container_registry_authentication_service_spec.rb 5.25 KB
Newer Older
1
2
require 'spec_helper'

3
describe Auth::ContainerRegistryAuthenticationService, services: true do
4
5
6
7
  let(:current_project) { nil }
  let(:current_user) { nil }
  let(:current_params) { {} }
  let(:rsa_key) { OpenSSL::PKey::RSA.generate(512) }
Kamil Trzcinski's avatar
Kamil Trzcinski committed
8
  let(:registry_settings) do
9
    {
10
      enabled: true,
11
12
13
      issuer: 'rspec',
      key: nil
    }
Kamil Trzcinski's avatar
Kamil Trzcinski committed
14
  end
15
16
17
18
19
20
  let(:payload) { JWT.decode(subject[:token], rsa_key).first }

  subject { described_class.new(current_project, current_user, current_params).execute }

  before do
    allow(Gitlab.config.registry).to receive_messages(registry_settings)
Kamil Trzcinski's avatar
Kamil Trzcinski committed
21
    allow_any_instance_of(JWT::RSAToken).to receive(:key).and_return(rsa_key)
22
23
24
25
26
27
28
29
  end

  shared_examples 'an authenticated' do
    it { is_expected.to include(:token) }
    it { expect(payload).to include('access') }
  end

  shared_examples 'a accessible' do
Kamil Trzcinski's avatar
Kamil Trzcinski committed
30
    let(:access) do
31
32
33
34
35
      [{
         'type' => 'repository',
         'name' => project.path_with_namespace,
         'actions' => actions,
       }]
Kamil Trzcinski's avatar
Kamil Trzcinski committed
36
    end
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71

    it_behaves_like 'an authenticated'
    it { expect(payload).to include('access' => access) }
  end

  shared_examples 'a pullable' do
    it_behaves_like 'a accessible' do
      let(:actions) { ['pull'] }
    end
  end

  shared_examples 'a pushable' do
    it_behaves_like 'a accessible' do
      let(:actions) { ['push'] }
    end
  end

  shared_examples 'a pullable and pushable' do
    it_behaves_like 'a accessible' do
      let(:actions) { ['pull', 'push'] }
    end
  end

  shared_examples 'a forbidden' do
    it { is_expected.to include(http_status: 401) }
    it { is_expected.to_not include(:token) }
  end

  context 'user authorization' do
    let(:project) { create(:project) }
    let(:current_user) { create(:user) }

    context 'allow developer to push images' do
      before { project.team << [current_user, :developer] }

Kamil Trzcinski's avatar
Kamil Trzcinski committed
72
      let(:current_params) do
73
        { scope: "repository:#{project.path_with_namespace}:push" }
Kamil Trzcinski's avatar
Kamil Trzcinski committed
74
      end
75
76
77
78
79
80
81

      it_behaves_like 'a pushable'
    end

    context 'allow reporter to pull images' do
      before { project.team << [current_user, :reporter] }

Kamil Trzcinski's avatar
Kamil Trzcinski committed
82
      let(:current_params) do
83
        { scope: "repository:#{project.path_with_namespace}:pull" }
Kamil Trzcinski's avatar
Kamil Trzcinski committed
84
      end
85
86
87
88
89
90
91

      it_behaves_like 'a pullable'
    end

    context 'return a least of privileges' do
      before { project.team << [current_user, :reporter] }

Kamil Trzcinski's avatar
Kamil Trzcinski committed
92
      let(:current_params) do
93
        { scope: "repository:#{project.path_with_namespace}:push,pull" }
Kamil Trzcinski's avatar
Kamil Trzcinski committed
94
      end
95
96
97
98
99
100
101

      it_behaves_like 'a pullable'
    end

    context 'disallow guest to pull or push images' do
      before { project.team << [current_user, :guest] }

Kamil Trzcinski's avatar
Kamil Trzcinski committed
102
      let(:current_params) do
103
        { scope: "repository:#{project.path_with_namespace}:pull,push" }
Kamil Trzcinski's avatar
Kamil Trzcinski committed
104
      end
105
106
107
108
109
110
111
112
113

      it_behaves_like 'a forbidden'
    end
  end

  context 'project authorization' do
    let(:current_project) { create(:empty_project) }

    context 'allow to pull and push images' do
Kamil Trzcinski's avatar
Kamil Trzcinski committed
114
      let(:current_params) do
115
        { scope: "repository:#{current_project.path_with_namespace}:pull,push" }
Kamil Trzcinski's avatar
Kamil Trzcinski committed
116
      end
117
118
119
120
121
122
123
124

      it_behaves_like 'a pullable and pushable' do
        let(:project) { current_project }
      end
    end

    context 'for other projects' do
      context 'when pulling' do
Kamil Trzcinski's avatar
Kamil Trzcinski committed
125
        let(:current_params) do
126
          { scope: "repository:#{project.path_with_namespace}:pull" }
Kamil Trzcinski's avatar
Kamil Trzcinski committed
127
        end
128
129
130
131
132
133
134
135
136
137
138
139
140

        context 'allow for public' do
          let(:project) { create(:empty_project, :public) }
          it_behaves_like 'a pullable'
        end

        context 'disallow for private' do
          let(:project) { create(:empty_project, :private) }
          it_behaves_like 'a forbidden'
        end
      end

      context 'when pushing' do
Kamil Trzcinski's avatar
Kamil Trzcinski committed
141
        let(:current_params) do
142
          { scope: "repository:#{project.path_with_namespace}:push" }
Kamil Trzcinski's avatar
Kamil Trzcinski committed
143
        end
144
145
146
147
148
149

        context 'disallow for all' do
          let(:project) { create(:empty_project, :public) }
          it_behaves_like 'a forbidden'
        end
      end
150
151
152
153
154
155
    end

    context 'for project without container registry' do
      let(:project) { create(:empty_project, :public, container_registry_enabled: false) }

      before { project.update(container_registry_enabled: false) }
156

157
158
159
160
161
162
163
      context 'disallow when pulling' do
        let(:current_params) do
          { scope: "repository:#{project.path_with_namespace}:pull" }
        end

        it_behaves_like 'a forbidden'
      end
164
165
166
167
168
    end
  end

  context 'unauthorized' do
    context 'for invalid scope' do
Kamil Trzcinski's avatar
Kamil Trzcinski committed
169
      let(:current_params) do
170
        { scope: 'invalid:aa:bb' }
Kamil Trzcinski's avatar
Kamil Trzcinski committed
171
      end
172
173
174
175
176
177
178

      it_behaves_like 'a forbidden'
    end

    context 'for private project' do
      let(:project) { create(:empty_project, :private) }

Kamil Trzcinski's avatar
Kamil Trzcinski committed
179
      let(:current_params) do
180
        { scope: "repository:#{project.path_with_namespace}:pull" }
Kamil Trzcinski's avatar
Kamil Trzcinski committed
181
      end
182
183
184
185
186
187
188
189

      it_behaves_like 'a forbidden'
    end

    context 'for public project' do
      let(:project) { create(:empty_project, :public) }

      context 'when pulling and pushing' do
Kamil Trzcinski's avatar
Kamil Trzcinski committed
190
        let(:current_params) do
191
          { scope: "repository:#{project.path_with_namespace}:pull,push" }
Kamil Trzcinski's avatar
Kamil Trzcinski committed
192
        end
193
194
195
196
197

        it_behaves_like 'a pullable'
      end

      context 'when pushing' do
Kamil Trzcinski's avatar
Kamil Trzcinski committed
198
        let(:current_params) do
199
          { scope: "repository:#{project.path_with_namespace}:push" }
Kamil Trzcinski's avatar
Kamil Trzcinski committed
200
        end
201
202
203
204
205
206

        it_behaves_like 'a forbidden'
      end
    end
  end
end