mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-10-07 21:27:31 +00:00
More test cases
This commit is contained in:
Fang-Pen Lin
@@ -2,7 +2,7 @@ Feature: Access Control
|
||||
|
||||
Scenario Outline: Access across resources across different account
|
||||
Given I have an ACME cert profile as "acme_profile"
|
||||
When I have an ACME client connecting to {BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/directory
|
||||
When I have an ACME client connecting to "{BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/directory"
|
||||
Then I register a new ACME account with email fangpen@infisical.com and EAB key id "{acme_profile.eab_kid}" with secret "{acme_profile.eab_secret}" as acme_account0
|
||||
Then I memorize acme_account0.uri with jq "capture("/(?<id>[^/]+)$") | .id" as account0_id
|
||||
When I create certificate signing request as csr
|
||||
@@ -34,7 +34,7 @@ Feature: Access Control
|
||||
Then the value response.status_code should not be equal to 404
|
||||
And I put away current ACME client as client0
|
||||
|
||||
When I have an ACME client connecting to {BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/directory
|
||||
When I have an ACME client connecting to "{BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/directory"
|
||||
Then I register a new ACME account with email maidu@infisical.com and EAB key id "{acme_profile.eab_kid}" with secret "{acme_profile.eab_secret}" as acme_account1
|
||||
Then I peak and memorize the next nonce as nonce
|
||||
When I send a raw ACME request to "<url>"
|
||||
@@ -62,7 +62,87 @@ Feature: Access Control
|
||||
|
||||
Scenario Outline: Access resources across a different profile
|
||||
Given I have an ACME cert profile as "acme_profile"
|
||||
When I have an ACME client connecting to {BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/directory
|
||||
When I have an ACME client connecting to "{BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/directory"
|
||||
Then I register a new ACME account with email fangpen@infisical.com and EAB key id "{acme_profile.eab_kid}" with secret "{acme_profile.eab_secret}" as acme_account0
|
||||
Then I memorize acme_account0.uri with jq "capture("/(?<id>[^/]+)$") | .id" as account0_id
|
||||
When I create certificate signing request as csr
|
||||
Then I add names to certificate signing request csr
|
||||
"""
|
||||
{
|
||||
"COMMON_NAME": "localhost"
|
||||
}
|
||||
"""
|
||||
Then I create a RSA private key pair as cert_key
|
||||
Then I sign the certificate signing request csr with private key cert_key and output it as csr_pem in PEM format
|
||||
Then I submit the certificate signing request PEM csr_pem certificate order to the ACME server as order
|
||||
Then I peak and memorize the next nonce as nonce
|
||||
Then I memorize <src_var> with jq "<jq>" as <dest_var>
|
||||
When I send a raw ACME request to "<url>"
|
||||
"""
|
||||
{
|
||||
"protected": {
|
||||
"alg": "RS256",
|
||||
"nonce": "{nonce}",
|
||||
"url": "<url>",
|
||||
"kid": "{acme_account0.uri}"
|
||||
},
|
||||
"payload": {"invalid": "payload"}
|
||||
}
|
||||
"""
|
||||
# With original owner account under their profile, the invalid payload is going to trigger other errors instead of
|
||||
# 404, this is to make sure that our URLs are actually correct
|
||||
Then the value response.status_code should not be equal to 404
|
||||
And I put away current ACME client as client0
|
||||
|
||||
Given I make a random slug as profile_slug
|
||||
Given I use AUTH_TOKEN for authentication
|
||||
When I send a "POST" request to "/api/v1/pki/certificate-profiles" with JSON payload
|
||||
"""
|
||||
{
|
||||
"projectId": "{PROJECT_ID}",
|
||||
"slug": "{profile_slug}",
|
||||
"description": "",
|
||||
"enrollmentType": "acme",
|
||||
"caId": "{CERT_CA_ID}",
|
||||
"certificateTemplateId": "{CERT_TEMPLATE_ID}",
|
||||
"acmeConfig": {}
|
||||
}
|
||||
"""
|
||||
Then the value response.status_code should be equal to 200
|
||||
Then I memorize response with jq ".certificateProfile.id" as profile_id
|
||||
When I send a "GET" request to "/api/v1/pki/certificate-profiles/{profile_id}/acme/eab-secret/reveal"
|
||||
Then I memorize response with jq ".eabKid" as eab_kid
|
||||
And I memorize response with jq ".eabSecret" as eab_secret
|
||||
When I have an ACME client connecting to "{BASE_URL}/api/v1/pki/acme/profiles/{profile_id}/directory"
|
||||
Then I register a new ACME account with email maidu@infisical.com and EAB key id "{eab_kid}" with secret "{eab_secret}" as acme_account1
|
||||
Then I peak and memorize the next nonce as nonce
|
||||
Then I memorize <src_var> with jq "<jq>" as <dest_var>
|
||||
When I send a raw ACME request to "<url>"
|
||||
"""
|
||||
{
|
||||
"protected": {
|
||||
"alg": "RS256",
|
||||
"nonce": "{nonce}",
|
||||
"url": "<url>",
|
||||
"kid": "{acme_account1.uri}"
|
||||
},
|
||||
"raw_payload": "<payload>"
|
||||
}
|
||||
"""
|
||||
Then the value response.status_code should be equal to 404
|
||||
|
||||
Examples: Endpoints
|
||||
| src_var | jq | dest_var | url | payload |
|
||||
| order | . | not_used | {BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/accounts/{account0_id}/orders | |
|
||||
| order | . | not_used | {order.uri} | |
|
||||
| order | . | not_used | {order.uri}/finalize | {\"csr\": \"\"} |
|
||||
| order | . | not_used | {order.uri}/certificate | |
|
||||
| order | .authorizations[0].uri | auth_uri | {auth_uri} | |
|
||||
| order | .authorizations[0].body.challenges[0].url | challenge_uri | {challenge_uri} | {} |
|
||||
|
||||
Scenario Outline: Access resources across a different profile with the same key pair
|
||||
Given I have an ACME cert profile as "acme_profile"
|
||||
When I have an ACME client connecting to "{BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/directory"
|
||||
Then I register a new ACME account with email fangpen@infisical.com and EAB key id "{acme_profile.eab_kid}" with secret "{acme_profile.eab_secret}" as acme_account0
|
||||
Then I memorize acme_account0.uri with jq "capture("/(?<id>[^/]+)$") | .id" as account0_id
|
||||
When I create certificate signing request as csr
|
||||
@@ -99,7 +179,7 @@ Feature: Access Control
|
||||
When I send a "GET" request to "/api/v1/pki/certificate-profiles/{profile_id}/acme/eab-secret/reveal"
|
||||
Then I memorize response with jq ".eabKid" as eab_kid
|
||||
And I memorize response with jq ".eabSecret" as eab_secret
|
||||
When I have an ACME client connecting to {BASE_URL}/api/v1/pki/acme/profiles/{profile_id}/directory
|
||||
When I have an ACME client connecting to "{BASE_URL}/api/v1/pki/acme/profiles/{profile_id}/directory" with the key pair from client0
|
||||
Then I register a new ACME account with email maidu@infisical.com and EAB key id "{eab_kid}" with secret "{eab_secret}" as acme_account1
|
||||
Then I peak and memorize the next nonce as nonce
|
||||
Then I memorize <src_var> with jq "<jq>" as <dest_var>
|
||||
@@ -126,9 +206,10 @@ Feature: Access Control
|
||||
| order | .authorizations[0].uri | auth_uri | {auth_uri} | |
|
||||
| order | .authorizations[0].body.challenges[0].url | challenge_uri | {challenge_uri} | {} |
|
||||
|
||||
|
||||
Scenario Outline: URL mismatch
|
||||
Given I have an ACME cert profile as "acme_profile"
|
||||
When I have an ACME client connecting to {BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/directory
|
||||
When I have an ACME client connecting to "{BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/directory"
|
||||
Then I register a new ACME account with email fangpen@infisical.com and EAB key id "{acme_profile.eab_kid}" with secret "{acme_profile.eab_secret}" as acme_account
|
||||
Then I memorize acme_account.uri with jq "capture("/(?<id>[^/]+)$") | .id" as account_id
|
||||
When I create certificate signing request as csr
|
||||
|
||||
Reference in New Issue
Block a user