mirror of
https://github.com/shankar0123/certctl.git
synced 2026-06-07 17:12:04 +00:00
shankar0123
7ff2e2de08
Phase 3.5 atomic conversion. The five legacy admin-gated handlers (bulk_revocation, admin_crl_cache, admin_scep_intune, admin_est, intermediate_ca) had their in-body auth.IsAdmin checks removed; the gate moved to router.go via auth.RequirePermission middleware wrapping each route. Non-admin operators with the right scoped permission can now reach these endpoints; legacy in-body admin checks no longer block them.
Migration 000030_rbac_admin_perms.up.sql ships five admin-only fine-grained permissions: cert.bulk_revoke, crl.admin, scep.admin, est.admin, ca.hierarchy.manage. All five are seeded into r-admin only; operator/viewer/agent/mcp/cli/auditor do not receive them by default. Operators can grant any of these to a custom role via the Phase 4 RBAC API. Idempotent + transaction-wrapped.
internal/domain/auth/validate.go::CanonicalPermissions extended with the five new entries so RoleService.AddPermission accepts them.
internal/api/router/router.go: HandlerRegistry gains a Checker field (auth.PermissionChecker). New rbacGate(checker, perm, handler) helper wraps a handler with auth.RequirePermission middleware; nil-checker fall-through preserves test/demo deployments without the RBAC stack. 12 admin routes wrapped: cert.bulk_revoke (POST /api/v1/certificates/bulk-revoke + POST /api/v1/est/certificates/bulk-revoke), crl.admin (GET /api/v1/admin/crl/cache), scep.admin (GET /api/v1/admin/scep/profiles + GET /api/v1/admin/scep/intune/stats + POST /api/v1/admin/scep/intune/reload-trust), est.admin (GET /api/v1/admin/est/profiles + POST /api/v1/admin/est/reload-trust), ca.hierarchy.manage (POST /api/v1/issuers/{id}/intermediates + GET /api/v1/issuers/{id}/intermediates + POST /api/v1/intermediates/{id}/retire + GET /api/v1/intermediates/{id}).
cmd/server/main.go: HandlerRegistry.Checker wired with the same authPermissionCheckerAdapter shim Phase 4 introduced for AuthHandler. Same adapter; one source of truth.
Handler bodies: removed eight in-body auth.IsAdmin checks across the 5 files. bulk_revocation.go's BulkRevoke + BulkRevokeEST, admin_crl_cache.go::ListCache, admin_scep_intune.go's three methods, admin_est.go's two methods, intermediate_ca.go's four methods. Replaced each with a comment naming the new gate location. Unused 'github.com/certctl-io/certctl/internal/auth' imports removed.
Test triplet rewrite: deleted obsolete _NonAdmin_Returns403 and _AdminExplicitFalse_Returns403 tests across 6 test files (5 handler tests + bulk_revocation_est_test.go) — they tested the now-removed in-body gate. _AdminPermitted_ForwardsActor tests stay intact: they pin the actor-passthrough invariant which is still relevant. Added internal/api/router/rbac_gate_integration_test.go with four router-level integration tests pinning the new gate: deny → 403 + handler not reached, permit → 200 + handler reached, nil-checker → fall-through, no-actor → 401.
M-008 admin-gate registry: AdminGatedHandlers map now empty (Phase 3.5 invariant: zero in-handler auth.IsAdmin call sites; only health.go's informational caller remains). m008_admin_gate_test.go retains the scan to enforce the invariant going forward; new admin-gated routes must wrap at router.go::rbacGate, not gate in-handler. Updated error message to direct future contributors to the new pattern.
Verifications: gofmt clean across all touched files; go vet ./... clean; go test -short across internal/auth, internal/service/auth, internal/api/handler, internal/api/router, cmd/server all green.
Branch: dev/auth-bundle-1. Commit chain: 99a012e (Phase 0 extract) -> 19497ee (Phase 1 schema + repo) -> bd54d5f (Phase 2 service) -> d473398 (Phase 3 primitive) -> b169f25 (Phase 4 + 5) -> THIS (Phase 3.5 conversion). Phase 6+ (bootstrap, scope-down, auditor, approval-bypass closure, GUI, docs) on subsequent sessions.
94 lines
3.5 KiB
Go
94 lines
3.5 KiB
Go
package handler
|
|
|
|
import (
|
|
"bytes"
|
|
"context"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
|
|
"github.com/certctl-io/certctl/internal/domain"
|
|
)
|
|
|
|
// EST RFC 7030 hardening master bundle Phase 11.4 — BulkRevokeEST handler tests.
|
|
// Mirror the BulkRevoke pattern in bulk_revocation_handler_test.go but pin
|
|
// the EST-source-scoping contract (criteria.Source MUST be set to EST + the
|
|
// safety-guard that rejects narrower-criterion-empty requests fires
|
|
// regardless of Source).
|
|
|
|
func TestBulkRevokeEST_AdminTrue_PinsSourceToEST(t *testing.T) {
|
|
var capturedSource domain.CertificateSource
|
|
svc := &mockBulkRevocationService{
|
|
BulkRevokeFn: func(_ context.Context, criteria domain.BulkRevocationCriteria, _ string, _ string) (*domain.BulkRevocationResult, error) {
|
|
capturedSource = criteria.Source
|
|
return &domain.BulkRevocationResult{TotalMatched: 1, TotalRevoked: 1}, nil
|
|
},
|
|
}
|
|
h := NewBulkRevocationHandler(svc)
|
|
body := `{"reason":"keyCompromise","profile_id":"prof-iot"}`
|
|
req := httptest.NewRequest(http.MethodPost,
|
|
"/api/v1/est/certificates/bulk-revoke", bytes.NewBufferString(body))
|
|
req.Header.Set("Content-Type", "application/json")
|
|
req = req.WithContext(adminContext())
|
|
w := httptest.NewRecorder()
|
|
h.BulkRevokeEST(w, req)
|
|
if w.Code != http.StatusOK {
|
|
t.Fatalf("status = %d, want 200; body=%q", w.Code, w.Body.String())
|
|
}
|
|
if capturedSource != domain.CertificateSourceEST {
|
|
t.Errorf("Source = %q, want %q (handler must pin)", capturedSource, domain.CertificateSourceEST)
|
|
}
|
|
}
|
|
|
|
// TestBulkRevokeEST_NonAdmin_Returns403 was deleted as part of Bundle 1
|
|
// Phase 3.5: the in-handler auth.IsAdmin gate moved to router.go via
|
|
// auth.RequirePermission(checker, "cert.bulk_revoke", nil). The
|
|
// non-admin rejection is now exercised by the router-level integration
|
|
// suite (internal/api/router/rbac_gate_integration_test.go) rather
|
|
// than by a direct-handler test that bypasses middleware.
|
|
|
|
func TestBulkRevokeEST_EmptyCriteria_400(t *testing.T) {
|
|
svc := &mockBulkRevocationService{}
|
|
h := NewBulkRevocationHandler(svc)
|
|
body := `{"reason":"keyCompromise"}` // no narrower criterion
|
|
req := httptest.NewRequest(http.MethodPost,
|
|
"/api/v1/est/certificates/bulk-revoke", bytes.NewBufferString(body))
|
|
req.Header.Set("Content-Type", "application/json")
|
|
req = req.WithContext(adminContext())
|
|
w := httptest.NewRecorder()
|
|
h.BulkRevokeEST(w, req)
|
|
if w.Code != http.StatusBadRequest {
|
|
t.Errorf("empty-criterion status = %d, want 400", w.Code)
|
|
}
|
|
if !strings.Contains(w.Body.String(), "criterion") {
|
|
t.Errorf("error body should mention criterion; got %q", w.Body.String())
|
|
}
|
|
}
|
|
|
|
func TestBulkRevokeEST_InvalidReason_400(t *testing.T) {
|
|
svc := &mockBulkRevocationService{}
|
|
h := NewBulkRevocationHandler(svc)
|
|
body := `{"reason":"not-a-valid-reason","profile_id":"prof-iot"}`
|
|
req := httptest.NewRequest(http.MethodPost,
|
|
"/api/v1/est/certificates/bulk-revoke", bytes.NewBufferString(body))
|
|
req.Header.Set("Content-Type", "application/json")
|
|
req = req.WithContext(adminContext())
|
|
w := httptest.NewRecorder()
|
|
h.BulkRevokeEST(w, req)
|
|
if w.Code != http.StatusBadRequest {
|
|
t.Errorf("invalid-reason status = %d, want 400", w.Code)
|
|
}
|
|
}
|
|
|
|
func TestBulkRevokeEST_MethodNotAllowed(t *testing.T) {
|
|
svc := &mockBulkRevocationService{}
|
|
h := NewBulkRevocationHandler(svc)
|
|
req := httptest.NewRequest(http.MethodGet, "/api/v1/est/certificates/bulk-revoke", nil)
|
|
w := httptest.NewRecorder()
|
|
h.BulkRevokeEST(w, req)
|
|
if w.Code != http.StatusMethodNotAllowed {
|
|
t.Errorf("GET against POST-only endpoint status = %d, want 405", w.Code)
|
|
}
|
|
}
|