sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-08-29 02:51:29 +02:00
Code Issues Packages Projects Releases Wiki Activity

[management] Add context to the new proxy access assertions

Browse Source 
Comparison assertions carry a failure message, and a denied tunnel peer is
asserted to receive no session token so the missing-owner case cannot pass
on the denied reason alone.
This commit is contained in:
mlsmaycon
2026-08-08 04:54:27 +00:00
parent 35587bdfeb
commit eddf9269b7
2 changed files with 17 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
management/internals/shared/grpc/proxy_group_access_test.go
View File

@@ -608,9 +608,12 @@ func TestValidateTunnelPeerUserEmailEnrichment(t *testing.T) {
require.NoError(t, err)
require.NotNil(t, resp)
assert.Equal(t, tt.expectDeniedReason == "", resp.GetValid(), "unexpected access decision")
assert.Equal(t, tt.expectDeniedReason, resp.GetDeniedReason())
assert.Equal(t, tt.expectDeniedReason, resp.GetDeniedReason(), "unexpected denied reason")
assert.Equal(t, tt.expectEmail, resp.GetUserEmail())
assert.Equal(t, tt.expectUserID, resp.GetUserId())
if tt.expectDeniedReason != "" {
assert.Empty(t, resp.GetSessionToken(), "a denied peer must not receive a session token")
}
if idpMock != nil {
if tt.expectIdPHit {
@@ -629,9 +632,9 @@ func TestValidateTunnelPeerUserEmailEnrichment(t *testing.T) {
// reasons. The proxy logs them and operators filter access logs on them, so a
// rename is a breaking change rather than an internal detail.
func TestDeniedReasonValues(t *testing.T) {
assert.Equal(t, "pending_approval", deniedReasonPendingApproval)
assert.Equal(t, "user_blocked", deniedReasonUserBlocked)
assert.Equal(t, "user_not_found", deniedReasonUserNotFound)
assert.Equal(t, "pending_approval", deniedReasonPendingApproval, "pending approval denied reason wire value")
assert.Equal(t, "user_blocked", deniedReasonUserBlocked, "blocked user denied reason wire value")
assert.Equal(t, "user_not_found", deniedReasonUserNotFound, "unresolved user denied reason wire value")
}
// TestValidateTunnelPeerOwnerStatus verifies that the mesh fast-path gates on
@@ -697,7 +700,7 @@ func TestValidateTunnelPeerOwnerStatus(t *testing.T) {
require.NoError(t, err)
require.NotNil(t, resp)
assert.Equal(t, tt.expectDeniedReason, resp.GetDeniedReason())
assert.Equal(t, tt.expectDeniedReason, resp.GetDeniedReason(), "unexpected denied reason")
assert.Equal(t, tt.expectDeniedReason == "", resp.GetValid(), "unexpected access decision")
if tt.expectDeniedReason != "" {
assert.Empty(t, resp.GetSessionToken(), "a denied peer must not receive a session token")

18
management/internals/shared/grpc/validate_session_test.go
View File

@@ -245,8 +245,8 @@ func TestValidateSession_PendingApprovalUserDenied(t *testing.T) {
require.NoError(t, err)
assert.False(t, resp.Valid, "User pending approval should be denied")
assert.Equal(t, deniedReasonPendingApproval, resp.DeniedReason)
assert.Equal(t, pendingUserID, resp.UserId)
assert.Equal(t, deniedReasonPendingApproval, resp.DeniedReason, "Denied reason should name the pending approval state")
assert.Equal(t, pendingUserID, resp.UserId, "Denial should identify the user it applies to")
assert.Equal(t, []string{"allowedGroupId"}, resp.GetPeerGroupIds(), "PeerGroupIds must mirror the resolved user's group memberships on denial")
assert.Equal(t, []string{"Allowed Group"}, resp.GetPeerGroupNames(), "PeerGroupNames must pair with PeerGroupIds on denial")
}
@@ -270,8 +270,8 @@ func TestValidateSession_PendingApprovalUserInAllUsersGroupDenied(t *testing.T)
require.NoError(t, err)
assert.False(t, resp.Valid, "User pending approval should be denied even in the All Users group")
assert.Equal(t, deniedReasonPendingApproval, resp.DeniedReason)
assert.Equal(t, pendingAllUsersID, resp.UserId)
assert.Equal(t, deniedReasonPendingApproval, resp.DeniedReason, "Denied reason should name the pending approval state")
assert.Equal(t, pendingAllUsersID, resp.UserId, "Denial should identify the user it applies to")
assert.Equal(t, []string{allUsersGroupID}, resp.GetPeerGroupIds(), "PeerGroupIds must mirror the resolved user's group memberships on denial")
}
@@ -293,8 +293,8 @@ func TestValidateSession_BlockedUserDenied(t *testing.T) {
require.NoError(t, err)
assert.False(t, resp.Valid, "Blocked user should be denied")
assert.Equal(t, deniedReasonUserBlocked, resp.DeniedReason)
assert.Equal(t, blockedUserID, resp.UserId)
assert.Equal(t, deniedReasonUserBlocked, resp.DeniedReason, "Denied reason should name the blocked state")
assert.Equal(t, blockedUserID, resp.UserId, "Denial should identify the user it applies to")
}
// TestValidateSession_UserAllowedAfterApproval walks the same session token
@@ -318,7 +318,7 @@ func TestValidateSession_UserAllowedAfterApproval(t *testing.T) {
resp, err := setup.proxyService.ValidateSession(ctx, req)
require.NoError(t, err)
require.False(t, resp.Valid, "User pending approval should be denied before approval")
assert.Equal(t, deniedReasonPendingApproval, resp.DeniedReason)
assert.Equal(t, deniedReasonPendingApproval, resp.DeniedReason, "Denied reason should name the pending approval state")
user, err := setup.store.GetUserByUserID(ctx, store.LockingStrengthNone, pendingUserID)
require.NoError(t, err)
@@ -330,8 +330,8 @@ func TestValidateSession_UserAllowedAfterApproval(t *testing.T) {
require.NoError(t, err)
assert.True(t, resp.Valid, "Approved user should be allowed access")
assert.Empty(t, resp.DeniedReason)
assert.Equal(t, pendingUserID, resp.UserId)
assert.Equal(t, []string{"allowedGroupId"}, resp.GetPeerGroupIds())
assert.Equal(t, pendingUserID, resp.UserId, "Approved user should be identified in the response")
assert.Equal(t, []string{"allowedGroupId"}, resp.GetPeerGroupIds(), "PeerGroupIds must mirror the approved user's group memberships")
}
func TestValidateSession_UserInDifferentAccount(t *testing.T) {