Nico
edf4a45df9
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves: N/A # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Updated host deletion behavior to return consistent “not found” responses when the host doesn’t exist or isn’t visible to the requester. * Prevented out-of-scope delete attempts from disclosing whether the target host exists (now returns “not found” instead of “forbidden”). * Preserved “forbidden” errors when the host is visible but the requester lacks delete permission. * **Tests** * Added/updated authorization and deletion coverage to verify the new response-masking behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
55 lines
2.4 KiB
Go
55 lines
2.4 KiB
Go
package authz
|
|
|
|
import (
|
|
"errors"
|
|
"testing"
|
|
|
|
"github.com/fleetdm/fleet/v4/server/fleet"
|
|
"github.com/fleetdm/fleet/v4/server/test"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestAuthorizeOrNotFound(t *testing.T) {
|
|
notFoundErr := errors.New("not found sentinel")
|
|
teamHost := &fleet.Host{TeamID: new(uint(1))}
|
|
|
|
t.Run("write allowed", func(t *testing.T) {
|
|
ctx := test.UserContext(t.Context(), &fleet.User{Teams: []fleet.UserTeam{{Team: fleet.Team{ID: 1}, Role: fleet.RoleAdmin}}})
|
|
err := auth.AuthorizeOrNotFound(ctx, teamHost, fleet.ActionWrite, teamHost, notFoundErr)
|
|
require.NoError(t, err)
|
|
})
|
|
|
|
t.Run("write denied but read allowed returns the write error, not masked", func(t *testing.T) {
|
|
// A team observer can read the host but can't write it: this is not
|
|
// an existence oracle (the caller already knows the host exists), so
|
|
// the real Forbidden should surface, not notFoundErr.
|
|
ctx := test.UserContext(t.Context(), &fleet.User{Teams: []fleet.UserTeam{{Team: fleet.Team{ID: 1}, Role: fleet.RoleObserver}}})
|
|
err := auth.AuthorizeOrNotFound(ctx, teamHost, fleet.ActionWrite, teamHost, notFoundErr)
|
|
require.Error(t, err)
|
|
require.NotErrorIs(t, err, notFoundErr)
|
|
var forbidden *Forbidden
|
|
require.ErrorAs(t, err, &forbidden)
|
|
})
|
|
|
|
t.Run("write denied and read denied masks as notFoundErr", func(t *testing.T) {
|
|
// A caller with no relationship to the host's team can't read or
|
|
// write it: masking as notFoundErr prevents them from learning the
|
|
// host exists on some other team via a distinguishable Forbidden.
|
|
ctx := test.UserContext(t.Context(), &fleet.User{Teams: []fleet.UserTeam{{Team: fleet.Team{ID: 2}, Role: fleet.RoleObserver}}})
|
|
err := auth.AuthorizeOrNotFound(ctx, teamHost, fleet.ActionWrite, teamHost, notFoundErr)
|
|
require.Error(t, err)
|
|
require.ErrorIs(t, err, notFoundErr)
|
|
})
|
|
|
|
t.Run("nil notFoundErr never fails open", func(t *testing.T) {
|
|
// A caller misusing this helper by passing a nil notFoundErr must
|
|
// never get nil (success) back for a caller who can neither read nor
|
|
// write the resource: that would silently bypass authorization.
|
|
ctx := test.UserContext(t.Context(), &fleet.User{Teams: []fleet.UserTeam{{Team: fleet.Team{ID: 2}, Role: fleet.RoleObserver}}})
|
|
err := auth.AuthorizeOrNotFound(ctx, teamHost, fleet.ActionWrite, teamHost, nil)
|
|
require.Error(t, err)
|
|
var forbidden *Forbidden
|
|
require.ErrorAs(t, err, &forbidden)
|
|
})
|
|
}
|