darkhelm/notifications-api
1
0
Fork 0
mirror of https://github.com/GSA/notifications-api.git synced 2026-08-20 22:39:43 -04:00
Code Issues Packages Projects Releases Wiki Activity

Make ADMIN_CLIENT_SECRET a list of a single secret

Browse Source 
And support this change across our code. Note, this is a halfway step
where it is not a list rather than a string but still only supports a
single secret, ie one item in the list.
This commit is contained in:
David McDonald
2020-02-19 16:42:40 +00:00
parent f7f6be56c7
commit 52d3df49d4
4 changed files with 16 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
app/authentication/auth.py
View File

@@ -61,7 +61,12 @@ def requires_admin_auth():
if client == current_app.config.get('ADMIN_CLIENT_USER_NAME'): if client == current_app.config.get('ADMIN_CLIENT_USER_NAME'):
g.service_id = current_app.config.get('ADMIN_CLIENT_USER_NAME') g.service_id = current_app.config.get('ADMIN_CLIENT_USER_NAME')
return handle_admin_key(auth_token, current_app.config.get('ADMIN_CLIENT_SECRET'))
secret = ""
if len(current_app.config.get('ADMIN_CLIENT_SECRETS')):
secret = current_app.config.get('ADMIN_CLIENT_SECRETS')[0]
return handle_admin_key(auth_token, secret)
else: else:
raise AuthError('Unauthorized: admin authentication token required', 401) raise AuthError('Unauthorized: admin authentication token required', 401)

4
app/config.py
View File

@@ -65,7 +65,7 @@ class Config(object):
API_HOST_NAME = os.getenv('API_HOST_NAME') API_HOST_NAME = os.getenv('API_HOST_NAME')
# admin app api key # admin app api key
ADMIN_CLIENT_SECRET = os.getenv('ADMIN_CLIENT_SECRET') ADMIN_CLIENT_SECRETS = [os.getenv('ADMIN_CLIENT_SECRET')] if os.getenv('ADMIN_CLIENT_SECRET') else []
# encyption secret/salt # encyption secret/salt
SECRET_KEY = os.getenv('SECRET_KEY') SECRET_KEY = os.getenv('SECRET_KEY')
@@ -369,7 +369,7 @@ class Development(Config):
TRANSIENT_UPLOADED_LETTERS = 'development-transient-uploaded-letters' TRANSIENT_UPLOADED_LETTERS = 'development-transient-uploaded-letters'
LETTER_SANITISE_BUCKET_NAME = 'development-letters-sanitise' LETTER_SANITISE_BUCKET_NAME = 'development-letters-sanitise'
ADMIN_CLIENT_SECRET = 'dev-notify-secret-key' ADMIN_CLIENT_SECRETS = ['dev-notify-secret-key']
SECRET_KEY = 'dev-notify-secret-key' SECRET_KEY = 'dev-notify-secret-key'
DANGEROUS_SALT = 'dev-notify-salt' DANGEROUS_SALT = 'dev-notify-salt'

2
tests/__init__.py
View File

@@ -28,7 +28,7 @@ def create_authorization_header(service_id=None, key_type=KEY_TYPE_NORMAL):
else: else:
client_id = current_app.config['ADMIN_CLIENT_USER_NAME'] client_id = current_app.config['ADMIN_CLIENT_USER_NAME']
secret = current_app.config['ADMIN_CLIENT_SECRET'] secret = current_app.config['ADMIN_CLIENT_SECRETS'][0]
token = create_jwt_token(secret=secret, client_id=client_id) token = create_jwt_token(secret=secret, client_id=client_id)
return 'Authorization', 'Bearer {}'.format(token) return 'Authorization', 'Bearer {}'.format(token)

14
tests/app/authentication/test_authentication.py
View File

@@ -188,7 +188,7 @@ def test_should_allow_valid_token_for_request_with_path_params_for_public_url(cl
def test_should_allow_valid_token_for_request_with_path_params_for_admin_url(client): def test_should_allow_valid_token_for_request_with_path_params_for_admin_url(client):
token = create_jwt_token(current_app.config['ADMIN_CLIENT_SECRET'], current_app.config['ADMIN_CLIENT_USER_NAME']) token = create_jwt_token(current_app.config['ADMIN_CLIENT_SECRETS'][0], current_app.config['ADMIN_CLIENT_USER_NAME'])
response = client.get('/service', headers={'Authorization': 'Bearer {}'.format(token)}) response = client.get('/service', headers={'Authorization': 'Bearer {}'.format(token)})
assert response.status_code == 200 assert response.status_code == 200
@@ -264,13 +264,13 @@ def test_authentication_returns_token_expired_when_service_uses_expired_key_and_
def test_authentication_returns_error_when_admin_client_has_no_secrets(client): def test_authentication_returns_error_when_admin_client_has_no_secrets(client):
api_secret = current_app.config.get('ADMIN_CLIENT_SECRET') api_secret = current_app.config.get('ADMIN_CLIENT_SECRETS')[0]
api_service_id = current_app.config.get('ADMIN_CLIENT_USER_NAME') api_service_id = current_app.config.get('ADMIN_CLIENT_USER_NAME')
token = create_jwt_token( token = create_jwt_token(
secret=api_secret, secret=api_secret,
client_id=api_service_id client_id=api_service_id
) )
with set_config(client.application, 'ADMIN_CLIENT_SECRET', ''): with set_config(client.application, 'ADMIN_CLIENT_SECRETS', []):
response = client.get( response = client.get(
'/service', '/service',
headers={'Authorization': 'Bearer {}'.format(token)}) headers={'Authorization': 'Bearer {}'.format(token)})
@@ -280,19 +280,19 @@ def test_authentication_returns_error_when_admin_client_has_no_secrets(client):
def test_authentication_returns_error_when_admin_client_secret_is_invalid(client): def test_authentication_returns_error_when_admin_client_secret_is_invalid(client):
api_secret = current_app.config.get('ADMIN_CLIENT_SECRET') api_secret = current_app.config.get('ADMIN_CLIENT_SECRETS')[0]
token = create_jwt_token( token = create_jwt_token(
secret=api_secret, secret=api_secret,
client_id=current_app.config.get('ADMIN_CLIENT_USER_NAME') client_id=current_app.config.get('ADMIN_CLIENT_USER_NAME')
) )
current_app.config['ADMIN_CLIENT_SECRET'] = 'something-wrong' current_app.config['ADMIN_CLIENT_SECRETS'][0] = 'something-wrong'
response = client.get( response = client.get(
'/service', '/service',
headers={'Authorization': 'Bearer {}'.format(token)}) headers={'Authorization': 'Bearer {}'.format(token)})
assert response.status_code == 403 assert response.status_code == 403
error_message = json.loads(response.get_data()) error_message = json.loads(response.get_data())
assert error_message['message'] == {"token": ["Invalid token: could not decode your API token"]} assert error_message['message'] == {"token": ["Invalid token: could not decode your API token"]}
current_app.config['ADMIN_CLIENT_SECRET'] = api_secret current_app.config['ADMIN_CLIENT_SECRETS'][0] = api_secret
def test_authentication_returns_error_when_service_doesnt_exit( def test_authentication_returns_error_when_service_doesnt_exit(
@@ -397,7 +397,7 @@ def test_proxy_key_non_auth_endpoint(notify_api, check_proxy_header, header_valu
(False, 'wrong_key', 200), (False, 'wrong_key', 200),
]) ])
def test_proxy_key_on_admin_auth_endpoint(notify_api, check_proxy_header, header_value, expected_status): def test_proxy_key_on_admin_auth_endpoint(notify_api, check_proxy_header, header_value, expected_status):
token = create_jwt_token(current_app.config['ADMIN_CLIENT_SECRET'], current_app.config['ADMIN_CLIENT_USER_NAME']) token = create_jwt_token(current_app.config['ADMIN_CLIENT_SECRETS'][0], current_app.config['ADMIN_CLIENT_USER_NAME'])
with set_config_values(notify_api, { with set_config_values(notify_api, {
'ROUTE_SECRET_KEY_1': 'key_1', 'ROUTE_SECRET_KEY_1': 'key_1',