mirror of
https://github.com/neondatabase/neon.git
synced 2026-05-16 20:50:37 +00:00
2ce5d8137d
There will be different scopes for those two, so authorization code should be different. The `check_permission` function is now not in the shared library. Its implementation is very similar to the one which will be added for Safekeeper. In fact, we may reuse the same existing root-like 'PageServerApi' scope, but I would prefer to have separate root-like scopes for services. Also, generate_management_token in tests is generate_pageserver_token now.
76 lines
2.8 KiB
Python
76 lines
2.8 KiB
Python
from contextlib import closing
|
|
|
|
import pytest
|
|
from fixtures.neon_fixtures import NeonEnvBuilder, PageserverApiException
|
|
from fixtures.types import TenantId
|
|
|
|
|
|
def test_pageserver_auth(neon_env_builder: NeonEnvBuilder):
|
|
neon_env_builder.auth_enabled = True
|
|
env = neon_env_builder.init_start()
|
|
|
|
ps = env.pageserver
|
|
|
|
tenant_token = env.auth_keys.generate_tenant_token(env.initial_tenant)
|
|
tenant_http_client = env.pageserver.http_client(tenant_token)
|
|
invalid_tenant_token = env.auth_keys.generate_tenant_token(TenantId.generate())
|
|
invalid_tenant_http_client = env.pageserver.http_client(invalid_tenant_token)
|
|
|
|
pageserver_token = env.auth_keys.generate_pageserver_token()
|
|
pageserver_http_client = env.pageserver.http_client(pageserver_token)
|
|
|
|
# this does not invoke auth check and only decodes jwt and checks it for validity
|
|
# check both tokens
|
|
ps.safe_psql("set FOO", password=tenant_token)
|
|
ps.safe_psql("set FOO", password=pageserver_token)
|
|
|
|
new_timeline_id = env.neon_cli.create_branch(
|
|
"test_pageserver_auth", tenant_id=env.initial_tenant
|
|
)
|
|
|
|
# tenant can create branches
|
|
tenant_http_client.timeline_create(
|
|
tenant_id=env.initial_tenant, ancestor_timeline_id=new_timeline_id
|
|
)
|
|
# console can create branches for tenant
|
|
pageserver_http_client.timeline_create(
|
|
tenant_id=env.initial_tenant, ancestor_timeline_id=new_timeline_id
|
|
)
|
|
|
|
# fail to create branch using token with different tenant_id
|
|
with pytest.raises(
|
|
PageserverApiException, match="Forbidden: Tenant id mismatch. Permission denied"
|
|
):
|
|
invalid_tenant_http_client.timeline_create(
|
|
tenant_id=env.initial_tenant, ancestor_timeline_id=new_timeline_id
|
|
)
|
|
|
|
# create tenant using management token
|
|
pageserver_http_client.tenant_create()
|
|
|
|
# fail to create tenant using tenant token
|
|
with pytest.raises(
|
|
PageserverApiException,
|
|
match="Forbidden: Attempt to access management api with tenant scope. Permission denied",
|
|
):
|
|
tenant_http_client.tenant_create()
|
|
|
|
|
|
def test_compute_auth_to_pageserver(neon_env_builder: NeonEnvBuilder):
|
|
neon_env_builder.auth_enabled = True
|
|
neon_env_builder.num_safekeepers = 3
|
|
env = neon_env_builder.init_start()
|
|
|
|
branch = "test_compute_auth_to_pageserver"
|
|
env.neon_cli.create_branch(branch)
|
|
pg = env.postgres.create_start(branch)
|
|
|
|
with closing(pg.connect()) as conn:
|
|
with conn.cursor() as cur:
|
|
# we rely upon autocommit after each statement
|
|
# as waiting for acceptors happens there
|
|
cur.execute("CREATE TABLE t(key int primary key, value text)")
|
|
cur.execute("INSERT INTO t SELECT generate_series(1,100000), 'payload'")
|
|
cur.execute("SELECT sum(key) FROM t")
|
|
assert cur.fetchone() == (5000050000,)
|