598 lines
20 KiB
PHP
598 lines
20 KiB
PHP
<?php
|
|
|
|
use App\Models\CloudProviderToken;
|
|
use App\Models\InstanceSettings;
|
|
use App\Models\Team;
|
|
use App\Models\User;
|
|
use Illuminate\Foundation\Testing\RefreshDatabase;
|
|
use Illuminate\Support\Facades\Http;
|
|
use Illuminate\Support\Facades\Log;
|
|
use Illuminate\Support\Once;
|
|
|
|
uses(RefreshDatabase::class);
|
|
|
|
beforeEach(function () {
|
|
config([
|
|
'app.maintenance.driver' => 'file',
|
|
'cache.default' => 'array',
|
|
'session.driver' => 'array',
|
|
]);
|
|
|
|
InstanceSettings::query()->whereKey(0)->delete();
|
|
$settings = new InstanceSettings(['is_api_enabled' => true]);
|
|
$settings->id = 0;
|
|
$settings->save();
|
|
Once::flush();
|
|
|
|
// Create a team with owner
|
|
$this->team = Team::factory()->create();
|
|
$this->user = User::factory()->create();
|
|
$this->team->members()->attach($this->user->id, ['role' => 'owner']);
|
|
|
|
// Set the current team session before creating the token
|
|
session(['currentTeam' => $this->team]);
|
|
|
|
// Create an API token for the user
|
|
$this->token = $this->user->createToken('test-token', ['*']);
|
|
$this->bearerToken = $this->token->plainTextToken;
|
|
});
|
|
|
|
describe('GET /api/v1/cloud-tokens', function () {
|
|
test('lists all cloud provider tokens for the team', function () {
|
|
// Create some tokens
|
|
CloudProviderToken::factory()->count(3)->create([
|
|
'team_id' => $this->team->id,
|
|
'provider' => 'hetzner',
|
|
]);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$this->bearerToken,
|
|
'Content-Type' => 'application/json',
|
|
])->getJson('/api/v1/cloud-tokens');
|
|
|
|
$response->assertStatus(200);
|
|
$response->assertJsonCount(3);
|
|
$response->assertJsonStructure([
|
|
'*' => ['uuid', 'name', 'provider', 'team_id', 'servers_count', 'created_at', 'updated_at'],
|
|
]);
|
|
});
|
|
|
|
test('does not include tokens from other teams', function () {
|
|
// Create tokens for this team
|
|
CloudProviderToken::factory()->create([
|
|
'team_id' => $this->team->id,
|
|
'provider' => 'hetzner',
|
|
]);
|
|
|
|
// Create tokens for another team
|
|
$otherTeam = Team::factory()->create();
|
|
CloudProviderToken::factory()->count(2)->create([
|
|
'team_id' => $otherTeam->id,
|
|
'provider' => 'hetzner',
|
|
]);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$this->bearerToken,
|
|
'Content-Type' => 'application/json',
|
|
])->getJson('/api/v1/cloud-tokens');
|
|
|
|
$response->assertStatus(200);
|
|
$response->assertJsonCount(1);
|
|
});
|
|
|
|
test('rejects request without authentication', function () {
|
|
$response = $this->getJson('/api/v1/cloud-tokens');
|
|
$response->assertStatus(401);
|
|
});
|
|
|
|
test('read token does not include provider token values', function () {
|
|
CloudProviderToken::create([
|
|
'team_id' => $this->team->id,
|
|
'name' => 'Hidden Token',
|
|
'provider' => 'hetzner',
|
|
'token' => 'hidden-cloud-provider-token',
|
|
]);
|
|
|
|
$readToken = $this->user->createToken('read-token', ['read'])->plainTextToken;
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$readToken,
|
|
'Content-Type' => 'application/json',
|
|
])->getJson('/api/v1/cloud-tokens');
|
|
|
|
$response->assertSuccessful();
|
|
expect($response->getContent())->not->toContain('"token":');
|
|
});
|
|
|
|
test('read sensitive token includes provider token values', function () {
|
|
CloudProviderToken::create([
|
|
'team_id' => $this->team->id,
|
|
'name' => 'Visible Token',
|
|
'provider' => 'hetzner',
|
|
'token' => 'visible-cloud-provider-token',
|
|
]);
|
|
|
|
$readSensitiveToken = $this->user->createToken('read-sensitive-token', ['read', 'read:sensitive'])->plainTextToken;
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$readSensitiveToken,
|
|
'Content-Type' => 'application/json',
|
|
])->getJson('/api/v1/cloud-tokens');
|
|
|
|
$response->assertSuccessful();
|
|
$response->assertJsonFragment(['token' => 'visible-cloud-provider-token']);
|
|
});
|
|
|
|
test('root token includes provider token values', function () {
|
|
CloudProviderToken::create([
|
|
'team_id' => $this->team->id,
|
|
'name' => 'Root Visible Token',
|
|
'provider' => 'hetzner',
|
|
'token' => 'root-visible-cloud-provider-token',
|
|
]);
|
|
|
|
$rootToken = $this->user->createToken('root-token', ['root'])->plainTextToken;
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$rootToken,
|
|
'Content-Type' => 'application/json',
|
|
])->getJson('/api/v1/cloud-tokens');
|
|
|
|
$response->assertSuccessful();
|
|
$response->assertJsonFragment(['token' => 'root-visible-cloud-provider-token']);
|
|
});
|
|
});
|
|
|
|
describe('GET /api/v1/cloud-tokens/{uuid}', function () {
|
|
test('gets cloud provider token by UUID', function () {
|
|
$token = CloudProviderToken::factory()->create([
|
|
'team_id' => $this->team->id,
|
|
'provider' => 'hetzner',
|
|
'name' => 'My Hetzner Token',
|
|
]);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$this->bearerToken,
|
|
'Content-Type' => 'application/json',
|
|
])->getJson("/api/v1/cloud-tokens/{$token->uuid}");
|
|
|
|
$response->assertStatus(200);
|
|
$response->assertJsonFragment(['name' => 'My Hetzner Token', 'provider' => 'hetzner']);
|
|
});
|
|
|
|
test('returns 404 for non-existent token', function () {
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$this->bearerToken,
|
|
'Content-Type' => 'application/json',
|
|
])->getJson('/api/v1/cloud-tokens/non-existent-uuid');
|
|
|
|
$response->assertStatus(404);
|
|
});
|
|
|
|
test('cannot access token from another team', function () {
|
|
$otherTeam = Team::factory()->create();
|
|
$token = CloudProviderToken::factory()->create([
|
|
'team_id' => $otherTeam->id,
|
|
'provider' => 'hetzner',
|
|
]);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$this->bearerToken,
|
|
'Content-Type' => 'application/json',
|
|
])->getJson("/api/v1/cloud-tokens/{$token->uuid}");
|
|
|
|
$response->assertStatus(404);
|
|
});
|
|
|
|
test('read token does not include provider token value by UUID', function () {
|
|
$token = CloudProviderToken::create([
|
|
'team_id' => $this->team->id,
|
|
'name' => 'Hidden Token Detail',
|
|
'provider' => 'hetzner',
|
|
'token' => 'hidden-cloud-provider-token-detail',
|
|
]);
|
|
|
|
$readToken = $this->user->createToken('read-token', ['read'])->plainTextToken;
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$readToken,
|
|
'Content-Type' => 'application/json',
|
|
])->getJson("/api/v1/cloud-tokens/{$token->uuid}");
|
|
|
|
$response->assertSuccessful();
|
|
expect($response->getContent())->not->toContain('"token":');
|
|
});
|
|
|
|
test('read sensitive token includes provider token value by UUID', function () {
|
|
$token = CloudProviderToken::create([
|
|
'team_id' => $this->team->id,
|
|
'name' => 'Visible Token Detail',
|
|
'provider' => 'hetzner',
|
|
'token' => 'visible-cloud-provider-token-detail',
|
|
]);
|
|
|
|
$readSensitiveToken = $this->user->createToken('read-sensitive-token', ['read', 'read:sensitive'])->plainTextToken;
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$readSensitiveToken,
|
|
'Content-Type' => 'application/json',
|
|
])->getJson("/api/v1/cloud-tokens/{$token->uuid}");
|
|
|
|
$response->assertSuccessful();
|
|
$response->assertJsonFragment(['token' => 'visible-cloud-provider-token-detail']);
|
|
});
|
|
});
|
|
|
|
describe('POST /api/v1/cloud-tokens', function () {
|
|
test('creates a Hetzner cloud provider token', function () {
|
|
// Mock Hetzner API validation
|
|
Http::fake([
|
|
'https://api.hetzner.cloud/v1/servers' => Http::response([], 200),
|
|
]);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$this->bearerToken,
|
|
'Content-Type' => 'application/json',
|
|
])->postJson('/api/v1/cloud-tokens', [
|
|
'provider' => 'hetzner',
|
|
'token' => 'test-hetzner-token',
|
|
'name' => 'My Hetzner Token',
|
|
]);
|
|
|
|
$response->assertStatus(201);
|
|
$response->assertJsonStructure(['uuid']);
|
|
|
|
// Verify token was created
|
|
$this->assertDatabaseHas('cloud_provider_tokens', [
|
|
'team_id' => $this->team->id,
|
|
'provider' => 'hetzner',
|
|
'name' => 'My Hetzner Token',
|
|
]);
|
|
});
|
|
|
|
test('creates a DigitalOcean cloud provider token', function () {
|
|
// Mock DigitalOcean API validation
|
|
Http::fake([
|
|
'https://api.digitalocean.com/v2/account' => Http::response([], 200),
|
|
]);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$this->bearerToken,
|
|
'Content-Type' => 'application/json',
|
|
])->postJson('/api/v1/cloud-tokens', [
|
|
'provider' => 'digitalocean',
|
|
'token' => 'test-do-token',
|
|
'name' => 'My DO Token',
|
|
]);
|
|
|
|
$response->assertStatus(201);
|
|
$response->assertJsonStructure(['uuid']);
|
|
});
|
|
|
|
test('creates a Vultr cloud provider token', function () {
|
|
Http::fake([
|
|
'https://api.vultr.com/v2/account' => Http::response([], 200),
|
|
]);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$this->bearerToken,
|
|
'Content-Type' => 'application/json',
|
|
])->postJson('/api/v1/cloud-tokens', [
|
|
'provider' => 'vultr',
|
|
'token' => 'test-vultr-token',
|
|
'name' => 'My Vultr Token',
|
|
]);
|
|
|
|
$response->assertStatus(201);
|
|
$response->assertJsonStructure(['uuid']);
|
|
|
|
$this->assertDatabaseHas('cloud_provider_tokens', [
|
|
'team_id' => $this->team->id,
|
|
'provider' => 'vultr',
|
|
'name' => 'My Vultr Token',
|
|
]);
|
|
});
|
|
|
|
test('validates provider is required', function () {
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$this->bearerToken,
|
|
'Content-Type' => 'application/json',
|
|
])->postJson('/api/v1/cloud-tokens', [
|
|
'token' => 'test-token',
|
|
'name' => 'My Token',
|
|
]);
|
|
|
|
$response->assertStatus(422);
|
|
$response->assertJsonValidationErrors(['provider']);
|
|
});
|
|
|
|
test('validates token is required', function () {
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$this->bearerToken,
|
|
'Content-Type' => 'application/json',
|
|
])->postJson('/api/v1/cloud-tokens', [
|
|
'provider' => 'hetzner',
|
|
'name' => 'My Token',
|
|
]);
|
|
|
|
$response->assertStatus(422);
|
|
$response->assertJsonValidationErrors(['token']);
|
|
});
|
|
|
|
test('validates name is required', function () {
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$this->bearerToken,
|
|
'Content-Type' => 'application/json',
|
|
])->postJson('/api/v1/cloud-tokens', [
|
|
'provider' => 'hetzner',
|
|
'token' => 'test-token',
|
|
]);
|
|
|
|
$response->assertStatus(422);
|
|
$response->assertJsonValidationErrors(['name']);
|
|
});
|
|
|
|
test('validates provider must be hetzner digitalocean or vultr', function () {
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$this->bearerToken,
|
|
'Content-Type' => 'application/json',
|
|
])->postJson('/api/v1/cloud-tokens', [
|
|
'provider' => 'invalid-provider',
|
|
'token' => 'test-token',
|
|
'name' => 'My Token',
|
|
]);
|
|
|
|
$response->assertStatus(422);
|
|
$response->assertJsonValidationErrors(['provider']);
|
|
});
|
|
|
|
test('rejects invalid Hetzner token', function () {
|
|
// Mock failed Hetzner API validation
|
|
Http::fake([
|
|
'https://api.hetzner.cloud/v1/servers' => Http::response([], 401),
|
|
]);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$this->bearerToken,
|
|
'Content-Type' => 'application/json',
|
|
])->postJson('/api/v1/cloud-tokens', [
|
|
'provider' => 'hetzner',
|
|
'token' => 'invalid-token',
|
|
'name' => 'My Token',
|
|
]);
|
|
|
|
$response->assertStatus(400);
|
|
$response->assertJson(['message' => 'Invalid hetzner token. Please check your API token.']);
|
|
});
|
|
|
|
test('rejects extra fields not in allowed list', function () {
|
|
Http::fake([
|
|
'https://api.hetzner.cloud/v1/servers' => Http::response([], 200),
|
|
]);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$this->bearerToken,
|
|
'Content-Type' => 'application/json',
|
|
])->postJson('/api/v1/cloud-tokens', [
|
|
'provider' => 'hetzner',
|
|
'token' => 'test-token',
|
|
'name' => 'My Token',
|
|
'invalid_field' => 'invalid_value',
|
|
]);
|
|
|
|
$response->assertStatus(422);
|
|
});
|
|
});
|
|
|
|
describe('PATCH /api/v1/cloud-tokens/{uuid}', function () {
|
|
test('updates cloud provider token name', function () {
|
|
$token = CloudProviderToken::factory()->create([
|
|
'team_id' => $this->team->id,
|
|
'provider' => 'hetzner',
|
|
'name' => 'Old Name',
|
|
]);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$this->bearerToken,
|
|
'Content-Type' => 'application/json',
|
|
])->patchJson("/api/v1/cloud-tokens/{$token->uuid}", [
|
|
'name' => 'New Name',
|
|
]);
|
|
|
|
$response->assertStatus(200);
|
|
|
|
// Verify token name was updated
|
|
$this->assertDatabaseHas('cloud_provider_tokens', [
|
|
'uuid' => $token->uuid,
|
|
'name' => 'New Name',
|
|
]);
|
|
});
|
|
|
|
test('validates name is required', function () {
|
|
$token = CloudProviderToken::factory()->create([
|
|
'team_id' => $this->team->id,
|
|
'provider' => 'hetzner',
|
|
]);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$this->bearerToken,
|
|
'Content-Type' => 'application/json',
|
|
])->patchJson("/api/v1/cloud-tokens/{$token->uuid}", []);
|
|
|
|
$response->assertStatus(400);
|
|
$response->assertJson([
|
|
'message' => 'Invalid request.',
|
|
'error' => 'Invalid JSON.',
|
|
]);
|
|
});
|
|
|
|
test('cannot update token from another team', function () {
|
|
$otherTeam = Team::factory()->create();
|
|
$token = CloudProviderToken::factory()->create([
|
|
'team_id' => $otherTeam->id,
|
|
'provider' => 'hetzner',
|
|
]);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$this->bearerToken,
|
|
'Content-Type' => 'application/json',
|
|
])->patchJson("/api/v1/cloud-tokens/{$token->uuid}", [
|
|
'name' => 'New Name',
|
|
]);
|
|
|
|
$response->assertStatus(404);
|
|
});
|
|
});
|
|
|
|
describe('DELETE /api/v1/cloud-tokens/{uuid}', function () {
|
|
test('deletes cloud provider token', function () {
|
|
$token = CloudProviderToken::factory()->create([
|
|
'team_id' => $this->team->id,
|
|
'provider' => 'hetzner',
|
|
]);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$this->bearerToken,
|
|
'Content-Type' => 'application/json',
|
|
])->deleteJson("/api/v1/cloud-tokens/{$token->uuid}");
|
|
|
|
$response->assertStatus(200);
|
|
$response->assertJson(['message' => 'Cloud provider token deleted.']);
|
|
|
|
// Verify token was deleted
|
|
$this->assertDatabaseMissing('cloud_provider_tokens', [
|
|
'uuid' => $token->uuid,
|
|
]);
|
|
});
|
|
|
|
test('cannot delete token from another team', function () {
|
|
$otherTeam = Team::factory()->create();
|
|
$token = CloudProviderToken::factory()->create([
|
|
'team_id' => $otherTeam->id,
|
|
'provider' => 'hetzner',
|
|
]);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$this->bearerToken,
|
|
'Content-Type' => 'application/json',
|
|
])->deleteJson("/api/v1/cloud-tokens/{$token->uuid}");
|
|
|
|
$response->assertStatus(404);
|
|
});
|
|
|
|
test('returns 404 for non-existent token', function () {
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$this->bearerToken,
|
|
'Content-Type' => 'application/json',
|
|
])->deleteJson('/api/v1/cloud-tokens/non-existent-uuid');
|
|
|
|
$response->assertStatus(404);
|
|
});
|
|
});
|
|
|
|
describe('POST /api/v1/cloud-tokens/{uuid}/validate', function () {
|
|
test('validates a valid Hetzner token', function () {
|
|
$token = CloudProviderToken::factory()->create([
|
|
'team_id' => $this->team->id,
|
|
'provider' => 'hetzner',
|
|
]);
|
|
|
|
Http::fake([
|
|
'https://api.hetzner.cloud/v1/servers' => Http::response([], 200),
|
|
]);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$this->bearerToken,
|
|
'Content-Type' => 'application/json',
|
|
])->postJson("/api/v1/cloud-tokens/{$token->uuid}/validate");
|
|
|
|
$response->assertStatus(200);
|
|
$response->assertJson(['valid' => true, 'message' => 'Token is valid.']);
|
|
});
|
|
|
|
test('detects invalid Hetzner token', function () {
|
|
$token = CloudProviderToken::factory()->create([
|
|
'team_id' => $this->team->id,
|
|
'provider' => 'hetzner',
|
|
]);
|
|
|
|
Http::fake([
|
|
'https://api.hetzner.cloud/v1/servers' => Http::response([], 401),
|
|
]);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$this->bearerToken,
|
|
'Content-Type' => 'application/json',
|
|
])->postJson("/api/v1/cloud-tokens/{$token->uuid}/validate");
|
|
|
|
$response->assertStatus(200);
|
|
$response->assertJson(['valid' => false, 'message' => 'Invalid hetzner token. Please check your API token.']);
|
|
});
|
|
|
|
test('validates a valid DigitalOcean token', function () {
|
|
$token = CloudProviderToken::factory()->create([
|
|
'team_id' => $this->team->id,
|
|
'provider' => 'digitalocean',
|
|
]);
|
|
|
|
Http::fake([
|
|
'https://api.digitalocean.com/v2/account' => Http::response([], 200),
|
|
]);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$this->bearerToken,
|
|
'Content-Type' => 'application/json',
|
|
])->postJson("/api/v1/cloud-tokens/{$token->uuid}/validate");
|
|
|
|
$response->assertStatus(200);
|
|
$response->assertJson(['valid' => true, 'message' => 'Token is valid.']);
|
|
});
|
|
|
|
test('validates a valid Vultr token', function () {
|
|
$token = CloudProviderToken::factory()->create([
|
|
'team_id' => $this->team->id,
|
|
'provider' => 'vultr',
|
|
]);
|
|
|
|
Http::fake([
|
|
'https://api.vultr.com/v2/account' => Http::response([], 200),
|
|
]);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$this->bearerToken,
|
|
'Content-Type' => 'application/json',
|
|
])->postJson("/api/v1/cloud-tokens/{$token->uuid}/validate");
|
|
|
|
$response->assertStatus(200);
|
|
$response->assertJson(['valid' => true, 'message' => 'Token is valid.']);
|
|
});
|
|
|
|
test('writes an audit log entry when validating a stored token', function () {
|
|
$token = CloudProviderToken::factory()->create([
|
|
'team_id' => $this->team->id,
|
|
'provider' => 'hetzner',
|
|
'name' => 'Audit Token',
|
|
]);
|
|
|
|
Http::fake([
|
|
'https://api.hetzner.cloud/v1/servers' => Http::response([], 200),
|
|
]);
|
|
|
|
$auditChannel = Mockery::mock();
|
|
$auditChannel->shouldReceive('info')
|
|
->once()
|
|
->with('api.cloud_token.validated', Mockery::on(function (array $context) use ($token) {
|
|
return $context['cloud_token_uuid'] === $token->uuid
|
|
&& $context['provider'] === 'hetzner'
|
|
&& $context['valid'] === true;
|
|
}));
|
|
|
|
Log::shouldReceive('channel')->with('audit')->andReturn($auditChannel);
|
|
|
|
$this->withHeaders([
|
|
'Authorization' => 'Bearer '.$this->bearerToken,
|
|
'Content-Type' => 'application/json',
|
|
])->postJson("/api/v1/cloud-tokens/{$token->uuid}/validate")
|
|
->assertOk();
|
|
});
|
|
});
|