AuthenticationMW fixed; rbac tests added;

Author: bakhterets

internal/api/middleware.go

@@ -129,13 +129,13 @@ func AuthenticationMW(prov *auth.Provider, logger *zap.Logger, secretKey string)
 
 		if errUserID := setUserIDFromClaims(claims, c, logger); errUserID != nil {
 			logger.Error("failed to set userID from claims", zap.Error(errUserID))
-			c.Abort()
+			apiErrors.RaiseNotAuthorizedErr(c, apiErrors.ErrAuthTokenInvalid)
 			return
 		}
 
 		if groupsErr := setGroupsFromClaims(claims, c, logger); groupsErr != nil {
 			logger.Error("failed to set groups from claims", zap.Error(groupsErr))
-			c.Abort()
+			apiErrors.RaiseNotAuthorizedErr(c, apiErrors.ErrAuthTokenInvalid)
 			return
 		}
 
@@ -174,6 +174,7 @@ func SetJWTClaims(
 
 		claims, ok := token.Claims.(jwt.MapClaims)
 		if !ok {
+			logger.Error("authentication failed: unable to extract claims from token")
 			apiErrors.RaiseNotAuthorizedErr(c, apiErrors.ErrAuthTokenInvalid)
 			return
 		}

internal/api/middleware_test.go

@@ -123,6 +123,16 @@ func TestAuthenticationMW_HMAC_SuccessAndFailures(t *testing.T) {
 	w := performRequestWithAuth(mw, "Bearer "+signed)
 	assert.Equal(t, http.StatusOK, w.Code, "expected middleware to allow valid HMAC token")
 
+	invalidGroupsTkn := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims{
+		"preferred_username": "test-user",
+		"groups":             "sd_admins",
+	})
+	invalidSigned, err := invalidGroupsTkn.SignedString([]byte(secret))
+	require.NoError(t, err, "failed to sign token with invalid groups claim")
+
+	w = performRequestWithAuth(mw, "Bearer "+invalidSigned)
+	assert.Equal(t, http.StatusUnauthorized, w.Code, "expected 401 when groups claim has invalid type")
+
 	w = performRequestWithAuth(mw, "")
 	assert.Equal(t, http.StatusUnauthorized, w.Code, "expected 401 when no Authorization header")
 
@@ -136,8 +146,8 @@ func TestAuthenticationMW_RSA_ValidToken(t *testing.T) {
 	require.NoError(t, err, "failed to generate rsa key")
 
 	claims := jwt.MapClaims{
-		"sub":    "rsa-user",
-		"groups": []interface{}{"/sd-admins"},
+		"preferred_username": "rsa-user",
+		"groups":             []interface{}{"/sd-admins"},
 	}
 	token := jwt.NewWithClaims(jwt.SigningMethodRS256, claims)
 	signed, err := token.SignedString(priv)

tests/v2_events_rbac_test.go

@@ -714,3 +714,67 @@ func TestV2HasExtendedViewBehavior(t *testing.T) {
 		assert.GreaterOrEqual(t, len(resp.Data), 1, "should see at least the planned event")
 	})
 }
+
+func TestV2InvalidTokenAndClaims(t *testing.T) {
+	truncateIncidents(t)
+	r := initTestsWithHMAC(t)
+
+	creatorToken := generateTestToken("user-a", []string{"sd_creators"})
+
+	components := []int{1, 2}
+	impact := 0
+	system := false
+	startDate := time.Now().Add(time.Hour).UTC()
+	endDate := time.Now().Add(2 * time.Hour).UTC()
+
+	incData := v2.IncidentData{
+		Title: "Test event", Description: "test",
+		ContactEmail: "test@example.com", Impact: &impact,
+		Components: components, StartDate: startDate,
+		EndDate: &endDate, System: &system, Type: event.TypeMaintenance,
+	}
+
+	t.Run("invalid token signature returns 401", func(t *testing.T) {
+		wrongSecretToken := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims{
+			"preferred_username": "user-a",
+			"groups":             []interface{}{"sd_creators"},
+		})
+		invalidToken, err := wrongSecretToken.SignedString([]byte("wrong-secret"))
+		require.NoError(t, err)
+
+		data, _ := json.Marshal(incData)
+		w := httptest.NewRecorder()
+		req, _ := http.NewRequest(http.MethodPost, "/v2/events", bytes.NewReader(data))
+		req.Header.Set("Authorization", "Bearer "+invalidToken)
+		r.ServeHTTP(w, req)
+
+		assert.Equal(t, http.StatusUnauthorized, w.Code)
+	})
+
+	t.Run("valid token with invalid groups claim returns 401", func(t *testing.T) {
+		invalidClaimsToken := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims{
+			"preferred_username": "user-a",
+			"groups":             "sd_creators",
+		})
+		tokenWithInvalidClaims, err := invalidClaimsToken.SignedString([]byte(testHMACSecret))
+		require.NoError(t, err)
+
+		data, _ := json.Marshal(incData)
+		w := httptest.NewRecorder()
+		req, _ := http.NewRequest(http.MethodPost, "/v2/events", bytes.NewReader(data))
+		req.Header.Set("Authorization", "Bearer "+tokenWithInvalidClaims)
+		r.ServeHTTP(w, req)
+
+		assert.Equal(t, http.StatusUnauthorized, w.Code)
+	})
+
+	t.Run("valid token with valid claims succeeds", func(t *testing.T) {
+		data, _ := json.Marshal(incData)
+		w := httptest.NewRecorder()
+		req, _ := http.NewRequest(http.MethodPost, "/v2/events", bytes.NewReader(data))
+		req.Header.Set("Authorization", "Bearer "+creatorToken)
+		r.ServeHTTP(w, req)
+
+		assert.Equal(t, http.StatusOK, w.Code)
+	})
+}