From 2af1bb7579588538ce93147fa71ff136ee266bea Mon Sep 17 00:00:00 2001 From: Farhan Munshi <3207297+fmunshi@users.noreply.github.com> Date: Thu, 24 Sep 2020 11:26:11 -0400 Subject: [PATCH] [MM-28536] [MM-28535] sysconsole_write_authentication bug fixes (#15558) * MM-28536 User with write-auth should be able to use all saml related endpoints * MM-28535 allow users with write auth to invalidate pending email invites * Update api4/team_test.go * No need for init basic * Address review comments * Fix test ordering --- api4/saml.go | 32 ++++++++++++++++---------------- api4/team.go | 4 ++-- api4/team_test.go | 25 +++++++++++++++++++++++++ 3 files changed, 43 insertions(+), 18 deletions(-) diff --git a/api4/saml.go b/api4/saml.go index 6dc7a93585..d6aa0c9cda 100644 --- a/api4/saml.go +++ b/api4/saml.go @@ -62,8 +62,8 @@ func parseSamlCertificateRequest(r *http.Request, maxFileSize int64) (*multipart } func addSamlPublicCertificate(c *Context, w http.ResponseWriter, r *http.Request) { - if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_SYSTEM) { - c.SetPermissionError(model.PERMISSION_MANAGE_SYSTEM) + if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_SYSCONSOLE_WRITE_AUTHENTICATION) { + c.SetPermissionError(model.PERMISSION_SYSCONSOLE_WRITE_AUTHENTICATION) return } @@ -86,8 +86,8 @@ func addSamlPublicCertificate(c *Context, w http.ResponseWriter, r *http.Request } func addSamlPrivateCertificate(c *Context, w http.ResponseWriter, r *http.Request) { - if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_SYSTEM) { - c.SetPermissionError(model.PERMISSION_MANAGE_SYSTEM) + if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_SYSCONSOLE_WRITE_AUTHENTICATION) { + c.SetPermissionError(model.PERMISSION_SYSCONSOLE_WRITE_AUTHENTICATION) return } @@ -110,8 +110,8 @@ func addSamlPrivateCertificate(c *Context, w http.ResponseWriter, r *http.Reques } func addSamlIdpCertificate(c *Context, w http.ResponseWriter, r *http.Request) { - if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_SYSTEM) { - c.SetPermissionError(model.PERMISSION_MANAGE_SYSTEM) + if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_SYSCONSOLE_WRITE_AUTHENTICATION) { + c.SetPermissionError(model.PERMISSION_SYSCONSOLE_WRITE_AUTHENTICATION) return } @@ -163,8 +163,8 @@ func addSamlIdpCertificate(c *Context, w http.ResponseWriter, r *http.Request) { } func removeSamlPublicCertificate(c *Context, w http.ResponseWriter, r *http.Request) { - if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_SYSTEM) { - c.SetPermissionError(model.PERMISSION_MANAGE_SYSTEM) + if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_SYSCONSOLE_WRITE_AUTHENTICATION) { + c.SetPermissionError(model.PERMISSION_SYSCONSOLE_WRITE_AUTHENTICATION) return } @@ -181,8 +181,8 @@ func removeSamlPublicCertificate(c *Context, w http.ResponseWriter, r *http.Requ } func removeSamlPrivateCertificate(c *Context, w http.ResponseWriter, r *http.Request) { - if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_SYSTEM) { - c.SetPermissionError(model.PERMISSION_MANAGE_SYSTEM) + if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_SYSCONSOLE_WRITE_AUTHENTICATION) { + c.SetPermissionError(model.PERMISSION_SYSCONSOLE_WRITE_AUTHENTICATION) return } @@ -199,8 +199,8 @@ func removeSamlPrivateCertificate(c *Context, w http.ResponseWriter, r *http.Req } func removeSamlIdpCertificate(c *Context, w http.ResponseWriter, r *http.Request) { - if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_SYSTEM) { - c.SetPermissionError(model.PERMISSION_MANAGE_SYSTEM) + if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_SYSCONSOLE_WRITE_AUTHENTICATION) { + c.SetPermissionError(model.PERMISSION_SYSCONSOLE_WRITE_AUTHENTICATION) return } @@ -217,8 +217,8 @@ func removeSamlIdpCertificate(c *Context, w http.ResponseWriter, r *http.Request } func getSamlCertificateStatus(c *Context, w http.ResponseWriter, r *http.Request) { - if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_SYSTEM) { - c.SetPermissionError(model.PERMISSION_MANAGE_SYSTEM) + if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_SYSCONSOLE_WRITE_AUTHENTICATION) { + c.SetPermissionError(model.PERMISSION_SYSCONSOLE_WRITE_AUTHENTICATION) return } @@ -227,8 +227,8 @@ func getSamlCertificateStatus(c *Context, w http.ResponseWriter, r *http.Request } func getSamlMetadataFromIdp(c *Context, w http.ResponseWriter, r *http.Request) { - if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_SYSTEM) { - c.SetPermissionError(model.PERMISSION_MANAGE_SYSTEM) + if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_SYSCONSOLE_WRITE_AUTHENTICATION) { + c.SetPermissionError(model.PERMISSION_SYSCONSOLE_WRITE_AUTHENTICATION) return } diff --git a/api4/team.go b/api4/team.go index fb699d79f8..42499ba698 100644 --- a/api4/team.go +++ b/api4/team.go @@ -1328,8 +1328,8 @@ func getInviteInfo(c *Context, w http.ResponseWriter, r *http.Request) { } func invalidateAllEmailInvites(c *Context, w http.ResponseWriter, r *http.Request) { - if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_SYSTEM) { - c.SetPermissionError(model.PERMISSION_MANAGE_SYSTEM) + if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_SYSCONSOLE_WRITE_AUTHENTICATION) { + c.SetPermissionError(model.PERMISSION_SYSCONSOLE_WRITE_AUTHENTICATION) return } diff --git a/api4/team_test.go b/api4/team_test.go index 5a44e4639d..79f6c3f4dd 100644 --- a/api4/team_test.go +++ b/api4/team_test.go @@ -3351,3 +3351,28 @@ func TestTeamMembersMinusGroupMembers(t *testing.T) { }) } } + +func TestInvalidateAllEmailInvites(t *testing.T) { + th := Setup(t) + defer th.TearDown() + + t.Run("Forbidden when request performed by system user", func(t *testing.T) { + ok, res := th.Client.InvalidateEmailInvites() + require.Equal(t, false, ok) + CheckForbiddenStatus(t, res) + }) + + t.Run("OK when request performed by system user with requisite system permission", func(t *testing.T) { + th.AddPermissionToRole(model.PERMISSION_SYSCONSOLE_WRITE_AUTHENTICATION.Id, model.SYSTEM_USER_ROLE_ID) + defer th.RemovePermissionFromRole(model.PERMISSION_SYSCONSOLE_WRITE_AUTHENTICATION.Id, model.SYSTEM_USER_ROLE_ID) + ok, res := th.Client.InvalidateEmailInvites() + require.Equal(t, true, ok) + CheckOKStatus(t, res) + }) + + t.Run("OK when request performed by system admin", func(t *testing.T) { + ok, res := th.SystemAdminClient.InvalidateEmailInvites() + require.Equal(t, true, ok) + CheckOKStatus(t, res) + }) +}