Repository: etcd-io/etcd
File: tests/e2e/ctl_v3_auth_test.go (Go)

Code before:
	// grant the entire keys
	cx.user, cx.pass = "root", "root"
	require.NoError(cx.t, ctlV3RoleGrantPermission(cx, "test-role", grantingPerm{true, true, "", "\x00", false}))

	// try keys, of course it must be allowed because test-role has a permission of the entire keys
	cx.user, cx.pass = "test-user", "pass"
	for i := 0; i < 10; i++ {
		key := fmt.Sprintf("z%d", i)
		require.NoError(cx.t, ctlV3Put(cx, key, "val", ""))
	}

	// revoke the entire keys
	cx.user, cx.pass = "root", "root"
	require.NoError(cx.t, ctlV3RoleRevokePermission(cx, "test-role", "", "", true))

	// try the revoked entire key permission
	cx.user, cx.pass = "test-user", "pass"
	for i := 0; i < 10; i++ {
		key := fmt.Sprintf("z%d", i)
		err := ctlV3PutFailPerm(cx, key, "val")
		require.ErrorContains(cx.t, err, "permission denied")
	}
}

func authTestWatch(cx ctlCtx) {
	require.NoError(cx.t, authStatus(cx))
	require.NoError(cx.t, authEnable(cx))

	cx.user, cx.pass = "root", "root"
	authSetupTestUser(cx)

	// grant a key range
	require.NoError(cx.t, ctlV3RoleGrantPermission(cx, "test-role", grantingPerm{true, true, "key", "key4", false}))

	tests := []struct {
		puts []kv
		args []string

		wkv  []kvExec
		want bool
	}{
		{ // watch 1 key, should be successful
			[]kv{{"key", "value"}},
			[]string{"key", "--rev", "1"},
			[]kvExec{{key: "key", val: "value"}},
			true,
		},
		{ // watch 3 keys by range, should be successful
			[]kv{{"key1", "val1"}, {"key3", "val3"}, {"key2", "val2"}},
			[]string{"key", "key3", "--rev", "1"},
			[]kvExec{{key: "key1", val: "val1"}, {key: "key2", val: "val2"}},

Review comment (security):
This isn't correct. You should enable auth first, and get the auth status later.

Pls add a separate e2e test case `TestGetAuthStatus`, in which contains two cases: auth enabled, auth disabled

Code after:

	// grant the entire keys
	cx.user, cx.pass = "root", "root"
	require.NoError(cx.t, ctlV3RoleGrantPermission(cx, "test-role", grantingPerm{true, true, "", "\x00", false}))

	// try keys, of course it must be allowed because test-role has a permission of the entire keys
	cx.user, cx.pass = "test-user", "pass"
	for i := 0; i < 10; i++ {
		key := fmt.Sprintf("z%d", i)
		require.NoError(cx.t, ctlV3Put(cx, key, "val", ""))
	}

	// revoke the entire keys
	cx.user, cx.pass = "root", "root"
	require.NoError(cx.t, ctlV3RoleRevokePermission(cx, "test-role", "", "", true))

	// try the revoked entire key permission
	cx.user, cx.pass = "test-user", "pass"
	for i := 0; i < 10; i++ {
		key := fmt.Sprintf("z%d", i)
		err := ctlV3PutFailPerm(cx, key, "val")
		require.ErrorContains(cx.t, err, "permission denied")
	}
}

func authTestWatch(cx ctlCtx) {
	require.NoError(cx.t, authEnable(cx))

	cx.user, cx.pass = "root", "root"
	authSetupTestUser(cx)

	// grant a key range
	require.NoError(cx.t, ctlV3RoleGrantPermission(cx, "test-role", grantingPerm{true, true, "key", "key4", false}))

	tests := []struct {
		puts []kv
		args []string

		wkv  []kvExec
		want bool
	}{
		{ // watch 1 key, should be successful
			[]kv{{"key", "value"}},
			[]string{"key", "--rev", "1"},
			[]kvExec{{key: "key", val: "value"}},
			true,
		},
		{ // watch 3 keys by range, should be successful
			[]kv{{"key1", "val1"}, {"key3", "val3"}, {"key2", "val2"}},
			[]string{"key", "key3", "--rev", "1"},
			[]kvExec{{key: "key1", val: "val1"}, {key: "key2", val: "val2"}},