188 lines
8.6 KiB
FSharp
188 lines
8.6 KiB
FSharp
#load "gateway.fsx"
|
|
|
|
open System
|
|
open System.Net
|
|
open System.Net.Http
|
|
open System.Net.Http.Headers
|
|
open System.Security.Cryptography
|
|
open System.Text
|
|
open System.Text.Json
|
|
open System.Threading
|
|
open System.Threading.Tasks
|
|
open Bootstrap
|
|
open Gateway
|
|
|
|
let require condition message =
|
|
if not condition then
|
|
invalidOp message
|
|
|
|
let base64Bytes (value: string) =
|
|
let value = value.Replace('-', '+').Replace('_', '/')
|
|
let padded = value.PadRight(value.Length + ((4 - value.Length % 4) % 4), '=')
|
|
Convert.FromBase64String padded
|
|
|
|
type QuayHandler(rsa: RSA, wrongScopes: bool) =
|
|
inherit HttpMessageHandler()
|
|
|
|
let mutable assigned = false
|
|
let seen = ResizeArray<string>()
|
|
member _.Seen = seen
|
|
|
|
member private _.Respond(request: HttpRequestMessage) =
|
|
let path = request.RequestUri.AbsolutePath
|
|
seen.Add($"{request.Method} {path}")
|
|
|
|
if request.RequestUri.Host = "zitadel-api" then
|
|
require (request.Headers.Host = "zitadel") "canonical ZITADEL host changed"
|
|
|
|
require
|
|
(request.Headers.GetValues("X-Zitadel-Public-Host") |> Seq.exactlyOne = "zitadel")
|
|
"public ZITADEL host changed"
|
|
|
|
if path.StartsWith "/v2/" then
|
|
require (request.Headers.Authorization.Scheme = "Bearer") "ZITADEL system JWT was omitted"
|
|
let segments = request.Headers.Authorization.Parameter.Split('.')
|
|
require (segments.Length = 3) "JWT segment count changed"
|
|
use header = JsonDocument.Parse(base64Bytes segments[0])
|
|
use claims = JsonDocument.Parse(base64Bytes segments[1])
|
|
require (header.RootElement.GetProperty("alg").GetString() = "RS256") "JWT algorithm changed"
|
|
require (claims.RootElement.GetProperty("iss").GetString() = "login-client") "JWT issuer changed"
|
|
require (claims.RootElement.GetProperty("sub").GetString() = "login-client") "JWT subject changed"
|
|
require (claims.RootElement.GetProperty("aud").GetString() = "http://zitadel") "JWT audience changed"
|
|
let issued = claims.RootElement.GetProperty("iat").GetInt64()
|
|
require (claims.RootElement.GetProperty("exp").GetInt64() = issued + 300L) "JWT lifetime changed"
|
|
|
|
require
|
|
(rsa.VerifyData(
|
|
Encoding.UTF8.GetBytes($"{segments[0]}.{segments[1]}"),
|
|
base64Bytes segments[2],
|
|
HashAlgorithmName.SHA256,
|
|
RSASignaturePadding.Pkcs1
|
|
))
|
|
"JWT signature is invalid"
|
|
|
|
let status, body, location =
|
|
match request.Method.Method, path with
|
|
| "GET", "/csrf_token" -> HttpStatusCode.OK, """{"csrf_token":"csrf"}""", None
|
|
| "POST", "/api/v1/externallogin/zitadel" ->
|
|
require (request.Headers.GetValues("X-CSRF-Token") |> Seq.exactlyOne = "csrf") "Quay CSRF token changed"
|
|
require (isNull request.Content.Headers.ContentType.CharSet) "Quay JSON media type included a charset"
|
|
require (request.Content.Headers.ContentLength.HasValue) "Quay JSON request omitted its content length"
|
|
HttpStatusCode.OK, """{"auth_url":"http://zitadel/oidc/start"}""", None
|
|
| "GET", "/oidc/start" -> HttpStatusCode.Found, "", Some "/ui/v2/login/login?authRequest=request-id"
|
|
| "POST", "/v2/sessions" -> HttpStatusCode.Created, """{"sessionId":"session-id"}""", None
|
|
| "PATCH", "/v2/sessions/session-id" -> HttpStatusCode.OK, """{"sessionToken":"session-token"}""", None
|
|
| "POST", "/v2/oidc/auth_requests/request-id" ->
|
|
HttpStatusCode.OK, """{"callbackUrl":"http://quay/callback"}""", None
|
|
| "GET", "/callback" -> HttpStatusCode.Found, "", Some "http://quay/"
|
|
| "PUT", "/api/v1/organization/candidates/team/mirrored-image" -> HttpStatusCode.OK, "", None
|
|
| "PUT", "/api/v1/organization/candidates/team/mirrored-image/members/candidates-bot" ->
|
|
HttpStatusCode.OK, "", None
|
|
| "GET", "/api/v1/organization/candidates/prototypes" -> HttpStatusCode.OK, """{"prototypes":[]}""", None
|
|
| "POST", "/api/v1/organization/candidates/prototypes" -> HttpStatusCode.OK, "", None
|
|
| "GET", "/api/v1/organization/candidates/applications" ->
|
|
HttpStatusCode.OK, """{"applications":[]}""", None
|
|
| "POST", "/api/v1/organization/candidates/applications" ->
|
|
HttpStatusCode.OK, """{"client_id":"client-id"}""", None
|
|
| "GET", "/api/v1/user/assignedauthorization" when not assigned ->
|
|
HttpStatusCode.OK, """{"authorizations":[]}""", None
|
|
| "POST", "/oauth/authorize/assignuser" ->
|
|
require (request.Headers.Authorization.Scheme = "Basic") "admin token did not use Quay Basic auth"
|
|
let query = Uri.UnescapeDataString request.RequestUri.Query
|
|
require (query.Contains "scope=repo:create+repo:write") "writer scopes changed"
|
|
require (not (query.Contains "repo:read")) "writer token redundantly requested read"
|
|
assigned <- true
|
|
HttpStatusCode.OK, "", None
|
|
| "GET", "/api/v1/user/assignedauthorization" ->
|
|
let scopes =
|
|
if wrongScopes then
|
|
"""[{"scope":"repo:read"}]"""
|
|
else
|
|
"""[{"scope":"repo:create"},{"scope":"repo:write"}]"""
|
|
|
|
HttpStatusCode.OK,
|
|
sprintf
|
|
"""{"authorizations":[{"application":{"clientId":"client-id"},"uuid":"assignment-id","redirectUri":"http://quay/oauth/localapp","responseType":"token","scopes":%s}]}"""
|
|
scopes,
|
|
None
|
|
| "GET", "/oauth/authorize" -> HttpStatusCode.OK, """{"csrf_token_val":"approval-csrf"}""", None
|
|
| "POST", "/oauth/authorizeapp" ->
|
|
require
|
|
(request.Headers.GetValues("X-CSRF-Token") |> Seq.exactlyOne = "approval-csrf")
|
|
"approval CSRF token changed"
|
|
|
|
HttpStatusCode.Found, "", Some "http://quay/oauth/localapp#access_token=issued-token"
|
|
| _ -> invalidOp $"unexpected request {request.Method} {request.RequestUri}"
|
|
|
|
let response = new HttpResponseMessage(status)
|
|
response.Content <- new StringContent(body, Encoding.UTF8, "application/json")
|
|
|
|
location
|
|
|> Option.iter (fun value -> response.Headers.Location <- Uri(value, UriKind.RelativeOrAbsolute))
|
|
|
|
response
|
|
|
|
override this.Send(request: HttpRequestMessage, _: CancellationToken) = this.Respond request
|
|
|
|
override this.SendAsync(request: HttpRequestMessage, _: CancellationToken) = Task.FromResult(this.Respond request)
|
|
|
|
let rsa = RSA.Create(2048)
|
|
let handler = new QuayHandler(rsa, false)
|
|
let adminClient = new HttpClient(handler, false)
|
|
|
|
let sessionClient () = new HttpClient(handler, false)
|
|
|
|
let quay =
|
|
makeQuayWith
|
|
adminClient
|
|
sessionClient
|
|
{ URL = "http://quay"
|
|
ZitadelAPI = "http://zitadel-api"
|
|
ZitadelIssuer = "http://zitadel"
|
|
CaPath = ""
|
|
LoginKey = rsa.ExportRSAPrivateKeyPem() }
|
|
|
|
let session = quay.Login "candidates-bot" "password" (quay.LoginAuth())
|
|
let definition = apps |> List.find (fun app -> app.Name = "candidates-writer")
|
|
quay.Access "admin-token" definition
|
|
let clientID = quay.Application "admin-token" definition
|
|
let app = { definition with Client = clientID }
|
|
quay.Assign "admin-token" session app
|
|
let token = quay.Issue session app
|
|
require (token = "issued-token") "issued Quay token changed"
|
|
require (handler.Seen.Count = 19) "bootstrap request sequence changed"
|
|
adminClient.Dispose()
|
|
|
|
let wrongHandler = new QuayHandler(rsa, true)
|
|
let wrongAdmin = new HttpClient(wrongHandler, false)
|
|
|
|
let wrongQuay =
|
|
makeQuayWith
|
|
wrongAdmin
|
|
(fun () -> new HttpClient(wrongHandler, false))
|
|
{ URL = "http://quay"
|
|
ZitadelAPI = "http://zitadel-api"
|
|
ZitadelIssuer = "http://zitadel"
|
|
CaPath = ""
|
|
LoginKey = rsa.ExportRSAPrivateKeyPem() }
|
|
|
|
let wrongSession =
|
|
wrongQuay.Login "candidates-bot" "password" (wrongQuay.LoginAuth())
|
|
|
|
wrongQuay.Access "admin-token" definition
|
|
|
|
let wrongApp =
|
|
{ definition with
|
|
Client = wrongQuay.Application "admin-token" definition }
|
|
|
|
let scopeRejected =
|
|
try
|
|
wrongQuay.Assign "admin-token" wrongSession wrongApp
|
|
false
|
|
with :? InvalidOperationException as error ->
|
|
error.Message = "assigned authorization has different scopes"
|
|
|
|
require scopeRejected "wrong assigned scopes were accepted"
|
|
wrongAdmin.Dispose()
|
|
rsa.Dispose()
|
|
printfn "Quay bootstrap tests passed"
|