access-engine/internal/callerauth/runtime_rename_test.go

package callerauth

import (
	"context"
	"encoding/json"
	"errors"
	"net/http"
	"net/http/httptest"
	"os"
	"path/filepath"
	"reflect"
	"strings"
	"testing"

	"gopkg.in/yaml.v3"
)

func TestRuntimeRenameEveryInstalledPinBinding(t *testing.T) {
	pins := []string{"ops-warden", "ops-warden-fetch", "secrets-engine", "user-engine", "tenant-engine", "informed-decision-lifecycle", "informed-decision-sitting", "informed-decision-t03", "application-readback"}
	for _, pin := range pins {
		t.Run(pin, func(t *testing.T) {
			data, err := os.ReadFile(filepath.Join("..", "..", "values", pin+".yaml"))
			if err != nil {
				t.Fatal(err)
			}
			var value struct {
				CallerAuth struct {
					Binding string   `yaml:"binding"`
					Extra   []string `yaml:"extraBindings"`
				} `yaml:"callerAuth"`
				Readback struct {
					Caller string `yaml:"caller"`
				} `yaml:"readback"`
			}
			if err := yaml.Unmarshal(data, &value); err != nil {
				t.Fatal(err)
			}
			bindings := map[string]string{}
			for _, entry := range append([]string{value.CallerAuth.Binding}, value.CallerAuth.Extra...) {
				if entry == "" {
					continue
				}
				system, principal, ok := strings.Cut(entry, "=")
				if !ok {
					t.Fatalf("bad binding: %s", entry)
				}
				bindings[system] = principal
			}
			// Readback's bounded authenticated caller is installed by serve-readback,
			// rather than a callerAuth binding flag.
			if value.Readback.Caller != "" {
				bindings["application-readback"] = value.Readback.Caller
			}
			if len(bindings) == 0 {
				t.Fatal("pin has no installed caller mapping")
			}
			for system, principal := range bindings {
				for _, configured := range []string{"flex-auth", "access-engine"} {
					for _, reviewed := range []string{"flex-auth", "access-engine"} {
						a, err := New(ModeEnforce, fakeReviewer{identity: Identity{Username: principal, Audiences: []string{reviewed}}}, configured, bindings, nil)
						if err != nil {
							t.Fatal(err)
						}
						id, err := a.Authorize(context.Background(), "Bearer test-token", []string{system})
						if err != nil {
							t.Fatal(err)
						}
						if got := a.Record(id).Audience; got != reviewed {
							t.Fatalf("provenance %q != reviewed %q", got, reviewed)
						}
						for _, forbidden := range []string{"foreign-consumer", "flex-auth", "access-engine"} {
							if _, err := a.Authorize(context.Background(), "Bearer test-token", []string{forbidden}); !errors.Is(err, ErrForbidden) {
								t.Fatalf("%s accepted as %s: %v", system, forbidden, err)
							}
						}
						wrong, _ := New(ModeEnforce, fakeReviewer{identity: Identity{Username: "other-principal", Audiences: []string{reviewed}}}, configured, bindings, nil)
						if _, err := wrong.Authorize(context.Background(), "Bearer test-token", []string{system}); !errors.Is(err, ErrForbidden) {
							t.Fatalf("wrong principal: %v", err)
						}
					}
				}
			}
		})
	}
}

func TestRuntimeRenameUsesActualTokenReviewAudience(t *testing.T) {
	for _, configured := range []string{"flex-auth", "access-engine", "custom-pdp"} {
		for _, returned := range []string{"flex-auth", "access-engine", "foreign", "custom-pdp", ""} {
			t.Run(configured+"/"+returned, func(t *testing.T) {
				srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
					var request tokenReview
					if err := json.NewDecoder(req.Body).Decode(&request); err != nil {
						t.Error(err)
						return
					}
					if !reflect.DeepEqual(request.Spec.Audiences, runtimeAudiences(configured)) {
						t.Errorf("requested audiences: %v", request.Spec.Audiences)
					}
					response := tokenReview{}
					response.Status.Authenticated = true
					response.Status.User.Username = "principal"
					if returned != "" {
						response.Status.Audiences = []string{returned}
					}
					_ = json.NewEncoder(w).Encode(response)
				}))
				defer srv.Close()
				file := filepath.Join(t.TempDir(), "reviewer")
				if err := os.WriteFile(file, []byte("test-only-reviewer"), 0600); err != nil {
					t.Fatal(err)
				}
				reviewer := &KubernetesTokenReviewer{endpoint: srv.URL, audience: configured, reviewerTokenFile: file, client: srv.Client()}
				a, _ := New(ModeEnforce, reviewer, configured, map[string]string{"consumer": "principal"}, nil)
				// The untrusted token claims the opposite: only authenticated TokenReview
				// response audiences decide admission and provenance.
				token := unsignedJWT(map[string]any{"aud": "foreign", "sub": "forged"})
				id, err := a.Authorize(context.Background(), "Bearer "+token, []string{"consumer"})
				want := contains(runtimeAudiences(configured), returned)
				if want {
					if err != nil {
						t.Fatal(err)
					}
					if a.Record(id).Audience != returned {
						t.Fatal("configured/untrusted audience leaked into provenance")
					}
				} else if !errors.Is(err, ErrUnauthenticated) {
					t.Fatalf("foreign/missing audience accepted: %v", err)
				}
			})
		}
	}
}

func TestRuntimeRenameCustomAudienceAndInputBindingsStayExact(t *testing.T) {
	bindings := map[string]string{"flex-auth": "principal"}
	a, err := New(ModeEnforce, fakeReviewer{identity: Identity{Username: "principal", Audiences: []string{"custom-pdp"}}}, "custom-pdp", bindings, nil)
	if err != nil {
		t.Fatal(err)
	}
	if _, err := a.Authorize(context.Background(), "Bearer test", []string{"access-engine"}); !errors.Is(err, ErrForbidden) {
		t.Fatalf("uninstalled alias binding accepted: %v", err)
	}
	if len(bindings) != 1 {
		t.Fatal("input bindings mutated")
	}
}