2019-03-30 07:23:56 +00:00
|
|
|
# frozen_string_literal: true
|
|
|
|
|
2018-11-14 13:58:11 +00:00
|
|
|
require 'spec_helper'
|
|
|
|
|
2020-06-24 18:09:03 +00:00
|
|
|
RSpec.describe TokenAuthenticatableStrategies::Encrypted do
|
2018-11-14 13:58:11 +00:00
|
|
|
let(:model) { double(:model) }
|
2018-11-14 14:24:00 +00:00
|
|
|
let(:instance) { double(:instance) }
|
2018-11-14 13:58:11 +00:00
|
|
|
|
2018-11-14 14:24:00 +00:00
|
|
|
let(:encrypted) do
|
2021-04-16 09:09:16 +00:00
|
|
|
TokenAuthenticatableStrategies::EncryptionHelper.encrypt_token('my-value')
|
|
|
|
end
|
|
|
|
|
|
|
|
let(:encrypted_with_static_iv) do
|
2018-11-14 14:24:00 +00:00
|
|
|
Gitlab::CryptoHelper.aes256_gcm_encrypt('my-value')
|
|
|
|
end
|
|
|
|
|
2018-11-14 13:58:11 +00:00
|
|
|
subject do
|
|
|
|
described_class.new(model, 'some_field', options)
|
|
|
|
end
|
|
|
|
|
|
|
|
describe '#find_token_authenticatable' do
|
2021-04-16 09:09:16 +00:00
|
|
|
context 'when encryption is required' do
|
|
|
|
let(:options) { { encrypted: :required } }
|
|
|
|
|
|
|
|
it 'finds the encrypted resource by cleartext' do
|
|
|
|
allow(model).to receive(:find_by)
|
|
|
|
.with('some_field_encrypted' => [encrypted, encrypted_with_static_iv])
|
|
|
|
.and_return('encrypted resource')
|
|
|
|
|
|
|
|
expect(subject.find_token_authenticatable('my-value'))
|
|
|
|
.to eq 'encrypted resource'
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
context 'when encryption is optional' do
|
2019-03-06 12:18:53 +00:00
|
|
|
let(:options) { { encrypted: :optional } }
|
2018-12-03 11:35:49 +00:00
|
|
|
|
|
|
|
it 'finds the encrypted resource by cleartext' do
|
|
|
|
allow(model).to receive(:find_by)
|
2021-04-16 09:09:16 +00:00
|
|
|
.with('some_field_encrypted' => [encrypted, encrypted_with_static_iv])
|
2018-12-03 11:35:49 +00:00
|
|
|
.and_return('encrypted resource')
|
|
|
|
|
|
|
|
expect(subject.find_token_authenticatable('my-value'))
|
|
|
|
.to eq 'encrypted resource'
|
|
|
|
end
|
2018-11-14 14:24:00 +00:00
|
|
|
|
2018-12-03 13:12:51 +00:00
|
|
|
it 'uses insecure strategy when encrypted token cannot be found' do
|
|
|
|
allow(subject.send(:insecure_strategy))
|
2018-12-03 11:35:49 +00:00
|
|
|
.to receive(:find_token_authenticatable)
|
|
|
|
.and_return('plaintext resource')
|
|
|
|
|
|
|
|
allow(model).to receive(:find_by)
|
2021-04-16 09:09:16 +00:00
|
|
|
.with('some_field_encrypted' => [encrypted, encrypted_with_static_iv])
|
2018-12-03 11:35:49 +00:00
|
|
|
.and_return(nil)
|
|
|
|
|
|
|
|
expect(subject.find_token_authenticatable('my-value'))
|
|
|
|
.to eq 'plaintext resource'
|
|
|
|
end
|
2018-11-14 14:24:00 +00:00
|
|
|
end
|
|
|
|
|
2021-04-16 09:09:16 +00:00
|
|
|
context 'when encryption is migrating' do
|
2019-03-06 12:18:53 +00:00
|
|
|
let(:options) { { encrypted: :migrating } }
|
2018-12-03 11:35:49 +00:00
|
|
|
|
|
|
|
it 'finds the cleartext resource by cleartext' do
|
|
|
|
allow(model).to receive(:find_by)
|
|
|
|
.with('some_field' => 'my-value')
|
|
|
|
.and_return('cleartext resource')
|
2018-11-14 14:24:00 +00:00
|
|
|
|
2018-12-03 11:35:49 +00:00
|
|
|
expect(subject.find_token_authenticatable('my-value'))
|
|
|
|
.to eq 'cleartext resource'
|
|
|
|
end
|
2018-11-14 14:24:00 +00:00
|
|
|
|
2018-12-03 11:35:49 +00:00
|
|
|
it 'returns nil if resource cannot be found' do
|
|
|
|
allow(model).to receive(:find_by)
|
|
|
|
.with('some_field' => 'my-value')
|
|
|
|
.and_return(nil)
|
|
|
|
|
|
|
|
expect(subject.find_token_authenticatable('my-value'))
|
|
|
|
.to be_nil
|
|
|
|
end
|
2018-11-14 14:24:00 +00:00
|
|
|
end
|
2018-11-14 13:58:11 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
describe '#get_token' do
|
2021-04-16 09:09:16 +00:00
|
|
|
context 'when encryption is required' do
|
|
|
|
let(:options) { { encrypted: :required } }
|
|
|
|
|
|
|
|
it 'returns decrypted token when an encrypted with static iv token is present' do
|
|
|
|
allow(instance).to receive(:read_attribute)
|
|
|
|
.with('some_field_encrypted')
|
|
|
|
.and_return(Gitlab::CryptoHelper.aes256_gcm_encrypt('my-test-value'))
|
|
|
|
|
|
|
|
expect(subject.get_token(instance)).to eq 'my-test-value'
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'returns decrypted token when an encrypted token is present' do
|
|
|
|
allow(instance).to receive(:read_attribute)
|
|
|
|
.with('some_field_encrypted')
|
|
|
|
.and_return(encrypted)
|
|
|
|
|
|
|
|
expect(subject.get_token(instance)).to eq 'my-value'
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
context 'when encryption is optional' do
|
2019-03-06 12:18:53 +00:00
|
|
|
let(:options) { { encrypted: :optional } }
|
2018-12-03 11:35:49 +00:00
|
|
|
|
|
|
|
it 'returns decrypted token when an encrypted token is present' do
|
|
|
|
allow(instance).to receive(:read_attribute)
|
|
|
|
.with('some_field_encrypted')
|
|
|
|
.and_return(encrypted)
|
|
|
|
|
|
|
|
expect(subject.get_token(instance)).to eq 'my-value'
|
|
|
|
end
|
2018-11-14 14:24:00 +00:00
|
|
|
|
2021-04-16 09:09:16 +00:00
|
|
|
it 'returns decrypted token when an encrypted with static iv token is present' do
|
|
|
|
allow(instance).to receive(:read_attribute)
|
|
|
|
.with('some_field_encrypted')
|
|
|
|
.and_return(Gitlab::CryptoHelper.aes256_gcm_encrypt('my-test-value'))
|
|
|
|
|
|
|
|
expect(subject.get_token(instance)).to eq 'my-test-value'
|
|
|
|
end
|
|
|
|
|
2018-12-03 11:35:49 +00:00
|
|
|
it 'returns the plaintext token when encrypted token is not present' do
|
|
|
|
allow(instance).to receive(:read_attribute)
|
|
|
|
.with('some_field_encrypted')
|
|
|
|
.and_return(nil)
|
|
|
|
|
|
|
|
allow(instance).to receive(:read_attribute)
|
|
|
|
.with('some_field')
|
|
|
|
.and_return('cleartext value')
|
|
|
|
|
|
|
|
expect(subject.get_token(instance)).to eq 'cleartext value'
|
|
|
|
end
|
2018-11-14 14:24:00 +00:00
|
|
|
end
|
|
|
|
|
2021-04-16 09:09:16 +00:00
|
|
|
context 'when encryption is migrating' do
|
2019-03-06 12:18:53 +00:00
|
|
|
let(:options) { { encrypted: :migrating } }
|
2018-12-03 11:35:49 +00:00
|
|
|
|
|
|
|
it 'returns cleartext token when an encrypted token is present' do
|
|
|
|
allow(instance).to receive(:read_attribute)
|
|
|
|
.with('some_field_encrypted')
|
|
|
|
.and_return(encrypted)
|
|
|
|
|
|
|
|
allow(instance).to receive(:read_attribute)
|
|
|
|
.with('some_field')
|
|
|
|
.and_return('my-cleartext-value')
|
|
|
|
|
|
|
|
expect(subject.get_token(instance)).to eq 'my-cleartext-value'
|
|
|
|
end
|
|
|
|
|
|
|
|
it 'returns the cleartext token when encrypted token is not present' do
|
|
|
|
allow(instance).to receive(:read_attribute)
|
|
|
|
.with('some_field_encrypted')
|
|
|
|
.and_return(nil)
|
2018-11-14 14:24:00 +00:00
|
|
|
|
2018-12-03 11:35:49 +00:00
|
|
|
allow(instance).to receive(:read_attribute)
|
|
|
|
.with('some_field')
|
|
|
|
.and_return('cleartext value')
|
2018-11-14 14:24:00 +00:00
|
|
|
|
2018-12-03 11:35:49 +00:00
|
|
|
expect(subject.get_token(instance)).to eq 'cleartext value'
|
|
|
|
end
|
2018-11-14 14:24:00 +00:00
|
|
|
end
|
2018-11-14 13:58:11 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
describe '#set_token' do
|
2021-04-16 09:09:16 +00:00
|
|
|
context 'when encryption is required' do
|
|
|
|
let(:options) { { encrypted: :required } }
|
|
|
|
|
|
|
|
it 'writes encrypted token and returns it' do
|
|
|
|
expect(instance).to receive(:[]=)
|
|
|
|
.with('some_field_encrypted', encrypted)
|
|
|
|
|
|
|
|
expect(subject.set_token(instance, 'my-value')).to eq 'my-value'
|
|
|
|
end
|
|
|
|
end
|
|
|
|
context 'when encryption is optional' do
|
2019-03-06 12:18:53 +00:00
|
|
|
let(:options) { { encrypted: :optional } }
|
2018-12-03 11:35:49 +00:00
|
|
|
|
|
|
|
it 'writes encrypted token and removes plaintext token and returns it' do
|
|
|
|
expect(instance).to receive(:[]=)
|
2021-04-16 09:09:16 +00:00
|
|
|
.with('some_field_encrypted', encrypted)
|
2018-12-03 11:35:49 +00:00
|
|
|
expect(instance).to receive(:[]=)
|
|
|
|
.with('some_field', nil)
|
|
|
|
|
|
|
|
expect(subject.set_token(instance, 'my-value')).to eq 'my-value'
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2021-04-16 09:09:16 +00:00
|
|
|
context 'when encryption is migrating' do
|
2019-03-06 12:18:53 +00:00
|
|
|
let(:options) { { encrypted: :migrating } }
|
2018-12-03 11:35:49 +00:00
|
|
|
|
|
|
|
it 'writes encrypted token and writes plaintext token' do
|
|
|
|
expect(instance).to receive(:[]=)
|
2021-04-16 09:09:16 +00:00
|
|
|
.with('some_field_encrypted', encrypted)
|
2018-12-03 11:35:49 +00:00
|
|
|
expect(instance).to receive(:[]=)
|
|
|
|
.with('some_field', 'my-value')
|
2018-11-14 14:24:00 +00:00
|
|
|
|
2018-12-03 11:35:49 +00:00
|
|
|
expect(subject.set_token(instance, 'my-value')).to eq 'my-value'
|
|
|
|
end
|
2018-11-14 14:24:00 +00:00
|
|
|
end
|
2018-11-14 13:58:11 +00:00
|
|
|
end
|
|
|
|
end
|