mirror of
https://github.com/coollabsio/coolify.git
synced 2026-11-04 10:42:23 +00:00
Andras Bacsai
105584da06
The policies checked the admin role in the session team. A user who was demoted in the owning team could still edit its cloud tokens and cloud-init scripts after switching to a team they administer. View, update and delete now need admin of the resource's team, as for integration tokens.
116 lines
4.5 KiB
PHP
116 lines
4.5 KiB
PHP
<?php
|
|
|
|
use App\Livewire\Security\CloudInitScript\Show as CloudInitScriptShow;
|
|
use App\Livewire\Security\CloudProviderToken\Show as CloudProviderTokenShow;
|
|
use App\Models\CloudInitScript;
|
|
use App\Models\CloudProviderToken;
|
|
use App\Models\InstanceSettings;
|
|
use App\Models\Team;
|
|
use App\Models\User;
|
|
use Illuminate\Foundation\Testing\RefreshDatabase;
|
|
use Illuminate\Support\Facades\Cache;
|
|
use Illuminate\Support\Once;
|
|
use Livewire\Livewire;
|
|
|
|
uses(RefreshDatabase::class);
|
|
|
|
beforeEach(function () {
|
|
$this->withoutDefer();
|
|
if (! InstanceSettings::query()->whereKey(0)->exists()) {
|
|
$settings = new InstanceSettings;
|
|
$settings->id = 0;
|
|
$settings->save();
|
|
}
|
|
Once::flush();
|
|
|
|
$this->resourceTeam = Team::factory()->create();
|
|
$this->otherTeam = Team::factory()->create();
|
|
$this->user = User::factory()->create();
|
|
$this->otherTeam->members()->attach($this->user->id, ['role' => 'owner']);
|
|
|
|
$this->cloudToken = CloudProviderToken::factory()->create([
|
|
'team_id' => $this->resourceTeam->id,
|
|
'name' => 'Production Hetzner',
|
|
]);
|
|
$this->cloudInitScript = CloudInitScript::query()->create([
|
|
'team_id' => $this->resourceTeam->id,
|
|
'name' => 'Bootstrap',
|
|
'script' => "#cloud-config\nruncmd:\n - echo original\n",
|
|
]);
|
|
|
|
$this->actingAs($this->user);
|
|
session(['currentTeam' => $this->otherTeam]);
|
|
});
|
|
|
|
function switchCloudResourcePolicySessionTeam(Team $team): void
|
|
{
|
|
session(['currentTeam' => $team]);
|
|
Cache::flush();
|
|
Once::flush();
|
|
}
|
|
|
|
function setCloudResourcePolicyRole(Team $team, User $user, string $role): void
|
|
{
|
|
$team->members()->syncWithoutDetaching([$user->id => ['role' => $role]]);
|
|
$team->members()->updateExistingPivot($user->id, ['role' => $role]);
|
|
$user->unsetRelation('teams');
|
|
Cache::flush();
|
|
Once::flush();
|
|
}
|
|
|
|
it('lets an admin of the resource team manage cloud resources while the session team is another team', function (string $ability) {
|
|
setCloudResourcePolicyRole($this->resourceTeam, $this->user, 'admin');
|
|
$user = $this->user->fresh();
|
|
|
|
expect($user->can($ability, $this->cloudToken))->toBeTrue()
|
|
->and($user->can($ability, $this->cloudInitScript))->toBeTrue();
|
|
})->with(['view', 'update', 'delete']);
|
|
|
|
it('denies a member of the resource team who owns the session team', function (string $ability) {
|
|
setCloudResourcePolicyRole($this->resourceTeam, $this->user, 'member');
|
|
$user = $this->user->fresh();
|
|
|
|
expect($user->can($ability, $this->cloudToken))->toBeFalse()
|
|
->and($user->can($ability, $this->cloudInitScript))->toBeFalse();
|
|
})->with(['view', 'update', 'delete']);
|
|
|
|
it('denies an outsider even when the session points to the resource team', function (string $ability) {
|
|
switchCloudResourcePolicySessionTeam($this->resourceTeam);
|
|
$user = $this->user->fresh();
|
|
|
|
expect($user->can($ability, $this->cloudToken))->toBeFalse()
|
|
->and($user->can($ability, $this->cloudInitScript))->toBeFalse();
|
|
})->with(['view', 'update', 'delete']);
|
|
|
|
it('blocks a demoted cloud token editor after a session switch to a team they own', function (string $action) {
|
|
setCloudResourcePolicyRole($this->resourceTeam, $this->user, 'admin');
|
|
switchCloudResourcePolicySessionTeam($this->resourceTeam);
|
|
|
|
$component = Livewire::test(CloudProviderTokenShow::class, ['cloud_token_uuid' => $this->cloudToken->uuid]);
|
|
|
|
setCloudResourcePolicyRole($this->resourceTeam, $this->user, 'member');
|
|
switchCloudResourcePolicySessionTeam($this->otherTeam);
|
|
|
|
$component->set('name', 'Hijacked')->call($action)->assertForbidden();
|
|
|
|
$fresh = CloudProviderToken::query()->find($this->cloudToken->id);
|
|
expect($fresh)->not->toBeNull()
|
|
->and($fresh->name)->toBe('Production Hetzner');
|
|
})->with(['save', 'delete']);
|
|
|
|
it('blocks a demoted cloud-init script editor after a session switch to a team they own', function (string $action) {
|
|
setCloudResourcePolicyRole($this->resourceTeam, $this->user, 'admin');
|
|
switchCloudResourcePolicySessionTeam($this->resourceTeam);
|
|
|
|
$component = Livewire::test(CloudInitScriptShow::class, ['cloud_init_script_uuid' => $this->cloudInitScript->uuid]);
|
|
|
|
setCloudResourcePolicyRole($this->resourceTeam, $this->user, 'member');
|
|
switchCloudResourcePolicySessionTeam($this->otherTeam);
|
|
|
|
$component->set('name', 'Hijacked')->call($action)->assertForbidden();
|
|
|
|
$fresh = CloudInitScript::query()->find($this->cloudInitScript->id);
|
|
expect($fresh)->not->toBeNull()
|
|
->and($fresh->name)->toBe('Bootstrap');
|
|
})->with(['save', 'delete']);
|