Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit86ba866

Browse files
committed
add unit test to enforce unauthorized
1 parent3e1087e commit86ba866

File tree

3 files changed

+68
-11
lines changed

3 files changed

+68
-11
lines changed

‎codersdk/idpsync.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -47,8 +47,8 @@ func (c *Client) GroupIDPSyncSettings(ctx context.Context, orgID string) (GroupS
4747
returnresp,json.NewDecoder(res.Body).Decode(&resp)
4848
}
4949

50-
func (c*Client)PostGroupIDPSyncSettings(ctx context.Context,orgIDstring,reqGroupSyncSettings) (GroupSyncSettings,error) {
51-
res,err:=c.Request(ctx,http.MethodPost,fmt.Sprintf("/api/v2/organizations/%s/settings/idpsync/groups",orgID),req)
50+
func (c*Client)PatchGroupIDPSyncSettings(ctx context.Context,orgIDstring,reqGroupSyncSettings) (GroupSyncSettings,error) {
51+
res,err:=c.Request(ctx,http.MethodPatch,fmt.Sprintf("/api/v2/organizations/%s/settings/idpsync/groups",orgID),req)
5252
iferr!=nil {
5353
returnGroupSyncSettings{},xerrors.Errorf("make request: %w",err)
5454
}

‎enterprise/coderd/idpsync.go‎

Lines changed: 21 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,12 @@ package coderd
33
import (
44
"net/http"
55

6+
"github.com/coder/coder/v2/coderd/database/dbauthz"
67
"github.com/coder/coder/v2/coderd/httpapi"
78
"github.com/coder/coder/v2/coderd/httpmw"
89
"github.com/coder/coder/v2/coderd/idpsync"
10+
"github.com/coder/coder/v2/coderd/rbac"
11+
"github.com/coder/coder/v2/coderd/rbac/policy"
912
)
1013

1114
// @Summary Get group IdP Sync settings by organization
@@ -20,9 +23,17 @@ func (api *API) groupIDPSyncSettings(rw http.ResponseWriter, r *http.Request) {
2023
ctx:=r.Context()
2124
org:=httpmw.OrganizationParam(r)
2225

26+
if!api.Authorize(r,policy.ActionRead,rbac.ResourceIdpsyncSettings.InOrg(org.ID)) {
27+
httpapi.Forbidden(rw)
28+
return
29+
}
30+
2331
rlv:=api.Options.RuntimeConfig.OrganizationResolver(api.Database,org.ID)
2432
runtimeConfigEntry:=api.IDPSync.GroupSyncSettings()
25-
settings,err:=runtimeConfigEntry.Resolve(ctx,rlv)
33+
34+
//nolint:gocritic // Requires system context to read runtime config
35+
sysCtx:=dbauthz.AsSystemRestricted(ctx)
36+
settings,err:=runtimeConfigEntry.Resolve(sysCtx,rlv)
2637
iferr!=nil {
2738
httpapi.InternalServerError(rw,err)
2839
return
@@ -43,6 +54,11 @@ func (api *API) patchGroupIDPSyncSettings(rw http.ResponseWriter, r *http.Reques
4354
ctx:=r.Context()
4455
org:=httpmw.OrganizationParam(r)
4556

57+
if!api.Authorize(r,policy.ActionUpdate,rbac.ResourceIdpsyncSettings.InOrg(org.ID)) {
58+
httpapi.Forbidden(rw)
59+
return
60+
}
61+
4662
varreq idpsync.GroupSyncSettings
4763
if!httpapi.Read(ctx,rw,r,&req) {
4864
return
@@ -51,13 +67,15 @@ func (api *API) patchGroupIDPSyncSettings(rw http.ResponseWriter, r *http.Reques
5167
rlv:=api.Options.RuntimeConfig.OrganizationResolver(api.Database,org.ID)
5268
runtimeConfigEntry:=api.IDPSync.GroupSyncSettings()
5369

54-
err:=runtimeConfigEntry.SetRuntimeValue(ctx,rlv,&req)
70+
//nolint:gocritic // Requires system context to update runtime config
71+
sysCtx:=dbauthz.AsSystemRestricted(ctx)
72+
err:=runtimeConfigEntry.SetRuntimeValue(sysCtx,rlv,&req)
5573
iferr!=nil {
5674
httpapi.InternalServerError(rw,err)
5775
return
5876
}
5977

60-
settings,err:=runtimeConfigEntry.Resolve(ctx,rlv)
78+
settings,err:=runtimeConfigEntry.Resolve(sysCtx,rlv)
6179
iferr!=nil {
6280
httpapi.InternalServerError(rw,err)
6381
return

‎enterprise/coderd/idpsync_test.go‎

Lines changed: 45 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,15 @@
11
package coderd_test
22

33
import (
4+
"net/http"
45
"testing"
56

67
"github.com/stretchr/testify/require"
78

89
"github.com/coder/coder/v2/coderd/coderdtest"
910
"github.com/coder/coder/v2/coderd/database/dbauthz"
1011
"github.com/coder/coder/v2/coderd/idpsync"
12+
"github.com/coder/coder/v2/coderd/rbac"
1113
"github.com/coder/coder/v2/coderd/runtimeconfig"
1214
"github.com/coder/coder/v2/codersdk"
1315
"github.com/coder/coder/v2/enterprise/coderd/coderdenttest"
@@ -63,7 +65,7 @@ func TestPostGroupSyncConfig(t *testing.T) {
6365
string(codersdk.ExperimentMultiOrganization),
6466
}
6567

66-
client,db,user:=coderdenttest.NewWithDatabase(t,&coderdenttest.Options{
68+
owner,user:=coderdenttest.New(t,&coderdenttest.Options{
6769
Options:&coderdtest.Options{
6870
DeploymentValues:dv,
6971
},
@@ -75,17 +77,54 @@ func TestPostGroupSyncConfig(t *testing.T) {
7577
},
7678
})
7779

80+
orgAdmin,_:=coderdtest.CreateAnotherUser(t,owner,user.OrganizationID,rbac.ScopedRoleOrgAdmin(user.OrganizationID))
81+
82+
// Test as org admin
7883
ctx:=testutil.Context(t,testutil.WaitShort)
79-
settings,err:=client.PostGroupIDPSyncSettings(ctx,user.OrganizationID.String(), codersdk.GroupSyncSettings{
84+
settings,err:=orgAdmin.PatchGroupIDPSyncSettings(ctx,user.OrganizationID.String(), codersdk.GroupSyncSettings{
8085
Field:"august",
8186
})
8287
require.NoError(t,err)
8388
require.Equal(t,"august",settings.Field)
8489

85-
dbresv:=runtimeconfig.OrganizationResolver(user.OrganizationID,runtimeconfig.NewStoreResolver(db))
86-
entry:= runtimeconfig.MustNew[*idpsync.GroupSyncSettings]("group-sync-settings")
87-
dbSettings,err:=entry.Resolve(ctx,dbresv)
90+
fetchedSettings,err:=orgAdmin.GroupIDPSyncSettings(ctx,user.OrganizationID.String())
8891
require.NoError(t,err)
89-
require.Equal(t,"august",dbSettings.Field)
92+
require.Equal(t,"august",fetchedSettings.Field)
93+
})
94+
95+
t.Run("NotAuthorized",func(t*testing.T) {
96+
t.Parallel()
97+
98+
dv:=coderdtest.DeploymentValues(t)
99+
dv.Experiments= []string{
100+
string(codersdk.ExperimentCustomRoles),
101+
string(codersdk.ExperimentMultiOrganization),
102+
}
103+
104+
owner,user:=coderdenttest.New(t,&coderdenttest.Options{
105+
Options:&coderdtest.Options{
106+
DeploymentValues:dv,
107+
},
108+
LicenseOptions:&coderdenttest.LicenseOptions{
109+
Features: license.Features{
110+
codersdk.FeatureCustomRoles:1,
111+
codersdk.FeatureMultipleOrganizations:1,
112+
},
113+
},
114+
})
115+
116+
member,_:=coderdtest.CreateAnotherUser(t,owner,user.OrganizationID)
117+
118+
ctx:=testutil.Context(t,testutil.WaitShort)
119+
_,err:=member.PatchGroupIDPSyncSettings(ctx,user.OrganizationID.String(), codersdk.GroupSyncSettings{
120+
Field:"august",
121+
})
122+
varapiError*codersdk.Error
123+
require.ErrorAs(t,err,&apiError)
124+
require.Equal(t,http.StatusForbidden,apiError.StatusCode())
125+
126+
_,err=member.GroupIDPSyncSettings(ctx,user.OrganizationID.String())
127+
require.ErrorAs(t,err,&apiError)
128+
require.Equal(t,http.StatusForbidden,apiError.StatusCode())
90129
})
91130
}

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp