mirror of
https://github.com/penpot/penpot.git
synced 2026-11-09 11:30:54 +00:00
41654aa1b7
* ✨ Restrict management RPC methods to their shared keys Management methods now declare the shared-key ids allowed to call them with ::rpc/shared-keys. A wrapper in wrap-management checks the key id from the request before opening a transaction, so a valid key outside the declared set answers 403 shared-key-not-allowed. Methods without the metadata keep accepting any configured key. Scope upload-tempfile to exporter and media-processor, file analysis to nexus, durable jobs to exporter, and the Nitrate methods to admin-console. The test helper injects a declared key for the allowed path, and a coverage test fails when a management method is missing or declares the wrong set. Closes #12730 AI-assisted-by: deepseek-v4.1-flash * ♻️ Harden shared-key authorization scope and tests Rename the per-method metadata to ::rpc/allowed-shared-keys so it reads as the allowed key ids, not the secrets. Fix the management test helper to resolve the key from the supplied request and to keep an explicit nil, which prevents a rejection test from silently using an allowed key. Strengthen coverage: assert every management namespace is scanned, check all four job methods reject a key they do not declare, verify a rejected complete-job leaves the row and its events untouched, and exercise both keys allowed on upload-tempfile. Log denied keys with the method name and key id, without the secret, and update the audit-log memory for push-audit-events. Closes #12730 AI-assisted-by: deepseek-v4.1-flash
50 lines
2.2 KiB
Clojure
50 lines
2.2 KiB
Clojure
;; This Source Code Form is subject to the terms of the Mozilla Public
|
|
;; License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
|
;;
|
|
;; Copyright (c) KALEIDOS SUBSIDIARY SL
|
|
|
|
(ns backend-tests.rpc-management-shared-keys-test
|
|
"Covers the shared-key scope declared by every management RPC method."
|
|
(:require
|
|
[app.rpc :as-alias rpc]
|
|
[backend-tests.helpers :as th]
|
|
[clojure.test :as t]))
|
|
|
|
(t/use-fixtures :once (t/compose-fixtures
|
|
(partial th/init-config [:enable-admin-console])
|
|
th/init-system))
|
|
|
|
(def ^:private expected-shared-keys
|
|
{"app.rpc.management.exporter" #{:exporter :media-processor}
|
|
"app.rpc.management.files" #{:nexus}
|
|
"app.rpc.management.jobs" #{:exporter}
|
|
"app.rpc.management.nitrate" #{:admin-console}})
|
|
|
|
(t/deftest every-management-method-declares-its-shared-keys
|
|
(let [methods (get th/*system* :app.rpc/management-methods)
|
|
seen (into #{} (map (comp :ns first val)) methods)]
|
|
(t/is (seq methods))
|
|
(t/is (= (set (keys expected-shared-keys)) seen)
|
|
"every management namespace must be scanned")
|
|
(doseq [[method-name [mdata _]] methods]
|
|
(let [ns-name (:ns mdata)
|
|
expected (get expected-shared-keys ns-name)]
|
|
(t/is (some? expected)
|
|
(str "unexpected management namespace for " method-name ": " ns-name))
|
|
(t/is (= expected (::rpc/allowed-shared-keys mdata))
|
|
(str "wrong ::rpc/allowed-shared-keys for " method-name " in " ns-name))))))
|
|
|
|
(t/deftest management-command-uses-the-key-from-the-request-metadata
|
|
(let [out (th/management-command!
|
|
(with-meta {::th/type :upload-tempfile}
|
|
{:app.http/request {:app.http/auth-key-id :nexus}}))]
|
|
(t/is (= :authorization (th/ex-type (:error out))))
|
|
(t/is (= :shared-key-not-allowed (th/ex-code (:error out))))))
|
|
|
|
(t/deftest management-command-keeps-an-explicit-nil-key
|
|
(let [out (th/management-command! {::th/type :upload-tempfile
|
|
::rpc/auth-key-id nil})]
|
|
(t/is (= :authorization (th/ex-type (:error out))))
|
|
(t/is (= :shared-key-not-allowed (th/ex-code (:error out))))))
|