Skip to content

Commit 9847899

Browse files
namedgraphnamedgraph
committed
New ACL tests for system endpoints
1 parent b9a6aea commit 9847899

36 files changed

Lines changed: 852 additions & 0 deletions

‎http-tests/system/admin/POST-clear-401.sh‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
initialize_dataset "$END_USER_BASE_URL" "$TMP_END_USER_DATASET" "$END_USER_ENDPOINT_URL"
5+
initialize_dataset "$ADMIN_BASE_URL" "$TMP_ADMIN_DATASET" "$ADMIN_ENDPOINT_URL"
6+
purge_cache "$END_USER_VARNISH_SERVICE"
7+
purge_cache "$ADMIN_VARNISH_SERVICE"
8+
purge_cache "$FRONTEND_VARNISH_SERVICE"
9+
10+
# POST /clear without a certificate should return 401
11+
# Only owners have access to /clear via full-control authorization in admin.trig
12+
13+
curl -k -w "%{http_code}\n" -o /dev/null -s \
14+
-X POST \
15+
-H "Content-Type: application/x-www-form-urlencoded" \
16+
--data-urlencode "uri=${END_USER_BASE_URL}ns#" \
17+
"${ADMIN_BASE_URL}clear" \
18+
| grep -q "$STATUS_UNAUTHORIZED"

‎http-tests/system/admin/POST-clear-403.sh‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
initialize_dataset "$END_USER_BASE_URL" "$TMP_END_USER_DATASET" "$END_USER_ENDPOINT_URL"
5+
initialize_dataset "$ADMIN_BASE_URL" "$TMP_ADMIN_DATASET" "$ADMIN_ENDPOINT_URL"
6+
purge_cache "$END_USER_VARNISH_SERVICE"
7+
purge_cache "$ADMIN_VARNISH_SERVICE"
8+
purge_cache "$FRONTEND_VARNISH_SERVICE"
9+
10+
# POST /clear with a writer (not owner) should return 403
11+
# /clear is only in the full-control authorization which is restricted to owners
12+
13+
add-agent-to-group.sh \
14+
-f "$OWNER_CERT_FILE" \
15+
-p "$OWNER_CERT_PWD" \
16+
--agent "$AGENT_URI" \
17+
"${ADMIN_BASE_URL}acl/groups/writers/"
18+
19+
curl -k -w "%{http_code}\n" -o /dev/null -s \
20+
-E "$AGENT_CERT_FILE":"$AGENT_CERT_PWD" \
21+
-X POST \
22+
-H "Content-Type: application/x-www-form-urlencoded" \
23+
--data-urlencode "uri=${END_USER_BASE_URL}ns#" \
24+
"${ADMIN_BASE_URL}clear" \
25+
| grep -q "$STATUS_FORBIDDEN"

‎http-tests/system/admin/POST-clear-readers-403.sh‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
initialize_dataset "$END_USER_BASE_URL" "$TMP_END_USER_DATASET" "$END_USER_ENDPOINT_URL"
5+
initialize_dataset "$ADMIN_BASE_URL" "$TMP_ADMIN_DATASET" "$ADMIN_ENDPOINT_URL"
6+
purge_cache "$END_USER_VARNISH_SERVICE"
7+
purge_cache "$ADMIN_VARNISH_SERVICE"
8+
purge_cache "$FRONTEND_VARNISH_SERVICE"
9+
10+
# POST /clear with a reader should return 403
11+
# /clear is only in the full-control authorization which is restricted to owners
12+
13+
add-agent-to-group.sh \
14+
-f "$OWNER_CERT_FILE" \
15+
-p "$OWNER_CERT_PWD" \
16+
--agent "$AGENT_URI" \
17+
"${ADMIN_BASE_URL}acl/groups/readers/"
18+
19+
curl -k -w "%{http_code}\n" -o /dev/null -s \
20+
-E "$AGENT_CERT_FILE":"$AGENT_CERT_PWD" \
21+
-X POST \
22+
-H "Content-Type: application/x-www-form-urlencoded" \
23+
--data-urlencode "uri=${END_USER_BASE_URL}ns#" \
24+
"${ADMIN_BASE_URL}clear" \
25+
| grep -q "$STATUS_FORBIDDEN"

‎http-tests/system/admin/POST-clear.sh‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
initialize_dataset "$END_USER_BASE_URL" "$TMP_END_USER_DATASET" "$END_USER_ENDPOINT_URL"
5+
initialize_dataset "$ADMIN_BASE_URL" "$TMP_ADMIN_DATASET" "$ADMIN_ENDPOINT_URL"
6+
purge_cache "$END_USER_VARNISH_SERVICE"
7+
purge_cache "$ADMIN_VARNISH_SERVICE"
8+
purge_cache "$FRONTEND_VARNISH_SERVICE"
9+
10+
# POST /clear with owner should succeed
11+
# Owner POSTs the end-user namespace ontology URI to clear it from memory (reload on next request)
12+
13+
curl -k -w "%{http_code}\n" -o /dev/null -s \
14+
-E "$OWNER_CERT_FILE":"$OWNER_CERT_PWD" \
15+
-H "Accept: text/turtle" \
16+
-H "Content-Type: application/x-www-form-urlencoded" \
17+
--data-urlencode "uri=${END_USER_BASE_URL}ns#" \
18+
"${ADMIN_BASE_URL}clear" \
19+
| grep -qE "^($STATUS_OK|$STATUS_NO_CONTENT)$"

‎http-tests/system/admin/POST-packages-install-401.sh‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
initialize_dataset "$END_USER_BASE_URL" "$TMP_END_USER_DATASET" "$END_USER_ENDPOINT_URL"
5+
initialize_dataset "$ADMIN_BASE_URL" "$TMP_ADMIN_DATASET" "$ADMIN_ENDPOINT_URL"
6+
purge_cache "$END_USER_VARNISH_SERVICE"
7+
purge_cache "$ADMIN_VARNISH_SERVICE"
8+
purge_cache "$FRONTEND_VARNISH_SERVICE"
9+
10+
# POST /packages/install without a certificate should return 401
11+
# Only owners have access to /packages/install via full-control authorization in admin.trig
12+
13+
curl -k -w "%{http_code}\n" -o /dev/null -s \
14+
-X POST \
15+
-H "Content-Type: application/x-www-form-urlencoded" \
16+
--data-urlencode "package-uri=https://packages.linkeddatahub.com/skos/#this" \
17+
"${ADMIN_BASE_URL}packages/install" \
18+
| grep -q "$STATUS_UNAUTHORIZED"

‎http-tests/system/admin/POST-packages-install-403.sh‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
initialize_dataset "$END_USER_BASE_URL" "$TMP_END_USER_DATASET" "$END_USER_ENDPOINT_URL"
5+
initialize_dataset "$ADMIN_BASE_URL" "$TMP_ADMIN_DATASET" "$ADMIN_ENDPOINT_URL"
6+
purge_cache "$END_USER_VARNISH_SERVICE"
7+
purge_cache "$ADMIN_VARNISH_SERVICE"
8+
purge_cache "$FRONTEND_VARNISH_SERVICE"
9+
10+
# POST /packages/install with a writer (not owner) should return 403
11+
# /packages/install is only in the full-control authorization which is restricted to owners
12+
13+
add-agent-to-group.sh \
14+
-f "$OWNER_CERT_FILE" \
15+
-p "$OWNER_CERT_PWD" \
16+
--agent "$AGENT_URI" \
17+
"${ADMIN_BASE_URL}acl/groups/writers/"
18+
19+
curl -k -w "%{http_code}\n" -o /dev/null -s \
20+
-E "$AGENT_CERT_FILE":"$AGENT_CERT_PWD" \
21+
-X POST \
22+
-H "Content-Type: application/x-www-form-urlencoded" \
23+
--data-urlencode "package-uri=https://packages.linkeddatahub.com/skos/#this" \
24+
"${ADMIN_BASE_URL}packages/install" \
25+
| grep -q "$STATUS_FORBIDDEN"

‎http-tests/system/admin/POST-packages-install-readers-403.sh‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
initialize_dataset "$END_USER_BASE_URL" "$TMP_END_USER_DATASET" "$END_USER_ENDPOINT_URL"
5+
initialize_dataset "$ADMIN_BASE_URL" "$TMP_ADMIN_DATASET" "$ADMIN_ENDPOINT_URL"
6+
purge_cache "$END_USER_VARNISH_SERVICE"
7+
purge_cache "$ADMIN_VARNISH_SERVICE"
8+
purge_cache "$FRONTEND_VARNISH_SERVICE"
9+
10+
# POST /packages/install with a reader should return 403
11+
# /packages/install is only in the full-control authorization which is restricted to owners
12+
13+
add-agent-to-group.sh \
14+
-f "$OWNER_CERT_FILE" \
15+
-p "$OWNER_CERT_PWD" \
16+
--agent "$AGENT_URI" \
17+
"${ADMIN_BASE_URL}acl/groups/readers/"
18+
19+
curl -k -w "%{http_code}\n" -o /dev/null -s \
20+
-E "$AGENT_CERT_FILE":"$AGENT_CERT_PWD" \
21+
-X POST \
22+
-H "Content-Type: application/x-www-form-urlencoded" \
23+
--data-urlencode "package-uri=https://packages.linkeddatahub.com/skos/#this" \
24+
"${ADMIN_BASE_URL}packages/install" \
25+
| grep -q "$STATUS_FORBIDDEN"

‎http-tests/system/admin/POST-packages-uninstall-401.sh‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
initialize_dataset "$END_USER_BASE_URL" "$TMP_END_USER_DATASET" "$END_USER_ENDPOINT_URL"
5+
initialize_dataset "$ADMIN_BASE_URL" "$TMP_ADMIN_DATASET" "$ADMIN_ENDPOINT_URL"
6+
purge_cache "$END_USER_VARNISH_SERVICE"
7+
purge_cache "$ADMIN_VARNISH_SERVICE"
8+
purge_cache "$FRONTEND_VARNISH_SERVICE"
9+
10+
# POST /packages/uninstall without a certificate should return 401
11+
# Only owners have access to /packages/uninstall via full-control authorization in admin.trig
12+
13+
curl -k -w "%{http_code}\n" -o /dev/null -s \
14+
-X POST \
15+
-H "Content-Type: application/x-www-form-urlencoded" \
16+
--data-urlencode "package-uri=https://packages.linkeddatahub.com/skos/#this" \
17+
"${ADMIN_BASE_URL}packages/uninstall" \
18+
| grep -q "$STATUS_UNAUTHORIZED"

‎http-tests/system/admin/POST-packages-uninstall-403.sh‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
initialize_dataset "$END_USER_BASE_URL" "$TMP_END_USER_DATASET" "$END_USER_ENDPOINT_URL"
5+
initialize_dataset "$ADMIN_BASE_URL" "$TMP_ADMIN_DATASET" "$ADMIN_ENDPOINT_URL"
6+
purge_cache "$END_USER_VARNISH_SERVICE"
7+
purge_cache "$ADMIN_VARNISH_SERVICE"
8+
purge_cache "$FRONTEND_VARNISH_SERVICE"
9+
10+
# POST /packages/uninstall with a writer (not owner) should return 403
11+
# /packages/uninstall is only in the full-control authorization which is restricted to owners
12+
13+
add-agent-to-group.sh \
14+
-f "$OWNER_CERT_FILE" \
15+
-p "$OWNER_CERT_PWD" \
16+
--agent "$AGENT_URI" \
17+
"${ADMIN_BASE_URL}acl/groups/writers/"
18+
19+
curl -k -w "%{http_code}\n" -o /dev/null -s \
20+
-E "$AGENT_CERT_FILE":"$AGENT_CERT_PWD" \
21+
-X POST \
22+
-H "Content-Type: application/x-www-form-urlencoded" \
23+
--data-urlencode "package-uri=https://packages.linkeddatahub.com/skos/#this" \
24+
"${ADMIN_BASE_URL}packages/uninstall" \
25+
| grep -q "$STATUS_FORBIDDEN"

‎http-tests/system/admin/POST-packages-uninstall-readers-403.sh‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
initialize_dataset "$END_USER_BASE_URL" "$TMP_END_USER_DATASET" "$END_USER_ENDPOINT_URL"
5+
initialize_dataset "$ADMIN_BASE_URL" "$TMP_ADMIN_DATASET" "$ADMIN_ENDPOINT_URL"
6+
purge_cache "$END_USER_VARNISH_SERVICE"
7+
purge_cache "$ADMIN_VARNISH_SERVICE"
8+
purge_cache "$FRONTEND_VARNISH_SERVICE"
9+
10+
# POST /packages/uninstall with a reader should return 403
11+
# /packages/uninstall is only in the full-control authorization which is restricted to owners
12+
13+
add-agent-to-group.sh \
14+
-f "$OWNER_CERT_FILE" \
15+
-p "$OWNER_CERT_PWD" \
16+
--agent "$AGENT_URI" \
17+
"${ADMIN_BASE_URL}acl/groups/readers/"
18+
19+
curl -k -w "%{http_code}\n" -o /dev/null -s \
20+
-E "$AGENT_CERT_FILE":"$AGENT_CERT_PWD" \
21+
-X POST \
22+
-H "Content-Type: application/x-www-form-urlencoded" \
23+
--data-urlencode "package-uri=https://packages.linkeddatahub.com/skos/#this" \
24+
"${ADMIN_BASE_URL}packages/uninstall" \
25+
| grep -q "$STATUS_FORBIDDEN"

0 commit comments

Comments
 (0)