vbatts/quay
Archived
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Switch the security tests over to the new test format which is generated.

Browse source
This commit is contained in:
jakedt 2014-03-18 16:48:09 -04:00
parent 6f39e158d6
commit 0c4c4c78c7
2 changed files with 2900 additions and 507 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

442
test/specs.py
View file

@ -1,10 +1,10 @@
import json
from flask import url_for
from collections import OrderedDict
from uuid import uuid4
from base64 import b64encode
NO_REPO = None
PUBLIC_REPO = 'public/publicrepo'
PRIVATE_REPO = 'devtable/shared'
@ -72,446 +72,6 @@ UPDATE_REPO_DETAILS = {
}
class TestSpec(object):
def __init__(self, url, anon_code=401, no_access_code=403, read_code=403,
admin_code=200):
self._url = url
self._data = None
self._method = 'GET'
self.anon_code = anon_code
self.no_access_code = no_access_code
self.read_code = read_code
self.admin_code = admin_code
def set_data_from_obj(self, json_serializable):
self._data = json.dumps(json_serializable)
return self
def set_method(self, method):
self._method = method
return self
def get_client_args(self):
kwargs = {
'method': self._method
}
if self._data or self._method == 'POST' or self._method == 'PUT':
kwargs['data'] = self._data if self._data else '{}'
kwargs['content_type'] = 'application/json'
return self._url, kwargs
def build_specs():
return [
TestSpec(url_for('api.welcome'), 200, 200, 200, 200),
TestSpec(url_for('api.list_plans'), 200, 200, 200, 200),
TestSpec(url_for('api.get_logged_in_user'), 200, 200, 200, 200),
TestSpec(url_for('api.change_user_details'),
401, 200, 200, 200).set_method('PUT'),
TestSpec(url_for('api.create_new_user'), 201, 201, 201,
201).set_method('POST').set_data_from_obj(NEW_USER_DETAILS),
TestSpec(url_for('api.signin_user'), 200, 200, 200,
200).set_method('POST').set_data_from_obj(SIGNIN_DETAILS),
TestSpec(url_for('api.request_recovery_email'), 201, 201, 201,
201).set_method('POST').set_data_from_obj(SEND_RECOVERY_DETAILS),
TestSpec(url_for('api.get_matching_users', prefix='dev'),
401, 200, 200, 200),
TestSpec(url_for('api.get_matching_entities', prefix='dev'), 401, 200, 200,
200),
TestSpec(url_for('api.get_organization', orgname=ORG), 401, 403, 200, 200),
TestSpec(url_for('api.get_organization_private_allowed', orgname=ORG)),
TestSpec(url_for('api.update_organization_team', orgname=ORG,
teamname=ORG_OWNERS)).set_method('PUT'),
TestSpec(url_for('api.update_organization_team', orgname=ORG,
teamname=ORG_READERS)).set_method('PUT'),
TestSpec(url_for('api.delete_organization_team', orgname=ORG,
teamname=ORG_OWNERS),
admin_code=400).set_method('DELETE'),
TestSpec(url_for('api.delete_organization_team', orgname=ORG,
teamname=ORG_READERS),
admin_code=204).set_method('DELETE'),
TestSpec(url_for('api.get_organization_team_members', orgname=ORG,
teamname=ORG_OWNERS)),
TestSpec(url_for('api.get_organization_team_members', orgname=ORG,
teamname=ORG_READERS), read_code=200),
TestSpec(url_for('api.update_organization_team_member', orgname=ORG,
teamname=ORG_OWNERS, membername=ORG_OWNER),
admin_code=400).set_method('PUT'),
TestSpec(url_for('api.update_organization_team_member', orgname=ORG,
teamname=ORG_READERS,
membername=ORG_OWNER)).set_method('PUT'),
TestSpec(url_for('api.delete_organization_team_member', orgname=ORG,
teamname=ORG_OWNERS, membername=ORG_OWNER),
admin_code=400).set_method('DELETE'),
TestSpec(url_for('api.delete_organization_team_member', orgname=ORG,
teamname=ORG_READERS, membername=ORG_OWNER),
admin_code=400).set_method('DELETE'),
(TestSpec(url_for('api.create_repo'))
.set_method('POST')
.set_data_from_obj(NEW_ORG_REPO_DETAILS)),
TestSpec(url_for('api.find_repos'), 200, 200, 200, 200),
TestSpec(url_for('api.list_repos'), 200, 200, 200, 200),
TestSpec(url_for('api.update_repo', repository=PUBLIC_REPO),
admin_code=403).set_method('PUT'),
(TestSpec(url_for('api.update_repo', repository=ORG_REPO))
.set_method('PUT')
.set_data_from_obj(UPDATE_REPO_DETAILS)),
(TestSpec(url_for('api.update_repo', repository=PRIVATE_REPO))
.set_method('PUT')
.set_data_from_obj(UPDATE_REPO_DETAILS)),
(TestSpec(url_for('api.change_repo_visibility', repository=PUBLIC_REPO),
admin_code=403).set_method('POST')
.set_data_from_obj(CHANGE_VISIBILITY_DETAILS)),
(TestSpec(url_for('api.change_repo_visibility', repository=ORG_REPO))
.set_method('POST').set_data_from_obj(CHANGE_VISIBILITY_DETAILS)),
(TestSpec(url_for('api.change_repo_visibility', repository=PRIVATE_REPO))
.set_method('POST').set_data_from_obj(CHANGE_VISIBILITY_DETAILS)),
TestSpec(url_for('api.delete_repository', repository=PUBLIC_REPO),
admin_code=403).set_method('DELETE'),
TestSpec(url_for('api.delete_repository', repository=ORG_REPO),
admin_code=204).set_method('DELETE'),
TestSpec(url_for('api.delete_repository', repository=PRIVATE_REPO),
admin_code=204).set_method('DELETE'),
TestSpec(url_for('api.get_repo', repository=PUBLIC_REPO),
200, 200, 200,200),
TestSpec(url_for('api.get_repo', repository=ORG_REPO),
403, 403, 200, 200),
TestSpec(url_for('api.get_repo', repository=PRIVATE_REPO),
403, 403, 200, 200),
TestSpec(url_for('api.get_repo_builds', repository=PUBLIC_REPO),
200, 200, 200, 200),
TestSpec(url_for('api.get_repo_builds', repository=ORG_REPO),
403, 403, 200, 200),
TestSpec(url_for('api.get_repo_builds', repository=PRIVATE_REPO),
403, 403, 200, 200),
TestSpec(url_for('api.get_filedrop_url'), 401, 200, 200,
200).set_method('POST').set_data_from_obj(FILE_DROP_DETAILS),
(TestSpec(url_for('api.request_repo_build', repository=PUBLIC_REPO),
admin_code=403).set_method('POST')
.set_data_from_obj(CREATE_BUILD_DETAILS)),
(TestSpec(url_for('api.request_repo_build', repository=ORG_REPO),
admin_code=201).set_method('POST')
.set_data_from_obj(CREATE_BUILD_DETAILS)),
(TestSpec(url_for('api.request_repo_build', repository=PRIVATE_REPO),
admin_code=201).set_method('POST')
.set_data_from_obj(CREATE_BUILD_DETAILS)),
TestSpec(url_for('api.create_webhook', repository=PUBLIC_REPO),
admin_code=403).set_method('POST'),
TestSpec(url_for('api.create_webhook',
repository=ORG_REPO)).set_method('POST'),
TestSpec(url_for('api.create_webhook',
repository=PRIVATE_REPO)).set_method('POST'),
TestSpec(url_for('api.get_webhook', repository=PUBLIC_REPO,
public_id=FAKE_WEBHOOK), admin_code=403),
TestSpec(url_for('api.get_webhook', repository=ORG_REPO,
public_id=FAKE_WEBHOOK), admin_code=404),
TestSpec(url_for('api.get_webhook', repository=PRIVATE_REPO,
public_id=FAKE_WEBHOOK), admin_code=404),
TestSpec(url_for('api.list_webhooks', repository=PUBLIC_REPO),
admin_code=403),
TestSpec(url_for('api.list_webhooks', repository=ORG_REPO)),
TestSpec(url_for('api.list_webhooks', repository=PRIVATE_REPO)),
TestSpec(url_for('api.delete_webhook', repository=PUBLIC_REPO,
public_id=FAKE_WEBHOOK),
admin_code=403).set_method('DELETE'),
TestSpec(url_for('api.delete_webhook', repository=ORG_REPO,
public_id=FAKE_WEBHOOK),
admin_code=400).set_method('DELETE'),
TestSpec(url_for('api.delete_webhook', repository=PRIVATE_REPO,
public_id=FAKE_WEBHOOK),
admin_code=400).set_method('DELETE'),
TestSpec(url_for('api.list_repository_images', repository=PUBLIC_REPO),
200, 200, 200, 200),
TestSpec(url_for('api.list_repository_images', repository=ORG_REPO),
403, 403, 200, 200),
TestSpec(url_for('api.list_repository_images', repository=PRIVATE_REPO),
403, 403, 200, 200),
TestSpec(url_for('api.get_image', repository=PUBLIC_REPO,
image_id=FAKE_IMAGE_ID), 404, 404, 404, 404),
TestSpec(url_for('api.get_image', repository=ORG_REPO,
image_id=FAKE_IMAGE_ID), 403, 403, 404, 404),
TestSpec(url_for('api.get_image', repository=PRIVATE_REPO,
image_id=FAKE_IMAGE_ID), 403, 403, 404, 404),
TestSpec(url_for('api.get_image_changes', repository=PUBLIC_REPO,
image_id=FAKE_IMAGE_ID), 404, 404, 404, 404),
TestSpec(url_for('api.get_image_changes', repository=ORG_REPO,
image_id=FAKE_IMAGE_ID), 403, 403, 404, 404),
TestSpec(url_for('api.get_image_changes', repository=PRIVATE_REPO,
image_id=FAKE_IMAGE_ID), 403, 403, 404, 404),
TestSpec(url_for('api.list_tag_images', repository=PUBLIC_REPO,
tag=FAKE_TAG_NAME), 404, 404, 404, 404),
TestSpec(url_for('api.list_tag_images', repository=ORG_REPO,
tag=FAKE_TAG_NAME), 403, 403, 404, 404),
TestSpec(url_for('api.list_tag_images', repository=PRIVATE_REPO,
tag=FAKE_TAG_NAME), 403, 403, 404, 404),
TestSpec(url_for('api.list_repo_team_permissions', repository=PUBLIC_REPO),
admin_code=403),
TestSpec(url_for('api.list_repo_team_permissions', repository=ORG_REPO)),
TestSpec(url_for('api.list_repo_team_permissions',
repository=PRIVATE_REPO)),
TestSpec(url_for('api.list_repo_user_permissions', repository=PUBLIC_REPO),
admin_code=403),
TestSpec(url_for('api.list_repo_user_permissions', repository=ORG_REPO)),
TestSpec(url_for('api.list_repo_user_permissions',
repository=PRIVATE_REPO)),
TestSpec(url_for('api.get_user_permissions', repository=PUBLIC_REPO,
username=FAKE_USERNAME), admin_code=403),
TestSpec(url_for('api.get_user_permissions', repository=ORG_REPO,
username=FAKE_USERNAME), admin_code=400),
TestSpec(url_for('api.get_user_permissions', repository=PRIVATE_REPO,
username=FAKE_USERNAME), admin_code=400),
TestSpec(url_for('api.get_team_permissions', repository=PUBLIC_REPO,
teamname=ORG_OWNERS), admin_code=403),
TestSpec(url_for('api.get_team_permissions', repository=PUBLIC_REPO,
teamname=ORG_READERS), admin_code=403),
TestSpec(url_for('api.get_team_permissions', repository=ORG_REPO,
teamname=ORG_OWNERS), admin_code=400),
TestSpec(url_for('api.get_team_permissions', repository=ORG_REPO,
teamname=ORG_READERS)),
TestSpec(url_for('api.get_team_permissions', repository=PRIVATE_REPO,
teamname=ORG_OWNERS), admin_code=400),
TestSpec(url_for('api.get_team_permissions', repository=PRIVATE_REPO,
teamname=ORG_READERS), admin_code=400),
TestSpec(url_for('api.change_user_permissions', repository=PUBLIC_REPO,
username=FAKE_USERNAME),
admin_code=403).set_method('PUT'),
TestSpec(url_for('api.change_user_permissions', repository=ORG_REPO,
username=FAKE_USERNAME),
admin_code=400).set_method('PUT'),
TestSpec(url_for('api.change_user_permissions', repository=PRIVATE_REPO,
username=FAKE_USERNAME),
admin_code=400).set_method('PUT'),
(TestSpec(url_for('api.change_team_permissions', repository=PUBLIC_REPO,
teamname=ORG_OWNERS), admin_code=403)
.set_method('PUT')
.set_data_from_obj(CHANGE_PERMISSION_DETAILS)),
(TestSpec(url_for('api.change_team_permissions', repository=PUBLIC_REPO,
teamname=ORG_READERS), admin_code=403)
.set_method('PUT')
.set_data_from_obj(CHANGE_PERMISSION_DETAILS)),
(TestSpec(url_for('api.change_team_permissions', repository=ORG_REPO,
teamname=ORG_OWNERS))
.set_method('PUT')
.set_data_from_obj(CHANGE_PERMISSION_DETAILS)),
(TestSpec(url_for('api.change_team_permissions', repository=ORG_REPO,
teamname=ORG_READERS))
.set_method('PUT')
.set_data_from_obj(CHANGE_PERMISSION_DETAILS)),
(TestSpec(url_for('api.change_team_permissions', repository=PRIVATE_REPO,
teamname=ORG_OWNERS), admin_code=400)
.set_method('PUT')
.set_data_from_obj(CHANGE_PERMISSION_DETAILS)),
(TestSpec(url_for('api.change_team_permissions', repository=PRIVATE_REPO,
teamname=ORG_READERS), admin_code=400)
.set_method('PUT')
.set_data_from_obj(CHANGE_PERMISSION_DETAILS)),
TestSpec(url_for('api.delete_user_permissions', repository=PUBLIC_REPO,
username=FAKE_USERNAME),
admin_code=403).set_method('DELETE'),
TestSpec(url_for('api.delete_user_permissions', repository=ORG_REPO,
username=FAKE_USERNAME),
admin_code=400).set_method('DELETE'),
TestSpec(url_for('api.delete_user_permissions', repository=PRIVATE_REPO,
username=FAKE_USERNAME),
admin_code=400).set_method('DELETE'),
TestSpec(url_for('api.delete_team_permissions', repository=PUBLIC_REPO,
teamname=ORG_OWNERS),
admin_code=403).set_method('DELETE'),
TestSpec(url_for('api.delete_team_permissions', repository=PUBLIC_REPO,
teamname=ORG_READERS),
admin_code=403).set_method('DELETE'),
TestSpec(url_for('api.delete_team_permissions', repository=ORG_REPO,
teamname=ORG_OWNERS),
admin_code=400).set_method('DELETE'),
TestSpec(url_for('api.delete_team_permissions', repository=ORG_REPO,
teamname=ORG_READERS),
admin_code=204).set_method('DELETE'),
TestSpec(url_for('api.delete_team_permissions', repository=PRIVATE_REPO,
teamname=ORG_OWNERS),
admin_code=400).set_method('DELETE'),
TestSpec(url_for('api.delete_team_permissions', repository=PRIVATE_REPO,
teamname=ORG_READERS),
admin_code=400).set_method('DELETE'),
TestSpec(url_for('api.list_repo_tokens', repository=PUBLIC_REPO),
admin_code=403),
TestSpec(url_for('api.list_repo_tokens', repository=ORG_REPO)),
TestSpec(url_for('api.list_repo_tokens', repository=PRIVATE_REPO)),
TestSpec(url_for('api.get_tokens', repository=PUBLIC_REPO,
code=FAKE_TOKEN), admin_code=403),
TestSpec(url_for('api.get_tokens', repository=ORG_REPO, code=FAKE_TOKEN),
admin_code=404),
TestSpec(url_for('api.get_tokens', repository=PRIVATE_REPO,
code=FAKE_TOKEN), admin_code=404),
TestSpec(url_for('api.create_token', repository=PUBLIC_REPO),
admin_code=403).set_method('POST'),
(TestSpec(url_for('api.create_token', repository=ORG_REPO),
admin_code=201).set_method('POST')
.set_data_from_obj(CREATE_TOKEN_DETAILS)),
(TestSpec(url_for('api.create_token', repository=PRIVATE_REPO),
admin_code=201).set_method('POST')
.set_data_from_obj(CREATE_TOKEN_DETAILS)),
TestSpec(url_for('api.change_token', repository=PUBLIC_REPO,
code=FAKE_TOKEN), admin_code=403).set_method('PUT'),
TestSpec(url_for('api.change_token', repository=ORG_REPO, code=FAKE_TOKEN),
admin_code=400).set_method('PUT'),
TestSpec(url_for('api.change_token', repository=PRIVATE_REPO,
code=FAKE_TOKEN), admin_code=400).set_method('PUT'),
TestSpec(url_for('api.delete_token', repository=PUBLIC_REPO,
code=FAKE_TOKEN), admin_code=403).set_method('DELETE'),
TestSpec(url_for('api.delete_token', repository=ORG_REPO, code=FAKE_TOKEN),
admin_code=400).set_method('DELETE'),
TestSpec(url_for('api.delete_token', repository=PRIVATE_REPO,
code=FAKE_TOKEN), admin_code=400).set_method('DELETE'),
TestSpec(url_for('api.update_user_subscription'),
401, 400, 400, 400).set_method('PUT'),
TestSpec(url_for('api.update_org_subscription', orgname=ORG),
401, 403, 403, 400).set_method('PUT'),
TestSpec(url_for('api.get_user_subscription'), 401, 200, 200, 200),
TestSpec(url_for('api.get_org_subscription', orgname=ORG)),
TestSpec(url_for('api.list_repo_logs', repository=PUBLIC_REPO),
admin_code=403),
TestSpec(url_for('api.list_repo_logs', repository=ORG_REPO)),
TestSpec(url_for('api.list_repo_logs', repository=PRIVATE_REPO)),
TestSpec(url_for('api.list_org_logs', orgname=ORG)),
TestSpec(url_for('api.get_repo_build_status', repository=PUBLIC_REPO,
build_uuid=BUILD_UUID), 400, 400, 400, 400),
TestSpec(url_for('api.get_repo_build_status', repository=ORG_REPO,
build_uuid=BUILD_UUID), 403, 403, 400, 400),
TestSpec(url_for('api.get_repo_build_status', repository=PRIVATE_REPO,
build_uuid=BUILD_UUID), 403, 403, 400, 400),
TestSpec(url_for('api.get_repo_build_archive_url', repository=PUBLIC_REPO,
build_uuid=BUILD_UUID), 403, 403, 403, 403),
TestSpec(url_for('api.get_repo_build_archive_url', repository=ORG_REPO,
build_uuid=BUILD_UUID), 403, 403, 403, 400),
TestSpec(url_for('api.get_repo_build_archive_url', repository=PRIVATE_REPO,
build_uuid=BUILD_UUID), 403, 403, 403, 400),
TestSpec(url_for('api.get_repo_build_logs', repository=PUBLIC_REPO,
build_uuid=BUILD_UUID), 403, 403, 403, 403),
TestSpec(url_for('api.get_repo_build_logs', repository=ORG_REPO,
build_uuid=BUILD_UUID), 403, 403, 403, 400),
TestSpec(url_for('api.get_repo_build_logs', repository=PRIVATE_REPO,
build_uuid=BUILD_UUID), 403, 403, 403, 400),
TestSpec(url_for('api.get_build_trigger', repository=PUBLIC_REPO,
trigger_uuid=TRIGGER_UUID), admin_code=403),
TestSpec(url_for('api.get_build_trigger', repository=ORG_REPO,
trigger_uuid=TRIGGER_UUID), admin_code=404),
TestSpec(url_for('api.get_build_trigger', repository=PRIVATE_REPO,
trigger_uuid=TRIGGER_UUID), admin_code=404),
TestSpec(url_for('api.list_build_trigger_subdirs', repository=PUBLIC_REPO,
trigger_uuid=TRIGGER_UUID), 403, 403, 403, 403),
TestSpec(url_for('api.list_build_trigger_subdirs', repository=ORG_REPO,
trigger_uuid=TRIGGER_UUID), 403, 403, 403, 404),
TestSpec(url_for('api.list_build_trigger_subdirs', repository=PRIVATE_REPO,
trigger_uuid=TRIGGER_UUID), 403, 403, 403, 404),
TestSpec(url_for('api.activate_build_trigger', repository=PUBLIC_REPO,
trigger_uuid=TRIGGER_UUID), 403, 403, 403, 403),
TestSpec(url_for('api.activate_build_trigger', repository=ORG_REPO,
trigger_uuid=TRIGGER_UUID), 403, 403, 403, 404),
TestSpec(url_for('api.activate_build_trigger', repository=PRIVATE_REPO,
trigger_uuid=TRIGGER_UUID), 403, 403, 403, 404),
TestSpec(url_for('api.manually_start_build_trigger',
repository=PUBLIC_REPO, trigger_uuid=TRIGGER_UUID),
403, 403, 403, 403),
TestSpec(url_for('api.manually_start_build_trigger',
repository=ORG_REPO, trigger_uuid=TRIGGER_UUID),
403, 403, 403, 404),
TestSpec(url_for('api.manually_start_build_trigger',
repository=PRIVATE_REPO, trigger_uuid=TRIGGER_UUID),
403, 403, 403, 404),
TestSpec(url_for('api.list_trigger_recent_builds', repository=PUBLIC_REPO,
trigger_uuid=TRIGGER_UUID), admin_code=403),
TestSpec(url_for('api.list_trigger_recent_builds', repository=ORG_REPO,
trigger_uuid=TRIGGER_UUID)),
TestSpec(url_for('api.list_trigger_recent_builds', repository=PRIVATE_REPO,
trigger_uuid=TRIGGER_UUID)),
TestSpec(url_for('api.list_trigger_build_sources', repository=PUBLIC_REPO,
trigger_uuid=TRIGGER_UUID), admin_code=403),
TestSpec(url_for('api.list_trigger_build_sources', repository=ORG_REPO,
trigger_uuid=TRIGGER_UUID), admin_code=404),
TestSpec(url_for('api.list_trigger_build_sources', repository=PRIVATE_REPO,
trigger_uuid=TRIGGER_UUID), admin_code=404),
TestSpec(url_for('api.list_build_triggers', repository=PUBLIC_REPO,
trigger_uuid=TRIGGER_UUID), admin_code=403),
TestSpec(url_for('api.list_build_triggers', repository=ORG_REPO,
trigger_uuid=TRIGGER_UUID)),
TestSpec(url_for('api.list_build_triggers', repository=PRIVATE_REPO,
trigger_uuid=TRIGGER_UUID)),
TestSpec(url_for('api.delete_build_trigger', repository=PUBLIC_REPO,
trigger_uuid=TRIGGER_UUID), admin_code=403),
TestSpec(url_for('api.delete_build_trigger', repository=ORG_REPO,
trigger_uuid=TRIGGER_UUID), admin_code=404),
TestSpec(url_for('api.delete_build_trigger', repository=PRIVATE_REPO,
trigger_uuid=TRIGGER_UUID), admin_code=404),
]
class IndexTestSpec(object):
def __init__(self, url, sess_repo=None, anon_code=403, no_access_code=403,
read_code=200, admin_code=200):

2965
test/test_api_security.py
View file

File diff suppressed because it is too large Load diff