vbatts/quay
Archived
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

test_endpoints: update to use JWT headers

Browse source
This commit is contained in:
Jimmy Zelinskie 2016-04-12 17:59:22 -04:00 • committed by Jimmy Zelinskie
parent d0bd70fb36
commit 2805dad64f
1 changed files with 6 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
test/test_endpoints.py
View file

@ -188,9 +188,6 @@ class WebEndpointTestCase(EndpointTestCase):
self.getResponse('web.redirect_to_namespace', namespace='devtable', expected_code=302) self.getResponse('web.redirect_to_namespace', namespace='devtable', expected_code=302)
self.getResponse('web.redirect_to_namespace', namespace='buynlarge', expected_code=302) self.getResponse('web.redirect_to_namespace', namespace='buynlarge', expected_code=302)
def test_jwk_set_uri(self):
self.getResponse('web.jwk_set_uri')
class KeyServerTestCase(EndpointTestCase): class KeyServerTestCase(EndpointTestCase):
_test_jwt_payload = { _test_jwt_payload = {
@ -199,7 +196,6 @@ class KeyServerTestCase(EndpointTestCase):
'exp': int(time.time()) + 60, 'exp': int(time.time()) + 60,
'iat': int(time.time()), 'iat': int(time.time()),
'nbf': int(time.time()), 'nbf': int(time.time()),
'kid': 'kid123',
} }
def test_list_service_keys(self): def test_list_service_keys(self):
@ -232,7 +228,6 @@ class KeyServerTestCase(EndpointTestCase):
private_key = RSA.generate(2048) private_key = RSA.generate(2048)
jwk = RSAKey(key=private_key.publickey()).serialize() jwk = RSAKey(key=private_key.publickey()).serialize()
payload = self._test_jwt_payload payload = self._test_jwt_payload
payload.pop('kid')
token = jwt.encode(payload, private_key.exportKey('PEM'), 'RS256') token = jwt.encode(payload, private_key.exportKey('PEM'), 'RS256')
# Publish a new key # Publish a new key
@ -243,8 +238,7 @@ class KeyServerTestCase(EndpointTestCase):
}, data=jwk, expected_code=202) }, data=jwk, expected_code=202)
# Rotate that new key # Rotate that new key
payload['kid'] = 'kid420' token = jwt.encode(payload, private_key.exportKey('PEM'), 'RS256', headers={'kid': 'kid420'})
token = jwt.encode(payload, private_key.exportKey('PEM'), 'RS256')
self.putResponse('key_server.put_service_key', service='sample_service', kid='kid6969', self.putResponse('key_server.put_service_key', service='sample_service', kid='kid6969',
headers={ headers={
'Authorization': 'Bearer %s' % token, 'Authorization': 'Bearer %s' % token,
@ -254,7 +248,7 @@ class KeyServerTestCase(EndpointTestCase):
# Rotation should only work when signed by the previous key # Rotation should only work when signed by the previous key
private_key = RSA.generate(2048) private_key = RSA.generate(2048)
jwk = RSAKey(key=private_key.publickey()).serialize() jwk = RSAKey(key=private_key.publickey()).serialize()
token = jwt.encode(payload, private_key.exportKey('PEM'), 'RS256') token = jwt.encode(payload, private_key.exportKey('PEM'), 'RS256', headers={'kid': 'kid420'})
self.putResponse('key_server.put_service_key', service='sample_service', kid='kid6969', self.putResponse('key_server.put_service_key', service='sample_service', kid='kid6969',
headers={ headers={
'Authorization': 'Bearer %s' % token, 'Authorization': 'Bearer %s' % token,
@ -272,7 +266,8 @@ class KeyServerTestCase(EndpointTestCase):
model.service_keys.approve_service_key('kid123', 1, ServiceKeyApprovalType.SUPERUSER) model.service_keys.approve_service_key('kid123', 1, ServiceKeyApprovalType.SUPERUSER)
# Mint a JWT with our test payload # Mint a JWT with our test payload
token = jwt.encode(self._test_jwt_payload, private_key.exportKey('PEM'), 'RS256') token = jwt.encode(self._test_jwt_payload, private_key.exportKey('PEM'), 'RS256',
headers={'kid': 'kid123'})
# Using the credentials of our approved key, delete our unapproved key # Using the credentials of our approved key, delete our unapproved key
self.deleteResponse('key_server.delete_service_key', self.deleteResponse('key_server.delete_service_key',
@ -280,9 +275,8 @@ class KeyServerTestCase(EndpointTestCase):
expected_code=204, service='sample_service', kid='kid321') expected_code=204, service='sample_service', kid='kid321')
# Attempt to delete a key signed by a key from a different service # Attempt to delete a key signed by a key from a different service
bad_payload = self._test_jwt_payload bad_token = jwt.encode(self._test_jwt_payload, private_key.exportKey('PEM'), 'RS256',
bad_payload['kid'] = 'kid5' headers={'kid': 'kid5'})
bad_token = jwt.encode(self._test_jwt_payload, private_key.exportKey('PEM'), 'RS256')
self.deleteResponse('key_server.delete_service_key', self.deleteResponse('key_server.delete_service_key',
headers={'Authorization': 'Bearer %s' % bad_token}, headers={'Authorization': 'Bearer %s' % bad_token},
expected_code=403, service='sample_service', kid='kid123') expected_code=403, service='sample_service', kid='kid123')