X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/58a026e09bda4c1e2374347615c325007c64fac4..e9bfb6900e3340bfcdcea691466cd849ca7d9ffc:/lib/controller/handler_test.go diff --git a/lib/controller/handler_test.go b/lib/controller/handler_test.go index eb947ea363..ebadc5d021 100644 --- a/lib/controller/handler_test.go +++ b/lib/controller/handler_test.go @@ -5,6 +5,7 @@ package controller import ( + "context" "encoding/json" "net/http" "net/http/httptest" @@ -16,13 +17,19 @@ import ( "git.curoverse.com/arvados.git/sdk/go/arvados" "git.curoverse.com/arvados.git/sdk/go/arvadostest" + "git.curoverse.com/arvados.git/sdk/go/ctxlog" "git.curoverse.com/arvados.git/sdk/go/httpserver" + "github.com/prometheus/client_golang/prometheus" check "gopkg.in/check.v1" ) +var enableBetaController14287 bool + // Gocheck boilerplate func Test(t *testing.T) { - check.TestingT(t) + for _, enableBetaController14287 = range []bool{false, true} { + check.TestingT(t) + } } var _ = check.Suite(&HandlerSuite{}) @@ -30,20 +37,55 @@ var _ = check.Suite(&HandlerSuite{}) type HandlerSuite struct { cluster *arvados.Cluster handler http.Handler + ctx context.Context + cancel context.CancelFunc } func (s *HandlerSuite) SetUpTest(c *check.C) { + s.ctx, s.cancel = context.WithCancel(context.Background()) + s.ctx = ctxlog.Context(s.ctx, ctxlog.New(os.Stderr, "json", "debug")) s.cluster = &arvados.Cluster{ - ClusterID: "zzzzz", - NodeProfiles: map[string]arvados.NodeProfile{ - "*": { - Controller: arvados.SystemServiceInstance{Listen: ":"}, - RailsAPI: arvados.SystemServiceInstance{Listen: os.Getenv("ARVADOS_TEST_API_HOST"), TLS: true}, - }, - }, + ClusterID: "zzzzz", + PostgreSQL: integrationTestCluster().PostgreSQL, + + EnableBetaController14287: enableBetaController14287, + } + s.cluster.TLS.Insecure = true + arvadostest.SetServiceURL(&s.cluster.Services.RailsAPI, "https://"+os.Getenv("ARVADOS_TEST_API_HOST")) + arvadostest.SetServiceURL(&s.cluster.Services.Controller, "http://localhost:/") + s.handler = newHandler(s.ctx, s.cluster, "", prometheus.NewRegistry()) +} + +func (s *HandlerSuite) TearDownTest(c *check.C) { + s.cancel() +} + +func (s *HandlerSuite) TestConfigExport(c *check.C) { + s.cluster.ManagementToken = "secret" + s.cluster.SystemRootToken = "secret" + s.cluster.Collections.BlobSigning = true + s.cluster.Collections.BlobSigningTTL = arvados.Duration(23 * time.Second) + for _, method := range []string{"GET", "OPTIONS"} { + req := httptest.NewRequest(method, "/arvados/v1/config", nil) + resp := httptest.NewRecorder() + s.handler.ServeHTTP(resp, req) + c.Check(resp.Code, check.Equals, http.StatusOK) + c.Check(resp.Header().Get("Access-Control-Allow-Origin"), check.Equals, `*`) + c.Check(resp.Header().Get("Access-Control-Allow-Methods"), check.Matches, `.*\bGET\b.*`) + c.Check(resp.Header().Get("Access-Control-Allow-Headers"), check.Matches, `.+`) + if method == "OPTIONS" { + c.Check(resp.Body.String(), check.HasLen, 0) + continue + } + var cluster arvados.Cluster + c.Log(resp.Body.String()) + err := json.Unmarshal(resp.Body.Bytes(), &cluster) + c.Check(err, check.IsNil) + c.Check(cluster.ManagementToken, check.Equals, "") + c.Check(cluster.SystemRootToken, check.Equals, "") + c.Check(cluster.Collections.BlobSigning, check.DeepEquals, true) + c.Check(cluster.Collections.BlobSigningTTL, check.Equals, arvados.Duration(23*time.Second)) } - node := s.cluster.NodeProfiles["*"] - s.handler = newHandler(s.cluster, &node) } func (s *HandlerSuite) TestProxyDiscoveryDoc(c *check.C) { @@ -61,16 +103,16 @@ func (s *HandlerSuite) TestProxyDiscoveryDoc(c *check.C) { } func (s *HandlerSuite) TestRequestTimeout(c *check.C) { - s.cluster.HTTPRequestTimeout = arvados.Duration(time.Nanosecond) + s.cluster.API.RequestTimeout = arvados.Duration(time.Nanosecond) req := httptest.NewRequest("GET", "/discovery/v1/apis/arvados/v1/rest", nil) resp := httptest.NewRecorder() s.handler.ServeHTTP(resp, req) - c.Check(resp.Code, check.Equals, http.StatusInternalServerError) + c.Check(resp.Code, check.Equals, http.StatusBadGateway) var jresp httpserver.ErrorResponse err := json.Unmarshal(resp.Body.Bytes(), &jresp) c.Check(err, check.IsNil) c.Assert(len(jresp.Errors), check.Equals, 1) - c.Check(jresp.Errors[0], check.Matches, `.*context deadline exceeded`) + c.Check(jresp.Errors[0], check.Matches, `.*context deadline exceeded.*`) } func (s *HandlerSuite) TestProxyWithoutToken(c *check.C) { @@ -101,6 +143,7 @@ func (s *HandlerSuite) TestProxyWithTokenInRequestBody(c *check.C) { "_method": {"GET"}, "api_token": {arvadostest.ActiveToken}, }.Encode())) + req.Header.Set("Content-type", "application/x-www-form-urlencoded") resp := httptest.NewRecorder() s.handler.ServeHTTP(resp, req) c.Check(resp.Code, check.Equals, http.StatusOK) @@ -122,9 +165,52 @@ func (s *HandlerSuite) TestProxyNotFound(c *check.C) { } func (s *HandlerSuite) TestProxyRedirect(c *check.C) { - req := httptest.NewRequest("GET", "https://example.org:1234/login?return_to=foo", nil) + s.cluster.Login.ProviderAppID = "test" + s.cluster.Login.ProviderAppSecret = "test" + req := httptest.NewRequest("GET", "https://0.0.0.0:1/login?return_to=foo", nil) resp := httptest.NewRecorder() s.handler.ServeHTTP(resp, req) - c.Check(resp.Code, check.Equals, http.StatusFound) - c.Check(resp.Header().Get("Location"), check.Matches, `https://example\.org:1234/auth/joshid\?return_to=foo&?`) + if !c.Check(resp.Code, check.Equals, http.StatusFound) { + c.Log(resp.Body.String()) + } + // Old "proxy entire request" code path returns an absolute + // URL. New lib/controller/federation code path returns a + // relative URL. + c.Check(resp.Header().Get("Location"), check.Matches, `(https://0.0.0.0:1)?/auth/joshid\?return_to=%2Cfoo&?`) +} + +func (s *HandlerSuite) TestValidateV1APIToken(c *check.C) { + req := httptest.NewRequest("GET", "/arvados/v1/users/current", nil) + user, err := s.handler.(*Handler).validateAPItoken(req, arvadostest.ActiveToken) + c.Assert(err, check.IsNil) + c.Check(user.Authorization.UUID, check.Equals, arvadostest.ActiveTokenUUID) + c.Check(user.Authorization.APIToken, check.Equals, arvadostest.ActiveToken) + c.Check(user.Authorization.Scopes, check.DeepEquals, []string{"all"}) + c.Check(user.UUID, check.Equals, arvadostest.ActiveUserUUID) +} + +func (s *HandlerSuite) TestValidateV2APIToken(c *check.C) { + req := httptest.NewRequest("GET", "/arvados/v1/users/current", nil) + user, err := s.handler.(*Handler).validateAPItoken(req, arvadostest.ActiveTokenV2) + c.Assert(err, check.IsNil) + c.Check(user.Authorization.UUID, check.Equals, arvadostest.ActiveTokenUUID) + c.Check(user.Authorization.APIToken, check.Equals, arvadostest.ActiveToken) + c.Check(user.Authorization.Scopes, check.DeepEquals, []string{"all"}) + c.Check(user.UUID, check.Equals, arvadostest.ActiveUserUUID) + c.Check(user.Authorization.TokenV2(), check.Equals, arvadostest.ActiveTokenV2) +} + +func (s *HandlerSuite) TestCreateAPIToken(c *check.C) { + req := httptest.NewRequest("GET", "/arvados/v1/users/current", nil) + auth, err := s.handler.(*Handler).createAPItoken(req, arvadostest.ActiveUserUUID, nil) + c.Assert(err, check.IsNil) + c.Check(auth.Scopes, check.DeepEquals, []string{"all"}) + + user, err := s.handler.(*Handler).validateAPItoken(req, auth.TokenV2()) + c.Assert(err, check.IsNil) + c.Check(user.Authorization.UUID, check.Equals, auth.UUID) + c.Check(user.Authorization.APIToken, check.Equals, auth.APIToken) + c.Check(user.Authorization.Scopes, check.DeepEquals, []string{"all"}) + c.Check(user.UUID, check.Equals, arvadostest.ActiveUserUUID) + c.Check(user.Authorization.TokenV2(), check.Equals, auth.TokenV2()) }