d7939bed70
- Implemented `useManualChallenge`, `useChallengePoll`, and `useManualChallengeMutations` hooks for managing manual DNS challenges. - Created tests for the `useManualChallenge` hooks to ensure correct fetching and mutation behavior. - Added `ManualDNSChallenge` component for displaying challenge details and actions. - Developed end-to-end tests for the Manual DNS Provider feature, covering provider selection, challenge UI, and accessibility compliance. - Included error handling tests for verification failures and network errors.
2331 lines
68 KiB
Go
2331 lines
68 KiB
Go
package handlers
|
|
|
|
import (
|
|
"archive/tar"
|
|
"bytes"
|
|
"compress/gzip"
|
|
"context"
|
|
"encoding/json"
|
|
"errors"
|
|
"io"
|
|
"mime/multipart"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
|
|
"github.com/Wikid82/charon/backend/internal/crowdsec"
|
|
"github.com/Wikid82/charon/backend/internal/models"
|
|
"github.com/Wikid82/charon/backend/internal/services"
|
|
"github.com/gin-gonic/gin"
|
|
"github.com/stretchr/testify/require"
|
|
"gorm.io/gorm"
|
|
)
|
|
|
|
type fakeExec struct {
|
|
started bool
|
|
}
|
|
|
|
func (f *fakeExec) Start(ctx context.Context, binPath, configDir string) (int, error) {
|
|
f.started = true
|
|
return 12345, nil
|
|
}
|
|
func (f *fakeExec) Stop(ctx context.Context, configDir string) error {
|
|
f.started = false
|
|
return nil
|
|
}
|
|
func (f *fakeExec) Status(ctx context.Context, configDir string) (running bool, pid int, err error) {
|
|
if f.started {
|
|
return true, 12345, nil
|
|
}
|
|
return false, 0, nil
|
|
}
|
|
|
|
func setupCrowdDB(t *testing.T) *gorm.DB {
|
|
db := OpenTestDB(t)
|
|
// Migrate tables needed by CrowdSec handlers
|
|
if err := db.AutoMigrate(&models.SecurityConfig{}); err != nil {
|
|
t.Fatalf("failed to migrate SecurityConfig: %v", err)
|
|
}
|
|
return db
|
|
}
|
|
|
|
func TestCrowdsecEndpoints(t *testing.T) {
|
|
t.Parallel()
|
|
gin.SetMode(gin.TestMode)
|
|
db := setupCrowdDB(t)
|
|
tmpDir := t.TempDir()
|
|
|
|
fe := &fakeExec{}
|
|
h := NewCrowdsecHandler(db, fe, "/bin/false", tmpDir)
|
|
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
// Status (initially stopped)
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodGet, "/api/v1/admin/crowdsec/status", http.NoBody)
|
|
r.ServeHTTP(w, req)
|
|
if w.Code != http.StatusOK {
|
|
t.Fatalf("status expected 200 got %d", w.Code)
|
|
}
|
|
|
|
// Start
|
|
w2 := httptest.NewRecorder()
|
|
req2 := httptest.NewRequest(http.MethodPost, "/api/v1/admin/crowdsec/start", http.NoBody)
|
|
r.ServeHTTP(w2, req2)
|
|
if w2.Code != http.StatusOK {
|
|
t.Fatalf("start expected 200 got %d", w2.Code)
|
|
}
|
|
|
|
// Stop
|
|
w3 := httptest.NewRecorder()
|
|
req3 := httptest.NewRequest(http.MethodPost, "/api/v1/admin/crowdsec/stop", http.NoBody)
|
|
r.ServeHTTP(w3, req3)
|
|
if w3.Code != http.StatusOK {
|
|
t.Fatalf("stop expected 200 got %d", w3.Code)
|
|
}
|
|
}
|
|
|
|
func TestImportConfig(t *testing.T) {
|
|
t.Parallel()
|
|
gin.SetMode(gin.TestMode)
|
|
db := setupCrowdDB(t)
|
|
tmpDir := t.TempDir()
|
|
fe := &fakeExec{}
|
|
h := NewCrowdsecHandler(db, fe, "/bin/false", tmpDir)
|
|
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
// create a small file to upload
|
|
buf := &bytes.Buffer{}
|
|
mw := multipart.NewWriter(buf)
|
|
fw, _ := mw.CreateFormFile("file", "cfg.tar.gz")
|
|
_, _ = fw.Write([]byte("dummy"))
|
|
_ = mw.Close()
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodPost, "/api/v1/admin/crowdsec/import", buf)
|
|
req.Header.Set("Content-Type", mw.FormDataContentType())
|
|
r.ServeHTTP(w, req)
|
|
if w.Code != http.StatusOK {
|
|
t.Fatalf("import expected 200 got %d body=%s", w.Code, w.Body.String())
|
|
}
|
|
|
|
// ensure file exists in data dir
|
|
if _, err := os.Stat(filepath.Join(tmpDir, "cfg.tar.gz")); err != nil {
|
|
t.Fatalf("expected file in data dir: %v", err)
|
|
}
|
|
}
|
|
|
|
func TestImportCreatesBackup(t *testing.T) {
|
|
t.Parallel()
|
|
gin.SetMode(gin.TestMode)
|
|
db := setupCrowdDB(t)
|
|
tmpDir := t.TempDir()
|
|
// create existing config dir with a marker file
|
|
_ = os.MkdirAll(tmpDir, 0o755)
|
|
_ = os.WriteFile(filepath.Join(tmpDir, "existing.conf"), []byte("v1"), 0o644)
|
|
|
|
fe := &fakeExec{}
|
|
h := NewCrowdsecHandler(db, fe, "/bin/false", tmpDir)
|
|
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
// upload
|
|
buf := &bytes.Buffer{}
|
|
mw := multipart.NewWriter(buf)
|
|
fw, _ := mw.CreateFormFile("file", "cfg.tar.gz")
|
|
_, _ = fw.Write([]byte("dummy2"))
|
|
_ = mw.Close()
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodPost, "/api/v1/admin/crowdsec/import", buf)
|
|
req.Header.Set("Content-Type", mw.FormDataContentType())
|
|
r.ServeHTTP(w, req)
|
|
if w.Code != http.StatusOK {
|
|
t.Fatalf("import expected 200 got %d body=%s", w.Code, w.Body.String())
|
|
}
|
|
|
|
// ensure backup dir exists (ends with .backup.TIMESTAMP)
|
|
found := false
|
|
entries, _ := os.ReadDir(filepath.Dir(tmpDir))
|
|
for _, e := range entries {
|
|
if e.IsDir() && strings.HasPrefix(e.Name(), filepath.Base(tmpDir)+".backup.") {
|
|
found = true
|
|
break
|
|
}
|
|
}
|
|
if !found {
|
|
// fallback: check for any .backup.* in same parent dir
|
|
entries, _ := os.ReadDir(filepath.Dir(tmpDir))
|
|
for _, e := range entries {
|
|
if e.IsDir() && filepath.Ext(e.Name()) == "" && e.Name() != "" && (filepath.Base(e.Name()) != filepath.Base(tmpDir)) {
|
|
// best-effort assume backup present
|
|
found = true
|
|
break
|
|
}
|
|
}
|
|
}
|
|
if !found {
|
|
t.Fatalf("expected backup directory next to data dir")
|
|
}
|
|
}
|
|
|
|
func TestExportConfig(t *testing.T) {
|
|
t.Parallel()
|
|
gin.SetMode(gin.TestMode)
|
|
db := setupCrowdDB(t)
|
|
tmpDir := t.TempDir()
|
|
|
|
// create some files to export
|
|
_ = os.MkdirAll(filepath.Join(tmpDir, "conf.d"), 0o755)
|
|
_ = os.WriteFile(filepath.Join(tmpDir, "conf.d", "a.conf"), []byte("rule1"), 0o644)
|
|
_ = os.WriteFile(filepath.Join(tmpDir, "b.conf"), []byte("rule2"), 0o644)
|
|
|
|
fe := &fakeExec{}
|
|
h := NewCrowdsecHandler(db, fe, "/bin/false", tmpDir)
|
|
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodGet, "/api/v1/admin/crowdsec/export", http.NoBody)
|
|
r.ServeHTTP(w, req)
|
|
if w.Code != http.StatusOK {
|
|
t.Fatalf("export expected 200 got %d body=%s", w.Code, w.Body.String())
|
|
}
|
|
if ct := w.Header().Get("Content-Type"); ct != "application/gzip" {
|
|
t.Fatalf("unexpected content type: %s", ct)
|
|
}
|
|
if w.Body.Len() == 0 {
|
|
t.Fatalf("expected response body to contain archive data")
|
|
}
|
|
}
|
|
|
|
func TestListAndReadFile(t *testing.T) {
|
|
t.Parallel()
|
|
gin.SetMode(gin.TestMode)
|
|
db := setupCrowdDB(t)
|
|
tmpDir := t.TempDir()
|
|
// create a nested file
|
|
_ = os.MkdirAll(filepath.Join(tmpDir, "conf.d"), 0o755)
|
|
_ = os.WriteFile(filepath.Join(tmpDir, "conf.d", "a.conf"), []byte("rule1"), 0o644)
|
|
_ = os.WriteFile(filepath.Join(tmpDir, "b.conf"), []byte("rule2"), 0o644)
|
|
|
|
fe := &fakeExec{}
|
|
h := NewCrowdsecHandler(db, fe, "/bin/false", tmpDir)
|
|
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodGet, "/api/v1/admin/crowdsec/files", http.NoBody)
|
|
r.ServeHTTP(w, req)
|
|
if w.Code != http.StatusOK {
|
|
t.Fatalf("files expected 200 got %d body=%s", w.Code, w.Body.String())
|
|
}
|
|
// read a single file
|
|
w2 := httptest.NewRecorder()
|
|
req2 := httptest.NewRequest(http.MethodGet, "/api/v1/admin/crowdsec/file?path=conf.d/a.conf", http.NoBody)
|
|
r.ServeHTTP(w2, req2)
|
|
if w2.Code != http.StatusOK {
|
|
t.Fatalf("file read expected 200 got %d body=%s", w2.Code, w2.Body.String())
|
|
}
|
|
}
|
|
|
|
func TestExportConfigStreamsArchive(t *testing.T) {
|
|
t.Parallel()
|
|
gin.SetMode(gin.TestMode)
|
|
db := setupCrowdDB(t)
|
|
dataDir := t.TempDir()
|
|
require.NoError(t, os.WriteFile(filepath.Join(dataDir, "config.yaml"), []byte("hello"), 0o644))
|
|
|
|
h := NewCrowdsecHandler(db, &fakeExec{}, "/bin/false", dataDir)
|
|
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodGet, "/api/v1/admin/crowdsec/export", http.NoBody)
|
|
r.ServeHTTP(w, req)
|
|
|
|
require.Equal(t, http.StatusOK, w.Code)
|
|
require.Equal(t, "application/gzip", w.Header().Get("Content-Type"))
|
|
require.Contains(t, w.Header().Get("Content-Disposition"), "crowdsec-config-")
|
|
|
|
gr, err := gzip.NewReader(bytes.NewReader(w.Body.Bytes()))
|
|
require.NoError(t, err)
|
|
tr := tar.NewReader(gr)
|
|
found := false
|
|
for {
|
|
hdr, err := tr.Next()
|
|
if errors.Is(err, io.EOF) {
|
|
break
|
|
}
|
|
require.NoError(t, err)
|
|
if hdr.Name == "config.yaml" {
|
|
data, readErr := io.ReadAll(tr)
|
|
require.NoError(t, readErr)
|
|
require.Equal(t, "hello", string(data))
|
|
found = true
|
|
}
|
|
}
|
|
require.True(t, found, "expected exported archive to contain config file")
|
|
}
|
|
|
|
func TestWriteFileCreatesBackup(t *testing.T) {
|
|
t.Parallel()
|
|
gin.SetMode(gin.TestMode)
|
|
db := setupCrowdDB(t)
|
|
tmpDir := t.TempDir()
|
|
// create existing config dir with a marker file
|
|
_ = os.MkdirAll(tmpDir, 0o755)
|
|
_ = os.WriteFile(filepath.Join(tmpDir, "existing.conf"), []byte("v1"), 0o644)
|
|
|
|
fe := &fakeExec{}
|
|
h := NewCrowdsecHandler(db, fe, "/bin/false", tmpDir)
|
|
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
// write content to new file
|
|
payload := map[string]string{"path": "conf.d/new.conf", "content": "hello world"}
|
|
b, _ := json.Marshal(payload)
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodPost, "/api/v1/admin/crowdsec/file", bytes.NewReader(b))
|
|
req.Header.Set("Content-Type", "application/json")
|
|
r.ServeHTTP(w, req)
|
|
if w.Code != http.StatusOK {
|
|
t.Fatalf("write expected 200 got %d body=%s", w.Code, w.Body.String())
|
|
}
|
|
|
|
// ensure backup directory was created
|
|
entries, err := os.ReadDir(filepath.Dir(tmpDir))
|
|
require.NoError(t, err)
|
|
foundBackup := false
|
|
for _, e := range entries {
|
|
if e.IsDir() && strings.HasPrefix(e.Name(), filepath.Base(tmpDir)+".backup.") {
|
|
foundBackup = true
|
|
break
|
|
}
|
|
}
|
|
require.True(t, foundBackup, "expected backup directory to be created")
|
|
}
|
|
|
|
func TestListPresetsCerberusDisabled(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
t.Setenv("FEATURE_CERBERUS_ENABLED", "false")
|
|
|
|
h := NewCrowdsecHandler(OpenTestDB(t), &fakeExec{}, "/bin/false", t.TempDir())
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodGet, "/api/v1/admin/crowdsec/presets", http.NoBody)
|
|
r.ServeHTTP(w, req)
|
|
|
|
if w.Code != http.StatusNotFound {
|
|
t.Fatalf("expected 404 when cerberus disabled got %d", w.Code)
|
|
}
|
|
}
|
|
|
|
func TestReadFileInvalidPath(t *testing.T) {
|
|
t.Parallel()
|
|
gin.SetMode(gin.TestMode)
|
|
h := NewCrowdsecHandler(OpenTestDB(t), &fakeExec{}, "/bin/false", t.TempDir())
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodGet, "/api/v1/admin/crowdsec/file?path=../secret", http.NoBody)
|
|
r.ServeHTTP(w, req)
|
|
|
|
if w.Code != http.StatusBadRequest {
|
|
t.Fatalf("expected 400 for invalid path got %d", w.Code)
|
|
}
|
|
}
|
|
|
|
func TestWriteFileInvalidPath(t *testing.T) {
|
|
t.Parallel()
|
|
gin.SetMode(gin.TestMode)
|
|
h := NewCrowdsecHandler(OpenTestDB(t), &fakeExec{}, "/bin/false", t.TempDir())
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
body, _ := json.Marshal(map[string]string{"path": "../../escape", "content": "bad"})
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodPost, "/api/v1/admin/crowdsec/file", bytes.NewReader(body))
|
|
req.Header.Set("Content-Type", "application/json")
|
|
r.ServeHTTP(w, req)
|
|
|
|
if w.Code != http.StatusBadRequest {
|
|
t.Fatalf("expected 400 for invalid path got %d", w.Code)
|
|
}
|
|
}
|
|
|
|
func TestWriteFileMissingPath(t *testing.T) {
|
|
t.Parallel()
|
|
gin.SetMode(gin.TestMode)
|
|
h := NewCrowdsecHandler(OpenTestDB(t), &fakeExec{}, "/bin/false", t.TempDir())
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
body, _ := json.Marshal(map[string]string{"content": "data only"})
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodPost, "/api/v1/admin/crowdsec/file", bytes.NewReader(body))
|
|
req.Header.Set("Content-Type", "application/json")
|
|
r.ServeHTTP(w, req)
|
|
|
|
require.Equal(t, http.StatusBadRequest, w.Code)
|
|
}
|
|
|
|
func TestWriteFileInvalidPayload(t *testing.T) {
|
|
t.Parallel()
|
|
gin.SetMode(gin.TestMode)
|
|
h := NewCrowdsecHandler(OpenTestDB(t), &fakeExec{}, "/bin/false", t.TempDir())
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodPost, "/api/v1/admin/crowdsec/file", bytes.NewBufferString("not-json"))
|
|
req.Header.Set("Content-Type", "application/json")
|
|
r.ServeHTTP(w, req)
|
|
|
|
require.Equal(t, http.StatusBadRequest, w.Code)
|
|
}
|
|
|
|
func TestImportConfigRequiresFile(t *testing.T) {
|
|
t.Parallel()
|
|
gin.SetMode(gin.TestMode)
|
|
h := NewCrowdsecHandler(OpenTestDB(t), &fakeExec{}, "/bin/false", t.TempDir())
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodPost, "/api/v1/admin/crowdsec/import", http.NoBody)
|
|
r.ServeHTTP(w, req)
|
|
|
|
if w.Code != http.StatusBadRequest {
|
|
t.Fatalf("expected 400 when file missing got %d", w.Code)
|
|
}
|
|
}
|
|
|
|
func TestImportConfigRejectsEmptyUpload(t *testing.T) {
|
|
t.Parallel()
|
|
gin.SetMode(gin.TestMode)
|
|
h := NewCrowdsecHandler(OpenTestDB(t), &fakeExec{}, "/bin/false", t.TempDir())
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
buf := &bytes.Buffer{}
|
|
mw := multipart.NewWriter(buf)
|
|
_, _ = mw.CreateFormFile("file", "empty.tgz")
|
|
_ = mw.Close()
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodPost, "/api/v1/admin/crowdsec/import", buf)
|
|
req.Header.Set("Content-Type", mw.FormDataContentType())
|
|
r.ServeHTTP(w, req)
|
|
|
|
if w.Code != http.StatusBadRequest {
|
|
t.Fatalf("expected 400 for empty upload got %d", w.Code)
|
|
}
|
|
}
|
|
|
|
func TestListFilesMissingDir(t *testing.T) {
|
|
t.Parallel()
|
|
gin.SetMode(gin.TestMode)
|
|
missingDir := filepath.Join(t.TempDir(), "does-not-exist")
|
|
h := NewCrowdsecHandler(OpenTestDB(t), &fakeExec{}, "/bin/false", missingDir)
|
|
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodGet, "/api/v1/admin/crowdsec/files", http.NoBody)
|
|
r.ServeHTTP(w, req)
|
|
|
|
if w.Code != http.StatusOK {
|
|
t.Fatalf("expected 200 for missing dir got %d", w.Code)
|
|
}
|
|
}
|
|
|
|
func TestListFilesReturnsEntries(t *testing.T) {
|
|
t.Parallel()
|
|
gin.SetMode(gin.TestMode)
|
|
dataDir := t.TempDir()
|
|
require.NoError(t, os.WriteFile(filepath.Join(dataDir, "root.txt"), []byte("root"), 0o644))
|
|
nestedDir := filepath.Join(dataDir, "nested")
|
|
require.NoError(t, os.MkdirAll(nestedDir, 0o755))
|
|
require.NoError(t, os.WriteFile(filepath.Join(nestedDir, "child.txt"), []byte("child"), 0o644))
|
|
|
|
h := NewCrowdsecHandler(OpenTestDB(t), &fakeExec{}, "/bin/false", dataDir)
|
|
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodGet, "/api/v1/admin/crowdsec/files", http.NoBody)
|
|
r.ServeHTTP(w, req)
|
|
|
|
if w.Code != http.StatusOK {
|
|
t.Fatalf("expected 200 got %d", w.Code)
|
|
}
|
|
|
|
var resp struct {
|
|
Files []string `json:"files"`
|
|
}
|
|
require.NoError(t, json.Unmarshal(w.Body.Bytes(), &resp))
|
|
require.ElementsMatch(t, []string{"root.txt", filepath.Join("nested", "child.txt")}, resp.Files)
|
|
}
|
|
|
|
func TestIsCerberusEnabledFromDB(t *testing.T) {
|
|
t.Parallel()
|
|
gin.SetMode(gin.TestMode)
|
|
db := OpenTestDB(t)
|
|
require.NoError(t, db.AutoMigrate(&models.Setting{}))
|
|
require.NoError(t, db.Create(&models.Setting{Key: "feature.cerberus.enabled", Value: "0"}).Error)
|
|
|
|
h := NewCrowdsecHandler(db, &fakeExec{}, "/bin/false", t.TempDir())
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodGet, "/api/v1/admin/crowdsec/presets", http.NoBody)
|
|
r.ServeHTTP(w, req)
|
|
|
|
if w.Code != http.StatusNotFound {
|
|
t.Fatalf("expected 404 when cerberus disabled via DB got %d", w.Code)
|
|
}
|
|
}
|
|
|
|
func TestIsCerberusEnabledInvalidEnv(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
t.Setenv("FEATURE_CERBERUS_ENABLED", "not-a-bool")
|
|
h := NewCrowdsecHandler(nil, &fakeExec{}, "/bin/false", t.TempDir())
|
|
|
|
if h.isCerberusEnabled() {
|
|
t.Fatalf("expected cerberus to be disabled for invalid env flag")
|
|
}
|
|
}
|
|
|
|
func TestIsCerberusEnabledLegacyEnv(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
h := NewCrowdsecHandler(nil, &fakeExec{}, "/bin/false", t.TempDir())
|
|
|
|
t.Setenv("CERBERUS_ENABLED", "0")
|
|
|
|
if h.isCerberusEnabled() {
|
|
t.Fatalf("expected cerberus to be disabled for legacy env flag")
|
|
}
|
|
}
|
|
|
|
// ============================================
|
|
// Console Enrollment Tests
|
|
// ============================================
|
|
|
|
type mockEnvExecutor struct {
|
|
responses []struct {
|
|
out []byte
|
|
err error
|
|
}
|
|
defaultResponse struct {
|
|
out []byte
|
|
err error
|
|
}
|
|
calls []struct {
|
|
name string
|
|
args []string
|
|
}
|
|
}
|
|
|
|
func (m *mockEnvExecutor) ExecuteWithEnv(ctx context.Context, name string, args []string, env map[string]string) ([]byte, error) {
|
|
m.calls = append(m.calls, struct {
|
|
name string
|
|
args []string
|
|
}{name, args})
|
|
|
|
if len(m.calls) <= len(m.responses) {
|
|
resp := m.responses[len(m.calls)-1]
|
|
return resp.out, resp.err
|
|
}
|
|
return m.defaultResponse.out, m.defaultResponse.err
|
|
}
|
|
|
|
func setupTestConsoleEnrollment(t *testing.T) (*CrowdsecHandler, *mockEnvExecutor) {
|
|
t.Helper()
|
|
gin.SetMode(gin.TestMode)
|
|
db := OpenTestDB(t)
|
|
require.NoError(t, db.AutoMigrate(&models.CrowdsecConsoleEnrollment{}))
|
|
|
|
exec := &mockEnvExecutor{}
|
|
dataDir := t.TempDir()
|
|
|
|
h := NewCrowdsecHandler(db, &fakeExec{}, "/bin/false", dataDir)
|
|
// Replace the Console service with one that uses our mock executor
|
|
h.Console = crowdsec.NewConsoleEnrollmentService(db, exec, dataDir, "test-secret")
|
|
|
|
return h, exec
|
|
}
|
|
|
|
func TestConsoleEnrollDisabled(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
t.Setenv("FEATURE_CROWDSEC_CONSOLE_ENROLLMENT", "false")
|
|
|
|
h := NewCrowdsecHandler(OpenTestDB(t), &fakeExec{}, "/bin/false", t.TempDir())
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
body := `{"enrollment_key": "abc123456789", "agent_name": "test-agent"}`
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodPost, "/api/v1/admin/crowdsec/console/enroll", strings.NewReader(body))
|
|
req.Header.Set("Content-Type", "application/json")
|
|
r.ServeHTTP(w, req)
|
|
|
|
require.Equal(t, http.StatusNotFound, w.Code)
|
|
require.Contains(t, w.Body.String(), "disabled")
|
|
}
|
|
|
|
func TestConsoleEnrollServiceUnavailable(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
t.Setenv("FEATURE_CROWDSEC_CONSOLE_ENROLLMENT", "true")
|
|
|
|
h := NewCrowdsecHandler(OpenTestDB(t), &fakeExec{}, "/bin/false", t.TempDir())
|
|
// Set Console to nil to simulate unavailable
|
|
h.Console = nil
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
body := `{"enrollment_key": "abc123456789", "agent_name": "test-agent"}`
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodPost, "/api/v1/admin/crowdsec/console/enroll", strings.NewReader(body))
|
|
req.Header.Set("Content-Type", "application/json")
|
|
r.ServeHTTP(w, req)
|
|
|
|
require.Equal(t, http.StatusServiceUnavailable, w.Code)
|
|
require.Contains(t, w.Body.String(), "unavailable")
|
|
}
|
|
|
|
func TestConsoleEnrollInvalidPayload(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
t.Setenv("FEATURE_CROWDSEC_CONSOLE_ENROLLMENT", "true")
|
|
|
|
h, _ := setupTestConsoleEnrollment(t)
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodPost, "/api/v1/admin/crowdsec/console/enroll", strings.NewReader("not-json"))
|
|
req.Header.Set("Content-Type", "application/json")
|
|
r.ServeHTTP(w, req)
|
|
|
|
require.Equal(t, http.StatusBadRequest, w.Code)
|
|
require.Contains(t, w.Body.String(), "invalid payload")
|
|
}
|
|
|
|
func TestConsoleEnrollSuccess(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
t.Setenv("FEATURE_CROWDSEC_CONSOLE_ENROLLMENT", "true")
|
|
|
|
h, _ := setupTestConsoleEnrollment(t)
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
body := `{"enrollment_key": "abc123456789", "agent_name": "test-agent", "tenant": "my-tenant"}`
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodPost, "/api/v1/admin/crowdsec/console/enroll", strings.NewReader(body))
|
|
req.Header.Set("Content-Type", "application/json")
|
|
r.ServeHTTP(w, req)
|
|
|
|
require.Equal(t, http.StatusOK, w.Code)
|
|
|
|
var resp map[string]any
|
|
require.NoError(t, json.Unmarshal(w.Body.Bytes(), &resp))
|
|
// Enrollment request sent, but user must accept on crowdsec.net
|
|
require.Equal(t, "pending_acceptance", resp["status"])
|
|
}
|
|
|
|
func TestConsoleEnrollMissingAgentName(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
t.Setenv("FEATURE_CROWDSEC_CONSOLE_ENROLLMENT", "true")
|
|
|
|
h, _ := setupTestConsoleEnrollment(t)
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
body := `{"enrollment_key": "abc123456789", "agent_name": ""}`
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodPost, "/api/v1/admin/crowdsec/console/enroll", strings.NewReader(body))
|
|
req.Header.Set("Content-Type", "application/json")
|
|
r.ServeHTTP(w, req)
|
|
|
|
require.Equal(t, http.StatusBadRequest, w.Code)
|
|
require.Contains(t, w.Body.String(), "required")
|
|
}
|
|
|
|
func TestConsoleStatusDisabled(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
t.Setenv("FEATURE_CROWDSEC_CONSOLE_ENROLLMENT", "false")
|
|
|
|
h := NewCrowdsecHandler(OpenTestDB(t), &fakeExec{}, "/bin/false", t.TempDir())
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodGet, "/api/v1/admin/crowdsec/console/status", http.NoBody)
|
|
r.ServeHTTP(w, req)
|
|
|
|
require.Equal(t, http.StatusNotFound, w.Code)
|
|
require.Contains(t, w.Body.String(), "disabled")
|
|
}
|
|
|
|
func TestConsoleStatusServiceUnavailable(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
t.Setenv("FEATURE_CROWDSEC_CONSOLE_ENROLLMENT", "true")
|
|
|
|
h := NewCrowdsecHandler(OpenTestDB(t), &fakeExec{}, "/bin/false", t.TempDir())
|
|
// Set Console to nil to simulate unavailable
|
|
h.Console = nil
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodGet, "/api/v1/admin/crowdsec/console/status", http.NoBody)
|
|
r.ServeHTTP(w, req)
|
|
|
|
require.Equal(t, http.StatusServiceUnavailable, w.Code)
|
|
require.Contains(t, w.Body.String(), "unavailable")
|
|
}
|
|
|
|
func TestConsoleStatusSuccess(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
t.Setenv("FEATURE_CROWDSEC_CONSOLE_ENROLLMENT", "true")
|
|
|
|
h, _ := setupTestConsoleEnrollment(t)
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
// Get status when not enrolled yet
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodGet, "/api/v1/admin/crowdsec/console/status", http.NoBody)
|
|
r.ServeHTTP(w, req)
|
|
|
|
require.Equal(t, http.StatusOK, w.Code)
|
|
|
|
var resp map[string]any
|
|
require.NoError(t, json.Unmarshal(w.Body.Bytes(), &resp))
|
|
require.Equal(t, "not_enrolled", resp["status"])
|
|
}
|
|
|
|
func TestConsoleStatusAfterEnroll(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
t.Setenv("FEATURE_CROWDSEC_CONSOLE_ENROLLMENT", "true")
|
|
|
|
h, _ := setupTestConsoleEnrollment(t)
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
// First enroll
|
|
body := `{"enrollment_key": "abc123456789", "agent_name": "test-agent"}`
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodPost, "/api/v1/admin/crowdsec/console/enroll", strings.NewReader(body))
|
|
req.Header.Set("Content-Type", "application/json")
|
|
r.ServeHTTP(w, req)
|
|
require.Equal(t, http.StatusOK, w.Code)
|
|
|
|
// Then check status
|
|
w2 := httptest.NewRecorder()
|
|
req2 := httptest.NewRequest(http.MethodGet, "/api/v1/admin/crowdsec/console/status", http.NoBody)
|
|
r.ServeHTTP(w2, req2)
|
|
|
|
require.Equal(t, http.StatusOK, w2.Code)
|
|
|
|
var resp map[string]any
|
|
require.NoError(t, json.Unmarshal(w2.Body.Bytes(), &resp))
|
|
// Enrollment request sent, but user must accept on crowdsec.net
|
|
require.Equal(t, "pending_acceptance", resp["status"])
|
|
require.Equal(t, "test-agent", resp["agent_name"])
|
|
}
|
|
|
|
// ============================================
|
|
// isConsoleEnrollmentEnabled Tests
|
|
// ============================================
|
|
|
|
func TestIsConsoleEnrollmentEnabledFromDB(t *testing.T) {
|
|
t.Parallel()
|
|
gin.SetMode(gin.TestMode)
|
|
db := OpenTestDB(t)
|
|
require.NoError(t, db.AutoMigrate(&models.Setting{}))
|
|
require.NoError(t, db.Create(&models.Setting{Key: "feature.crowdsec.console_enrollment", Value: "true"}).Error)
|
|
|
|
h := NewCrowdsecHandler(db, &fakeExec{}, "/bin/false", t.TempDir())
|
|
require.True(t, h.isConsoleEnrollmentEnabled())
|
|
}
|
|
|
|
func TestIsConsoleEnrollmentDisabledFromDB(t *testing.T) {
|
|
t.Parallel()
|
|
gin.SetMode(gin.TestMode)
|
|
db := OpenTestDB(t)
|
|
require.NoError(t, db.AutoMigrate(&models.Setting{}))
|
|
require.NoError(t, db.Create(&models.Setting{Key: "feature.crowdsec.console_enrollment", Value: "false"}).Error)
|
|
|
|
h := NewCrowdsecHandler(db, &fakeExec{}, "/bin/false", t.TempDir())
|
|
require.False(t, h.isConsoleEnrollmentEnabled())
|
|
}
|
|
|
|
func TestIsConsoleEnrollmentEnabledFromEnv(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
t.Setenv("FEATURE_CROWDSEC_CONSOLE_ENROLLMENT", "true")
|
|
|
|
h := NewCrowdsecHandler(nil, &fakeExec{}, "/bin/false", t.TempDir())
|
|
require.True(t, h.isConsoleEnrollmentEnabled())
|
|
}
|
|
|
|
func TestIsConsoleEnrollmentDisabledFromEnv(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
t.Setenv("FEATURE_CROWDSEC_CONSOLE_ENROLLMENT", "0")
|
|
|
|
h := NewCrowdsecHandler(nil, &fakeExec{}, "/bin/false", t.TempDir())
|
|
require.False(t, h.isConsoleEnrollmentEnabled())
|
|
}
|
|
|
|
func TestIsConsoleEnrollmentInvalidEnv(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
t.Setenv("FEATURE_CROWDSEC_CONSOLE_ENROLLMENT", "invalid")
|
|
|
|
h := NewCrowdsecHandler(nil, &fakeExec{}, "/bin/false", t.TempDir())
|
|
require.False(t, h.isConsoleEnrollmentEnabled())
|
|
}
|
|
|
|
func TestIsConsoleEnrollmentDefaultDisabled(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
|
|
h := NewCrowdsecHandler(nil, &fakeExec{}, "/bin/false", t.TempDir())
|
|
require.False(t, h.isConsoleEnrollmentEnabled())
|
|
}
|
|
|
|
func TestIsConsoleEnrollmentDBTrueVariants(t *testing.T) {
|
|
tests := []struct {
|
|
value string
|
|
expected bool
|
|
}{
|
|
{"true", true},
|
|
{"TRUE", true},
|
|
{"True", true},
|
|
{"1", true},
|
|
{"yes", true},
|
|
{"YES", true},
|
|
{"false", false},
|
|
{"FALSE", false},
|
|
{"0", false},
|
|
{"no", false},
|
|
}
|
|
|
|
for _, tc := range tests {
|
|
t.Run(tc.value, func(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
db := OpenTestDB(t)
|
|
require.NoError(t, db.AutoMigrate(&models.Setting{}))
|
|
require.NoError(t, db.Create(&models.Setting{Key: "feature.crowdsec.console_enrollment", Value: tc.value}).Error)
|
|
|
|
h := NewCrowdsecHandler(db, &fakeExec{}, "/bin/false", t.TempDir())
|
|
require.Equal(t, tc.expected, h.isConsoleEnrollmentEnabled(), "value %q", tc.value)
|
|
})
|
|
}
|
|
}
|
|
|
|
// ============================================
|
|
// Bouncer Registration Tests
|
|
// ============================================
|
|
|
|
type mockCmdExecutor struct {
|
|
output []byte
|
|
err error
|
|
calls []struct {
|
|
name string
|
|
args []string
|
|
}
|
|
}
|
|
|
|
func (m *mockCmdExecutor) Execute(ctx context.Context, name string, args ...string) ([]byte, error) {
|
|
m.calls = append(m.calls, struct {
|
|
name string
|
|
args []string
|
|
}{name, args})
|
|
return m.output, m.err
|
|
}
|
|
|
|
func TestRegisterBouncerScriptNotFound(t *testing.T) {
|
|
t.Parallel()
|
|
gin.SetMode(gin.TestMode)
|
|
h := NewCrowdsecHandler(OpenTestDB(t), &fakeExec{}, "/bin/false", t.TempDir())
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodPost, "/api/v1/admin/crowdsec/bouncer/register", http.NoBody)
|
|
r.ServeHTTP(w, req)
|
|
|
|
// Script doesn't exist, should return 404
|
|
require.Equal(t, http.StatusNotFound, w.Code)
|
|
require.Contains(t, w.Body.String(), "script not found")
|
|
}
|
|
|
|
func TestRegisterBouncerSuccess(t *testing.T) {
|
|
t.Parallel()
|
|
gin.SetMode(gin.TestMode)
|
|
|
|
// Create a temp script that mimics successful bouncer registration
|
|
tmpDir := t.TempDir()
|
|
|
|
// Skip if we can't create the script in the expected location
|
|
if _, err := os.Stat("/usr/local/bin"); os.IsNotExist(err) {
|
|
t.Skip("Skipping test: /usr/local/bin does not exist")
|
|
}
|
|
|
|
// Create a mock command executor that simulates successful registration
|
|
mockExec := &mockCmdExecutor{
|
|
output: []byte("Bouncer registered successfully\nAPI Key: abc123456789abcdef0123456789abcdef\n"),
|
|
err: nil,
|
|
}
|
|
|
|
h := NewCrowdsecHandler(OpenTestDB(t), &fakeExec{}, "/bin/false", tmpDir)
|
|
h.CmdExec = mockExec
|
|
|
|
// We need the script to exist for the test to work
|
|
// Create a dummy script in tmpDir and modify the handler to check there
|
|
// For this test, we'll just verify the mock executor is called correctly
|
|
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
// This will fail because script doesn't exist at /usr/local/bin/register_bouncer.sh
|
|
// The test verifies the handler's script-not-found behavior
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodPost, "/api/v1/admin/crowdsec/bouncer/register", http.NoBody)
|
|
r.ServeHTTP(w, req)
|
|
|
|
require.Equal(t, http.StatusNotFound, w.Code)
|
|
}
|
|
|
|
func TestRegisterBouncerExecutionError(t *testing.T) {
|
|
t.Parallel()
|
|
gin.SetMode(gin.TestMode)
|
|
|
|
// Create a mock command executor that simulates execution error
|
|
mockExec := &mockCmdExecutor{
|
|
output: []byte("Error: failed to execute cscli"),
|
|
err: errors.New("exit status 1"),
|
|
}
|
|
|
|
tmpDir := t.TempDir()
|
|
h := NewCrowdsecHandler(OpenTestDB(t), &fakeExec{}, "/bin/false", tmpDir)
|
|
h.CmdExec = mockExec
|
|
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
// Script doesn't exist, so it will return 404 first
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodPost, "/api/v1/admin/crowdsec/bouncer/register", http.NoBody)
|
|
r.ServeHTTP(w, req)
|
|
|
|
require.Equal(t, http.StatusNotFound, w.Code)
|
|
}
|
|
|
|
// ============================================
|
|
// Acquisition Config Tests
|
|
// ============================================
|
|
|
|
func TestGetAcquisitionConfigNotFound(t *testing.T) {
|
|
t.Parallel()
|
|
gin.SetMode(gin.TestMode)
|
|
h := NewCrowdsecHandler(OpenTestDB(t), &fakeExec{}, "/bin/false", t.TempDir())
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodGet, "/api/v1/admin/crowdsec/acquisition", http.NoBody)
|
|
r.ServeHTTP(w, req)
|
|
|
|
// Test behavior depends on whether /etc/crowdsec/acquis.yaml exists in test environment
|
|
// If file exists: 200 with content
|
|
// If file doesn't exist: 404
|
|
require.True(t, w.Code == http.StatusOK || w.Code == http.StatusNotFound,
|
|
"expected 200 or 404, got %d", w.Code)
|
|
|
|
if w.Code == http.StatusNotFound {
|
|
require.Contains(t, w.Body.String(), "not found")
|
|
} else {
|
|
var resp map[string]any
|
|
require.NoError(t, json.Unmarshal(w.Body.Bytes(), &resp))
|
|
require.Contains(t, resp, "content")
|
|
require.Equal(t, "/etc/crowdsec/acquis.yaml", resp["path"])
|
|
}
|
|
}
|
|
|
|
func TestGetAcquisitionConfigSuccess(t *testing.T) {
|
|
t.Parallel()
|
|
gin.SetMode(gin.TestMode)
|
|
|
|
// Create a temp acquis.yaml to test with
|
|
tmpDir := t.TempDir()
|
|
acquisDir := filepath.Join(tmpDir, "crowdsec")
|
|
require.NoError(t, os.MkdirAll(acquisDir, 0o755))
|
|
|
|
acquisContent := `# Test acquisition config
|
|
source: file
|
|
filenames:
|
|
- /var/log/caddy/access.log
|
|
labels:
|
|
type: caddy
|
|
`
|
|
acquisPath := filepath.Join(acquisDir, "acquis.yaml")
|
|
require.NoError(t, os.WriteFile(acquisPath, []byte(acquisContent), 0o644))
|
|
|
|
h := NewCrowdsecHandler(OpenTestDB(t), &fakeExec{}, "/bin/false", tmpDir)
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodGet, "/api/v1/admin/crowdsec/acquisition", http.NoBody)
|
|
r.ServeHTTP(w, req)
|
|
|
|
// The handler uses a hardcoded path /etc/crowdsec/acquis.yaml
|
|
// In test environments where this file exists, it returns 200
|
|
// Otherwise, it returns 404
|
|
require.True(t, w.Code == http.StatusOK || w.Code == http.StatusNotFound,
|
|
"expected 200 or 404, got %d", w.Code)
|
|
}
|
|
|
|
// ============================================
|
|
// DeleteConsoleEnrollment Tests
|
|
// ============================================
|
|
|
|
func TestDeleteConsoleEnrollmentDisabled(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
// Feature flag not set, should return 404
|
|
|
|
h := NewCrowdsecHandler(OpenTestDB(t), &fakeExec{}, "/bin/false", t.TempDir())
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodDelete, "/api/v1/admin/crowdsec/console/enrollment", http.NoBody)
|
|
r.ServeHTTP(w, req)
|
|
|
|
require.Equal(t, http.StatusNotFound, w.Code)
|
|
require.Contains(t, w.Body.String(), "disabled")
|
|
}
|
|
|
|
func TestDeleteConsoleEnrollmentServiceUnavailable(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
t.Setenv("FEATURE_CROWDSEC_CONSOLE_ENROLLMENT", "true")
|
|
|
|
// Create handler with nil Console service
|
|
db := OpenTestDB(t)
|
|
h := &CrowdsecHandler{
|
|
DB: db,
|
|
Executor: &fakeExec{},
|
|
CmdExec: &RealCommandExecutor{},
|
|
BinPath: "/bin/false",
|
|
DataDir: t.TempDir(),
|
|
Console: nil, // Explicitly nil
|
|
}
|
|
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodDelete, "/api/v1/admin/crowdsec/console/enrollment", http.NoBody)
|
|
r.ServeHTTP(w, req)
|
|
|
|
require.Equal(t, http.StatusServiceUnavailable, w.Code)
|
|
require.Contains(t, w.Body.String(), "not available")
|
|
}
|
|
|
|
func TestDeleteConsoleEnrollmentSuccess(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
t.Setenv("FEATURE_CROWDSEC_CONSOLE_ENROLLMENT", "true")
|
|
|
|
h, _ := setupTestConsoleEnrollment(t)
|
|
|
|
// First create an enrollment record
|
|
rec := &models.CrowdsecConsoleEnrollment{
|
|
UUID: "test-uuid",
|
|
Status: "enrolled",
|
|
AgentName: "test-agent",
|
|
Tenant: "test-tenant",
|
|
}
|
|
require.NoError(t, h.DB.Create(rec).Error)
|
|
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
// Delete the enrollment
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodDelete, "/api/v1/admin/crowdsec/console/enrollment", http.NoBody)
|
|
r.ServeHTTP(w, req)
|
|
|
|
require.Equal(t, http.StatusOK, w.Code)
|
|
require.Contains(t, w.Body.String(), "cleared")
|
|
|
|
// Verify the record is gone
|
|
var count int64
|
|
h.DB.Model(&models.CrowdsecConsoleEnrollment{}).Count(&count)
|
|
require.Equal(t, int64(0), count)
|
|
}
|
|
|
|
func TestDeleteConsoleEnrollmentNoRecordSuccess(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
t.Setenv("FEATURE_CROWDSEC_CONSOLE_ENROLLMENT", "true")
|
|
|
|
h, _ := setupTestConsoleEnrollment(t)
|
|
|
|
// Don't create any record - deletion should still succeed
|
|
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodDelete, "/api/v1/admin/crowdsec/console/enrollment", http.NoBody)
|
|
r.ServeHTTP(w, req)
|
|
|
|
require.Equal(t, http.StatusOK, w.Code)
|
|
require.Contains(t, w.Body.String(), "cleared")
|
|
}
|
|
|
|
func TestDeleteConsoleEnrollmentThenReenroll(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
t.Setenv("FEATURE_CROWDSEC_CONSOLE_ENROLLMENT", "true")
|
|
|
|
h, _ := setupTestConsoleEnrollment(t)
|
|
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
// First enroll
|
|
body := `{"enrollment_key": "abc123456789", "agent_name": "test-agent-1"}`
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodPost, "/api/v1/admin/crowdsec/console/enroll", strings.NewReader(body))
|
|
req.Header.Set("Content-Type", "application/json")
|
|
r.ServeHTTP(w, req)
|
|
require.Equal(t, http.StatusOK, w.Code)
|
|
|
|
// Check status shows pending_acceptance
|
|
w2 := httptest.NewRecorder()
|
|
req2 := httptest.NewRequest(http.MethodGet, "/api/v1/admin/crowdsec/console/status", http.NoBody)
|
|
r.ServeHTTP(w2, req2)
|
|
require.Equal(t, http.StatusOK, w2.Code)
|
|
var resp map[string]any
|
|
require.NoError(t, json.Unmarshal(w2.Body.Bytes(), &resp))
|
|
require.Equal(t, "pending_acceptance", resp["status"])
|
|
require.Equal(t, "test-agent-1", resp["agent_name"])
|
|
|
|
// Delete enrollment
|
|
w3 := httptest.NewRecorder()
|
|
req3 := httptest.NewRequest(http.MethodDelete, "/api/v1/admin/crowdsec/console/enrollment", http.NoBody)
|
|
r.ServeHTTP(w3, req3)
|
|
require.Equal(t, http.StatusOK, w3.Code)
|
|
|
|
// Check status shows not_enrolled
|
|
w4 := httptest.NewRecorder()
|
|
req4 := httptest.NewRequest(http.MethodGet, "/api/v1/admin/crowdsec/console/status", http.NoBody)
|
|
r.ServeHTTP(w4, req4)
|
|
require.Equal(t, http.StatusOK, w4.Code)
|
|
var resp2 map[string]any
|
|
require.NoError(t, json.Unmarshal(w4.Body.Bytes(), &resp2))
|
|
require.Equal(t, "not_enrolled", resp2["status"])
|
|
|
|
// Re-enroll with NEW agent name - should work WITHOUT force
|
|
body2 := `{"enrollment_key": "newkey123456", "agent_name": "test-agent-2"}`
|
|
w5 := httptest.NewRecorder()
|
|
req5 := httptest.NewRequest(http.MethodPost, "/api/v1/admin/crowdsec/console/enroll", strings.NewReader(body2))
|
|
req5.Header.Set("Content-Type", "application/json")
|
|
r.ServeHTTP(w5, req5)
|
|
require.Equal(t, http.StatusOK, w5.Code)
|
|
|
|
// Check status shows new agent name
|
|
w6 := httptest.NewRecorder()
|
|
req6 := httptest.NewRequest(http.MethodGet, "/api/v1/admin/crowdsec/console/status", http.NoBody)
|
|
r.ServeHTTP(w6, req6)
|
|
require.Equal(t, http.StatusOK, w6.Code)
|
|
var resp3 map[string]any
|
|
require.NoError(t, json.Unmarshal(w6.Body.Bytes(), &resp3))
|
|
require.Equal(t, "pending_acceptance", resp3["status"])
|
|
require.Equal(t, "test-agent-2", resp3["agent_name"])
|
|
}
|
|
|
|
// ============================================
|
|
// NEW COVERAGE TESTS - Phase 3 Implementation
|
|
// ============================================
|
|
|
|
// Start Handler - LAPI Readiness Polling Tests
|
|
func TestCrowdsecStart_LAPINotReadyTimeout(t *testing.T) {
|
|
t.Parallel()
|
|
gin.SetMode(gin.TestMode)
|
|
|
|
// Mock executor that returns error for lapi status checks
|
|
mockExec := &mockCmdExecutor{
|
|
output: []byte("error: lapi not reachable"),
|
|
err: errors.New("lapi unreachable"),
|
|
}
|
|
|
|
db := setupCrowdDB(t)
|
|
h := NewCrowdsecHandler(db, &fakeExec{}, "/bin/false", t.TempDir())
|
|
h.CmdExec = mockExec
|
|
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodPost, "/api/v1/admin/crowdsec/start", http.NoBody)
|
|
r.ServeHTTP(w, req)
|
|
|
|
require.Equal(t, http.StatusOK, w.Code)
|
|
var resp map[string]any
|
|
require.NoError(t, json.Unmarshal(w.Body.Bytes(), &resp))
|
|
require.Equal(t, "started", resp["status"])
|
|
require.False(t, resp["lapi_ready"].(bool))
|
|
require.Contains(t, resp, "warning")
|
|
}
|
|
|
|
// ============================================
|
|
// Additional Coverage Tests
|
|
// ============================================
|
|
|
|
// fakeExecWithError returns an error for executor operations
|
|
type fakeExecWithError struct {
|
|
statusError error
|
|
startError error
|
|
stopError error
|
|
}
|
|
|
|
func (f *fakeExecWithError) Start(ctx context.Context, binPath, configDir string) (int, error) {
|
|
if f.startError != nil {
|
|
return 0, f.startError
|
|
}
|
|
return 12345, nil
|
|
}
|
|
|
|
func (f *fakeExecWithError) Stop(ctx context.Context, configDir string) error {
|
|
return f.stopError
|
|
}
|
|
|
|
func (f *fakeExecWithError) Status(ctx context.Context, configDir string) (running bool, pid int, err error) {
|
|
if f.statusError != nil {
|
|
return false, 0, f.statusError
|
|
}
|
|
return true, 12345, nil
|
|
}
|
|
|
|
func TestCrowdsecHandler_Status_Error(t *testing.T) {
|
|
t.Parallel()
|
|
gin.SetMode(gin.TestMode)
|
|
|
|
fe := &fakeExecWithError{statusError: errors.New("status check failed")}
|
|
db := setupCrowdDB(t)
|
|
h := NewCrowdsecHandler(db, fe, "/bin/false", t.TempDir())
|
|
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodGet, "/api/v1/admin/crowdsec/status", http.NoBody)
|
|
r.ServeHTTP(w, req)
|
|
|
|
require.Equal(t, http.StatusInternalServerError, w.Code)
|
|
require.Contains(t, w.Body.String(), "status check failed")
|
|
}
|
|
|
|
func TestCrowdsecHandler_Start_ExecutorError(t *testing.T) {
|
|
t.Parallel()
|
|
gin.SetMode(gin.TestMode)
|
|
|
|
fe := &fakeExecWithError{startError: errors.New("failed to start process")}
|
|
db := setupCrowdDB(t)
|
|
h := NewCrowdsecHandler(db, fe, "/bin/false", t.TempDir())
|
|
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodPost, "/api/v1/admin/crowdsec/start", http.NoBody)
|
|
r.ServeHTTP(w, req)
|
|
|
|
require.Equal(t, http.StatusInternalServerError, w.Code)
|
|
require.Contains(t, w.Body.String(), "failed to start process")
|
|
}
|
|
|
|
func TestCrowdsecHandler_ExportConfig_DirNotFound(t *testing.T) {
|
|
t.Parallel()
|
|
gin.SetMode(gin.TestMode)
|
|
|
|
db := setupCrowdDB(t)
|
|
// Use a non-existent directory
|
|
nonExistentDir := "/tmp/crowdsec-nonexistent-test-" + t.Name()
|
|
_ = os.RemoveAll(nonExistentDir)
|
|
|
|
h := NewCrowdsecHandler(db, &fakeExec{}, "/bin/false", nonExistentDir)
|
|
// Remove any cache dir created during handler init so Export sees missing dir
|
|
_ = os.RemoveAll(nonExistentDir)
|
|
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodGet, "/api/v1/admin/crowdsec/export", http.NoBody)
|
|
r.ServeHTTP(w, req)
|
|
|
|
require.Equal(t, http.StatusNotFound, w.Code)
|
|
require.Contains(t, w.Body.String(), "crowdsec config not found")
|
|
}
|
|
|
|
func TestCrowdsecHandler_ReadFile_NotFound(t *testing.T) {
|
|
t.Parallel()
|
|
gin.SetMode(gin.TestMode)
|
|
|
|
db := setupCrowdDB(t)
|
|
tmpDir := t.TempDir()
|
|
h := NewCrowdsecHandler(db, &fakeExec{}, "/bin/false", tmpDir)
|
|
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodGet, "/api/v1/admin/crowdsec/file?path=nonexistent.conf", http.NoBody)
|
|
r.ServeHTTP(w, req)
|
|
|
|
require.Equal(t, http.StatusNotFound, w.Code)
|
|
require.Contains(t, w.Body.String(), "not found")
|
|
}
|
|
|
|
func TestCrowdsecHandler_ReadFile_MissingPath(t *testing.T) {
|
|
t.Parallel()
|
|
gin.SetMode(gin.TestMode)
|
|
|
|
db := setupCrowdDB(t)
|
|
h := NewCrowdsecHandler(db, &fakeExec{}, "/bin/false", t.TempDir())
|
|
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodGet, "/api/v1/admin/crowdsec/file", http.NoBody)
|
|
r.ServeHTTP(w, req)
|
|
|
|
require.Equal(t, http.StatusBadRequest, w.Code)
|
|
require.Contains(t, w.Body.String(), "path required")
|
|
}
|
|
|
|
func TestCrowdsecHandler_ListDecisions_Success(t *testing.T) {
|
|
t.Parallel()
|
|
gin.SetMode(gin.TestMode)
|
|
|
|
// Mock executor that returns valid JSON decisions
|
|
mockExec := &mockCmdExecutor{
|
|
output: []byte(`[{"id": 1, "origin": "cscli", "type": "ban", "scope": "ip", "value": "192.168.1.1", "duration": "24h", "scenario": "manual ban"}]`),
|
|
err: nil,
|
|
}
|
|
|
|
db := setupCrowdDB(t)
|
|
tmpDir := t.TempDir()
|
|
h := NewCrowdsecHandler(db, &fakeExec{}, "/bin/false", tmpDir)
|
|
h.CmdExec = mockExec
|
|
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodGet, "/api/v1/admin/crowdsec/decisions", http.NoBody)
|
|
r.ServeHTTP(w, req)
|
|
|
|
require.Equal(t, http.StatusOK, w.Code)
|
|
var resp map[string]any
|
|
require.NoError(t, json.Unmarshal(w.Body.Bytes(), &resp))
|
|
require.Equal(t, float64(1), resp["total"])
|
|
}
|
|
|
|
func TestCrowdsecHandler_ListDecisions_Empty(t *testing.T) {
|
|
t.Parallel()
|
|
gin.SetMode(gin.TestMode)
|
|
|
|
// Mock executor that returns null (no decisions)
|
|
mockExec := &mockCmdExecutor{
|
|
output: []byte("null\n"),
|
|
err: nil,
|
|
}
|
|
|
|
db := setupCrowdDB(t)
|
|
h := NewCrowdsecHandler(db, &fakeExec{}, "/bin/false", t.TempDir())
|
|
h.CmdExec = mockExec
|
|
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodGet, "/api/v1/admin/crowdsec/decisions", http.NoBody)
|
|
r.ServeHTTP(w, req)
|
|
|
|
require.Equal(t, http.StatusOK, w.Code)
|
|
var resp map[string]any
|
|
require.NoError(t, json.Unmarshal(w.Body.Bytes(), &resp))
|
|
require.Equal(t, float64(0), resp["total"])
|
|
}
|
|
|
|
func TestCrowdsecHandler_ListDecisions_CscliError(t *testing.T) {
|
|
t.Parallel()
|
|
gin.SetMode(gin.TestMode)
|
|
|
|
// Mock executor that returns an error
|
|
mockExec := &mockCmdExecutor{
|
|
output: []byte("cscli not found"),
|
|
err: errors.New("command failed"),
|
|
}
|
|
|
|
db := setupCrowdDB(t)
|
|
h := NewCrowdsecHandler(db, &fakeExec{}, "/bin/false", t.TempDir())
|
|
h.CmdExec = mockExec
|
|
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodGet, "/api/v1/admin/crowdsec/decisions", http.NoBody)
|
|
r.ServeHTTP(w, req)
|
|
|
|
require.Equal(t, http.StatusOK, w.Code)
|
|
require.Contains(t, w.Body.String(), "cscli not available")
|
|
}
|
|
|
|
func TestCrowdsecHandler_ListDecisions_InvalidJSON(t *testing.T) {
|
|
t.Parallel()
|
|
gin.SetMode(gin.TestMode)
|
|
|
|
// Mock executor that returns invalid JSON
|
|
mockExec := &mockCmdExecutor{
|
|
output: []byte("not valid json"),
|
|
err: nil,
|
|
}
|
|
|
|
db := setupCrowdDB(t)
|
|
h := NewCrowdsecHandler(db, &fakeExec{}, "/bin/false", t.TempDir())
|
|
h.CmdExec = mockExec
|
|
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodGet, "/api/v1/admin/crowdsec/decisions", http.NoBody)
|
|
r.ServeHTTP(w, req)
|
|
|
|
require.Equal(t, http.StatusInternalServerError, w.Code)
|
|
require.Contains(t, w.Body.String(), "failed to parse")
|
|
}
|
|
|
|
func TestCrowdsecHandler_BanIP_Success(t *testing.T) {
|
|
t.Parallel()
|
|
gin.SetMode(gin.TestMode)
|
|
|
|
mockExec := &mockCmdExecutor{
|
|
output: []byte("Decision created"),
|
|
err: nil,
|
|
}
|
|
|
|
db := setupCrowdDB(t)
|
|
h := NewCrowdsecHandler(db, &fakeExec{}, "/bin/false", t.TempDir())
|
|
h.CmdExec = mockExec
|
|
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
body := `{"ip": "192.168.1.100", "duration": "1h", "reason": "test ban"}`
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodPost, "/api/v1/admin/crowdsec/ban", strings.NewReader(body))
|
|
req.Header.Set("Content-Type", "application/json")
|
|
r.ServeHTTP(w, req)
|
|
|
|
require.Equal(t, http.StatusOK, w.Code)
|
|
var resp map[string]any
|
|
require.NoError(t, json.Unmarshal(w.Body.Bytes(), &resp))
|
|
require.Equal(t, "banned", resp["status"])
|
|
require.Equal(t, "192.168.1.100", resp["ip"])
|
|
}
|
|
|
|
func TestCrowdsecHandler_BanIP_MissingIP(t *testing.T) {
|
|
t.Parallel()
|
|
gin.SetMode(gin.TestMode)
|
|
|
|
db := setupCrowdDB(t)
|
|
h := NewCrowdsecHandler(db, &fakeExec{}, "/bin/false", t.TempDir())
|
|
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
body := `{"duration": "1h"}`
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodPost, "/api/v1/admin/crowdsec/ban", strings.NewReader(body))
|
|
req.Header.Set("Content-Type", "application/json")
|
|
r.ServeHTTP(w, req)
|
|
|
|
require.Equal(t, http.StatusBadRequest, w.Code)
|
|
require.Contains(t, w.Body.String(), "ip is required")
|
|
}
|
|
|
|
func TestCrowdsecHandler_BanIP_EmptyIP(t *testing.T) {
|
|
t.Parallel()
|
|
gin.SetMode(gin.TestMode)
|
|
|
|
db := setupCrowdDB(t)
|
|
h := NewCrowdsecHandler(db, &fakeExec{}, "/bin/false", t.TempDir())
|
|
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
body := `{"ip": " "}`
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodPost, "/api/v1/admin/crowdsec/ban", strings.NewReader(body))
|
|
req.Header.Set("Content-Type", "application/json")
|
|
r.ServeHTTP(w, req)
|
|
|
|
require.Equal(t, http.StatusBadRequest, w.Code)
|
|
require.Contains(t, w.Body.String(), "cannot be empty")
|
|
}
|
|
|
|
func TestCrowdsecHandler_BanIP_DefaultDuration(t *testing.T) {
|
|
t.Parallel()
|
|
gin.SetMode(gin.TestMode)
|
|
|
|
mockExec := &mockCmdExecutor{
|
|
output: []byte("Decision created"),
|
|
err: nil,
|
|
}
|
|
|
|
db := setupCrowdDB(t)
|
|
h := NewCrowdsecHandler(db, &fakeExec{}, "/bin/false", t.TempDir())
|
|
h.CmdExec = mockExec
|
|
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
// No duration specified - should default to 24h
|
|
body := `{"ip": "192.168.1.100"}`
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodPost, "/api/v1/admin/crowdsec/ban", strings.NewReader(body))
|
|
req.Header.Set("Content-Type", "application/json")
|
|
r.ServeHTTP(w, req)
|
|
|
|
require.Equal(t, http.StatusOK, w.Code)
|
|
var resp map[string]any
|
|
require.NoError(t, json.Unmarshal(w.Body.Bytes(), &resp))
|
|
require.Equal(t, "24h", resp["duration"])
|
|
}
|
|
|
|
func TestCrowdsecHandler_UnbanIP_Success(t *testing.T) {
|
|
t.Parallel()
|
|
gin.SetMode(gin.TestMode)
|
|
|
|
mockExec := &mockCmdExecutor{
|
|
output: []byte("Decision deleted"),
|
|
err: nil,
|
|
}
|
|
|
|
db := setupCrowdDB(t)
|
|
h := NewCrowdsecHandler(db, &fakeExec{}, "/bin/false", t.TempDir())
|
|
h.CmdExec = mockExec
|
|
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodDelete, "/api/v1/admin/crowdsec/ban/192.168.1.100", http.NoBody)
|
|
r.ServeHTTP(w, req)
|
|
|
|
require.Equal(t, http.StatusOK, w.Code)
|
|
var resp map[string]any
|
|
require.NoError(t, json.Unmarshal(w.Body.Bytes(), &resp))
|
|
require.Equal(t, "unbanned", resp["status"])
|
|
}
|
|
|
|
func TestCrowdsecHandler_UnbanIP_Error(t *testing.T) {
|
|
t.Parallel()
|
|
gin.SetMode(gin.TestMode)
|
|
|
|
mockExec := &mockCmdExecutor{
|
|
output: []byte("error"),
|
|
err: errors.New("delete failed"),
|
|
}
|
|
|
|
db := setupCrowdDB(t)
|
|
h := NewCrowdsecHandler(db, &fakeExec{}, "/bin/false", t.TempDir())
|
|
h.CmdExec = mockExec
|
|
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodDelete, "/api/v1/admin/crowdsec/ban/192.168.1.100", http.NoBody)
|
|
r.ServeHTTP(w, req)
|
|
|
|
require.Equal(t, http.StatusInternalServerError, w.Code)
|
|
require.Contains(t, w.Body.String(), "failed to unban")
|
|
}
|
|
|
|
// ============================================
|
|
// Additional CrowdSec Handler Tests for Coverage
|
|
// ============================================
|
|
|
|
func TestCrowdsecHandler_BanIP_ExecutionError(t *testing.T) {
|
|
t.Parallel()
|
|
gin.SetMode(gin.TestMode)
|
|
|
|
mockExec := &mockCmdExecutor{
|
|
output: []byte("error: failed to add decision"),
|
|
err: errors.New("cscli failed"),
|
|
}
|
|
|
|
db := setupCrowdDB(t)
|
|
h := NewCrowdsecHandler(db, &fakeExec{}, "/bin/false", t.TempDir())
|
|
h.CmdExec = mockExec
|
|
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
body := `{"ip": "192.168.1.100", "duration": "1h", "reason": "test ban"}`
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodPost, "/api/v1/admin/crowdsec/ban", strings.NewReader(body))
|
|
req.Header.Set("Content-Type", "application/json")
|
|
r.ServeHTTP(w, req)
|
|
|
|
require.Equal(t, http.StatusInternalServerError, w.Code)
|
|
require.Contains(t, w.Body.String(), "failed to ban IP")
|
|
}
|
|
|
|
// Note: TestCrowdsecHandler_Stop_Error is defined in crowdsec_stop_lapi_test.go
|
|
|
|
func TestCrowdsecHandler_CheckLAPIHealth_InvalidURL(t *testing.T) {
|
|
t.Parallel()
|
|
gin.SetMode(gin.TestMode)
|
|
|
|
db := setupCrowdDB(t)
|
|
require.NoError(t, db.AutoMigrate(&models.SecurityConfig{}))
|
|
// Create config with invalid URL
|
|
cfg := models.SecurityConfig{
|
|
UUID: "default",
|
|
CrowdSecAPIURL: "http://evil.external.com:8080", // Should be blocked by SSRF policy
|
|
}
|
|
require.NoError(t, db.Create(&cfg).Error)
|
|
|
|
h := NewCrowdsecHandler(db, &fakeExec{}, "/bin/false", t.TempDir())
|
|
// Initialize security service
|
|
h.Security = services.NewSecurityService(db)
|
|
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodGet, "/api/v1/admin/crowdsec/lapi/health", http.NoBody)
|
|
r.ServeHTTP(w, req)
|
|
|
|
require.Equal(t, http.StatusOK, w.Code)
|
|
var resp map[string]any
|
|
require.NoError(t, json.Unmarshal(w.Body.Bytes(), &resp))
|
|
require.False(t, resp["healthy"].(bool))
|
|
require.Contains(t, resp, "error")
|
|
}
|
|
|
|
func TestCrowdsecHandler_GetLAPIDecisions_Fallback(t *testing.T) {
|
|
t.Parallel()
|
|
gin.SetMode(gin.TestMode)
|
|
|
|
// Mock executor that simulates fallback to cscli
|
|
mockExec := &mockCmdExecutor{
|
|
output: []byte(`[{"id": 1, "origin": "cscli", "type": "ban", "scope": "ip", "value": "10.0.0.1"}]`),
|
|
err: nil,
|
|
}
|
|
|
|
db := setupCrowdDB(t)
|
|
require.NoError(t, db.AutoMigrate(&models.SecurityConfig{}))
|
|
// Create config with invalid URL to trigger fallback
|
|
cfg := models.SecurityConfig{
|
|
UUID: "default",
|
|
CrowdSecAPIURL: "http://external.evil.com:8080",
|
|
}
|
|
require.NoError(t, db.Create(&cfg).Error)
|
|
|
|
h := NewCrowdsecHandler(db, &fakeExec{}, "/bin/false", t.TempDir())
|
|
h.CmdExec = mockExec
|
|
h.Security = services.NewSecurityService(db)
|
|
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodGet, "/api/v1/admin/crowdsec/decisions/lapi", http.NoBody)
|
|
r.ServeHTTP(w, req)
|
|
|
|
// Should fall back to cscli-based method
|
|
require.Equal(t, http.StatusOK, w.Code)
|
|
}
|
|
|
|
func TestCrowdsecHandler_PullPreset_CerberusDisabled(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
t.Setenv("FEATURE_CERBERUS_ENABLED", "false")
|
|
|
|
h := NewCrowdsecHandler(OpenTestDB(t), &fakeExec{}, "/bin/false", t.TempDir())
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
body := `{"slug": "test-slug"}`
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodPost, "/api/v1/admin/crowdsec/presets/pull", strings.NewReader(body))
|
|
req.Header.Set("Content-Type", "application/json")
|
|
r.ServeHTTP(w, req)
|
|
|
|
require.Equal(t, http.StatusNotFound, w.Code)
|
|
require.Contains(t, w.Body.String(), "cerberus disabled")
|
|
}
|
|
|
|
func TestCrowdsecHandler_PullPreset_InvalidPayload(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
t.Setenv("FEATURE_CERBERUS_ENABLED", "true")
|
|
|
|
h := NewCrowdsecHandler(OpenTestDB(t), &fakeExec{}, "/bin/false", t.TempDir())
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodPost, "/api/v1/admin/crowdsec/presets/pull", strings.NewReader("not-json"))
|
|
req.Header.Set("Content-Type", "application/json")
|
|
r.ServeHTTP(w, req)
|
|
|
|
require.Equal(t, http.StatusBadRequest, w.Code)
|
|
require.Contains(t, w.Body.String(), "invalid payload")
|
|
}
|
|
|
|
func TestCrowdsecHandler_PullPreset_EmptySlug(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
t.Setenv("FEATURE_CERBERUS_ENABLED", "true")
|
|
|
|
h := NewCrowdsecHandler(OpenTestDB(t), &fakeExec{}, "/bin/false", t.TempDir())
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
body := `{"slug": ""}`
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodPost, "/api/v1/admin/crowdsec/presets/pull", strings.NewReader(body))
|
|
req.Header.Set("Content-Type", "application/json")
|
|
r.ServeHTTP(w, req)
|
|
|
|
require.Equal(t, http.StatusBadRequest, w.Code)
|
|
require.Contains(t, w.Body.String(), "slug required")
|
|
}
|
|
|
|
func TestCrowdsecHandler_PullPreset_HubUnavailable(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
t.Setenv("FEATURE_CERBERUS_ENABLED", "true")
|
|
|
|
h := NewCrowdsecHandler(OpenTestDB(t), &fakeExec{}, "/bin/false", t.TempDir())
|
|
h.Hub = nil // Simulate hub unavailable
|
|
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
body := `{"slug": "test-slug"}`
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodPost, "/api/v1/admin/crowdsec/presets/pull", strings.NewReader(body))
|
|
req.Header.Set("Content-Type", "application/json")
|
|
r.ServeHTTP(w, req)
|
|
|
|
require.Equal(t, http.StatusServiceUnavailable, w.Code)
|
|
require.Contains(t, w.Body.String(), "hub service unavailable")
|
|
}
|
|
|
|
func TestCrowdsecHandler_ApplyPreset_CerberusDisabled(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
t.Setenv("FEATURE_CERBERUS_ENABLED", "false")
|
|
|
|
h := NewCrowdsecHandler(OpenTestDB(t), &fakeExec{}, "/bin/false", t.TempDir())
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
body := `{"slug": "test-slug"}`
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodPost, "/api/v1/admin/crowdsec/presets/apply", strings.NewReader(body))
|
|
req.Header.Set("Content-Type", "application/json")
|
|
r.ServeHTTP(w, req)
|
|
|
|
require.Equal(t, http.StatusNotFound, w.Code)
|
|
require.Contains(t, w.Body.String(), "cerberus disabled")
|
|
}
|
|
|
|
func TestCrowdsecHandler_ApplyPreset_InvalidPayload(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
t.Setenv("FEATURE_CERBERUS_ENABLED", "true")
|
|
|
|
h := NewCrowdsecHandler(OpenTestDB(t), &fakeExec{}, "/bin/false", t.TempDir())
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodPost, "/api/v1/admin/crowdsec/presets/apply", strings.NewReader("not-json"))
|
|
req.Header.Set("Content-Type", "application/json")
|
|
r.ServeHTTP(w, req)
|
|
|
|
require.Equal(t, http.StatusBadRequest, w.Code)
|
|
require.Contains(t, w.Body.String(), "invalid payload")
|
|
}
|
|
|
|
func TestCrowdsecHandler_ApplyPreset_EmptySlug(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
t.Setenv("FEATURE_CERBERUS_ENABLED", "true")
|
|
|
|
h := NewCrowdsecHandler(OpenTestDB(t), &fakeExec{}, "/bin/false", t.TempDir())
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
body := `{"slug": " "}`
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodPost, "/api/v1/admin/crowdsec/presets/apply", strings.NewReader(body))
|
|
req.Header.Set("Content-Type", "application/json")
|
|
r.ServeHTTP(w, req)
|
|
|
|
require.Equal(t, http.StatusBadRequest, w.Code)
|
|
require.Contains(t, w.Body.String(), "slug required")
|
|
}
|
|
|
|
func TestCrowdsecHandler_ApplyPreset_HubUnavailable(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
t.Setenv("FEATURE_CERBERUS_ENABLED", "true")
|
|
|
|
h := NewCrowdsecHandler(OpenTestDB(t), &fakeExec{}, "/bin/false", t.TempDir())
|
|
h.Hub = nil // Simulate hub unavailable
|
|
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
body := `{"slug": "test-slug"}`
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodPost, "/api/v1/admin/crowdsec/presets/apply", strings.NewReader(body))
|
|
req.Header.Set("Content-Type", "application/json")
|
|
r.ServeHTTP(w, req)
|
|
|
|
require.Equal(t, http.StatusServiceUnavailable, w.Code)
|
|
require.Contains(t, w.Body.String(), "hub service unavailable")
|
|
}
|
|
|
|
func TestCrowdsecHandler_UpdateAcquisitionConfig_MissingContent(t *testing.T) {
|
|
t.Parallel()
|
|
gin.SetMode(gin.TestMode)
|
|
|
|
h := NewCrowdsecHandler(OpenTestDB(t), &fakeExec{}, "/bin/false", t.TempDir())
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
body := `{}`
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodPut, "/api/v1/admin/crowdsec/acquisition", strings.NewReader(body))
|
|
req.Header.Set("Content-Type", "application/json")
|
|
r.ServeHTTP(w, req)
|
|
|
|
require.Equal(t, http.StatusBadRequest, w.Code)
|
|
require.Contains(t, w.Body.String(), "content is required")
|
|
}
|
|
|
|
func TestCrowdsecHandler_UpdateAcquisitionConfig_InvalidJSON(t *testing.T) {
|
|
t.Parallel()
|
|
gin.SetMode(gin.TestMode)
|
|
|
|
h := NewCrowdsecHandler(OpenTestDB(t), &fakeExec{}, "/bin/false", t.TempDir())
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodPut, "/api/v1/admin/crowdsec/acquisition", strings.NewReader("not-json"))
|
|
req.Header.Set("Content-Type", "application/json")
|
|
r.ServeHTTP(w, req)
|
|
|
|
require.Equal(t, http.StatusBadRequest, w.Code)
|
|
}
|
|
|
|
func TestCrowdsecHandler_ListDecisions_WithConfigYaml(t *testing.T) {
|
|
t.Parallel()
|
|
gin.SetMode(gin.TestMode)
|
|
|
|
tmpDir := t.TempDir()
|
|
// Create config.yaml to trigger the config path code
|
|
require.NoError(t, os.WriteFile(filepath.Join(tmpDir, "config.yaml"), []byte("# test config"), 0o644))
|
|
|
|
mockExec := &mockCmdExecutor{
|
|
output: []byte(`[{"id": 1, "origin": "cscli", "type": "ban", "scope": "ip", "value": "10.0.0.1"}]`),
|
|
err: nil,
|
|
}
|
|
|
|
db := setupCrowdDB(t)
|
|
h := NewCrowdsecHandler(db, &fakeExec{}, "/bin/false", tmpDir)
|
|
h.CmdExec = mockExec
|
|
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodGet, "/api/v1/admin/crowdsec/decisions", http.NoBody)
|
|
r.ServeHTTP(w, req)
|
|
|
|
require.Equal(t, http.StatusOK, w.Code)
|
|
|
|
// Verify the -c flag was passed
|
|
require.NotEmpty(t, mockExec.calls)
|
|
foundConfigFlag := false
|
|
for _, call := range mockExec.calls {
|
|
for i, arg := range call.args {
|
|
if arg == "-c" && i+1 < len(call.args) {
|
|
foundConfigFlag = true
|
|
break
|
|
}
|
|
}
|
|
}
|
|
require.True(t, foundConfigFlag, "Expected -c flag to be passed when config.yaml exists")
|
|
}
|
|
|
|
func TestCrowdsecHandler_BanIP_WithConfigYaml(t *testing.T) {
|
|
t.Parallel()
|
|
gin.SetMode(gin.TestMode)
|
|
|
|
tmpDir := t.TempDir()
|
|
// Create config.yaml to trigger the config path code
|
|
require.NoError(t, os.WriteFile(filepath.Join(tmpDir, "config.yaml"), []byte("# test config"), 0o644))
|
|
|
|
mockExec := &mockCmdExecutor{
|
|
output: []byte("Decision created"),
|
|
err: nil,
|
|
}
|
|
|
|
db := setupCrowdDB(t)
|
|
h := NewCrowdsecHandler(db, &fakeExec{}, "/bin/false", tmpDir)
|
|
h.CmdExec = mockExec
|
|
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
body := `{"ip": "192.168.1.100"}`
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodPost, "/api/v1/admin/crowdsec/ban", strings.NewReader(body))
|
|
req.Header.Set("Content-Type", "application/json")
|
|
r.ServeHTTP(w, req)
|
|
|
|
require.Equal(t, http.StatusOK, w.Code)
|
|
}
|
|
|
|
func TestCrowdsecHandler_UnbanIP_WithConfigYaml(t *testing.T) {
|
|
t.Parallel()
|
|
gin.SetMode(gin.TestMode)
|
|
|
|
tmpDir := t.TempDir()
|
|
// Create config.yaml to trigger the config path code
|
|
require.NoError(t, os.WriteFile(filepath.Join(tmpDir, "config.yaml"), []byte("# test config"), 0o644))
|
|
|
|
mockExec := &mockCmdExecutor{
|
|
output: []byte("Decision deleted"),
|
|
err: nil,
|
|
}
|
|
|
|
db := setupCrowdDB(t)
|
|
h := NewCrowdsecHandler(db, &fakeExec{}, "/bin/false", tmpDir)
|
|
h.CmdExec = mockExec
|
|
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodDelete, "/api/v1/admin/crowdsec/ban/192.168.1.100", http.NoBody)
|
|
r.ServeHTTP(w, req)
|
|
|
|
require.Equal(t, http.StatusOK, w.Code)
|
|
}
|
|
|
|
func TestCrowdsecHandler_Status_LAPIReady(t *testing.T) {
|
|
t.Parallel()
|
|
gin.SetMode(gin.TestMode)
|
|
|
|
tmpDir := t.TempDir()
|
|
// Create config.yaml
|
|
require.NoError(t, os.WriteFile(filepath.Join(tmpDir, "config.yaml"), []byte("# test config"), 0o644))
|
|
|
|
// Mock executor that returns success for LAPI status
|
|
mockExec := &mockCmdExecutor{
|
|
output: []byte("LAPI OK"),
|
|
err: nil,
|
|
}
|
|
|
|
// fakeExec that reports running
|
|
fe := &fakeExec{started: true}
|
|
|
|
db := setupCrowdDB(t)
|
|
h := NewCrowdsecHandler(db, fe, "/bin/false", tmpDir)
|
|
h.CmdExec = mockExec
|
|
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodGet, "/api/v1/admin/crowdsec/status", http.NoBody)
|
|
r.ServeHTTP(w, req)
|
|
|
|
require.Equal(t, http.StatusOK, w.Code)
|
|
var resp map[string]any
|
|
require.NoError(t, json.Unmarshal(w.Body.Bytes(), &resp))
|
|
require.True(t, resp["running"].(bool))
|
|
require.True(t, resp["lapi_ready"].(bool))
|
|
}
|
|
|
|
func TestCrowdsecHandler_Status_LAPINotReady(t *testing.T) {
|
|
t.Parallel()
|
|
gin.SetMode(gin.TestMode)
|
|
|
|
tmpDir := t.TempDir()
|
|
|
|
// Mock executor that returns error for LAPI status
|
|
mockExec := &mockCmdExecutor{
|
|
output: []byte("error: LAPI unavailable"),
|
|
err: errors.New("lapi check failed"),
|
|
}
|
|
|
|
// fakeExec that reports running
|
|
fe := &fakeExec{started: true}
|
|
|
|
db := setupCrowdDB(t)
|
|
h := NewCrowdsecHandler(db, fe, "/bin/false", tmpDir)
|
|
h.CmdExec = mockExec
|
|
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodGet, "/api/v1/admin/crowdsec/status", http.NoBody)
|
|
r.ServeHTTP(w, req)
|
|
|
|
require.Equal(t, http.StatusOK, w.Code)
|
|
var resp map[string]any
|
|
require.NoError(t, json.Unmarshal(w.Body.Bytes(), &resp))
|
|
require.True(t, resp["running"].(bool))
|
|
require.False(t, resp["lapi_ready"].(bool))
|
|
}
|
|
|
|
func TestCrowdsecHandler_ListDecisions_WithCreatedAt(t *testing.T) {
|
|
t.Parallel()
|
|
gin.SetMode(gin.TestMode)
|
|
|
|
// Mock executor that returns decisions with created_at field
|
|
mockExec := &mockCmdExecutor{
|
|
output: []byte(`[{"id": 1, "origin": "cscli", "type": "ban", "scope": "ip", "value": "10.0.0.1", "created_at": "2024-01-01T12:00:00Z", "until": "2024-01-02T12:00:00Z"}]`),
|
|
err: nil,
|
|
}
|
|
|
|
db := setupCrowdDB(t)
|
|
h := NewCrowdsecHandler(db, &fakeExec{}, "/bin/false", t.TempDir())
|
|
h.CmdExec = mockExec
|
|
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodGet, "/api/v1/admin/crowdsec/decisions", http.NoBody)
|
|
r.ServeHTTP(w, req)
|
|
|
|
require.Equal(t, http.StatusOK, w.Code)
|
|
var resp map[string]any
|
|
require.NoError(t, json.Unmarshal(w.Body.Bytes(), &resp))
|
|
decisions := resp["decisions"].([]any)
|
|
require.Len(t, decisions, 1)
|
|
decision := decisions[0].(map[string]any)
|
|
require.Equal(t, "2024-01-02T12:00:00Z", decision["until"])
|
|
}
|
|
|
|
// Note: TestTTLRemainingSeconds, TestMapCrowdsecStatus, TestActorFromContext
|
|
// are defined in crowdsec_handler_comprehensive_test.go
|
|
|
|
func TestCrowdsecHandler_HubEndpoints(t *testing.T) {
|
|
t.Parallel()
|
|
gin.SetMode(gin.TestMode)
|
|
|
|
// Test with nil Hub
|
|
h := &CrowdsecHandler{Hub: nil}
|
|
endpoints := h.hubEndpoints()
|
|
require.Nil(t, endpoints)
|
|
|
|
// Test with Hub having base URLs
|
|
db := setupCrowdDB(t)
|
|
h2 := NewCrowdsecHandler(db, &fakeExec{}, "/bin/false", t.TempDir())
|
|
endpoints2 := h2.hubEndpoints()
|
|
// Hub is initialized with default URLs
|
|
require.NotNil(t, endpoints2)
|
|
}
|
|
|
|
func TestCrowdsecHandler_ConsoleEnroll_ProgressConflict(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
t.Setenv("FEATURE_CROWDSEC_CONSOLE_ENROLLMENT", "true")
|
|
|
|
h, _ := setupTestConsoleEnrollment(t)
|
|
|
|
// First enroll to create an "in progress" state
|
|
body := `{"enrollment_key": "abc123456789", "agent_name": "test-agent-1"}`
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodPost, "/api/v1/admin/crowdsec/console/enroll", strings.NewReader(body))
|
|
req.Header.Set("Content-Type", "application/json")
|
|
r.ServeHTTP(w, req)
|
|
require.Equal(t, http.StatusOK, w.Code)
|
|
|
|
// Try to enroll again without force - should succeed or conflict based on state
|
|
w2 := httptest.NewRecorder()
|
|
req2 := httptest.NewRequest(http.MethodPost, "/api/v1/admin/crowdsec/console/enroll", strings.NewReader(body))
|
|
req2.Header.Set("Content-Type", "application/json")
|
|
r.ServeHTTP(w2, req2)
|
|
|
|
// May succeed or return conflict depending on implementation
|
|
require.True(t, w2.Code == http.StatusOK || w2.Code == http.StatusConflict)
|
|
}
|
|
|
|
func TestCrowdsecHandler_GetCachedPreset_CerberusDisabled(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
t.Setenv("FEATURE_CERBERUS_ENABLED", "false")
|
|
|
|
h := NewCrowdsecHandler(OpenTestDB(t), &fakeExec{}, "/bin/false", t.TempDir())
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodGet, "/api/v1/admin/crowdsec/presets/cache/test-slug", http.NoBody)
|
|
r.ServeHTTP(w, req)
|
|
|
|
require.Equal(t, http.StatusNotFound, w.Code)
|
|
require.Contains(t, w.Body.String(), "cerberus disabled")
|
|
}
|
|
|
|
func TestCrowdsecHandler_GetCachedPreset_HubUnavailable(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
t.Setenv("FEATURE_CERBERUS_ENABLED", "true")
|
|
|
|
h := NewCrowdsecHandler(OpenTestDB(t), &fakeExec{}, "/bin/false", t.TempDir())
|
|
// Set Hub to nil to simulate unavailable
|
|
h.Hub = nil
|
|
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodGet, "/api/v1/admin/crowdsec/presets/cache/test-slug", http.NoBody)
|
|
r.ServeHTTP(w, req)
|
|
|
|
require.Equal(t, http.StatusServiceUnavailable, w.Code)
|
|
require.Contains(t, w.Body.String(), "unavailable")
|
|
}
|
|
|
|
func TestCrowdsecHandler_GetCachedPreset_EmptySlug(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
t.Setenv("FEATURE_CERBERUS_ENABLED", "true")
|
|
|
|
db := OpenTestDB(t)
|
|
tmpDir := t.TempDir()
|
|
h := NewCrowdsecHandler(db, &fakeExec{}, "/bin/false", tmpDir)
|
|
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodGet, "/api/v1/admin/crowdsec/presets/cache/", http.NoBody)
|
|
r.ServeHTTP(w, req)
|
|
|
|
// Empty slug should result in 404 (route not matched) or 400
|
|
require.True(t, w.Code == http.StatusNotFound || w.Code == http.StatusBadRequest)
|
|
}
|
|
|
|
// TestCrowdsecHandler_Start_StatusCode tests starting CrowdSec returns 200 status
|
|
func TestCrowdsecHandler_Start_StatusCode(t *testing.T) {
|
|
t.Parallel()
|
|
gin.SetMode(gin.TestMode)
|
|
db := setupCrowdDB(t)
|
|
tmpDir := t.TempDir()
|
|
fe := &fakeExec{}
|
|
h := NewCrowdsecHandler(db, fe, "/bin/false", tmpDir)
|
|
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodPost, "/api/v1/admin/crowdsec/start", http.NoBody)
|
|
r.ServeHTTP(w, req)
|
|
|
|
require.Equal(t, http.StatusOK, w.Code)
|
|
var response map[string]interface{}
|
|
err := json.Unmarshal(w.Body.Bytes(), &response)
|
|
require.NoError(t, err)
|
|
require.Equal(t, "started", response["status"])
|
|
}
|
|
|
|
// TestCrowdsecHandler_Stop_UpdatesSecurityConfig tests stopping CrowdSec updates SecurityConfig
|
|
func TestCrowdsecHandler_Stop_UpdatesSecurityConfig(t *testing.T) {
|
|
t.Parallel()
|
|
gin.SetMode(gin.TestMode)
|
|
db := setupCrowdDB(t)
|
|
tmpDir := t.TempDir()
|
|
fe := &fakeExec{started: true}
|
|
h := NewCrowdsecHandler(db, fe, "/bin/false", tmpDir)
|
|
|
|
// Create initial SecurityConfig
|
|
cfg := models.SecurityConfig{
|
|
UUID: "default",
|
|
Name: "Default",
|
|
Enabled: true,
|
|
CrowdSecMode: "local",
|
|
}
|
|
require.NoError(t, db.Create(&cfg).Error)
|
|
|
|
r := gin.New()
|
|
g := r.Group("/api/v1")
|
|
h.RegisterRoutes(g)
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodPost, "/api/v1/admin/crowdsec/stop", http.NoBody)
|
|
r.ServeHTTP(w, req)
|
|
|
|
require.Equal(t, http.StatusOK, w.Code)
|
|
|
|
// Verify SecurityConfig was updated
|
|
var updatedCfg models.SecurityConfig
|
|
require.NoError(t, db.First(&updatedCfg).Error)
|
|
require.Equal(t, "disabled", updatedCfg.CrowdSecMode)
|
|
require.False(t, updatedCfg.Enabled)
|
|
}
|
|
|
|
// TestCrowdsecHandler_ActorFromContext tests actor extraction from Gin context
|
|
func TestCrowdsecHandler_ActorFromContext(t *testing.T) {
|
|
t.Parallel()
|
|
gin.SetMode(gin.TestMode)
|
|
|
|
// Test with userID present
|
|
c1, _ := gin.CreateTestContext(httptest.NewRecorder())
|
|
c1.Set("userID", 123)
|
|
actor1 := actorFromContext(c1)
|
|
require.Equal(t, "user:123", actor1)
|
|
|
|
// Test without userID
|
|
c2, _ := gin.CreateTestContext(httptest.NewRecorder())
|
|
actor2 := actorFromContext(c2)
|
|
require.Equal(t, "unknown", actor2)
|
|
}
|
|
|
|
// TestCrowdsecHandler_IsCerberusEnabled_EnvVar tests Cerberus feature flag via environment variable
|
|
func TestCrowdsecHandler_IsCerberusEnabled_EnvVar(t *testing.T) {
|
|
// Note: Cannot use t.Parallel() with t.Setenv in subtests
|
|
gin.SetMode(gin.TestMode)
|
|
|
|
testCases := []struct {
|
|
name string
|
|
envKey string
|
|
envValue string
|
|
expected bool
|
|
}{
|
|
{"FEATURE_CERBERUS_ENABLED=true", "FEATURE_CERBERUS_ENABLED", "true", true},
|
|
{"FEATURE_CERBERUS_ENABLED=false", "FEATURE_CERBERUS_ENABLED", "false", false},
|
|
{"CERBERUS_ENABLED=1", "CERBERUS_ENABLED", "1", true},
|
|
{"CERBERUS_ENABLED=0", "CERBERUS_ENABLED", "0", false},
|
|
}
|
|
|
|
for _, tc := range testCases {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
t.Setenv(tc.envKey, tc.envValue)
|
|
db := setupCrowdDB(t)
|
|
tmpDir := t.TempDir()
|
|
h := NewCrowdsecHandler(db, &fakeExec{}, "/bin/false", tmpDir)
|
|
|
|
result := h.isCerberusEnabled()
|
|
require.Equal(t, tc.expected, result)
|
|
})
|
|
}
|
|
}
|