go.chromium.org/luci@v0.0.0-20240309015107-7cdc2e660f33/server/cmd/sidecar/main_test.go

// Copyright 2023 The LUCI Authors.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//      http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

package main

import (
	"context"
	"encoding/base64"
	"fmt"
	"testing"

	statuspb "google.golang.org/genproto/googleapis/rpc/status"
	"google.golang.org/grpc/codes"
	"google.golang.org/grpc/status"

	"go.chromium.org/luci/auth/identity"
	"go.chromium.org/luci/common/errors"
	"go.chromium.org/luci/common/proto/sidecar"
	"go.chromium.org/luci/common/retry/transient"

	"go.chromium.org/luci/server/auth"
	"go.chromium.org/luci/server/auth/authdb"
	"go.chromium.org/luci/server/auth/authtest"
	"go.chromium.org/luci/server/auth/realms"
	"go.chromium.org/luci/server/auth/service/protocol"

	. "github.com/smartystreets/goconvey/convey"
	. "go.chromium.org/luci/common/testing/assertions"
)

var (
	testPerm0 = realms.RegisterPermission("fake.permission.0")
	testPerm1 = realms.RegisterPermission("fake.permission.1")
)

func TestAuthServer(t *testing.T) {
	t.Parallel()

	Convey("With mocks", t, func() {
		ctx := authtest.MockAuthConfig(context.Background())
		ctx = auth.ModifyConfig(ctx, func(cfg auth.Config) auth.Config {
			cfg.DBProvider = func(ctx context.Context) (authdb.DB, error) {
				return authdb.NewSnapshotDB(&protocol.AuthDB{
					OauthClientId: "Client ID",
					Groups: []*protocol.AuthGroup{
						{
							Name:    auth.InternalServicesGroup,
							Members: []string{"user:service@example.com"},
						},
						{
							Name:    "user-group",
							Members: []string{"user:someone@example.com"},
						},
					},
				}, "http://auth.example.com", 1234, false)
			}
			return cfg
		})

		srv := &authServerImpl{
			info: &sidecar.ServerInfo{
				SidecarService: "service",
				SidecarJob:     "job",
				SidecarHost:    "host",
				SidecarVersion: "version",
			},
		}

		expectedInfo := &sidecar.ServerInfo{
			SidecarService: "service",
			SidecarJob:     "job",
			SidecarHost:    "host",
			SidecarVersion: "version",
			AuthDbService:  "http://auth.example.com",
			AuthDbRev:      1234,
		}

		mockAuthUser := func(u *auth.User) {
			srv.authenticator = auth.Authenticator{
				Methods: []auth.Method{
					authtest.FakeAuth{
						User: u,
					},
				},
			}
		}

		mockAuthError := func(err error) {
			srv.authenticator = auth.Authenticator{
				Methods: []auth.Method{
					authtest.FakeAuth{
						Error: err,
					},
				},
			}
		}

		call := func(md ...*sidecar.AuthenticateRequest_Metadata) (*sidecar.AuthenticateResponse, error) {
			return srv.Authenticate(ctx, &sidecar.AuthenticateRequest{
				Protocol: sidecar.AuthenticateRequest_HTTP1,
				Metadata: md,
			})
		}

		Convey("Anonymous", func() {
			mockAuthUser(&auth.User{Identity: identity.AnonymousIdentity})
			res, err := call()
			So(err, ShouldBeNil)
			So(res, ShouldResembleProto, &sidecar.AuthenticateResponse{
				Identity:   "anonymous:anonymous",
				ServerInfo: expectedInfo,
				Outcome: &sidecar.AuthenticateResponse_Anonymous_{
					Anonymous: &sidecar.AuthenticateResponse_Anonymous{},
				},
			})
		})

		Convey("User", func() {
			mockAuthUser(&auth.User{
				Identity: "user:someone@example.com",
				Email:    "someone@example.com",
				Name:     "Full Name",
				Picture:  "Picture",
				ClientID: "Client ID",
			})
			res, err := call()
			So(err, ShouldBeNil)
			So(res, ShouldResembleProto, &sidecar.AuthenticateResponse{
				Identity:   "user:someone@example.com",
				ServerInfo: expectedInfo,
				Outcome: &sidecar.AuthenticateResponse_User_{
					User: &sidecar.AuthenticateResponse_User{
						Email:    "someone@example.com",
						Name:     "Full Name",
						Picture:  "Picture",
						ClientId: "Client ID",
					},
				},
			})
		})

		Convey("Project", func() {
			mockAuthUser(&auth.User{Identity: "user:service@example.com"})
			res, err := call(&sidecar.AuthenticateRequest_Metadata{
				Key:   auth.XLUCIProjectHeader,
				Value: "something",
			})
			So(err, ShouldBeNil)
			So(res, ShouldResembleProto, &sidecar.AuthenticateResponse{
				Identity:   "project:something",
				ServerInfo: expectedInfo,
				Outcome: &sidecar.AuthenticateResponse_Project_{
					Project: &sidecar.AuthenticateResponse_Project{
						Project: "something",
						Service: "user:service@example.com",
					},
				},
			})
		})

		Convey("Unknown identity kind", func() {
			mockAuthUser(&auth.User{Identity: "bot:what"})
			res, err := call()
			So(err, ShouldBeNil)
			So(res, ShouldResembleProto, &sidecar.AuthenticateResponse{
				Identity:   "anonymous:anonymous",
				ServerInfo: expectedInfo,
				Outcome: &sidecar.AuthenticateResponse_Error{
					Error: &statuspb.Status{
						Code:    int32(codes.Unauthenticated),
						Message: "request was authenticated as \"bot:what\" which is an identity kind not supported by the LUCI Sidecar server",
					},
				},
			})
		})

		Convey("Fatal auth error", func() {
			mockAuthError(fmt.Errorf("boom"))
			res, err := call()
			So(err, ShouldBeNil)
			So(res, ShouldResembleProto, &sidecar.AuthenticateResponse{
				Identity:   "anonymous:anonymous",
				ServerInfo: expectedInfo,
				Outcome: &sidecar.AuthenticateResponse_Error{
					Error: &statuspb.Status{
						Code:    int32(codes.Unauthenticated),
						Message: "boom",
					},
				},
			})
		})

		Convey("Fatal auth error with code", func() {
			mockAuthError(status.Errorf(codes.PermissionDenied, "boom"))
			res, err := call()
			So(err, ShouldBeNil)
			So(res, ShouldResembleProto, &sidecar.AuthenticateResponse{
				Identity:   "anonymous:anonymous",
				ServerInfo: expectedInfo,
				Outcome: &sidecar.AuthenticateResponse_Error{
					Error: &statuspb.Status{
						Code:    int32(codes.PermissionDenied),
						Message: "boom",
					},
				},
			})
		})

		Convey("Transient error", func() {
			mockAuthError(errors.New("boom", transient.Tag))
			_, err := call()
			So(err, ShouldHaveGRPCStatus, codes.Internal)
			So(err, ShouldErrLike, "boom")
		})

		Convey("Group check", func() {
			mockAuthUser(&auth.User{
				Identity: "user:someone@example.com",
				Email:    "someone@example.com",
			})
			res, err := srv.Authenticate(ctx, &sidecar.AuthenticateRequest{
				Protocol: sidecar.AuthenticateRequest_HTTP1,
				Groups:   []string{"user-group", "something-else"},
			})
			So(err, ShouldBeNil)
			So(res, ShouldResembleProto, &sidecar.AuthenticateResponse{
				Identity:   "user:someone@example.com",
				ServerInfo: expectedInfo,
				Groups:     []string{"user-group"},
				Outcome: &sidecar.AuthenticateResponse_User_{
					User: &sidecar.AuthenticateResponse_User{
						Email: "someone@example.com",
					},
				},
			})
		})
	})
}

func TestIsMember(t *testing.T) {
	t.Parallel()

	Convey("With mocks", t, func() {
		ctx := auth.WithState(context.Background(), &authtest.FakeState{
			Identity: "user:sidecar-user-unused@example.com",
			FakeDB: authtest.NewFakeDB(
				authtest.MockMembership("user:enduser@example.com", "group-1"),
				authtest.MockMembership("user:sidecar-user-unused@example.com", "group-2"),
			),
		})

		srv := &authServerImpl{}

		Convey("OK", func() {
			res, err := srv.IsMember(ctx, &sidecar.IsMemberRequest{
				Identity: "user:enduser@example.com",
				Groups:   []string{"group-1", "group-2"},
			})
			So(err, ShouldBeNil)
			So(res.IsMember, ShouldBeTrue)
		})

		Convey("Not a member", func() {
			res, err := srv.IsMember(ctx, &sidecar.IsMemberRequest{
				Identity: "user:enduser@example.com",
				Groups:   []string{"group-2"},
			})
			So(err, ShouldBeNil)
			So(res.IsMember, ShouldBeFalse)
		})

		Convey("No ident", func() {
			_, err := srv.IsMember(ctx, &sidecar.IsMemberRequest{
				Groups: []string{"group-2"},
			})
			So(err, ShouldHaveGRPCStatus, codes.InvalidArgument)
			So(err, ShouldErrLike, "identity field is required")
		})

		Convey("Bad ident", func() {
			_, err := srv.IsMember(ctx, &sidecar.IsMemberRequest{
				Identity: "what",
				Groups:   []string{"group-2"},
			})
			So(err, ShouldHaveGRPCStatus, codes.InvalidArgument)
			So(err, ShouldErrLike, "bad identity")
		})

		Convey("No groups", func() {
			_, err := srv.IsMember(ctx, &sidecar.IsMemberRequest{
				Identity: "user:enduser@example.com",
			})
			So(err, ShouldHaveGRPCStatus, codes.InvalidArgument)
			So(err, ShouldErrLike, "at least one group is required")
		})
	})
}

func TestHasPermission(t *testing.T) {
	t.Parallel()

	Convey("With mocks", t, func() {
		ctx := auth.WithState(context.Background(), &authtest.FakeState{
			Identity: "user:sidecar-user-unused@example.com",
			FakeDB: authtest.NewFakeDB(
				authtest.MockPermission("user:enduser@example.com", "test:realm", testPerm0),
				authtest.MockPermission("user:enduser@example.com", "test:realm", testPerm1,
					authtest.RestrictAttribute("test.attr", "good-val"),
				),
			),
		})

		srv := &authServerImpl{
			perms: map[string]realms.Permission{
				testPerm0.Name(): testPerm0,
				testPerm1.Name(): testPerm1,
			},
		}

		Convey("OK", func() {
			res, err := srv.HasPermission(ctx, &sidecar.HasPermissionRequest{
				Identity:   "user:enduser@example.com",
				Permission: testPerm0.Name(),
				Realm:      "test:realm",
			})
			So(err, ShouldBeNil)
			So(res.HasPermission, ShouldBeTrue)
		})

		Convey("OK with attrs", func() {
			res, err := srv.HasPermission(ctx, &sidecar.HasPermissionRequest{
				Identity:   "user:enduser@example.com",
				Permission: testPerm1.Name(),
				Realm:      "test:realm",
				Attributes: map[string]string{"test.attr": "good-val"},
			})
			So(err, ShouldBeNil)
			So(res.HasPermission, ShouldBeTrue)
		})

		Convey("No permission", func() {
			res, err := srv.HasPermission(ctx, &sidecar.HasPermissionRequest{
				Identity:   "user:enduser@example.com",
				Permission: testPerm1.Name(),
				Realm:      "test:realm",
			})
			So(err, ShouldBeNil)
			So(res.HasPermission, ShouldBeFalse)
		})

		Convey("No ident", func() {
			_, err := srv.HasPermission(ctx, &sidecar.HasPermissionRequest{
				Permission: testPerm0.Name(),
				Realm:      "test:realm",
			})
			So(err, ShouldHaveGRPCStatus, codes.InvalidArgument)
			So(err, ShouldErrLike, "identity field is required")
		})

		Convey("Bad ident", func() {
			_, err := srv.HasPermission(ctx, &sidecar.HasPermissionRequest{
				Identity:   "what",
				Permission: testPerm0.Name(),
				Realm:      "test:realm",
			})
			So(err, ShouldHaveGRPCStatus, codes.InvalidArgument)
			So(err, ShouldErrLike, "bad identity")
		})

		Convey("No perm", func() {
			_, err := srv.HasPermission(ctx, &sidecar.HasPermissionRequest{
				Identity: "user:enduser@example.com",
				Realm:    "test:realm",
			})
			So(err, ShouldHaveGRPCStatus, codes.InvalidArgument)
			So(err, ShouldErrLike, "permission field is required")
		})

		Convey("Bad perm", func() {
			_, err := srv.HasPermission(ctx, &sidecar.HasPermissionRequest{
				Identity:   "user:enduser@example.com",
				Permission: "what",
				Realm:      "test:realm",
			})
			So(err, ShouldHaveGRPCStatus, codes.InvalidArgument)
			So(err, ShouldErrLike, "bad permission")
		})

		Convey("Unknown perm", func() {
			_, err := srv.HasPermission(ctx, &sidecar.HasPermissionRequest{
				Identity:   "user:enduser@example.com",
				Permission: "fake.permission.unknown",
				Realm:      "test:realm",
			})
			So(err, ShouldHaveGRPCStatus, codes.InvalidArgument)
			So(err, ShouldErrLike, "is not registered")
		})

		Convey("No realm", func() {
			_, err := srv.HasPermission(ctx, &sidecar.HasPermissionRequest{
				Identity:   "user:enduser@example.com",
				Permission: testPerm0.Name(),
			})
			So(err, ShouldHaveGRPCStatus, codes.InvalidArgument)
			So(err, ShouldErrLike, "realm field is required")
		})

		Convey("Bad realm", func() {
			_, err := srv.HasPermission(ctx, &sidecar.HasPermissionRequest{
				Identity:   "user:enduser@example.com",
				Permission: testPerm0.Name(),
				Realm:      "bad",
			})
			So(err, ShouldHaveGRPCStatus, codes.InvalidArgument)
			So(err, ShouldErrLike, "bad global realm name")
		})
	})
}

func TestRequestMetadata(t *testing.T) {
	t.Parallel()

	Convey("HTTP", t, func() {
		req, err := newRequestMetadata(&sidecar.AuthenticateRequest{
			Protocol: sidecar.AuthenticateRequest_HTTP1,
			Metadata: []*sidecar.AuthenticateRequest_Metadata{
				{Key: "Header", Value: "Val1"},
				{Key: "HeaDer", Value: "Val2"},
				{Key: "Host", Value: "host"},
				{Key: "Header-Bin", Value: "val"},
				{Key: "Cookie", Value: "cookie_1=value_1; cookie_2=value_2"},
				{Key: "Cookie", Value: "cookie_3=value_3"},
			},
		})
		So(err, ShouldBeNil)
		So(req.Host(), ShouldEqual, "host")
		So(req.RemoteAddr(), ShouldEqual, "")
		So(req.Header("HEADER"), ShouldEqual, "Val1")
		So(req.Header("header-bin"), ShouldEqual, "val")

		cookie, err := req.Cookie("cookie_3")
		So(err, ShouldBeNil)
		So(cookie.Value, ShouldEqual, "value_3")
	})

	Convey("gRPC", t, func() {
		req, err := newRequestMetadata(&sidecar.AuthenticateRequest{
			Protocol: sidecar.AuthenticateRequest_GRPC,
			Metadata: []*sidecar.AuthenticateRequest_Metadata{
				{Key: ":authority", Value: "host"},
				{Key: "Header-Bin", Value: base64.RawStdEncoding.EncodeToString([]byte("val"))},
			},
		})
		So(err, ShouldBeNil)
		So(req.Host(), ShouldEqual, "host")
		So(req.Header("header-bin"), ShouldEqual, "val")
	})

	Convey("Unknown protocol", t, func() {
		_, err := newRequestMetadata(&sidecar.AuthenticateRequest{})
		So(err, ShouldHaveGRPCStatus, codes.InvalidArgument)
	})
}