License Enforcement Application

.expeditor/verify.pipeline.yml

@@ -154,6 +154,7 @@ steps:
           - USE_OMNIBUS_FILES=0
           - PEDANT_OPTS="--skip-oc_id"
           - BUNDLE_GEMFILE=/workdir/oc-chef-pedant/Gemfile
+          - IS_AUTOMATE=false
 
 - label: With ChefFS=1
   command:
@@ -174,6 +175,7 @@ steps:
           - PEDANT_OPTS="--skip-oc_id"
           - CHEF_FS=1
           - BUNDLE_GEMFILE=/workdir/oc-chef-pedant/Gemfile
+          - IS_AUTOMATE=false
 
 - label: automate_build
   command:
@@ -214,39 +216,61 @@ steps:
 - label: "chef server"
   command:
     - .expeditor/chef_server.sh
+  env:
+    IS_AUTOMATE: true
   timeout_in_minutes: 30 # longer timeout for chef-server
   expeditor:
-    executor:
-      linux:
-        privileged: true
     secrets:
       A2_LICENSE:
         path: secret/a2/license
         field: license
+      A2_EXPIRED_LICENSE:
+        path: secret/a2/license
+        field: expLicense
+    executor:
+      linux:
+        privileged: true
+        environment:
+          - IS_AUTOMATE=true
 
 - label: "chef server only"
   command:
     - .expeditor/chef_server_only.sh
+  env:
+    IS_AUTOMATE: true
   timeout_in_minutes: 20
   expeditor:
-    executor:
-      linux:
-        privileged: true
     secrets:
       A2_LICENSE:
         path: secret/a2/license
         field: license
+      A2_EXPIRED_LICENSE:
+        path: secret/a2/license
+        field: expLicense
+    executor:
+      linux:
+        privileged: true
+        environment:
+          - IS_AUTOMATE=true
+
 
 - label: "ha chef server"
   command:
     - .expeditor/ha_chef_server.sh
+  env:
+    IS_AUTOMATE: true
   timeout_in_minutes: 35
   expeditor:
-    executor:
-      linux:
-        single-use: true
-        privileged: true
     secrets:
       A2_LICENSE:
         path: secret/a2/license
-        field: license
+        field: license
+      A2_EXPIRED_LICENSE:
+        path: secret/a2/license
+        field: expLicense
+    executor:
+      linux:
+        privileged: true
+        single-use: true
+        environment:
+          - IS_AUTOMATE=true

oc-chef-pedant/spec/api/server_license_spec.rb

@@ -0,0 +1,61 @@
+# -*- coding: utf-8 -*-
+require 'pedant/rspec/common'
+
+describe "server license testing", :license do
+
+  # Pedant has configurable test users.
+  # Selects Pedant users that are marked as associated
+  let(:default_pedant_user_names) { platform.users.select(&:associate).map(&:name).sort }
+  let(:default_users_body)        { default_pedant_user_names.map { |user| {"user" => {"username" => user} } } }
+
+  # context "/users endpoint", automate: true do
+  context "/users endpoint" do
+    let(:request_url) { "#{platform.server}/users" }
+    let(:status_url) { "#{platform.server}/_status" }
+
+    let(:users_body) do
+      {
+        # There are other users, but these are ours, so they should always be
+        # somewhere in the userspace soup.
+        "pivotal" => "#{request_url}/pivotal",
+        platform.bad_user.name => "#{request_url}/#{platform.bad_user.name}",
+        platform.admin_user.name => "#{request_url}/#{platform.admin_user.name}",
+        platform.non_admin_user.name => "#{request_url}/#{platform.non_admin_user.name}",
+      }
+    end
+
+    context "when having valid license" do
+      it "can get all users and since the license is valid, they should show 200 as return", :smoke do
+        get(request_url, platform.superuser).should look_like({
+            :status => 200,
+            :body => users_body
+          })
+      end
+    end
+
+    # In case of Embedded chef-server in Automate, If the license of automate is Expired in that case all requests reaching to chef-server should return 403
+    context "when not having valid license",  if: ENV["IS_AUTOMATE"] == "true" do
+      before(:all) do
+        puts "applying expired license"
+        puts ENV['A2_EXPIRED_LICENSE']
+        system("chef-automate license apply -f \"${A2_EXPIRED_LICENSE}\"")
+        system("sleep 50")
+        puts "expired license applied"
+        puts system("chef-automate license status")
+      end
+      after(:all) do
+        system("chef-automate license apply \"$A2_LICENSE\"")
+        system("sleep 50")
+        puts "valid license applied"
+        puts system("chef-automate license status")
+      end
+
+      it "returns 403", :smoke  do
+        puts get(request_url, platform.superuser)
+        get(request_url, platform.superuser).should look_like({
+            :status => 403
+          })
+      end
+    end
+  end # context /users/<name> endpoint
+end # describe users