76 lines
3.1 KiB
Python
76 lines
3.1 KiB
Python
from __future__ import annotations
|
|
|
|
import importlib
|
|
|
|
import pytest
|
|
|
|
CANARY_PASSWORD = "password-canary-4dd52a"
|
|
CANARY_SECRET = "secret-canary-9a73ce"
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_password_hash_secret_and_token_are_never_disclosed(app_client) -> None:
|
|
client, settings = app_client
|
|
setup = await client.post(
|
|
"/api/v2/setup", json={"username": "admin", "password": CANARY_PASSWORD}
|
|
)
|
|
assert setup.status_code == 201
|
|
csrf = client.cookies["backup_tool_csrf"]
|
|
secret = await client.post(
|
|
"/api/v2/admin/secrets",
|
|
json={"purpose": "database", "value": CANARY_SECRET},
|
|
headers={"X-CSRF-Token": csrf},
|
|
)
|
|
assert secret.status_code == 201
|
|
token_response = await client.post(
|
|
"/api/v2/auth/tokens",
|
|
json={"scopes": ["audit:read"], "expires_at": None},
|
|
headers={"X-CSRF-Token": csrf, "Idempotency-Key": "canary-token"},
|
|
)
|
|
token = token_response.json()["token"]
|
|
|
|
responses = [
|
|
setup,
|
|
secret,
|
|
await client.get("/api/v2/auth/session"),
|
|
await client.get("/api/v2/admin/secrets"),
|
|
await client.get("/api/v2/audit", params={"limit": 100}),
|
|
await client.get("/openapi.json"),
|
|
]
|
|
combined = "\n".join(response.text for response in responses)
|
|
assert CANARY_PASSWORD not in combined
|
|
assert CANARY_SECRET not in combined
|
|
assert token not in combined
|
|
|
|
models = importlib.import_module("backup_tool.db.models")
|
|
engine_module = importlib.import_module("backup_tool.db.engine")
|
|
sqlalchemy = importlib.import_module("sqlalchemy")
|
|
async_sessionmaker = importlib.import_module("sqlalchemy.ext.asyncio").async_sessionmaker
|
|
engine = engine_module.create_engine(settings)
|
|
sessions = async_sessionmaker(engine, expire_on_commit=False)
|
|
try:
|
|
async with sessions() as session:
|
|
user = await session.scalar(sqlalchemy.select(models.User))
|
|
stored_secret = await session.scalar(sqlalchemy.select(models.Secret))
|
|
stored_token = await session.scalar(sqlalchemy.select(models.ApiToken))
|
|
audits = list((await session.scalars(sqlalchemy.select(models.AuditEvent))).all())
|
|
assert user is not None and user.password_hash != CANARY_PASSWORD
|
|
assert user.password_hash.startswith("$argon2id$")
|
|
assert stored_secret is not None and CANARY_SECRET.encode() not in stored_secret.ciphertext
|
|
assert stored_token is not None and stored_token.token_hash != token
|
|
assert all(CANARY_PASSWORD not in str(audit.details) for audit in audits)
|
|
assert all(CANARY_SECRET not in str(audit.details) for audit in audits)
|
|
assert all(token not in str(audit.details) for audit in audits)
|
|
finally:
|
|
await engine.dispose()
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_master_key_file_never_appears_in_problem_detail(app_client) -> None:
|
|
client, settings = app_client
|
|
response = await client.post(
|
|
"/api/v2/auth/login", json={"username": "missing", "password": "bad"}
|
|
)
|
|
assert response.status_code == 401
|
|
assert str(settings.master_key_file) not in response.text
|