26 lines
1.7 KiB
Python
26 lines
1.7 KiB
Python
import importlib.util
|
|
from pathlib import Path
|
|
import json
|
|
import unittest
|
|
|
|
p=Path(__file__).resolve().parent/'diagnose_access.py';s=importlib.util.spec_from_file_location('access_probe',p);d=importlib.util.module_from_spec(s);s.loader.exec_module(d)
|
|
|
|
|
|
class Tests(unittest.TestCase):
|
|
def test_authentication_challenge_without_unauthorized_word(self):
|
|
raw=b'could not get API group list: the server has asked for the client to provide credentials PRIVATE_SENTINEL'
|
|
self.assertEqual(d.category(1,raw),'authentication-required')
|
|
def test_categories_do_not_echo_raw_errors(self):
|
|
for raw,expected in [(b'x509: certificate has expired PRIVATE_SENTINEL','certificate-validity-failure'),
|
|
(b'Forbidden PRIVATE_SENTINEL','authorization-denied'),
|
|
(b'connect: connection refused PRIVATE_SENTINEL','connection-refused'),
|
|
(b'PRIVATE_SENTINEL','unclassified-command-failure')]:
|
|
self.assertEqual(d.category(1,raw),expected)
|
|
def test_selected_success_fields_do_not_emit_credentials_or_full_objects(self):
|
|
raw=json.dumps({'items':[{'metadata':{'uid':'expected','annotations':{'unrelated':'PRIVATE_SENTINEL'}},'status':{'addresses':[{'address':'92.205.62.239'}]}}]}).encode()
|
|
self.assertEqual(d.selected_nodes(raw,{'node_uid':'expected'}),{'node_count':1,'target_node_matches':True})
|
|
raw=json.dumps({'status':{'userInfo':{'username':'ops-mason-builder','groups':['PRIVATE_SENTINEL']},'unrelated':'PRIVATE_SENTINEL'}}).encode()
|
|
result=d.selected_identity(raw);self.assertTrue(result['identity_is_builder']);self.assertNotIn('PRIVATE_SENTINEL',json.dumps(result))
|
|
|
|
|
|
if __name__=='__main__':unittest.main()
|