buckets.test.js

// Copyright 2019 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//      http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

'use strict';

const {Storage} = require('@google-cloud/storage');
const {assert} = require('chai');
const {before, after, afterEach, it} = require('mocha');
const cp = require('child_process');
const uuid = require('uuid');

const execSync = cmd => cp.execSync(cmd, {encoding: 'utf-8'});

const storage = new Storage();
const samplesTestBucketPrefix = `nodejs-storage-samples-${uuid.v4()}`;
const bucketName = `${samplesTestBucketPrefix}-a`;
const defaultKmsKeyName = process.env.GOOGLE_CLOUD_KMS_KEY_ASIA;
const bucket = storage.bucket(bucketName);

before(async () => {
  await storage.createBucket(bucketName);
});

async function deleteAllBucketsAsync() {
  const [buckets] = await storage.getBuckets({prefix: samplesTestBucketPrefix});

  for (const bucket of buckets) {
    await bucket.deleteFiles({force: true});
    await bucket.delete({ignoreNotFound: true});
  }
}

after(deleteAllBucketsAsync);
afterEach(async () => {
  await new Promise(res => setTimeout(res, 1000));
});

it('should set bucket encryption enforcement configuration', async function () {
  if (!defaultKmsKeyName) {
    this.skip();
  }
  const output = execSync(
    `node setBucketEncryptionEnforcementConfig.js ${bucketName} ${defaultKmsKeyName}`
  );

  assert.include(
    output,
    `Encryption enforcement configuration updated for bucket ${bucketName}.`
  );

  assert.include(output, `Default KMS Key: ${defaultKmsKeyName}`);

  assert.include(output, 'Google Managed (GMEK) Enforcement:');
  assert.include(output, 'Mode: FullyRestricted');

  assert.include(output, 'Customer Managed (CMEK) Enforcement:');
  assert.include(output, 'Mode: NotRestricted');

  assert.include(output, 'Customer Supplied (CSEK) Enforcement:');
  assert.include(output, 'Mode: FullyRestricted');

  assert.match(output, new RegExp('Effective:'));

  const [metadata] = await bucket.getMetadata();
  const encryption = metadata.encryption || {};
  assert.strictEqual(
    encryption.googleManagedEncryptionEnforcementConfig?.restrictionMode,
    'FullyRestricted'
  );
  assert.strictEqual(
    encryption.customerManagedEncryptionEnforcementConfig?.restrictionMode,
    'NotRestricted'
  );
  assert.strictEqual(
    encryption.customerSuppliedEncryptionEnforcementConfig?.restrictionMode,
    'FullyRestricted'
  );
});

it('should get bucket encryption enforcement configuration', async function () {
  if (!defaultKmsKeyName) {
    this.skip();
  }
  const output = execSync(
    `node getBucketEncryptionEnforcementConfig.js ${bucketName}`
  );

  assert.include(
    output,
    `Encryption enforcement configuration for bucket ${bucketName}.`
  );
  assert.include(output, `Default KMS Key: ${defaultKmsKeyName}`);

  assert.include(output, 'Google Managed (GMEK) Enforcement:');
  assert.include(output, 'Mode: FullyRestricted');
  assert.match(output, /Effective:/);

  const [metadata] = await bucket.getMetadata();
  const encryption = metadata.encryption || {};

  assert.strictEqual(encryption.defaultKmsKeyName, defaultKmsKeyName);
  assert.strictEqual(
    encryption.googleManagedEncryptionEnforcementConfig?.restrictionMode,
    'FullyRestricted'
  );
  assert.strictEqual(
    encryption.customerManagedEncryptionEnforcementConfig?.restrictionMode,
    'NotRestricted'
  );
  assert.strictEqual(
    encryption.customerSuppliedEncryptionEnforcementConfig?.restrictionMode,
    'FullyRestricted'
  );
});

it('should update and then remove bucket encryption enforcement configuration', async () => {
  const output = execSync(
    `node updateBucketEncryptionEnforcementConfig.js ${bucketName}`
  );

  assert.include(
    output,
    `Google-managed encryption enforcement set to FullyRestricted for ${bucketName}.`
  );
  assert.include(
    output,
    `All encryption enforcement configurations removed from bucket ${bucketName}.`
  );

  const [metadata] = await bucket.getMetadata();
  assert.ok(!metadata.encryption);
});

it('should enable the bucket IP filter', () => {
  const output = execSync(
    `node enableBucketIpFilter.js ${bucketName} Disabled`
  );
  assert.include(output, `IP Filter mode set to Disabled for bucket ${bucketName}.`);
  assert.include(output, '8.8.8.8/32');
});

it('should get the bucket IP filter', () => {
  const output = execSync(`node getBucketIpFilter.js ${bucketName}`);
  assert.include(output, 'IP Filter Mode: Disabled');
  assert.include(output, '8.8.8.8/32');
});

it('should list the bucket IP filters', () => {
  const projectId = process.env.GCLOUD_PROJECT;
  const output = execSync(`node listBucketIpFilters.js ${projectId}`);
  assert.include(output, `${bucketName}: IP Filter Mode - Disabled`);
  assert.include(output, 'Public Network Allowed IP Ranges:');
  assert.include(output, '- 8.8.8.8/32');
});

it('should delete specific bucket IP filter rules', () => {
  const output = execSync(`node deleteBucketIpFilterRules.js ${bucketName}`);
  assert.include(
    output,
    `Specific IP Filter rules deleted for bucket ${bucketName}.`
  );
});

it('should disable the bucket IP filter', () => {
  const output = execSync(`node disableBucketIpFilter.js ${bucketName}`);
  assert.include(output, `IP Filter disabled for bucket ${bucketName}.`);
  assert.include(output, '"mode": "Disabled"');
});