diff --git a/backend/src/helpers/rateLimiter.ts b/backend/src/helpers/rateLimiter.ts index 432bd5f97..073ba11bc 100644 --- a/backend/src/helpers/rateLimiter.ts +++ b/backend/src/helpers/rateLimiter.ts @@ -15,7 +15,7 @@ const apiLimiter = rateLimit({ }); // 10 requests per minute -const authLimiter = rateLimit({ +const authLimit = rateLimit({ windowMs: 60 * 1000, max: 10, standardHeaders: true, @@ -36,8 +36,16 @@ const passwordLimiter = rateLimit({ } }); -export { - apiLimiter, - authLimiter, - passwordLimiter +const authLimiter = (req: any, res: any, next: any) => { + if (process.env.NODE_ENV === 'production') { + authLimit(req, res, next); + } else { + next(); + } +}; + +export { + apiLimiter, + authLimiter, + passwordLimiter }; diff --git a/backend/tests/data/batch-create-secrets-with-some-missing-params.json b/backend/tests/data/batch-create-secrets-with-some-missing-params.json new file mode 100644 index 000000000..40d07827c --- /dev/null +++ b/backend/tests/data/batch-create-secrets-with-some-missing-params.json @@ -0,0 +1,51 @@ +[ + { + "method": "POST", + "secret": { + "workspace": "63cefb15c8d3175601cfa989", + "type": "shared", + "tags": [], + "environment": "dev", + "secretKeyCiphertext": "eaX9a2g=", + "secretKeyIV": "YJ4adgI/wEHifGdtT9reaA==", + "secretKeyTag": "dP73x3wrq7pqxzAHo+bfPA==", + "secretValueCiphertext": "cw==", + "secretValueIV": "7ksYWWZ3+9rzLG5NpEbEgg==", + "secretValueTag": "H0YQ8vrhiVJ0XSW4nBJdQA==", + "secretCommentCiphertext": "", + "secretCommentIV": "yXhMdLdA9q7Vaw4UUaeBYA==", + "secretCommentTag": "qMj7SHESM5Jn+C2qpbw2pA==" + } + }, + { + "method": "POST", + "secret": { + "workspace": "63cefb15c8d3175601cfa989", + "type": "shared", + "tags": [], + "environment": "dev", + "secretKeyIV": "YJ4adgI/wEHifGdtT9reaA==", + "secretKeyTag": "dP73x3wrq7pqxzAHo+bfPA==", + "secretValueIV": "7ksYWWZ3+9rzLG5NpEbEgg==", + "secretValueTag": "H0YQ8vrhiVJ0XSW4nBJdQA==", + "secretCommentIV": "yXhMdLdA9q7Vaw4UUaeBYA==", + "secretCommentTag": "qMj7SHESM5Jn+C2qpbw2pA==" + } + }, + { + "method": "POST", + "secret": { + "workspace": "63cefb15c8d3175601cfa989", + "type": "shared", + "tags": [], + "environment": "dev", + "secretKeyIV": "YJ4adgI/wEHifGdtT9reaA==", + "secretKeyTag": "dP73x3wrq7pqxzAHo+bfPA==", + "secretValueCiphertext": "cw==", + "secretValueTag": "H0YQ8vrhiVJ0XSW4nBJdQA==", + "secretCommentCiphertext": "", + "secretCommentIV": "yXhMdLdA9q7Vaw4UUaeBYA==", + "secretCommentTag": "qMj7SHESM5Jn+C2qpbw2pA==" + } + } +] \ No newline at end of file diff --git a/backend/tests/helper/helper.ts b/backend/tests/helper/helper.ts index 4f3371d55..c59c8d43b 100644 --- a/backend/tests/helper/helper.ts +++ b/backend/tests/helper/helper.ts @@ -89,4 +89,8 @@ export const getServiceTokenFromTestUser = async () => { export const deleteAllSecrets = async () => { await Secret.deleteMany() +} + +export const getAllSecrets = async () => { + return await Secret.find() } \ No newline at end of file diff --git a/backend/tests/integration-tests/routes/v2/secrets.test.ts b/backend/tests/integration-tests/routes/v2/secrets.test.ts index 0ceda45de..4df6056fe 100644 --- a/backend/tests/integration-tests/routes/v2/secrets.test.ts +++ b/backend/tests/integration-tests/routes/v2/secrets.test.ts @@ -1,14 +1,16 @@ import request from 'supertest' import main from '../../../../src/index' import { testWorkspaceId } from '../../../../src/utils/addDevelopmentUser'; -import { deleteAllSecrets, getJWTFromTestUser, getServiceTokenFromTestUser } from '../../../helper/helper'; +import { deleteAllSecrets, getAllSecrets, getJWTFromTestUser, getServiceTokenFromTestUser } from '../../../helper/helper'; // eslint-disable-next-line @typescript-eslint/no-var-requires const batchSecretRequestWithNoOverride = require('../../../data/batch-secrets-no-override.json'); // eslint-disable-next-line @typescript-eslint/no-var-requires const batchSecretRequestWithOverrides = require('../../../data/batch-secrets-with-overrides.json'); -let server: any; +// eslint-disable-next-line @typescript-eslint/no-var-requires +const batchSecretRequestWithBadRequest = require('../../../data/batch-create-secrets-with-some-missing-params.json'); +let server: any; beforeAll(async () => { server = await main; }); @@ -289,93 +291,118 @@ describe("GET /api/v2/secrets", () => { } }) - // test("should create secrets and read secrets via service token when no overrides", async () => { - // // get login details - // const loginResponse = await getJWTFromTestUser() + test("should create secrets and read secrets via service token when no overrides", async () => { + try { + // get login details + const loginResponse = await getJWTFromTestUser() - // // create secrets - // const createSecretsResponse = await request(server) - // .post("/api/v2/secrets/batch") - // .set('Authorization', `Bearer ${loginResponse.token}`) - // .send({ - // workspaceId: testWorkspaceId, - // environment: "dev", - // requests: batchSecretRequestWithNoOverride - // }) + // create secrets + const createSecretsResponse = await request(server) + .post("/api/v2/secrets/batch") + .set('Authorization', `Bearer ${loginResponse.token}`) + .send({ + workspaceId: testWorkspaceId, + environment: "dev", + requests: batchSecretRequestWithNoOverride + }) - // expect(createSecretsResponse.statusCode).toBe(200) + expect(createSecretsResponse.statusCode).toBe(200) - // // now use the service token to fetch secrets - // const serviceToken = await getServiceTokenFromTestUser() + // now use the service token to fetch secrets + const serviceToken = await getServiceTokenFromTestUser() - // const getSecrets = await request(server) - // .get("/api/v2/secrets") - // .set('Authorization', `Bearer ${serviceToken}`) - // .query({ - // workspaceId: testWorkspaceId, - // environment: "dev" - // }) + const getSecrets = await request(server) + .get("/api/v2/secrets") + .set('Authorization', `Bearer ${serviceToken}`) + .query({ + workspaceId: testWorkspaceId, + environment: "dev" + }) - // expect(getSecrets.statusCode).toBe(200) - // expect(getSecrets.body).toHaveProperty("secrets") - // expect(getSecrets.body.secrets).toHaveLength(3) - // expect(getSecrets.body.secrets).toBeInstanceOf(Array); + expect(getSecrets.statusCode).toBe(200) + expect(getSecrets.body).toHaveProperty("secrets") + expect(getSecrets.body.secrets).toHaveLength(3) + expect(getSecrets.body.secrets).toBeInstanceOf(Array); - // getSecrets.body.secrets.forEach((secret: any) => { - // expect(secret).toHaveProperty('_id'); - // expect(secret._id).toBeTruthy(); + getSecrets.body.secrets.forEach((secret: any) => { + expect(secret).toHaveProperty('_id'); + expect(secret._id).toBeTruthy(); - // expect(secret).toHaveProperty('version'); - // expect(secret.version).toBeTruthy(); + expect(secret).toHaveProperty('version'); + expect(secret.version).toBeTruthy(); - // expect(secret).toHaveProperty('workspace'); - // expect(secret.workspace).toBeTruthy(); + expect(secret).toHaveProperty('workspace'); + expect(secret.workspace).toBeTruthy(); - // expect(secret).toHaveProperty('type'); - // expect(secret.type).toBeTruthy(); + expect(secret).toHaveProperty('type'); + expect(secret.type).toBeTruthy(); - // expect(secret).toHaveProperty('tags'); - // expect(secret.tags).toHaveLength(0); + expect(secret).toHaveProperty('tags'); + expect(secret.tags).toHaveLength(0); - // expect(secret).toHaveProperty('environment'); - // expect(secret.environment).toEqual("dev"); + expect(secret).toHaveProperty('environment'); + expect(secret.environment).toEqual("dev"); - // expect(secret).toHaveProperty('secretKeyCiphertext'); - // expect(secret.secretKeyCiphertext).toBeTruthy(); + expect(secret).toHaveProperty('secretKeyCiphertext'); + expect(secret.secretKeyCiphertext).toBeTruthy(); - // expect(secret).toHaveProperty('secretKeyIV'); - // expect(secret.secretKeyIV).toBeTruthy(); + expect(secret).toHaveProperty('secretKeyIV'); + expect(secret.secretKeyIV).toBeTruthy(); - // expect(secret).toHaveProperty('secretKeyTag'); - // expect(secret.secretKeyTag).toBeTruthy(); + expect(secret).toHaveProperty('secretKeyTag'); + expect(secret.secretKeyTag).toBeTruthy(); - // expect(secret).toHaveProperty('secretValueCiphertext'); - // expect(secret.secretValueCiphertext).toBeTruthy(); + expect(secret).toHaveProperty('secretValueCiphertext'); + expect(secret.secretValueCiphertext).toBeTruthy(); - // expect(secret).toHaveProperty('secretValueIV'); - // expect(secret.secretValueIV).toBeTruthy(); + expect(secret).toHaveProperty('secretValueIV'); + expect(secret.secretValueIV).toBeTruthy(); - // expect(secret).toHaveProperty('secretValueTag'); - // expect(secret.secretValueTag).toBeTruthy(); + expect(secret).toHaveProperty('secretValueTag'); + expect(secret.secretValueTag).toBeTruthy(); - // expect(secret).toHaveProperty('secretCommentCiphertext'); - // expect(secret.secretCommentCiphertext).toBeFalsy(); + expect(secret).toHaveProperty('secretCommentCiphertext'); + expect(secret.secretCommentCiphertext).toBeFalsy(); - // expect(secret).toHaveProperty('secretCommentIV'); - // expect(secret.secretCommentIV).toBeTruthy(); + expect(secret).toHaveProperty('secretCommentIV'); + expect(secret.secretCommentIV).toBeTruthy(); - // expect(secret).toHaveProperty('secretCommentTag'); - // expect(secret.secretCommentTag).toBeTruthy(); + expect(secret).toHaveProperty('secretCommentTag'); + expect(secret.secretCommentTag).toBeTruthy(); - // expect(secret).toHaveProperty('createdAt'); - // expect(secret.createdAt).toBeTruthy(); + expect(secret).toHaveProperty('createdAt'); + expect(secret.createdAt).toBeTruthy(); - // expect(secret).toHaveProperty('updatedAt'); - // expect(secret.updatedAt).toBeTruthy(); - // }); - // }) + expect(secret).toHaveProperty('updatedAt'); + expect(secret.updatedAt).toBeTruthy(); + }); + } finally { + // clean up + await deleteAllSecrets() + } + }) + }) + describe("create secrets via JWT", () => { + test("Create secrets via jwt when some requests have missing required parameters", async () => { + // get login details + const loginResponse = await getJWTFromTestUser() + // create creates + const createSecretsResponse = await request(server) + .post("/api/v2/secrets/batch") + .set('Authorization', `Bearer ${loginResponse.token}`) + .send({ + workspaceId: testWorkspaceId, + environment: "dev", + requests: batchSecretRequestWithBadRequest + }) + + const allSecretsInDB = await getAllSecrets() + + expect(createSecretsResponse.statusCode).toBe(500) // TODO should be set to 400 + expect(allSecretsInDB).toHaveLength(0) + }) }) }) \ No newline at end of file