George Lambert
1b199ca4d4
Some checks are pending
offline / test (push) Waiting to run
Zapier is one ingress. Direct web, customer API, and S2S leaf nodes are their own services. Every hop to an internal subject must pass verae.access.authz.check (default deny by plane).
39 lines
1.4 KiB
JavaScript
39 lines
1.4 KiB
JavaScript
import { test } from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
import { spawn } from 'node:child_process';
|
|
import path from 'node:path';
|
|
import { fileURLToPath } from 'node:url';
|
|
|
|
const root = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
|
|
const authzRoot = path.join(root, '..', 'verae-access-authz');
|
|
|
|
test('zapier plane has no portal and cannot read statements', async () => {
|
|
const authzPort = 18028;
|
|
const zPort = 18029;
|
|
const authz = spawn(process.execPath, ['src/server.js'], {
|
|
cwd: authzRoot,
|
|
env: { ...process.env, PORT: String(authzPort) },
|
|
stdio: ['ignore', 'pipe', 'pipe'],
|
|
});
|
|
const z = spawn(process.execPath, ['src/server.js'], {
|
|
cwd: root,
|
|
env: { ...process.env, PORT: String(zPort), AUTHZ_URL: `http://127.0.0.1:${authzPort}` },
|
|
stdio: ['ignore', 'pipe', 'pipe'],
|
|
});
|
|
await new Promise((r) => setTimeout(r, 500));
|
|
try {
|
|
const h = await (await fetch(`http://127.0.0.1:${zPort}/health`)).json();
|
|
assert.equal(h.plane, 'zapier');
|
|
const portal = await fetch(`http://127.0.0.1:${zPort}/portal`);
|
|
assert.equal(portal.status, 404);
|
|
const deny = await fetch(`http://127.0.0.1:${authzPort}/check`, {
|
|
method: 'POST',
|
|
headers: { 'content-type': 'application/json' },
|
|
body: JSON.stringify({ plane: 'zapier', subject: 'verae.billing.statement.get' }),
|
|
});
|
|
assert.equal(deny.status, 403);
|
|
} finally {
|
|
z.kill('SIGTERM');
|
|
authz.kill('SIGTERM');
|
|
}
|
|
});
|