Skip to content

Commit c01e13f

Browse files
paulineribeyrepaulineribeyre
authored
Remove requestor dependency from client creds rotation test (uc-cdis#950)
1 parent 7583b58 commit c01e13f

File tree

4 files changed

+65
-67
lines changed

4 files changed

+65
-67
lines changed

‎.pre-commit-config.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
repos:
22
- repo: https://github.com/Yelp/detect-secrets.git
3-
rev: v1.0.3
3+
rev: v1.4.0
44
hooks:
55
- id: detect-secrets
66
args: ['--baseline', '.secrets.baseline']

‎.secrets.baseline

Lines changed: 42 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
2-
"version": "1.0.3",
2+
"version": "1.4.0",
33
"plugins_used": [
44
{
55
"name": "ArtifactoryDetector"
@@ -80,6 +80,12 @@
8080
{
8181
"path": "detect_secrets.filters.heuristic.is_likely_id_string"
8282
},
83+
{
84+
"path": "detect_secrets.filters.heuristic.is_lock_file"
85+
},
86+
{
87+
"path": "detect_secrets.filters.heuristic.is_not_alphanumeric_string"
88+
},
8389
{
8490
"path": "detect_secrets.filters.heuristic.is_potential_uuid"
8591
},
@@ -89,6 +95,9 @@
8995
{
9096
"path": "detect_secrets.filters.heuristic.is_sequential_string"
9197
},
98+
{
99+
"path": "detect_secrets.filters.heuristic.is_swagger_file"
100+
},
92101
{
93102
"path": "detect_secrets.filters.heuristic.is_templated_secret"
94103
},
@@ -100,24 +109,6 @@
100109
}
101110
],
102111
"results": {
103-
"README.md": [
104-
{
105-
"type": "Secret Keyword",
106-
"filename": "README.md",
107-
"hashed_secret": "398ec9c29cf195ff9202bd85b75002adc88832c3",
108-
"is_verified": false,
109-
"line_number": 154
110-
}
111-
],
112-
"getAccessToken.sh": [
113-
{
114-
"type": "Secret Keyword",
115-
"filename": "getAccessToken.sh",
116-
"hashed_secret": "d3df8a3b08a9de43b73eca1302d50e7a0e5b360f",
117-
"is_verified": false,
118-
"line_number": 21
119-
}
120-
],
121112
"load-testing/grafana/grafana-provisioning/datasources/datasource.yml": [
122113
{
123114
"type": "Secret Keyword",
@@ -136,15 +127,6 @@
136127
"line_number": 66
137128
}
138129
],
139-
"load-testing/sample-descriptors/load-test-metadata-service-create-and-query-sample.json": [
140-
{
141-
"type": "Secret Keyword",
142-
"filename": "load-testing/sample-descriptors/load-test-metadata-service-create-and-query-sample.json",
143-
"hashed_secret": "dd29ecf524b030a65261e3059c48ab9e1ecb2585",
144-
"is_verified": false,
145-
"line_number": 22
146-
}
147-
],
148130
"services/portal/studyViewer/studyViewerProps.js": [
149131
{
150132
"type": "Base64 High Entropy String",
@@ -313,22 +295,22 @@
313295
"line_number": 24
314296
}
315297
],
316-
"suites/apis/presignedUrlTest.js": [
298+
"suites/apis/oidcClientTest.js": [
317299
{
318300
"type": "Hex High Entropy String",
319-
"filename": "suites/apis/presignedUrlTest.js",
301+
"filename": "suites/apis/oidcClientTest.js",
320302
"hashed_secret": "62bd0c4d3a6b445b13212d23500a7f0916757c3e",
321303
"is_verified": false,
322-
"line_number": 13
304+
"line_number": 97
323305
}
324306
],
325-
"suites/apis/rasIntegrationTest.js": [
307+
"suites/apis/presignedUrlTest.js": [
326308
{
327-
"type": "Secret Keyword",
328-
"filename": "suites/apis/rasIntegrationTest.js",
329-
"hashed_secret": "f44217a81173869e08671753c52553646ff5d95b",
309+
"type": "Hex High Entropy String",
310+
"filename": "suites/apis/presignedUrlTest.js",
311+
"hashed_secret": "62bd0c4d3a6b445b13212d23500a7f0916757c3e",
330312
"is_verified": false,
331-
"line_number": 10
313+
"line_number": 13
332314
}
333315
],
334316
"suites/batch/GoogleBucketManifestGenerationTest.js": [
@@ -363,6 +345,15 @@
363345
"line_number": 32
364346
}
365347
],
348+
"suites/coremetadata/testPlan.md": [
349+
{
350+
"type": "Hex High Entropy String",
351+
"filename": "suites/coremetadata/testPlan.md",
352+
"hashed_secret": "c9705c520825a1682dac6283066f577c950844bf",
353+
"is_verified": false,
354+
"line_number": 25
355+
}
356+
],
366357
"suites/google/googleDataAccessTest.js": [
367358
{
368359
"type": "Hex High Entropy String",
@@ -379,6 +370,15 @@
379370
"line_number": 62
380371
}
381372
],
373+
"suites/google/googleServiceAccountKeyTest.js": [
374+
{
375+
"type": "Hex High Entropy String",
376+
"filename": "suites/google/googleServiceAccountKeyTest.js",
377+
"hashed_secret": "5e7cb7af2f82537bd0716cb4e821ffe25064af6f",
378+
"is_verified": false,
379+
"line_number": 193
380+
}
381+
],
382382
"suites/portal/indexingPageTest.js": [
383383
{
384384
"type": "Hex High Entropy String",
@@ -388,13 +388,13 @@
388388
"line_number": 18
389389
}
390390
],
391-
"suites/portal/rasAuthN.js": [
391+
"suites/pre-release/dcf/3.googleCredentialsTest.js": [
392392
{
393-
"type": "Secret Keyword",
394-
"filename": "suites/portal/rasAuthN.js",
395-
"hashed_secret": "f44217a81173869e08671753c52553646ff5d95b",
393+
"type": "Hex High Entropy String",
394+
"filename": "suites/pre-release/dcf/3.googleCredentialsTest.js",
395+
"hashed_secret": "1ffff910318085530fb395f27ec73a52084f0685",
396396
"is_verified": false,
397-
"line_number": 11
397+
"line_number": 119
398398
}
399399
],
400400
"utils/user.js": [
@@ -407,5 +407,5 @@
407407
}
408408
]
409409
},
410-
"generated_at": "2023-04-21T03:56:11Z"
410+
"generated_at": "2023-05-01T21:15:31Z"
411411
}

‎services/apis/indexd/indexdTasks.js

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ module.exports = {
3131
* user account (mainAcct)'s access token
3232
* @returns {Array<Promise<>>}
3333
*/
34-
async addFileIndices(files, authHeaders = user.mainAcct.indexdAuthHeader) {
34+
async addFileIndices(files, authHeaders = user.mainAcct.indexdAuthHeader, ignoreFailures = true) {
3535
authHeaders['Content-Type'] = 'application/json; charset=UTF-8';
3636
const promiseList = files.map((file) => {
3737
if (!file.did) {
@@ -79,9 +79,13 @@ module.exports = {
7979
async () => Promise.all(promiseList).then(
8080
() => true,
8181
(v) => {
82-
console.log('Some of the indexd submissions failed? Ignoring failure ...', v);
83-
// succeed anyway - this thing is flaky for some reason
84-
return true;
82+
if (ignoreFailures) {
83+
console.log('Some of the indexd submissions failed? Ignoring failure ...', v);
84+
// succeed anyway - this thing is flaky for some reason
85+
return true;
86+
} else {
87+
return false;
88+
}
8589
},
8690
)
8791
)();

‎suites/apis/oidcClientTest.js

Lines changed: 14 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@ Scenario('OIDC Client Expiration @clientExpiration', async ({ I, fence }) => {
6161
});
6262

6363

64-
Scenario('OIDC Client Rotation @clientRotation', async ({ I, fence, requestor }) => {
64+
Scenario('OIDC Client Rotation @clientRotation @requires-indexd', async ({ I, fence, indexd }) => {
6565
const clientName = 'jenkinsClientTester';
6666
console.log(` Creating client '${clientName}'`);
6767
const creds1 = new Client({
@@ -90,28 +90,22 @@ Scenario('OIDC Client Rotation @clientRotation', async ({ I, fence, requestor })
9090

9191
// check that both sets of credentials work:
9292
// - we can get an access token using the creds
93-
// - the token should have access to create a request in requestor, as stated in the user.yaml
93+
// - the token should have access to create a record in indexd, as stated in the user.yaml
94+
const indexdRecord = {
95+
filename: 'testfile',
96+
size: 9,
97+
md5: '73d643ec3f4beb9020eef0beed440ad0',
98+
urls: ['s3://mybucket/testfile'],
99+
authz: ['/programs/jnkns/projects/jenkins'],
100+
};
94101
console.log('Checking credentials obtained before rotating...');
95102
const client1AccessToken = await fence.do.getAccessTokenWithClientCredentials(creds1.id, creds1.secret);
96-
let createRequest = await I.sendPostRequest(
97-
`${requestor.props.endpoint.requestEndPoint}`,
98-
{
99-
username: "test-client-rotation-user",
100-
policy_id: 'requestor_client_credentials_test',
101-
},
102-
getAccessTokenHeader(client1AccessToken),
103-
);
104-
expect(createRequest, 'The token generated with the old creds should have access').to.have.property('status', 201);
103+
let ok = await indexd.do.addFileIndices([indexdRecord], getAccessTokenHeader(client1AccessToken), false);
104+
expect(ok, 'The token generated with the old creds should have access').to.be.true;
105105

106106
console.log('Checking credentials obtained after rotating...');
107+
delete indexdRecord.did; // reset the GUID so a new record is created
107108
const client2AccessToken = await fence.do.getAccessTokenWithClientCredentials(creds2.client_id, creds2.client_secret);
108-
createRequest = await I.sendPostRequest(
109-
`${requestor.props.endpoint.requestEndPoint}`,
110-
{
111-
username: "test-client-rotation-user",
112-
policy_id: 'requestor_client_credentials_test',
113-
},
114-
getAccessTokenHeader(client2AccessToken),
115-
);
116-
expect(createRequest, 'The token generated with the new creds should have access').to.have.property('status', 201);
109+
ok = await indexd.do.addFileIndices([indexdRecord], getAccessTokenHeader(client2AccessToken), false);
110+
expect(ok, 'The token generated with the new creds should have access').to.be.true;
117111
});

0 commit comments

Comments
 (0)