|
|
@@ -11135,6 +11135,7 @@ func TestWebAPIChangeUserProfileMock(t *testing.T) {
|
|
|
profileReq["email"] = email
|
|
|
profileReq["description"] = description
|
|
|
profileReq["public_keys"] = []string{testPubKey, testPubKey1}
|
|
|
+ profileReq["tls_certs"] = []string{httpsCert}
|
|
|
asJSON, err := json.Marshal(profileReq)
|
|
|
assert.NoError(t, err)
|
|
|
req, err = http.NewRequest(http.MethodPut, userProfilePath, bytes.NewBuffer(asJSON))
|
|
|
@@ -11158,6 +11159,10 @@ func TestWebAPIChangeUserProfileMock(t *testing.T) {
|
|
|
if assert.True(t, ok, profileReq) {
|
|
|
assert.Len(t, val, 2)
|
|
|
}
|
|
|
+ val, ok = profileReq["tls_certs"].([]any)
|
|
|
+ if assert.True(t, ok, profileReq) {
|
|
|
+ assert.Len(t, val, 1)
|
|
|
+ }
|
|
|
// set an invalid email
|
|
|
profileReq = make(map[string]any)
|
|
|
profileReq["email"] = "notavalidemail"
|
|
|
@@ -11180,10 +11185,22 @@ func TestWebAPIChangeUserProfileMock(t *testing.T) {
|
|
|
rr = executeRequest(req)
|
|
|
checkResponseCode(t, http.StatusBadRequest, rr)
|
|
|
assert.Contains(t, rr.Body.String(), "Validation error: error parsing public key")
|
|
|
+ // set an invalid TLS certificate
|
|
|
+ profileReq = make(map[string]any)
|
|
|
+ profileReq["tls_certs"] = []string{"not a TLS cert"}
|
|
|
+ asJSON, err = json.Marshal(profileReq)
|
|
|
+ assert.NoError(t, err)
|
|
|
+ req, err = http.NewRequest(http.MethodPut, userProfilePath, bytes.NewBuffer(asJSON))
|
|
|
+ assert.NoError(t, err)
|
|
|
+ setBearerForReq(req, token)
|
|
|
+ rr = executeRequest(req)
|
|
|
+ checkResponseCode(t, http.StatusBadRequest, rr)
|
|
|
+ assert.Contains(t, rr.Body.String(), "Validation error: invalid TLS certificate")
|
|
|
|
|
|
user, _, err = httpdtest.GetUserByUsername(user.Username, http.StatusOK)
|
|
|
assert.NoError(t, err)
|
|
|
- user.Filters.WebClient = []string{sdk.WebClientAPIKeyAuthChangeDisabled, sdk.WebClientPubKeyChangeDisabled}
|
|
|
+ user.Filters.WebClient = []string{sdk.WebClientAPIKeyAuthChangeDisabled, sdk.WebClientPubKeyChangeDisabled,
|
|
|
+ sdk.WebClientTLSCertChangeDisabled}
|
|
|
user.Email = email
|
|
|
user.Description = description
|
|
|
user.Filters.AllowAPIKeyAuth = true
|
|
|
@@ -11197,6 +11214,7 @@ func TestWebAPIChangeUserProfileMock(t *testing.T) {
|
|
|
profileReq["email"] = email
|
|
|
profileReq["description"] = description + "_mod" //nolint:goconst
|
|
|
profileReq["public_keys"] = []string{testPubKey}
|
|
|
+ profileReq["tls_certs"] = []string{}
|
|
|
asJSON, err = json.Marshal(profileReq)
|
|
|
assert.NoError(t, err)
|
|
|
req, err = http.NewRequest(http.MethodPut, userProfilePath, bytes.NewBuffer(asJSON))
|
|
|
@@ -11221,6 +11239,10 @@ func TestWebAPIChangeUserProfileMock(t *testing.T) {
|
|
|
if assert.True(t, ok, profileReq) {
|
|
|
assert.Len(t, val, 2)
|
|
|
}
|
|
|
+ val, ok = profileReq["tls_certs"].([]any)
|
|
|
+ if assert.True(t, ok, profileReq) {
|
|
|
+ assert.Len(t, val, 1)
|
|
|
+ }
|
|
|
|
|
|
user, _, err = httpdtest.GetUserByUsername(user.Username, http.StatusOK)
|
|
|
assert.NoError(t, err)
|
|
|
@@ -11257,7 +11279,7 @@ func TestWebAPIChangeUserProfileMock(t *testing.T) {
|
|
|
assert.Len(t, profileReq["public_keys"].([]any), 1)
|
|
|
// finally disable all profile permissions
|
|
|
user.Filters.WebClient = []string{sdk.WebClientAPIKeyAuthChangeDisabled, sdk.WebClientInfoChangeDisabled,
|
|
|
- sdk.WebClientPubKeyChangeDisabled}
|
|
|
+ sdk.WebClientPubKeyChangeDisabled, sdk.WebClientTLSCertChangeDisabled}
|
|
|
_, _, err = httpdtest.UpdateUser(user, http.StatusOK, "")
|
|
|
assert.NoError(t, err)
|
|
|
req, err = http.NewRequest(http.MethodPut, userProfilePath, bytes.NewBuffer(asJSON))
|
|
|
@@ -19288,6 +19310,7 @@ func TestWebUserProfile(t *testing.T) {
|
|
|
form.Set("description", description)
|
|
|
form.Set("public_keys[0][public_key]", testPubKey)
|
|
|
form.Set("public_keys[1][public_key]", testPubKey1)
|
|
|
+ form.Set("tls_certs[0][tls_cert]", httpsCert)
|
|
|
// no csrf token
|
|
|
req, err := http.NewRequest(http.MethodPost, webClientProfilePath, bytes.NewBuffer([]byte(form.Encode())))
|
|
|
assert.NoError(t, err)
|
|
|
@@ -19311,6 +19334,7 @@ func TestWebUserProfile(t *testing.T) {
|
|
|
assert.NoError(t, err)
|
|
|
assert.True(t, user.Filters.AllowAPIKeyAuth)
|
|
|
assert.Len(t, user.PublicKeys, 2)
|
|
|
+ assert.Len(t, user.Filters.TLSCerts, 1)
|
|
|
assert.Equal(t, email, user.Email)
|
|
|
assert.Equal(t, description, user.Description)
|
|
|
|
|
|
@@ -19323,8 +19347,18 @@ func TestWebUserProfile(t *testing.T) {
|
|
|
rr = executeRequest(req)
|
|
|
checkResponseCode(t, http.StatusOK, rr)
|
|
|
assert.Contains(t, rr.Body.String(), util.I18nErrorInvalidEmail)
|
|
|
- // invalid public key
|
|
|
+ // invalid tls cert
|
|
|
form.Set("email", email)
|
|
|
+ form.Set("tls_certs[0][tls_cert]", "not a TLS cert")
|
|
|
+ req, _ = http.NewRequest(http.MethodPost, webClientProfilePath, bytes.NewBuffer([]byte(form.Encode())))
|
|
|
+ req.RemoteAddr = defaultRemoteAddr
|
|
|
+ req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
|
|
+ setJWTCookieForReq(req, token)
|
|
|
+ rr = executeRequest(req)
|
|
|
+ checkResponseCode(t, http.StatusOK, rr)
|
|
|
+ assert.Contains(t, rr.Body.String(), util.I18nErrorInvalidTLSCert)
|
|
|
+ // invalid public key
|
|
|
+ form.Set("tls_certs[0][tls_cert]", httpsCert)
|
|
|
form.Set("public_keys[0][public_key]", "invalid")
|
|
|
req, _ = http.NewRequest(http.MethodPost, webClientProfilePath, bytes.NewBuffer([]byte(form.Encode())))
|
|
|
req.RemoteAddr = defaultRemoteAddr
|
|
|
@@ -19355,16 +19389,19 @@ func TestWebUserProfile(t *testing.T) {
|
|
|
assert.NoError(t, err)
|
|
|
assert.True(t, user.Filters.AllowAPIKeyAuth)
|
|
|
assert.Len(t, user.PublicKeys, 1)
|
|
|
+ assert.Len(t, user.Filters.TLSCerts, 1)
|
|
|
assert.Equal(t, email, user.Email)
|
|
|
assert.Equal(t, description, user.Description)
|
|
|
|
|
|
- user.Filters.WebClient = []string{sdk.WebClientAPIKeyAuthChangeDisabled, sdk.WebClientPubKeyChangeDisabled}
|
|
|
+ user.Filters.WebClient = []string{sdk.WebClientAPIKeyAuthChangeDisabled,
|
|
|
+ sdk.WebClientPubKeyChangeDisabled, sdk.WebClientTLSCertChangeDisabled}
|
|
|
_, _, err = httpdtest.UpdateUser(user, http.StatusOK, "")
|
|
|
assert.NoError(t, err)
|
|
|
token, err = getJWTWebClientTokenFromTestServer(defaultUsername, defaultPassword)
|
|
|
assert.NoError(t, err)
|
|
|
form.Set("public_keys[0][public_key]", testPubKey)
|
|
|
form.Set("public_keys[1][public_key]", testPubKey1)
|
|
|
+ form.Set("tls_certs[0][tls_cert]", "")
|
|
|
req, _ = http.NewRequest(http.MethodPost, webClientProfilePath, bytes.NewBuffer([]byte(form.Encode())))
|
|
|
req.RemoteAddr = defaultRemoteAddr
|
|
|
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
|
|
@@ -19376,6 +19413,7 @@ func TestWebUserProfile(t *testing.T) {
|
|
|
assert.NoError(t, err)
|
|
|
assert.True(t, user.Filters.AllowAPIKeyAuth)
|
|
|
assert.Len(t, user.PublicKeys, 1)
|
|
|
+ assert.Len(t, user.Filters.TLSCerts, 1)
|
|
|
assert.Equal(t, email, user.Email)
|
|
|
assert.Equal(t, description, user.Description)
|
|
|
|
|
|
@@ -19397,11 +19435,12 @@ func TestWebUserProfile(t *testing.T) {
|
|
|
assert.NoError(t, err)
|
|
|
assert.True(t, user.Filters.AllowAPIKeyAuth)
|
|
|
assert.Len(t, user.PublicKeys, 2)
|
|
|
+ assert.Len(t, user.Filters.TLSCerts, 0)
|
|
|
assert.Equal(t, email, user.Email)
|
|
|
assert.Equal(t, description, user.Description)
|
|
|
// finally disable all profile permissions
|
|
|
user.Filters.WebClient = []string{sdk.WebClientAPIKeyAuthChangeDisabled, sdk.WebClientInfoChangeDisabled,
|
|
|
- sdk.WebClientPubKeyChangeDisabled}
|
|
|
+ sdk.WebClientPubKeyChangeDisabled, sdk.WebClientTLSCertChangeDisabled}
|
|
|
_, _, err = httpdtest.UpdateUser(user, http.StatusOK, "")
|
|
|
assert.NoError(t, err)
|
|
|
token, err = getJWTWebClientTokenFromTestServer(defaultUsername, defaultPassword)
|
Nicola Murino