1003 lines
40 KiB
PHP
1003 lines
40 KiB
PHP
<?php
|
|
|
|
use App\Models\Application;
|
|
use App\Models\ApplicationDeploymentQueue;
|
|
use App\Models\Environment;
|
|
use App\Models\InstanceSettings;
|
|
use App\Models\PrivateKey;
|
|
use App\Models\Project;
|
|
use App\Models\Server;
|
|
use App\Models\Service;
|
|
use App\Models\StandalonePostgresql;
|
|
use App\Models\Team;
|
|
use App\Models\User;
|
|
use Illuminate\Database\Eloquent\Model;
|
|
use Illuminate\Foundation\Testing\RefreshDatabase;
|
|
use Illuminate\Support\Facades\DB;
|
|
|
|
uses(RefreshDatabase::class);
|
|
|
|
function makeApiToken(User $user, Team $team, array $abilities): string
|
|
{
|
|
session(['currentTeam' => $team]);
|
|
$token = $user->createToken('sensitive-test', $abilities);
|
|
DB::table('personal_access_tokens')->where('id', $token->accessToken->id)->update([
|
|
'team_id' => $team->id,
|
|
]);
|
|
|
|
return $token->plainTextToken;
|
|
}
|
|
|
|
function makeTeamUser(): array
|
|
{
|
|
$team = Team::factory()->create();
|
|
$user = User::factory()->create();
|
|
$team->members()->attach($user->id, ['role' => 'owner']);
|
|
session(['currentTeam' => $team]);
|
|
|
|
return [$team, $user];
|
|
}
|
|
|
|
beforeEach(function () {
|
|
InstanceSettings::query()->delete();
|
|
$settings = new InstanceSettings;
|
|
$settings->id = 0;
|
|
$settings->save();
|
|
|
|
[$this->team, $this->user] = makeTeamUser();
|
|
|
|
$this->server = Server::factory()->create(['team_id' => $this->team->id]);
|
|
$this->server->settings->forceFill([
|
|
'sentinel_token' => encrypt('super-secret-sentinel-token'),
|
|
'sentinel_custom_url' => 'https://sentinel.internal',
|
|
'logdrain_axiom_api_key' => encrypt('axiom-key-secret'),
|
|
'logdrain_newrelic_license_key' => encrypt('newrelic-key-secret'),
|
|
'logdrain_custom_config' => 'custom-config-data',
|
|
'logdrain_custom_config_parser' => 'custom-parser-data',
|
|
])->saveQuietly();
|
|
});
|
|
|
|
describe('GET /api/v1/servers sensitive field gating', function () {
|
|
test('read token does not leak sentinel or logdrain fields', function () {
|
|
$token = makeApiToken($this->user, $this->team, ['read']);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$token,
|
|
])->getJson('/api/v1/servers');
|
|
|
|
$response->assertStatus(200);
|
|
|
|
$body = $response->getContent();
|
|
expect($body)->not->toContain('sentinel_token');
|
|
expect($body)->not->toContain('sentinel_custom_url');
|
|
expect($body)->not->toContain('logdrain_axiom_api_key');
|
|
expect($body)->not->toContain('logdrain_newrelic_license_key');
|
|
expect($body)->not->toContain('logdrain_custom_config');
|
|
});
|
|
|
|
test('read sensitive token sees sentinel and logdrain fields', function () {
|
|
$token = makeApiToken($this->user, $this->team, ['read', 'read:sensitive']);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$token,
|
|
])->getJson('/api/v1/servers');
|
|
|
|
$response->assertStatus(200);
|
|
|
|
$body = $response->getContent();
|
|
expect($body)->toContain('sentinel_token');
|
|
expect($body)->toContain('sentinel_custom_url');
|
|
expect($body)->toContain('logdrain_axiom_api_key');
|
|
});
|
|
|
|
test('root token sees sentinel and logdrain fields', function () {
|
|
$token = makeApiToken($this->user, $this->team, ['root']);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$token,
|
|
])->getJson('/api/v1/servers');
|
|
|
|
$response->assertStatus(200);
|
|
|
|
$body = $response->getContent();
|
|
expect($body)->toContain('sentinel_token');
|
|
});
|
|
|
|
test('read token does not leak sentinel or logdrain fields in server detail', function () {
|
|
$token = makeApiToken($this->user, $this->team, ['read']);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$token,
|
|
])->getJson("/api/v1/servers/{$this->server->uuid}");
|
|
|
|
$response->assertStatus(200);
|
|
|
|
$body = $response->getContent();
|
|
expect($body)->not->toContain('sentinel_token');
|
|
expect($body)->not->toContain('sentinel_custom_url');
|
|
expect($body)->not->toContain('logdrain_axiom_api_key');
|
|
expect($body)->not->toContain('logdrain_newrelic_license_key');
|
|
expect($body)->not->toContain('logdrain_custom_config');
|
|
});
|
|
|
|
test('read sensitive token sees sentinel and logdrain fields in server detail', function () {
|
|
$token = makeApiToken($this->user, $this->team, ['read', 'read:sensitive']);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$token,
|
|
])->getJson("/api/v1/servers/{$this->server->uuid}");
|
|
|
|
$response->assertStatus(200);
|
|
|
|
$body = $response->getContent();
|
|
expect($body)->toContain('sentinel_token');
|
|
expect($body)->toContain('sentinel_custom_url');
|
|
expect($body)->toContain('logdrain_axiom_api_key');
|
|
});
|
|
|
|
test('server resources response does not leak server secrets', function () {
|
|
$token = makeApiToken($this->user, $this->team, ['read', 'read:sensitive']);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$token,
|
|
])->getJson("/api/v1/servers/{$this->server->uuid}/resources");
|
|
|
|
$response->assertStatus(200);
|
|
|
|
$body = $response->getContent();
|
|
expect($body)->not->toContain('sentinel_token');
|
|
expect($body)->not->toContain('logdrain_axiom_api_key');
|
|
expect($body)->not->toContain('logdrain_newrelic_license_key');
|
|
});
|
|
});
|
|
|
|
describe('GET /api/v1/security/keys sensitive field gating', function () {
|
|
beforeEach(function () {
|
|
PrivateKey::withoutEvents(function () {
|
|
PrivateKey::forceCreate([
|
|
'uuid' => 'private-key-sensitive-test',
|
|
'name' => 'Sensitive key',
|
|
'description' => 'test',
|
|
'private_key' => 'super-secret-private-key',
|
|
'is_git_related' => false,
|
|
'team_id' => $this->team->id,
|
|
]);
|
|
});
|
|
});
|
|
|
|
test('read token does not leak private key material', function () {
|
|
$token = makeApiToken($this->user, $this->team, ['read']);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$token,
|
|
])->getJson('/api/v1/security/keys/private-key-sensitive-test');
|
|
|
|
$response->assertStatus(200);
|
|
|
|
expect($response->getContent())->not->toContain('"private_key":');
|
|
});
|
|
|
|
test('read sensitive token sees private key material', function () {
|
|
$token = makeApiToken($this->user, $this->team, ['read', 'read:sensitive']);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$token,
|
|
])->getJson('/api/v1/security/keys/private-key-sensitive-test');
|
|
|
|
$response->assertStatus(200);
|
|
|
|
expect($response->getContent())->toContain('"private_key":');
|
|
});
|
|
|
|
test('read token does not leak private key material in key list', function () {
|
|
$token = makeApiToken($this->user, $this->team, ['read']);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$token,
|
|
])->getJson('/api/v1/security/keys');
|
|
|
|
$response->assertStatus(200);
|
|
|
|
expect($response->getContent())->not->toContain('"private_key":');
|
|
});
|
|
|
|
test('read sensitive token sees private key material in key list', function () {
|
|
$token = makeApiToken($this->user, $this->team, ['read', 'read:sensitive']);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$token,
|
|
])->getJson('/api/v1/security/keys');
|
|
|
|
$response->assertStatus(200);
|
|
|
|
expect($response->getContent())->toContain('"private_key":');
|
|
});
|
|
});
|
|
|
|
describe('GET /api/v1/deployments sensitive field gating', function () {
|
|
beforeEach(function () {
|
|
$this->project = Project::factory()->create(['team_id' => $this->team->id]);
|
|
$this->environment = Environment::factory()->create(['project_id' => $this->project->id]);
|
|
$destination = $this->server->standaloneDockers()->firstOrFail();
|
|
|
|
$this->application = Application::create([
|
|
'name' => 'deployment-sensitive-test-app',
|
|
'git_repository' => 'https://github.com/test/test',
|
|
'git_branch' => 'main',
|
|
'build_pack' => 'nixpacks',
|
|
'ports_exposes' => '3000',
|
|
'environment_id' => $this->environment->id,
|
|
'destination_id' => $destination->id,
|
|
'destination_type' => $destination->getMorphClass(),
|
|
]);
|
|
|
|
ApplicationDeploymentQueue::create([
|
|
'application_id' => $this->application->id,
|
|
'deployment_uuid' => 'deployment-sensitive-test',
|
|
'pull_request_id' => 0,
|
|
'status' => 'in_progress',
|
|
'logs' => '[{"output":"super-secret-deployment-log"}]',
|
|
'server_id' => $this->server->id,
|
|
'application_name' => $this->application->name,
|
|
'server_name' => $this->server->name,
|
|
]);
|
|
});
|
|
|
|
test('read token does not leak deployment logs', function () {
|
|
$token = makeApiToken($this->user, $this->team, ['read']);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$token,
|
|
])->getJson('/api/v1/deployments/deployment-sensitive-test');
|
|
|
|
$response->assertStatus(200);
|
|
|
|
expect($response->getContent())->not->toContain('"logs":');
|
|
});
|
|
|
|
test('read sensitive token sees deployment logs', function () {
|
|
$token = makeApiToken($this->user, $this->team, ['read', 'read:sensitive']);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$token,
|
|
])->getJson('/api/v1/deployments/deployment-sensitive-test');
|
|
|
|
$response->assertStatus(200);
|
|
|
|
expect($response->getContent())->toContain('"logs":');
|
|
});
|
|
|
|
test('read token does not leak deployment logs in deployment list', function () {
|
|
$token = makeApiToken($this->user, $this->team, ['read']);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$token,
|
|
])->getJson('/api/v1/deployments');
|
|
|
|
$response->assertStatus(200);
|
|
|
|
expect($response->getContent())->not->toContain('"logs":');
|
|
});
|
|
|
|
test('read sensitive token sees deployment logs in deployment list', function () {
|
|
$token = makeApiToken($this->user, $this->team, ['read', 'read:sensitive']);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$token,
|
|
])->getJson('/api/v1/deployments');
|
|
|
|
$response->assertStatus(200);
|
|
|
|
expect($response->getContent())->toContain('"logs":');
|
|
});
|
|
|
|
test('read token does not leak deployment logs in application deployment history', function () {
|
|
$token = makeApiToken($this->user, $this->team, ['read']);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$token,
|
|
])->getJson("/api/v1/deployments/applications/{$this->application->uuid}");
|
|
|
|
$response->assertStatus(200);
|
|
|
|
expect($response->getContent())->not->toContain('"logs":');
|
|
});
|
|
|
|
test('read sensitive token sees deployment logs in application deployment history', function () {
|
|
$token = makeApiToken($this->user, $this->team, ['read', 'read:sensitive']);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$token,
|
|
])->getJson("/api/v1/deployments/applications/{$this->application->uuid}");
|
|
|
|
$response->assertStatus(200);
|
|
|
|
expect($response->getContent())->toContain('"logs":');
|
|
});
|
|
});
|
|
|
|
describe('GET /api/v1/applications nested-relation scrubbing', function () {
|
|
beforeEach(function () {
|
|
$this->project = Project::factory()->create(['team_id' => $this->team->id]);
|
|
$this->environment = Environment::factory()->create(['project_id' => $this->project->id]);
|
|
$destination = $this->server->standaloneDockers()->firstOrFail();
|
|
|
|
$this->application = Application::create([
|
|
'name' => 'sensitive-test-app',
|
|
'git_repository' => 'https://github.com/test/test',
|
|
'git_branch' => 'main',
|
|
'build_pack' => 'nixpacks',
|
|
'ports_exposes' => '3000',
|
|
'environment_id' => $this->environment->id,
|
|
'destination_id' => $destination->id,
|
|
'destination_type' => $destination->getMorphClass(),
|
|
]);
|
|
});
|
|
|
|
test('read token does not leak sentinel_token via destination.server.settings', function () {
|
|
$token = makeApiToken($this->user, $this->team, ['read']);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$token,
|
|
])->getJson('/api/v1/applications');
|
|
|
|
$response->assertStatus(200);
|
|
|
|
$body = $response->getContent();
|
|
expect($body)->not->toContain('"sentinel_token":');
|
|
expect($body)->not->toContain('"sentinel_custom_url":');
|
|
expect($body)->not->toContain('"logdrain_axiom_api_key":');
|
|
});
|
|
|
|
test('read-sensitive token sees nested sentinel_token via destination.server.settings', function () {
|
|
$token = makeApiToken($this->user, $this->team, ['read', 'read:sensitive']);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$token,
|
|
])->getJson('/api/v1/applications');
|
|
|
|
$response->assertStatus(200);
|
|
|
|
$body = $response->getContent();
|
|
expect($body)->toContain('"sentinel_token":');
|
|
expect($body)->toContain('"sentinel_custom_url":');
|
|
});
|
|
|
|
test('read token does not leak application detail sensitive fields', function () {
|
|
$this->application->forceFill([
|
|
'manual_webhook_secret_github' => 'super-secret-github-webhook',
|
|
'http_basic_auth_password' => 'super-secret-basic-password',
|
|
])->save();
|
|
|
|
$token = makeApiToken($this->user, $this->team, ['read']);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$token,
|
|
])->getJson("/api/v1/applications/{$this->application->uuid}");
|
|
|
|
$response->assertStatus(200);
|
|
|
|
$body = $response->getContent();
|
|
expect($body)->not->toContain('"manual_webhook_secret_github":')
|
|
->and($body)->not->toContain('"http_basic_auth_password":')
|
|
->and($body)->not->toContain('"sentinel_token":');
|
|
});
|
|
|
|
test('read sensitive token sees application detail sensitive fields', function () {
|
|
$this->application->forceFill([
|
|
'manual_webhook_secret_github' => 'super-secret-github-webhook',
|
|
'http_basic_auth_password' => 'super-secret-basic-password',
|
|
])->save();
|
|
|
|
$token = makeApiToken($this->user, $this->team, ['read', 'read:sensitive']);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$token,
|
|
])->getJson("/api/v1/applications/{$this->application->uuid}");
|
|
|
|
$response->assertStatus(200);
|
|
|
|
$body = $response->getContent();
|
|
expect($body)->toContain('"manual_webhook_secret_github":')
|
|
->and($body)->toContain('"http_basic_auth_password":')
|
|
->and($body)->toContain('"sentinel_token":');
|
|
});
|
|
|
|
test('application env responses hide values for read tokens and reveal them for sensitive tokens', function () {
|
|
$this->application->environment_variables()->create([
|
|
'key' => 'APP_SECRET',
|
|
'value' => 'super-secret-app-env',
|
|
]);
|
|
|
|
$readToken = makeApiToken($this->user, $this->team, ['read']);
|
|
$sensitiveToken = makeApiToken($this->user, $this->team, ['read', 'read:sensitive']);
|
|
|
|
$readResponse = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$readToken,
|
|
])->getJson("/api/v1/applications/{$this->application->uuid}/envs");
|
|
|
|
auth()->forgetGuards();
|
|
|
|
$sensitiveResponse = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$sensitiveToken,
|
|
])->getJson("/api/v1/applications/{$this->application->uuid}/envs");
|
|
|
|
$readResponse->assertStatus(200);
|
|
$sensitiveResponse->assertStatus(200);
|
|
|
|
expect($readResponse->getContent())->not->toContain('"value":')
|
|
->and($readResponse->getContent())->not->toContain('"real_value":')
|
|
->and($sensitiveResponse->getContent())->toContain('"value":')
|
|
->and($sensitiveResponse->getContent())->toContain('"real_value":');
|
|
});
|
|
|
|
test('application create env response does not include secret values', function () {
|
|
$writeToken = makeApiToken($this->user, $this->team, ['write']);
|
|
$sensitiveToken = makeApiToken($this->user, $this->team, ['write', 'read:sensitive']);
|
|
|
|
$writeResponse = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$writeToken,
|
|
])->postJson("/api/v1/applications/{$this->application->uuid}/envs", [
|
|
'key' => 'APP_CREATE_SECRET',
|
|
'value' => 'super-secret-app-create-env',
|
|
]);
|
|
|
|
auth()->forgetGuards();
|
|
|
|
$sensitiveResponse = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$sensitiveToken,
|
|
])->postJson("/api/v1/applications/{$this->application->uuid}/envs", [
|
|
'key' => 'APP_CREATE_SENSITIVE_SECRET',
|
|
'value' => 'super-secret-app-create-sensitive-env',
|
|
]);
|
|
|
|
$writeResponse->assertStatus(201);
|
|
$sensitiveResponse->assertStatus(201);
|
|
|
|
expect($writeResponse->getContent())->not->toContain('"value":')
|
|
->and($writeResponse->getContent())->not->toContain('"real_value":')
|
|
->and($sensitiveResponse->getContent())->not->toContain('"value":')
|
|
->and($sensitiveResponse->getContent())->not->toContain('"real_value":');
|
|
});
|
|
|
|
test('application update env response hides values for write tokens and reveals them for sensitive tokens', function () {
|
|
$this->application->environment_variables()->create([
|
|
'key' => 'APP_UPDATE_SECRET',
|
|
'value' => 'old-app-update-secret',
|
|
]);
|
|
|
|
$writeToken = makeApiToken($this->user, $this->team, ['write']);
|
|
$sensitiveToken = makeApiToken($this->user, $this->team, ['write', 'read:sensitive']);
|
|
|
|
$writeResponse = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$writeToken,
|
|
])->patchJson("/api/v1/applications/{$this->application->uuid}/envs", [
|
|
'key' => 'APP_UPDATE_SECRET',
|
|
'value' => 'hidden-app-update-secret',
|
|
'is_multiline' => false,
|
|
'is_shown_once' => false,
|
|
]);
|
|
|
|
auth()->forgetGuards();
|
|
|
|
$sensitiveResponse = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$sensitiveToken,
|
|
])->patchJson("/api/v1/applications/{$this->application->uuid}/envs", [
|
|
'key' => 'APP_UPDATE_SECRET',
|
|
'value' => 'visible-app-update-secret',
|
|
'is_multiline' => false,
|
|
'is_shown_once' => false,
|
|
]);
|
|
|
|
$writeResponse->assertStatus(201);
|
|
$sensitiveResponse->assertStatus(201);
|
|
|
|
expect($writeResponse->getContent())->not->toContain('"value":')
|
|
->and($writeResponse->getContent())->not->toContain('"real_value":')
|
|
->and($sensitiveResponse->getContent())->toContain('"value":')
|
|
->and($sensitiveResponse->getContent())->toContain('"real_value":');
|
|
});
|
|
|
|
test('application bulk env response hides values for write tokens and reveals them for sensitive tokens', function () {
|
|
$writeToken = makeApiToken($this->user, $this->team, ['write']);
|
|
$sensitiveToken = makeApiToken($this->user, $this->team, ['write', 'read:sensitive']);
|
|
|
|
$writeResponse = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$writeToken,
|
|
])->patchJson("/api/v1/applications/{$this->application->uuid}/envs/bulk", [
|
|
'data' => [[
|
|
'key' => 'APP_BULK_SECRET',
|
|
'value' => 'hidden-app-bulk-secret',
|
|
]],
|
|
]);
|
|
|
|
auth()->forgetGuards();
|
|
|
|
$sensitiveResponse = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$sensitiveToken,
|
|
])->patchJson("/api/v1/applications/{$this->application->uuid}/envs/bulk", [
|
|
'data' => [[
|
|
'key' => 'APP_BULK_SENSITIVE_SECRET',
|
|
'value' => 'visible-app-bulk-secret',
|
|
]],
|
|
]);
|
|
|
|
$writeResponse->assertStatus(201);
|
|
$sensitiveResponse->assertStatus(201);
|
|
|
|
expect($writeResponse->getContent())->not->toContain('"value":')
|
|
->and($writeResponse->getContent())->not->toContain('"real_value":')
|
|
->and($sensitiveResponse->getContent())->toContain('"value":')
|
|
->and($sensitiveResponse->getContent())->toContain('"real_value":');
|
|
});
|
|
});
|
|
|
|
describe('GET /api/v1/databases sensitive field gating', function () {
|
|
beforeEach(function () {
|
|
$this->project = Project::factory()->create(['team_id' => $this->team->id]);
|
|
$this->environment = Environment::factory()->create(['project_id' => $this->project->id]);
|
|
$destination = $this->server->standaloneDockers()->firstOrFail();
|
|
|
|
$this->database = StandalonePostgresql::create([
|
|
'name' => 'sensitive-db',
|
|
'description' => 'test',
|
|
'postgres_user' => 'postgres',
|
|
'postgres_password' => encrypt('super-secret-db-password'),
|
|
'postgres_db' => 'app',
|
|
'image' => 'postgres:16-alpine',
|
|
'environment_id' => $this->environment->id,
|
|
'destination_id' => $destination->id,
|
|
'destination_type' => $destination->getMorphClass(),
|
|
]);
|
|
});
|
|
|
|
test('read token database list does not lazy load nested server relations', function () {
|
|
$token = makeApiToken($this->user, $this->team, ['read']);
|
|
|
|
$preventedLazyLoading = Model::preventsLazyLoading();
|
|
Model::preventLazyLoading();
|
|
|
|
try {
|
|
$response = $this->withoutExceptionHandling()->withHeaders([
|
|
'Authorization' => 'Bearer '.$token,
|
|
])->getJson('/api/v1/databases');
|
|
} finally {
|
|
Model::preventLazyLoading($preventedLazyLoading);
|
|
}
|
|
|
|
$response->assertStatus(200);
|
|
});
|
|
|
|
test('read token does not leak postgres_password or db urls', function () {
|
|
$token = makeApiToken($this->user, $this->team, ['read']);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$token,
|
|
])->getJson('/api/v1/databases');
|
|
|
|
$response->assertStatus(200);
|
|
|
|
$body = $response->getContent();
|
|
expect($body)->not->toContain('postgres_password');
|
|
expect($body)->not->toContain('internal_db_url');
|
|
expect($body)->not->toContain('external_db_url');
|
|
});
|
|
|
|
test('read sensitive token sees postgres_password and nested sentinel_token', function () {
|
|
$token = makeApiToken($this->user, $this->team, ['read', 'read:sensitive']);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$token,
|
|
])->getJson('/api/v1/databases');
|
|
|
|
$response->assertStatus(200);
|
|
|
|
$body = $response->getContent();
|
|
expect($body)->toContain('"postgres_password":');
|
|
expect($body)->toContain('"internal_db_url":');
|
|
expect($body)->toContain('"sentinel_token":');
|
|
});
|
|
|
|
test('read token does not leak database detail sensitive fields', function () {
|
|
$token = makeApiToken($this->user, $this->team, ['read']);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$token,
|
|
])->getJson("/api/v1/databases/{$this->database->uuid}");
|
|
|
|
$response->assertStatus(200);
|
|
|
|
$body = $response->getContent();
|
|
expect($body)->not->toContain('"postgres_password":')
|
|
->and($body)->not->toContain('"internal_db_url":')
|
|
->and($body)->not->toContain('"external_db_url":')
|
|
->and($body)->not->toContain('"sentinel_token":');
|
|
});
|
|
|
|
test('read sensitive token sees database detail sensitive fields', function () {
|
|
$token = makeApiToken($this->user, $this->team, ['read', 'read:sensitive']);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$token,
|
|
])->getJson("/api/v1/databases/{$this->database->uuid}");
|
|
|
|
$response->assertStatus(200);
|
|
|
|
$body = $response->getContent();
|
|
expect($body)->toContain('"postgres_password":')
|
|
->and($body)->toContain('"internal_db_url":')
|
|
->and($body)->toContain('"sentinel_token":');
|
|
});
|
|
|
|
test('database env responses hide values for read tokens and reveal them for sensitive tokens', function () {
|
|
$this->database->environment_variables()->create([
|
|
'key' => 'DB_SECRET',
|
|
'value' => 'super-secret-db-env',
|
|
]);
|
|
|
|
$readToken = makeApiToken($this->user, $this->team, ['read']);
|
|
$sensitiveToken = makeApiToken($this->user, $this->team, ['read', 'read:sensitive']);
|
|
|
|
$readResponse = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$readToken,
|
|
])->getJson("/api/v1/databases/{$this->database->uuid}/envs");
|
|
|
|
auth()->forgetGuards();
|
|
|
|
$sensitiveResponse = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$sensitiveToken,
|
|
])->getJson("/api/v1/databases/{$this->database->uuid}/envs");
|
|
|
|
$readResponse->assertStatus(200);
|
|
$sensitiveResponse->assertStatus(200);
|
|
|
|
expect($readResponse->getContent())->not->toContain('"value":')
|
|
->and($readResponse->getContent())->not->toContain('"real_value":')
|
|
->and($sensitiveResponse->getContent())->toContain('"value":')
|
|
->and($sensitiveResponse->getContent())->toContain('"real_value":');
|
|
});
|
|
|
|
test('database create env response hides values for write tokens and reveals them for sensitive tokens', function () {
|
|
$writeToken = makeApiToken($this->user, $this->team, ['write']);
|
|
$sensitiveToken = makeApiToken($this->user, $this->team, ['write', 'read:sensitive']);
|
|
|
|
$writeResponse = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$writeToken,
|
|
])->postJson("/api/v1/databases/{$this->database->uuid}/envs", [
|
|
'key' => 'DB_CREATE_SECRET',
|
|
'value' => 'hidden-db-create-secret',
|
|
]);
|
|
|
|
auth()->forgetGuards();
|
|
|
|
$sensitiveResponse = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$sensitiveToken,
|
|
])->postJson("/api/v1/databases/{$this->database->uuid}/envs", [
|
|
'key' => 'DB_CREATE_SENSITIVE_SECRET',
|
|
'value' => 'visible-db-create-secret',
|
|
]);
|
|
|
|
$writeResponse->assertStatus(201);
|
|
$sensitiveResponse->assertStatus(201);
|
|
|
|
expect($writeResponse->getContent())->not->toContain('"value":')
|
|
->and($writeResponse->getContent())->not->toContain('"real_value":')
|
|
->and($sensitiveResponse->getContent())->toContain('"value":')
|
|
->and($sensitiveResponse->getContent())->toContain('"real_value":');
|
|
});
|
|
|
|
test('database update env response hides values for write tokens and reveals them for sensitive tokens', function () {
|
|
$this->database->environment_variables()->create([
|
|
'key' => 'DB_UPDATE_SECRET',
|
|
'value' => 'old-db-update-secret',
|
|
]);
|
|
|
|
$writeToken = makeApiToken($this->user, $this->team, ['write']);
|
|
$sensitiveToken = makeApiToken($this->user, $this->team, ['write', 'read:sensitive']);
|
|
|
|
$writeResponse = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$writeToken,
|
|
])->patchJson("/api/v1/databases/{$this->database->uuid}/envs", [
|
|
'key' => 'DB_UPDATE_SECRET',
|
|
'value' => 'hidden-db-update-secret',
|
|
]);
|
|
|
|
auth()->forgetGuards();
|
|
|
|
$sensitiveResponse = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$sensitiveToken,
|
|
])->patchJson("/api/v1/databases/{$this->database->uuid}/envs", [
|
|
'key' => 'DB_UPDATE_SECRET',
|
|
'value' => 'visible-db-update-secret',
|
|
]);
|
|
|
|
$writeResponse->assertStatus(201);
|
|
$sensitiveResponse->assertStatus(201);
|
|
|
|
expect($writeResponse->getContent())->not->toContain('"value":')
|
|
->and($writeResponse->getContent())->not->toContain('"real_value":')
|
|
->and($sensitiveResponse->getContent())->toContain('"value":')
|
|
->and($sensitiveResponse->getContent())->toContain('"real_value":');
|
|
});
|
|
|
|
test('database bulk env response hides values for write tokens and reveals them for sensitive tokens', function () {
|
|
$writeToken = makeApiToken($this->user, $this->team, ['write']);
|
|
$sensitiveToken = makeApiToken($this->user, $this->team, ['write', 'read:sensitive']);
|
|
|
|
$writeResponse = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$writeToken,
|
|
])->patchJson("/api/v1/databases/{$this->database->uuid}/envs/bulk", [
|
|
'data' => [[
|
|
'key' => 'DB_BULK_SECRET',
|
|
'value' => 'hidden-db-bulk-secret',
|
|
]],
|
|
]);
|
|
|
|
auth()->forgetGuards();
|
|
|
|
$sensitiveResponse = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$sensitiveToken,
|
|
])->patchJson("/api/v1/databases/{$this->database->uuid}/envs/bulk", [
|
|
'data' => [[
|
|
'key' => 'DB_BULK_SENSITIVE_SECRET',
|
|
'value' => 'visible-db-bulk-secret',
|
|
]],
|
|
]);
|
|
|
|
$writeResponse->assertStatus(201);
|
|
$sensitiveResponse->assertStatus(201);
|
|
|
|
expect($writeResponse->getContent())->not->toContain('"value":')
|
|
->and($writeResponse->getContent())->not->toContain('"real_value":')
|
|
->and($sensitiveResponse->getContent())->toContain('"value":')
|
|
->and($sensitiveResponse->getContent())->toContain('"real_value":');
|
|
});
|
|
|
|
test('project database list can eager load nested destination server settings', function () {
|
|
$databases = $this->project->databases(['destination.server.settings']);
|
|
$database = $databases->firstWhere('id', $this->database->id);
|
|
|
|
expect($database)->not->toBeNull()
|
|
->and($database->relationLoaded('destination'))->toBeTrue()
|
|
->and($database->destination->relationLoaded('server'))->toBeTrue()
|
|
->and($database->destination->server->relationLoaded('settings'))->toBeTrue();
|
|
});
|
|
});
|
|
|
|
describe('GET /api/v1/services sensitive field gating', function () {
|
|
beforeEach(function () {
|
|
$this->project = Project::factory()->create(['team_id' => $this->team->id]);
|
|
$this->environment = Environment::factory()->create(['project_id' => $this->project->id]);
|
|
|
|
$destination = $this->server->standaloneDockers()->firstOrFail();
|
|
$this->service = Service::factory()->create([
|
|
'server_id' => $this->server->id,
|
|
'destination_id' => $destination->id,
|
|
'destination_type' => $destination->getMorphClass(),
|
|
'environment_id' => $this->environment->id,
|
|
]);
|
|
});
|
|
|
|
test('read token does not leak service or nested server sensitive fields', function () {
|
|
$token = makeApiToken($this->user, $this->team, ['read']);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$token,
|
|
])->getJson('/api/v1/services');
|
|
|
|
$response->assertStatus(200);
|
|
|
|
$body = $response->getContent();
|
|
expect($body)->not->toContain('"docker_compose_raw":')
|
|
->and($body)->not->toContain('"sentinel_token":')
|
|
->and($body)->not->toContain('"sentinel_custom_url":');
|
|
});
|
|
|
|
test('read sensitive token sees service and nested server sensitive fields', function () {
|
|
$token = makeApiToken($this->user, $this->team, ['read', 'read:sensitive']);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$token,
|
|
])->getJson('/api/v1/services');
|
|
|
|
$response->assertStatus(200);
|
|
|
|
$body = $response->getContent();
|
|
expect($body)->toContain('"docker_compose_raw":')
|
|
->and($body)->toContain('"sentinel_token":')
|
|
->and($body)->toContain('"sentinel_custom_url":');
|
|
});
|
|
|
|
test('read token does not leak service detail sensitive fields', function () {
|
|
$this->service->forceFill([
|
|
'docker_compose_raw' => 'services: secret',
|
|
'docker_compose' => 'services: rendered',
|
|
])->save();
|
|
|
|
$token = makeApiToken($this->user, $this->team, ['read']);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$token,
|
|
])->getJson("/api/v1/services/{$this->service->uuid}");
|
|
|
|
$response->assertStatus(200);
|
|
|
|
$body = $response->getContent();
|
|
expect($body)->not->toContain('"docker_compose_raw":')
|
|
->and($body)->not->toContain('"docker_compose":')
|
|
->and($body)->not->toContain('"sentinel_token":');
|
|
});
|
|
|
|
test('read sensitive token sees service detail sensitive fields', function () {
|
|
$this->service->forceFill([
|
|
'docker_compose_raw' => 'services: secret',
|
|
'docker_compose' => 'services: rendered',
|
|
])->save();
|
|
|
|
$token = makeApiToken($this->user, $this->team, ['read', 'read:sensitive']);
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$token,
|
|
])->getJson("/api/v1/services/{$this->service->uuid}");
|
|
|
|
$response->assertStatus(200);
|
|
|
|
$body = $response->getContent();
|
|
expect($body)->toContain('"docker_compose_raw":')
|
|
->and($body)->toContain('"docker_compose":')
|
|
->and($body)->toContain('"sentinel_token":');
|
|
});
|
|
|
|
test('service env responses hide values for read tokens and reveal them for sensitive tokens', function () {
|
|
$this->service->environment_variables()->create([
|
|
'key' => 'SERVICE_SECRET',
|
|
'value' => 'super-secret-service-env',
|
|
]);
|
|
|
|
$readToken = makeApiToken($this->user, $this->team, ['read']);
|
|
$sensitiveToken = makeApiToken($this->user, $this->team, ['read', 'read:sensitive']);
|
|
|
|
$readResponse = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$readToken,
|
|
])->getJson("/api/v1/services/{$this->service->uuid}/envs");
|
|
|
|
auth()->forgetGuards();
|
|
|
|
$sensitiveResponse = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$sensitiveToken,
|
|
])->getJson("/api/v1/services/{$this->service->uuid}/envs");
|
|
|
|
$readResponse->assertStatus(200);
|
|
$sensitiveResponse->assertStatus(200);
|
|
|
|
expect($readResponse->getContent())->not->toContain('"value":')
|
|
->and($readResponse->getContent())->not->toContain('"real_value":')
|
|
->and($sensitiveResponse->getContent())->toContain('"value":')
|
|
->and($sensitiveResponse->getContent())->toContain('"real_value":');
|
|
});
|
|
|
|
test('service create env response hides values for write tokens and reveals them for sensitive tokens', function () {
|
|
$writeToken = makeApiToken($this->user, $this->team, ['write']);
|
|
$sensitiveToken = makeApiToken($this->user, $this->team, ['write', 'read:sensitive']);
|
|
|
|
$writeResponse = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$writeToken,
|
|
])->postJson("/api/v1/services/{$this->service->uuid}/envs", [
|
|
'key' => 'SERVICE_CREATE_SECRET',
|
|
'value' => 'hidden-service-create-secret',
|
|
]);
|
|
|
|
auth()->forgetGuards();
|
|
|
|
$sensitiveResponse = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$sensitiveToken,
|
|
])->postJson("/api/v1/services/{$this->service->uuid}/envs", [
|
|
'key' => 'SERVICE_CREATE_SENSITIVE_SECRET',
|
|
'value' => 'visible-service-create-secret',
|
|
]);
|
|
|
|
$writeResponse->assertStatus(201);
|
|
$sensitiveResponse->assertStatus(201);
|
|
|
|
expect($writeResponse->getContent())->not->toContain('"value":')
|
|
->and($writeResponse->getContent())->not->toContain('"real_value":')
|
|
->and($sensitiveResponse->getContent())->toContain('"value":')
|
|
->and($sensitiveResponse->getContent())->toContain('"real_value":');
|
|
});
|
|
|
|
test('service update env response hides values for write tokens and reveals them for sensitive tokens', function () {
|
|
$this->service->environment_variables()->create([
|
|
'key' => 'SERVICE_UPDATE_SECRET',
|
|
'value' => 'old-service-update-secret',
|
|
]);
|
|
|
|
$writeToken = makeApiToken($this->user, $this->team, ['write']);
|
|
$sensitiveToken = makeApiToken($this->user, $this->team, ['write', 'read:sensitive']);
|
|
|
|
$writeResponse = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$writeToken,
|
|
])->patchJson("/api/v1/services/{$this->service->uuid}/envs", [
|
|
'key' => 'SERVICE_UPDATE_SECRET',
|
|
'value' => 'hidden-service-update-secret',
|
|
]);
|
|
|
|
auth()->forgetGuards();
|
|
|
|
$sensitiveResponse = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$sensitiveToken,
|
|
])->patchJson("/api/v1/services/{$this->service->uuid}/envs", [
|
|
'key' => 'SERVICE_UPDATE_SECRET',
|
|
'value' => 'visible-service-update-secret',
|
|
]);
|
|
|
|
$writeResponse->assertStatus(201);
|
|
$sensitiveResponse->assertStatus(201);
|
|
|
|
expect($writeResponse->getContent())->not->toContain('"value":')
|
|
->and($writeResponse->getContent())->not->toContain('"real_value":')
|
|
->and($sensitiveResponse->getContent())->toContain('"value":')
|
|
->and($sensitiveResponse->getContent())->toContain('"real_value":');
|
|
});
|
|
|
|
test('service bulk env response hides values for write tokens and reveals them for sensitive tokens', function () {
|
|
$writeToken = makeApiToken($this->user, $this->team, ['write']);
|
|
$sensitiveToken = makeApiToken($this->user, $this->team, ['write', 'read:sensitive']);
|
|
|
|
$writeResponse = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$writeToken,
|
|
])->patchJson("/api/v1/services/{$this->service->uuid}/envs/bulk", [
|
|
'data' => [[
|
|
'key' => 'SERVICE_BULK_SECRET',
|
|
'value' => 'hidden-service-bulk-secret',
|
|
]],
|
|
]);
|
|
|
|
auth()->forgetGuards();
|
|
|
|
$sensitiveResponse = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$sensitiveToken,
|
|
])->patchJson("/api/v1/services/{$this->service->uuid}/envs/bulk", [
|
|
'data' => [[
|
|
'key' => 'SERVICE_BULK_SENSITIVE_SECRET',
|
|
'value' => 'visible-service-bulk-secret',
|
|
]],
|
|
]);
|
|
|
|
$writeResponse->assertStatus(201);
|
|
$sensitiveResponse->assertStatus(201);
|
|
|
|
expect($writeResponse->getContent())->not->toContain('"value":')
|
|
->and($writeResponse->getContent())->not->toContain('"real_value":')
|
|
->and($sensitiveResponse->getContent())->toContain('"value":')
|
|
->and($sensitiveResponse->getContent())->toContain('"real_value":');
|
|
});
|
|
|
|
test('read sensitive service list eager loads nested server settings once', function () {
|
|
$secondServer = Server::factory()->create(['team_id' => $this->team->id]);
|
|
$secondDestination = $secondServer->standaloneDockers()->firstOrFail();
|
|
|
|
Service::factory()->create([
|
|
'server_id' => $secondServer->id,
|
|
'destination_id' => $secondDestination->id,
|
|
'destination_type' => $secondDestination->getMorphClass(),
|
|
'environment_id' => $this->environment->id,
|
|
]);
|
|
|
|
$token = makeApiToken($this->user, $this->team, ['read', 'read:sensitive']);
|
|
$serverSettingsQueries = collect();
|
|
|
|
DB::listen(function ($query) use ($serverSettingsQueries) {
|
|
if (str_contains($query->sql, 'from "server_settings"')) {
|
|
$serverSettingsQueries->push($query->sql);
|
|
}
|
|
});
|
|
|
|
$response = $this->withHeaders([
|
|
'Authorization' => 'Bearer '.$token,
|
|
])->getJson('/api/v1/services');
|
|
|
|
$response->assertStatus(200);
|
|
|
|
expect($serverSettingsQueries->contains(fn (string $sql) => str_contains($sql, '"server_settings"."server_id" in')))->toBeTrue();
|
|
});
|
|
});
|