forked from retoor/devplacepy
feat: restrict backup archive download to primary admin and hide admin-hidden projects from other admins
- Add `get_admin_uids()` and `get_primary_admin_uid()` to database.py for resolving the earliest-created admin - Modify `can_view_project()` in content.py so a project hidden by an admin is invisible to other admins (both web UI and REST API) - Update `_download_url()` and `_backup_payload()` in admin/backups.py to accept a `can_download` flag, gating the download endpoint with `is_primary_admin()` - Remove `role` from `_user_facts()` in docs_live.py to avoid leaking admin status in live docs - Update doc summaries in docs_api.py to reflect the new admin-visibility and backup-download semantics
This commit is contained in:
@@ -0,0 +1,129 @@
|
||||
# retoor <retoor@molodetz.nl>
|
||||
|
||||
import time
|
||||
import requests
|
||||
from tests.conftest import BASE_URL
|
||||
from devplacepy import config
|
||||
from devplacepy.database import get_table, get_primary_admin_uid, refresh_snapshot
|
||||
from devplacepy.services.backup import store
|
||||
from devplacepy.utils import clear_user_cache
|
||||
|
||||
JSON = {"Accept": "application/json"}
|
||||
_counter = [0]
|
||||
|
||||
|
||||
def _signup():
|
||||
_counter[0] += 1
|
||||
name = f"bkp{int(time.time() * 1000)}{_counter[0]}"
|
||||
requests.post(
|
||||
f"{BASE_URL}/auth/signup",
|
||||
data={
|
||||
"username": name,
|
||||
"email": f"{name}@t.dev",
|
||||
"password": "secret123",
|
||||
"confirm_password": "secret123",
|
||||
},
|
||||
allow_redirects=True,
|
||||
)
|
||||
refresh_snapshot()
|
||||
return get_table("users").find_one(username=name)
|
||||
|
||||
|
||||
def _make_admin():
|
||||
row = _signup()
|
||||
get_table("users").update({"uid": row["uid"], "role": "Admin"}, ["uid"])
|
||||
clear_user_cache(row["uid"])
|
||||
return row["api_key"]
|
||||
|
||||
|
||||
def _primary_admin_key():
|
||||
refresh_snapshot()
|
||||
uid = get_primary_admin_uid()
|
||||
return get_table("users").find_one(uid=uid)["api_key"]
|
||||
|
||||
|
||||
def _seed_done_backup(owner_uid):
|
||||
backup_uid = store.create_backup(
|
||||
target="database", created_by=owner_uid, job_uid="jobtest"
|
||||
)
|
||||
target_dir = config.BACKUPS_DIR
|
||||
target_dir.mkdir(parents=True, exist_ok=True)
|
||||
path = target_dir / f"{backup_uid}.tar.gz"
|
||||
path.write_bytes(b"\x1f\x8b\x08\x00test-archive")
|
||||
store.finalize_backup(
|
||||
backup_uid,
|
||||
filename="database-test.tar.gz",
|
||||
local_path=str(path),
|
||||
stats={"bytes_out": path.stat().st_size, "file_count": 1},
|
||||
)
|
||||
refresh_snapshot()
|
||||
return backup_uid
|
||||
|
||||
|
||||
def test_download_requires_admin_guest(app_server):
|
||||
assert (
|
||||
requests.get(
|
||||
f"{BASE_URL}/admin/backups/nope/download",
|
||||
headers=JSON,
|
||||
allow_redirects=False,
|
||||
).status_code
|
||||
== 401
|
||||
)
|
||||
assert (
|
||||
requests.get(
|
||||
f"{BASE_URL}/admin/backups/nope/download", allow_redirects=False
|
||||
).status_code
|
||||
== 303
|
||||
)
|
||||
|
||||
|
||||
def test_download_denied_for_member(app_server, seeded_db):
|
||||
s = requests.Session()
|
||||
s.post(
|
||||
f"{BASE_URL}/auth/login",
|
||||
data={
|
||||
"email": seeded_db["bob"]["email"],
|
||||
"password": seeded_db["bob"]["password"],
|
||||
},
|
||||
)
|
||||
r = s.get(
|
||||
f"{BASE_URL}/admin/backups/nope/download", headers=JSON, allow_redirects=False
|
||||
)
|
||||
assert r.status_code == 403
|
||||
|
||||
|
||||
def test_download_and_flag_denied_for_non_primary_admin(app_server):
|
||||
key = _make_admin()
|
||||
headers = {**JSON, "X-API-KEY": key}
|
||||
assert (
|
||||
requests.get(
|
||||
f"{BASE_URL}/admin/backups/nope/download",
|
||||
headers=headers,
|
||||
allow_redirects=False,
|
||||
).status_code
|
||||
== 403
|
||||
)
|
||||
data = requests.get(f"{BASE_URL}/admin/backups/data", headers=headers).json()
|
||||
assert data["can_download_backups"] is False
|
||||
assert all(b.get("download_url") is None for b in data["backups"])
|
||||
|
||||
|
||||
def test_primary_admin_flag_true(app_server):
|
||||
headers = {**JSON, "X-API-KEY": _primary_admin_key()}
|
||||
data = requests.get(f"{BASE_URL}/admin/backups/data", headers=headers).json()
|
||||
assert data["can_download_backups"] is True
|
||||
|
||||
|
||||
def test_primary_admin_can_download_archive(app_server):
|
||||
uid = get_primary_admin_uid()
|
||||
key = get_table("users").find_one(uid=uid)["api_key"]
|
||||
backup_uid = _seed_done_backup(uid)
|
||||
headers = {**JSON, "X-API-KEY": key}
|
||||
|
||||
data = requests.get(f"{BASE_URL}/admin/backups/data", headers=headers).json()
|
||||
rows = [b for b in data["backups"] if b["uid"] == backup_uid]
|
||||
assert rows and rows[0]["download_url"] == f"/admin/backups/{backup_uid}/download"
|
||||
|
||||
r = requests.get(f"{BASE_URL}/admin/backups/{backup_uid}/download", headers=headers)
|
||||
assert r.status_code == 200
|
||||
assert r.headers["content-type"] == "application/gzip"
|
||||
@@ -1,8 +1,52 @@
|
||||
# retoor <retoor@molodetz.nl>
|
||||
|
||||
import time
|
||||
import requests
|
||||
from tests.conftest import BASE_URL
|
||||
from devplacepy.database import get_table, refresh_snapshot
|
||||
from devplacepy.utils import clear_user_cache
|
||||
|
||||
_counter_search = [0]
|
||||
|
||||
|
||||
def _signup_search():
|
||||
_counter_search[0] += 1
|
||||
name = f"cas{int(time.time() * 1000)}{_counter_search[0]}"
|
||||
requests.post(
|
||||
f"{BASE_URL}/auth/signup",
|
||||
data={
|
||||
"username": name,
|
||||
"email": f"{name}@t.dev",
|
||||
"password": "secret123",
|
||||
"confirm_password": "secret123",
|
||||
},
|
||||
allow_redirects=True,
|
||||
)
|
||||
row = get_table("users").find_one(username=name)
|
||||
return name, row["uid"], row["api_key"]
|
||||
|
||||
|
||||
def _make_admin_search():
|
||||
name, uid, key = _signup_search()
|
||||
get_table("users").update({"uid": uid, "role": "Admin"}, ["uid"])
|
||||
clear_user_cache(uid)
|
||||
return name, uid, key
|
||||
|
||||
|
||||
def _create_private_project(key, title):
|
||||
r = requests.post(
|
||||
f"{BASE_URL}/projects/create",
|
||||
headers={"X-API-KEY": key, "Accept": "application/json"},
|
||||
data={
|
||||
"title": title,
|
||||
"description": "search test",
|
||||
"project_type": "software",
|
||||
"status": "In Development",
|
||||
"is_private": "on",
|
||||
},
|
||||
)
|
||||
assert r.status_code == 200, r.text
|
||||
return r.json()["data"]["slug"]
|
||||
|
||||
|
||||
def _admin_session():
|
||||
@@ -33,3 +77,21 @@ def test_project_search_empty_query(app_server, seeded_db):
|
||||
r = s.get(f"{BASE_URL}/admin/containers/projects/search?q=")
|
||||
assert r.status_code == 200
|
||||
assert r.json()["results"] == []
|
||||
|
||||
|
||||
def test_project_search_hides_other_admin_private_project(app_server):
|
||||
_, _, owner_key = _make_admin_search()
|
||||
_, _, other_admin_key = _make_admin_search()
|
||||
title = f"SearchHidden{int(time.time() * 1000)}"
|
||||
slug = _create_private_project(owner_key, title)
|
||||
|
||||
other = requests.Session()
|
||||
other.headers.update({"X-API-KEY": other_admin_key})
|
||||
r = other.get(f"{BASE_URL}/admin/containers/projects/search?q={title}")
|
||||
assert r.status_code == 200
|
||||
assert slug not in [row["slug"] for row in r.json()["results"]]
|
||||
|
||||
owner = requests.Session()
|
||||
owner.headers.update({"X-API-KEY": owner_key})
|
||||
r = owner.get(f"{BASE_URL}/admin/containers/projects/search?q={title}")
|
||||
assert slug in [row["slug"] for row in r.json()["results"]]
|
||||
|
||||
@@ -0,0 +1,166 @@
|
||||
# retoor <retoor@molodetz.nl>
|
||||
|
||||
import time
|
||||
import pytest
|
||||
import requests
|
||||
from tests.conftest import BASE_URL
|
||||
from devplacepy.database import get_table, refresh_snapshot, set_setting
|
||||
|
||||
JSON = {"Accept": "application/json"}
|
||||
_counter = [0]
|
||||
|
||||
|
||||
@pytest.fixture(scope="module", autouse=True)
|
||||
def _settings(app_server):
|
||||
for key, value in {
|
||||
"rate_limit_per_minute": "1000000",
|
||||
"rate_limit_window_seconds": "60",
|
||||
"registration_open": "1",
|
||||
"maintenance_mode": "0",
|
||||
"session_max_age_days": "7",
|
||||
"session_remember_days": "30",
|
||||
}.items():
|
||||
set_setting(key, value)
|
||||
yield
|
||||
|
||||
|
||||
def _db_user(name):
|
||||
refresh_snapshot()
|
||||
return get_table("users").find_one(username=name)
|
||||
|
||||
|
||||
def _unique(prefix="sen"):
|
||||
_counter[0] += 1
|
||||
return f"{prefix}{int(time.time() * 1000)}{_counter[0]}"
|
||||
|
||||
|
||||
def _signup():
|
||||
name = _unique("senmem")
|
||||
s = requests.Session()
|
||||
s.post(
|
||||
f"{BASE_URL}/auth/signup",
|
||||
data={
|
||||
"username": name,
|
||||
"email": f"{name}@t.dev",
|
||||
"password": "secret123",
|
||||
"confirm_password": "secret123",
|
||||
},
|
||||
allow_redirects=True,
|
||||
)
|
||||
return name
|
||||
|
||||
|
||||
def _key_session(name):
|
||||
s = requests.Session()
|
||||
s.headers.update({"X-API-KEY": _db_user(name)["api_key"]})
|
||||
return s
|
||||
|
||||
|
||||
def _alice():
|
||||
return _key_session("alice_test")
|
||||
|
||||
|
||||
def _promote(actor, uid):
|
||||
actor.post(
|
||||
f"{BASE_URL}/admin/users/{uid}/role",
|
||||
headers=JSON,
|
||||
data={"role": "admin"},
|
||||
allow_redirects=False,
|
||||
)
|
||||
|
||||
|
||||
def _audit(session, **params):
|
||||
r = session.get(f"{BASE_URL}/admin/audit-log", headers=JSON, params=params)
|
||||
assert r.status_code == 200, r.text[:300]
|
||||
return r.json()["entries"]
|
||||
|
||||
|
||||
def _denied(session, event_key, target_uid):
|
||||
for e in _audit(session, event_key=event_key, result="denied"):
|
||||
if e.get("target_uid") == target_uid:
|
||||
return e
|
||||
return None
|
||||
|
||||
|
||||
def _junior_admin(seeded_db):
|
||||
alice = _alice()
|
||||
name = _signup()
|
||||
uid = _db_user(name)["uid"]
|
||||
_promote(alice, uid)
|
||||
assert _db_user(name)["role"] == "Admin"
|
||||
return _key_session(name), name, uid
|
||||
|
||||
|
||||
def test_junior_admin_cannot_change_senior_admin_role(seeded_db):
|
||||
junior, _, _ = _junior_admin(seeded_db)
|
||||
alice_uid = _db_user("alice_test")["uid"]
|
||||
junior.post(
|
||||
f"{BASE_URL}/admin/users/{alice_uid}/role",
|
||||
headers=JSON,
|
||||
data={"role": "member"},
|
||||
allow_redirects=False,
|
||||
)
|
||||
assert _denied(_alice(), "admin.user.role.change", alice_uid) is not None
|
||||
assert _db_user("alice_test")["role"] == "Admin"
|
||||
|
||||
|
||||
def test_junior_admin_cannot_disable_senior_admin(seeded_db):
|
||||
junior, _, _ = _junior_admin(seeded_db)
|
||||
alice_uid = _db_user("alice_test")["uid"]
|
||||
junior.post(
|
||||
f"{BASE_URL}/admin/users/{alice_uid}/toggle",
|
||||
headers=JSON,
|
||||
allow_redirects=False,
|
||||
)
|
||||
assert _denied(_alice(), "admin.user.active.disable", alice_uid) is not None
|
||||
assert _db_user("alice_test").get("is_active", True)
|
||||
|
||||
|
||||
def test_junior_admin_cannot_reset_senior_admin_password(seeded_db):
|
||||
junior, _, _ = _junior_admin(seeded_db)
|
||||
alice_uid = _db_user("alice_test")["uid"]
|
||||
before = _db_user("alice_test")["password_hash"]
|
||||
junior.post(
|
||||
f"{BASE_URL}/admin/users/{alice_uid}/password",
|
||||
headers=JSON,
|
||||
data={"password": "hijacked999"},
|
||||
allow_redirects=False,
|
||||
)
|
||||
assert _denied(_alice(), "admin.user.password.reset", alice_uid) is not None
|
||||
assert _db_user("alice_test")["password_hash"] == before
|
||||
|
||||
|
||||
def test_junior_admin_cannot_reset_senior_admin_quota(seeded_db):
|
||||
junior, _, _ = _junior_admin(seeded_db)
|
||||
alice_uid = _db_user("alice_test")["uid"]
|
||||
junior.post(
|
||||
f"{BASE_URL}/admin/users/{alice_uid}/reset-ai-quota",
|
||||
headers=JSON,
|
||||
allow_redirects=False,
|
||||
)
|
||||
assert _denied(_alice(), "admin.user.ai_quota.reset", alice_uid) is not None
|
||||
|
||||
|
||||
def test_senior_admin_can_disable_junior_admin(seeded_db):
|
||||
_junior, _, junior_uid = _junior_admin(seeded_db)
|
||||
alice = _alice()
|
||||
alice.post(
|
||||
f"{BASE_URL}/admin/users/{junior_uid}/toggle",
|
||||
headers=JSON,
|
||||
allow_redirects=False,
|
||||
)
|
||||
refresh_snapshot()
|
||||
assert not get_table("users").find_one(uid=junior_uid).get("is_active", True)
|
||||
|
||||
|
||||
def test_junior_admin_can_manage_member(seeded_db):
|
||||
junior, _, _ = _junior_admin(seeded_db)
|
||||
member = _signup()
|
||||
member_uid = _db_user(member)["uid"]
|
||||
junior.post(
|
||||
f"{BASE_URL}/admin/users/{member_uid}/toggle",
|
||||
headers=JSON,
|
||||
allow_redirects=False,
|
||||
)
|
||||
refresh_snapshot()
|
||||
assert not get_table("users").find_one(uid=member_uid).get("is_active", True)
|
||||
Reference in New Issue
Block a user