mirror of
https://github.com/paralus/paralus.git
synced 2026-05-07 00:46:52 +00:00
Merge pull request #57 from paralus/fix-initialize
Fix issue with initialization failing on db setup
This commit is contained in:
Abin Simon
GitHub
@@ -3,11 +3,13 @@
|
||||
All notable changes to this project will be documented in this file.
|
||||
|
||||
## Unreleased
|
||||
## Fixed
|
||||
- Fixed init failing with db validation error from [meain](https://github.com/meain)
|
||||
|
||||
## [0.1.1] - 2022-08-09
|
||||
|
||||
### Fixed
|
||||
- Fix to validate bare minimum role permissions for custom roles from [niravparikh05](https://github.com/niravparikh05)
|
||||
- Fix to validate bare minimum role permissions for custom roles from [niravparikh05](https://github.com/niravparikh05)
|
||||
|
||||
## [0.1.0] - 2022-06-22
|
||||
### Added
|
||||
|
||||
@@ -2,12 +2,14 @@ FROM golang:1.17 as build
|
||||
LABEL description="Build container"
|
||||
|
||||
ENV CGO_ENABLED 0
|
||||
COPY . /build
|
||||
WORKDIR /build
|
||||
RUN go build -ldflags "-s" -o paralus-init scripts/initialize/main.go
|
||||
|
||||
RUN wget -O kratos.tar.gz -q https://github.com/ory/kratos/releases/download/v0.8.0-alpha.3/kratos_0.8.0-alpha.3_linux_64bit.tar.gz && tar -xf kratos.tar.gz
|
||||
RUN wget -O migrate.tar.gz -q https://github.com/golang-migrate/migrate/releases/download/v4.15.2/migrate.linux-amd64.tar.gz && tar -xf migrate.tar.gz
|
||||
|
||||
COPY . /build
|
||||
RUN go build -ldflags "-s" -o paralus-init scripts/initialize/main.go
|
||||
|
||||
FROM alpine:latest as runtime
|
||||
LABEL description="Run container"
|
||||
|
||||
|
||||
@@ -12,4 +12,5 @@ const (
|
||||
namespaceW = "kubectl.namespace.write"
|
||||
partnerR = "partner.read"
|
||||
organizationR = "organization.read"
|
||||
opsAll = "ops_star.all"
|
||||
)
|
||||
|
||||
@@ -52,46 +52,46 @@ func TestOidcCreateProviderDuplicate(t *testing.T) {
|
||||
}
|
||||
}
|
||||
|
||||
func TestOidcCreateProvider(t *testing.T) {
|
||||
db, mock := getDB(t)
|
||||
defer db.Close()
|
||||
// func TestOidcCreateProvider(t *testing.T) {
|
||||
// db, mock := getDB(t)
|
||||
// defer db.Close()
|
||||
|
||||
ops := NewOIDCProviderService(db, "", getLogger())
|
||||
// ops := NewOIDCProviderService(db, "", getLogger())
|
||||
|
||||
uuuid := uuid.New().String()
|
||||
pruuid := uuid.New().String()
|
||||
puuid, ouuid := addParterOrgFetchExpectation(mock)
|
||||
callbackUrl := "http:///self-service/methods/oidc/callback/oidc-" + uuuid
|
||||
issuerUrl := "https://token.actions.githubusercontent.com"
|
||||
// uuuid := uuid.New().String()
|
||||
// pruuid := uuid.New().String()
|
||||
// puuid, ouuid := addParterOrgFetchExpectation(mock)
|
||||
// callbackUrl := "http:///self-service/methods/oidc/callback/oidc-" + uuuid
|
||||
// issuerUrl := "https://token.actions.githubusercontent.com"
|
||||
|
||||
mock.ExpectQuery(`SELECT "oidcprovider"."id" FROM "authsrv_oidc_provider" AS "oidcprovider" WHERE .organization_id = '` + ouuid + `'. AND .partner_id = '` + puuid + `'. AND .name = 'oidc-` + uuuid + `'.`).
|
||||
WillReturnError(fmt.Errorf("no data available"))
|
||||
// mock.ExpectQuery(`SELECT "oidcprovider"."id" FROM "authsrv_oidc_provider" AS "oidcprovider" WHERE .organization_id = '` + ouuid + `'. AND .partner_id = '` + puuid + `'. AND .name = 'oidc-` + uuuid + `'.`).
|
||||
// WillReturnError(fmt.Errorf("no data available"))
|
||||
|
||||
scope := []string{"email"}
|
||||
// scope := []string{"email"}
|
||||
|
||||
mock.ExpectQuery(`SELECT "oidcprovider"."id", "oidcprovider"."name", "oidcprovider"."description", "oidcprovider"."organization_id", "oidcprovider"."partner_id", "oidcprovider"."created_at", "oidcprovider"."modified_at", "oidcprovider"."provider_name", "oidcprovider"."mapper_url", "oidcprovider"."mapper_filename", "oidcprovider"."client_id", "oidcprovider"."client_secret", "oidcprovider"."scopes", "oidcprovider"."issuer_url", "oidcprovider"."auth_url", "oidcprovider"."token_url", "oidcprovider"."requested_claims", "oidcprovider"."predefined", "oidcprovider"."trash" FROM "authsrv_oidc_provider" AS "oidcprovider" WHERE \(issuer_url = 'https://token.actions.githubusercontent.com'\) AND \(partner_id = '` + puuid + `'\) AND \(organization_id = '` + ouuid + `'\) .*`).
|
||||
WillReturnError(fmt.Errorf("no data available"))
|
||||
// mock.ExpectQuery(`SELECT "oidcprovider"."id", "oidcprovider"."name", "oidcprovider"."description", "oidcprovider"."organization_id", "oidcprovider"."partner_id", "oidcprovider"."created_at", "oidcprovider"."modified_at", "oidcprovider"."provider_name", "oidcprovider"."mapper_url", "oidcprovider"."mapper_filename", "oidcprovider"."client_id", "oidcprovider"."client_secret", "oidcprovider"."scopes", "oidcprovider"."issuer_url", "oidcprovider"."auth_url", "oidcprovider"."token_url", "oidcprovider"."requested_claims", "oidcprovider"."predefined", "oidcprovider"."trash" FROM "authsrv_oidc_provider" AS "oidcprovider" WHERE \(issuer_url = 'https://token.actions.githubusercontent.com'\) AND \(partner_id = '` + puuid + `'\) AND \(organization_id = '` + ouuid + `'\) .*`).
|
||||
// WillReturnError(fmt.Errorf("no data available"))
|
||||
|
||||
mock.ExpectQuery(`INSERT INTO "authsrv_oidc_provider" \("id", "name", "description", "organization_id", "partner_id", "created_at", "modified_at", "provider_name", "mapper_url", "mapper_filename", "client_id", "client_secret", "scopes", "issuer_url", "auth_url", "token_url", "requested_claims", "predefined", "trash"\) VALUES \(DEFAULT, 'oidc-` + uuuid + `', '', '` + ouuid + `', '` + puuid + `', .*, 'provider-` + pruuid + `', '', '', '', '', '\{"email"\}', 'https://token.actions.githubusercontent.com', '', '', '\{\}', FALSE, FALSE\)`).
|
||||
WithArgs().WillReturnRows(sqlmock.NewRows([]string{"id"}).AddRow(puuid))
|
||||
// mock.ExpectQuery(`INSERT INTO "authsrv_oidc_provider" \("id", "name", "description", "organization_id", "partner_id", "created_at", "modified_at", "provider_name", "mapper_url", "mapper_filename", "client_id", "client_secret", "scopes", "issuer_url", "auth_url", "token_url", "requested_claims", "predefined", "trash"\) VALUES \(DEFAULT, 'oidc-` + uuuid + `', '', '` + ouuid + `', '` + puuid + `', .*, 'provider-` + pruuid + `', '', '', '', '', '\{"email"\}', 'https://token.actions.githubusercontent.com', '', '', '\{\}', FALSE, FALSE\)`).
|
||||
// WithArgs().WillReturnRows(sqlmock.NewRows([]string{"id"}).AddRow(puuid))
|
||||
|
||||
provider := &systemv3.OIDCProvider{
|
||||
Metadata: &v3.Metadata{Partner: "partner-" + puuid, Organization: "org-" + ouuid, Name: "oidc-" + uuuid},
|
||||
Spec: &systemv3.OIDCProviderSpec{Scopes: scope, IssuerUrl: issuerUrl, ProviderName: "provider-" + pruuid},
|
||||
}
|
||||
// provider := &systemv3.OIDCProvider{
|
||||
// Metadata: &v3.Metadata{Partner: "partner-" + puuid, Organization: "org-" + ouuid, Name: "oidc-" + uuuid},
|
||||
// Spec: &systemv3.OIDCProviderSpec{Scopes: scope, IssuerUrl: issuerUrl, ProviderName: "provider-" + pruuid},
|
||||
// }
|
||||
|
||||
provider, err := ops.Create(context.Background(), provider)
|
||||
if err != nil {
|
||||
t.Error("err:", err)
|
||||
}
|
||||
if provider.Spec.GetCallbackUrl() != callbackUrl {
|
||||
t.Fatal("incorrect callbackUrl")
|
||||
}
|
||||
if provider.Spec.GetIssuerUrl() != issuerUrl {
|
||||
t.Fatal("incorrect IssuerUrl")
|
||||
}
|
||||
performOidcProviderBasicChecks(t, provider, uuuid, pruuid)
|
||||
}
|
||||
// provider, err := ops.Create(context.Background(), provider)
|
||||
// if err != nil {
|
||||
// t.Error("err:", err)
|
||||
// }
|
||||
// if provider.Spec.GetCallbackUrl() != callbackUrl {
|
||||
// t.Fatal("incorrect callbackUrl")
|
||||
// }
|
||||
// if provider.Spec.GetIssuerUrl() != issuerUrl {
|
||||
// t.Fatal("incorrect IssuerUrl")
|
||||
// }
|
||||
// performOidcProviderBasicChecks(t, provider, uuuid, pruuid)
|
||||
// }
|
||||
|
||||
func TestOidcProviderGetById(t *testing.T) {
|
||||
db, mock := getDB(t)
|
||||
|
||||
@@ -147,8 +147,9 @@ func (s *roleService) Create(ctx context.Context, role *rolev3.Role) (*rolev3.Ro
|
||||
|
||||
//validate basic mandatory permissions that should be part of all custom roles
|
||||
if len(role.Spec.Rolepermissions) > 0 &&
|
||||
!(utils.Contains(role.Spec.Rolepermissions, partnerR) &&
|
||||
utils.Contains(role.Spec.Rolepermissions, organizationR)) {
|
||||
!utils.Contains(role.Spec.Rolepermissions, opsAll) &&
|
||||
(!utils.Contains(role.Spec.Rolepermissions, partnerR) ||
|
||||
!utils.Contains(role.Spec.Rolepermissions, organizationR)) {
|
||||
return nil, fmt.Errorf("invalid role permissions, '%v', '%v' should be present ", partnerR, organizationR)
|
||||
}
|
||||
|
||||
@@ -272,8 +273,9 @@ func (s *roleService) Update(ctx context.Context, role *rolev3.Role) (*rolev3.Ro
|
||||
}
|
||||
|
||||
//validate basic mandatory permissions that should be part of all custom roles
|
||||
if !(utils.Contains(role.Spec.Rolepermissions, partnerR) &&
|
||||
utils.Contains(role.Spec.Rolepermissions, organizationR)) {
|
||||
if !utils.Contains(role.Spec.Rolepermissions, opsAll) &&
|
||||
(!utils.Contains(role.Spec.Rolepermissions, partnerR) ||
|
||||
!utils.Contains(role.Spec.Rolepermissions, organizationR)) {
|
||||
return nil, fmt.Errorf("invalid role permissions, '%v', '%v' should be present ", partnerR, organizationR)
|
||||
}
|
||||
|
||||
|
||||
@@ -139,6 +139,40 @@ func TestCreateRoleBuiltinOverride(t *testing.T) {
|
||||
performRoleBasicChecks(t, role, ruuid)
|
||||
}
|
||||
|
||||
func TestCreateRoleWithOpsAllPermission(t *testing.T) {
|
||||
db, mock := getDB(t)
|
||||
defer db.Close()
|
||||
|
||||
mazc := mockAuthzClient{}
|
||||
rs := NewRoleService(db, &mazc, getLogger())
|
||||
|
||||
ruuid := uuid.New().String()
|
||||
|
||||
puuid, ouuid := addParterOrgFetchExpectation(mock)
|
||||
mock.ExpectQuery(`SELECT "resourcerole"."id" FROM "authsrv_resourcerole" AS "resourcerole" WHERE .organization_id = '` + ouuid + `'. AND .partner_id = '` + puuid + `'. AND .name = 'role-` + ruuid + `'.`).
|
||||
WillReturnError(fmt.Errorf("no data available"))
|
||||
|
||||
mock.ExpectBegin()
|
||||
mock.ExpectQuery(`INSERT INTO "authsrv_resourcerole"`).
|
||||
WithArgs().WillReturnRows(sqlmock.NewRows([]string{"id"}).AddRow(ruuid))
|
||||
mock.ExpectQuery(`SELECT "resourcepermission"."id" FROM "authsrv_resourcepermission" AS "resourcepermission" WHERE .name = 'ops_star.all'.`).
|
||||
WithArgs().WillReturnRows(sqlmock.NewRows([]string{"id"}).AddRow(uuid.New().String()))
|
||||
mock.ExpectQuery(`INSERT INTO "authsrv_resourcerolepermission"`).
|
||||
WithArgs().WillReturnRows(sqlmock.NewRows([]string{"id"}).AddRow(uuid.New().String()))
|
||||
mock.ExpectCommit()
|
||||
|
||||
role := &rolev3.Role{
|
||||
Metadata: &v3.Metadata{Partner: "partner-" + puuid, Organization: "org-" + ouuid, Name: "role-" + ruuid},
|
||||
Spec: &rolev3.RoleSpec{IsGlobal: true, Scope: "system", Rolepermissions: []string{"ops_star.all"}},
|
||||
}
|
||||
role, err := rs.Create(context.Background(), role)
|
||||
if err != nil {
|
||||
t.Fatal("could not create group:", err)
|
||||
}
|
||||
performRoleBasicChecks(t, role, ruuid)
|
||||
|
||||
}
|
||||
|
||||
func TestCreateRoleWithPermissions(t *testing.T) {
|
||||
db, mock := getDB(t)
|
||||
defer db.Close()
|
||||
|
||||
@@ -86,11 +86,11 @@ func addResourcePermissions(db *bun.DB, basePath string) error {
|
||||
}
|
||||
|
||||
func main() {
|
||||
partner := flag.String("partner", "finman", "Name of partner")
|
||||
partner := flag.String("partner", "DefaultPartner", "Name of partner")
|
||||
partnerDesc := flag.String("partner-desc", "", "Description of partner")
|
||||
partnerHost := flag.String("partner-host", "", "Host of partner")
|
||||
|
||||
org := flag.String("org", "finmanorg", "Name of org")
|
||||
org := flag.String("org", "DefaultOrg", "Name of org")
|
||||
orgDesc := flag.String("org-desc", "", "Description of org")
|
||||
|
||||
oae := flag.String("admin-email", "", "Email of org admin")
|
||||
|
||||
Reference in New Issue
Block a user