >= 300 then ngx.status = code end ngx.say(body) } } --- response_body passed --- no_error_log [error] === TEST 37: verify echo plugin in consumer --- request GET /hello --- more_headers Authorization: V1#wolf-rbac-app#wolf-rbac-token --- response_headers X-UserId: 100 X-Username: admin X-Nickname: administrator --- response_body consumer merge echo plugins --- no_error_log [error]