omicron/nexus/tests/integration_tests/device_auth.rs at df0fae851b4ddd52c1df0f3ffecd1b6e5d39745a · oxidecomputer/omicron · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
// This Source Code Form is subject to the terms of the Mozilla Public
// License, v. 2.0. If a copy of the MPL was not distributed with this
// file, You can obtain one at https://mozilla.org/MPL/2.0/.

use std::num::NonZeroU32;

use dropshot::test_util::ClientTestContext;
use nexus_auth::authn::USER_TEST_UNPRIVILEGED;
use nexus_db_queries::db::fixed_data::silo::DEFAULT_SILO;
use nexus_db_queries::db::identity::{Asset, Resource};
use nexus_test_utils::http_testing::TestResponse;
use nexus_test_utils::resource_helpers::{
    object_get, object_put, object_put_error,
};
use nexus_test_utils::{
    http_testing::{AuthnMode, NexusRequest, RequestBuilder},
    resource_helpers::grant_iam,
};
use nexus_test_utils_macros::nexus_test;
use nexus_types::external_api::{params, views};
use nexus_types::external_api::{
    params::{DeviceAccessTokenRequest, DeviceAuthRequest, DeviceAuthVerify},
    views::{
        DeviceAccessTokenGrant, DeviceAccessTokenType, DeviceAuthResponse,
    },
};

use http::{StatusCode, header, method::Method};
use oxide_client::types::SiloRole;
use serde::Deserialize;
use tokio::time::{Duration, sleep};
use uuid::Uuid;

type ControlPlaneTestContext =
    nexus_test_utils::ControlPlaneTestContext<omicron_nexus::Server>;

#[derive(Deserialize)]
struct OAuthError {
    error: String,
    //error_description: Option<String>,
}

#[nexus_test]
async fn test_device_auth_flow(cptestctx: &ControlPlaneTestContext) {
    let testctx = &cptestctx.external_client;

    // Trying to authenticate without a `client_id` fails.
    RequestBuilder::new(testctx, Method::POST, "/device/auth")
        .allow_non_dropshot_errors()
        .expect_status(Some(StatusCode::BAD_REQUEST))
        .execute()
        .await
        .expect("failed to reject device auth start without client_id");

    let client_id = Uuid::new_v4();
    let authn_params = DeviceAuthRequest { client_id };

    // Using a JSON encoded body fails.
    RequestBuilder::new(testctx, Method::POST, "/device/auth")
        .allow_non_dropshot_errors()
        .body(Some(&authn_params))
        .expect_status(Some(StatusCode::BAD_REQUEST))
        .execute()
        .await
        .expect("failed to reject JSON encoded body");

    // Start a device authentication flow using a correctly encoded body.
    let auth_response: DeviceAuthResponse =
        RequestBuilder::new(testctx, Method::POST, "/device/auth")
            .allow_non_dropshot_errors()
            .body_urlencoded(Some(&authn_params))
            .expect_status(Some(StatusCode::OK))
            .execute()
            .await
            .expect("failed to start client authentication flow")
            .parsed_body()
            .expect("client authentication response");

    // Sanity-check the response.
    let device_code = auth_response.device_code;
    let user_code = auth_response.user_code;
    assert!(auth_response.verification_uri.ends_with("/device/verify"));
    assert_eq!(auth_response.expires_in, 300);

    // Unauthenticated requests to the verification page redirect to login.
    RequestBuilder::new(testctx, Method::GET, "/device/verify")
        .expect_status(Some(StatusCode::FOUND))
        .expect_response_header(
            header::LOCATION,
            &format!(
                "/login/{}/local?redirect_uri=%2Fdevice%2Fverify",
                cptestctx.silo_name
            ),
        )
        .execute()
        .await
        .expect("failed to redirect to login on auth failure");

    // Authenticated requests get the console verification page.
    assert!(
        NexusRequest::object_get(testctx, "/device/verify")
            .console_asset()
            .authn_as(AuthnMode::PrivilegedUser)
            .execute()
            .await
            .expect("failed to get verification page")
            .body
            .starts_with(b"<html>")
    );

    let confirm_params = DeviceAuthVerify { user_code };

    // Confirmation must be authenticated.
    RequestBuilder::new(testctx, Method::POST, "/device/confirm")
        .allow_non_dropshot_errors()
        .body(Some(&confirm_params))
        .expect_status(Some(StatusCode::UNAUTHORIZED))
        .execute()
        .await
        .expect("failed to 401 on unauthed confirmation");

    let token_params = DeviceAccessTokenRequest {
        grant_type: "urn:ietf:params:oauth:grant-type:device_code".to_string(),
        device_code,
        client_id,
    };

    // A client polling for a token gets an OAuth error until confirmation.
    let error: OAuthError =
        RequestBuilder::new(testctx, Method::POST, "/device/token")
            .allow_non_dropshot_errors()
            .body_urlencoded(Some(&token_params))
            .expect_status(Some(StatusCode::BAD_REQUEST))
            .execute()
            .await
            .expect("failed to get OAuth error on unconfirmed token request")
            .parsed_body()
            .expect("failed to deserialize OAuth error");
    assert_eq!(&error.error, "authorization_pending");

    // Authenticated confirmation should succeed.
    NexusRequest::new(
        RequestBuilder::new(testctx, Method::POST, "/device/confirm")
            .body(Some(&confirm_params))
            .expect_status(Some(StatusCode::NO_CONTENT)),
    )
    .authn_as(AuthnMode::UnprivilegedUser)
    .execute()
    .await
    .expect("failed to confirm");

    // Token should be granted after confirmation.
    let token: DeviceAccessTokenGrant = NexusRequest::new(
        RequestBuilder::new(testctx, Method::POST, "/device/token")
            .allow_non_dropshot_errors()
            .body_urlencoded(Some(&token_params))
            .expect_status(Some(StatusCode::OK)),
    )
    .authn_as(AuthnMode::UnprivilegedUser)
    .execute()
    .await
    .expect("failed to get token")
    .parsed_body()
    .expect("failed to deserialize token response");
    assert_eq!(token.token_type, DeviceAccessTokenType::Bearer);
    assert_eq!(token.access_token.len(), 52);
    assert!(token.access_token.starts_with("oxide-token-"));

    // now make a request with the token. it 403s because unpriv user has no
    // roles
    project_list(&testctx, &token.access_token, StatusCode::FORBIDDEN)
        .await
        .expect("projects list should 403 with no roles");

    // make sure it also fails with a nonsense token
    project_list(&testctx, "oxide-token-xyz", StatusCode::UNAUTHORIZED)
        .await
        .expect("projects list should 403 with nonsense token");

    // grant unprivileged user silo viewer so they can fetch the projects
    grant_iam(
        testctx,
        &format!("/v1/system/silos/{}", DEFAULT_SILO.identity().name),
        SiloRole::Viewer,
        USER_TEST_UNPRIVILEGED.id(),
        AuthnMode::PrivilegedUser,
    )
    .await;

    // now make the request again and it should work
    project_list(&testctx, &token.access_token, StatusCode::OK)
        .await
        .expect("failed to get projects with token");
}

/// Helper to make the test cute. Goes through the whole flow, returns the token
/// as a string
async fn get_device_token(testctx: &ClientTestContext) -> String {
    let client_id = Uuid::new_v4();
    let authn_params = DeviceAuthRequest { client_id };

    // Start a device authentication flow
    let auth_response: DeviceAuthResponse =
        RequestBuilder::new(testctx, Method::POST, "/device/auth")
            .allow_non_dropshot_errors()
            .body_urlencoded(Some(&authn_params))
            .expect_status(Some(StatusCode::OK))
            .execute()
            .await
            .expect("failed to start client authentication flow")
            .parsed_body()
            .expect("client authentication response");

    let device_code = auth_response.device_code;
    let user_code = auth_response.user_code;

    let confirm_params = DeviceAuthVerify { user_code };

    // Confirm the device authentication
    NexusRequest::new(
        RequestBuilder::new(testctx, Method::POST, "/device/confirm")
            .body(Some(&confirm_params))
            .expect_status(Some(StatusCode::NO_CONTENT)),
    )
    .authn_as(AuthnMode::PrivilegedUser)
    .execute()
    .await
    .expect("failed to confirm");

    let token_params = DeviceAccessTokenRequest {
        grant_type: "urn:ietf:params:oauth:grant-type:device_code".to_string(),
        device_code,
        client_id,
    };

    // Get the token
    let token: DeviceAccessTokenGrant = NexusRequest::new(
        RequestBuilder::new(testctx, Method::POST, "/device/token")
            .allow_non_dropshot_errors()
            .body_urlencoded(Some(&token_params))
            .expect_status(Some(StatusCode::OK)),
    )
    .authn_as(AuthnMode::PrivilegedUser)
    .execute()
    .await
    .expect("failed to get token")
    .parsed_body()
    .expect("failed to deserialize token response");

    token.access_token
}

#[nexus_test]
async fn test_device_token_expiration(cptestctx: &ControlPlaneTestContext) {
    let testctx = &cptestctx.external_client;

    let settings: views::SiloAuthSettings =
        object_get(testctx, "/v1/auth-settings").await;
    assert_eq!(settings.device_token_max_ttl_seconds, None);

    // get a token for the privileged user. default silo max token expiration
    // is null, so tokens don't expire
    let initial_token = get_device_token(testctx).await;

    // test token works on project list
    project_list(&testctx, &initial_token, StatusCode::OK)
        .await
        .expect("initial token should work");

    //  passing negative or zero gives a 400
    for value in [-3, 0] {
        let error = object_put_error(
            testctx,
            "/v1/auth-settings",
            &serde_json::json!({ "device_token_max_ttl_seconds": value }),
            StatusCode::BAD_REQUEST,
        )
        .await;
        let msg = "unable to parse JSON body: \
                   device_token_max_ttl_seconds: invalid value";
        assert!(error.message.starts_with(&msg));
    }
    for value in [-3, 0] {
        let error = object_put_error(
            testctx,
            "/v1/auth-settings",
            &serde_json::json!({ "device_token_max_ttl_seconds": value }),
            StatusCode::BAD_REQUEST,
        )
        .await;
        let msg = "unable to parse JSON body: \
                   device_token_max_ttl_seconds: invalid value";
        assert!(error.message.starts_with(&msg));
    }

    // omitting the key is also a 400
    let error = object_put_error(
        testctx,
        "/v1/auth-settings",
        &serde_json::json!({}),
        StatusCode::BAD_REQUEST,
    )
    .await;
    let msg = "unable to parse JSON body: \
         missing field `device_token_max_ttl_seconds`";
    assert!(error.message.starts_with(&msg));

    // set token expiration on silo to 3 seconds
    let settings: views::SiloAuthSettings = object_put(
        testctx,
        "/v1/auth-settings",
        &params::SiloAuthSettingsUpdate {
            device_token_max_ttl_seconds: NonZeroU32::new(3).into(),
        },
    )
    .await;

    assert_eq!(settings.device_token_max_ttl_seconds, Some(3));

    // might as well test the get endpoint as well
    let settings: views::SiloAuthSettings =
        object_get(testctx, "/v1/auth-settings").await;
    assert_eq!(settings.device_token_max_ttl_seconds, Some(3));

    // create token again (this one will have the 3-second expiration)
    let expiring_token = get_device_token(testctx).await;

    // immediately use token, it should work
    project_list(&testctx, &expiring_token, StatusCode::OK)
        .await
        .expect("expiring token should work immediately");

    // wait 4 seconds to ensure token has expired
    sleep(Duration::from_secs(4)).await;

    // confirm token has expired
    project_list(&testctx, &expiring_token, StatusCode::UNAUTHORIZED)
        .await
        .expect("expiring token should fail after expiration");

    // original token should still work (created before the expiration setting)
    project_list(&testctx, &initial_token, StatusCode::OK)
        .await
        .expect("initial token should still work");

    // now test setting the silo max TTL back to null
    let settings: views::SiloAuthSettings = object_put(
        testctx,
        "/v1/auth-settings",
        &params::SiloAuthSettingsUpdate {
            device_token_max_ttl_seconds: None.into(),
        },
    )
    .await;
    assert_eq!(settings.device_token_max_ttl_seconds, None);

    let settings: views::SiloAuthSettings =
        object_get(testctx, "/v1/auth-settings").await;
    assert_eq!(settings.device_token_max_ttl_seconds, None);
}

async fn project_list(
    testctx: &ClientTestContext,
    token: &str,
    status: StatusCode,
) -> Result<TestResponse, anyhow::Error> {
    RequestBuilder::new(testctx, Method::GET, "/v1/projects")
        .header(header::AUTHORIZATION, format!("Bearer {}", token))
        .expect_status(Some(status))
        .execute()
        .await
}