path: root/spec/unit/network/authconfig_spec.rb

#!/usr/bin/env ruby

require File.dirname(__FILE__) + '/../../spec_helper'

require 'puppet/network/authconfig'

describe Puppet::Network::AuthConfig do
    before do
        @rights = stubs 'rights'
        Puppet::Network::Rights.stubs(:new).returns(@rights)
        @rights.stubs(:each).returns([])

        FileTest.stubs(:exists?).returns(true)
        File.stubs(:stat).returns(stub('stat', :ctime => :now))
        Time.stubs(:now).returns :now

        @authconfig = Puppet::Network::AuthConfig.new("dummy", false)
    end

    describe "when initializing" do
        before :each do
            Puppet::Network::AuthConfig.any_instance.stubs(:read)
        end

        it "should use the authconfig default pathname if none provided" do
            Puppet.expects(:[]).with(:authconfig).returns("dummy")

            Puppet::Network::AuthConfig.new
        end

        it "should raise an error if no file is defined finally" do
            Puppet.stubs(:[]).with(:authconfig).returns(nil)

            lambda { Puppet::Network::AuthConfig.new }.should raise_error(Puppet::DevError)
        end

        it "should read and parse the file if parsenow is true" do
            Puppet::Network::AuthConfig.any_instance.expects(:read)

            Puppet::Network::AuthConfig.new("dummy", true)
        end

    end

    describe "when checking authorization" do
        before :each do
            @authconfig.stubs(:read)
            @call = stub 'call', :intern => "name"
            @handler = stub 'handler', :intern => "handler"
            @method = stub_everything 'method'
            @request = stub 'request', :call => @call, :handler => @handler, :method => @method, :name => "me", :ip => "1.2.3.4"
        end

        it "should attempt to read the authconfig file" do
            @rights.stubs(:include?)

            @authconfig.expects(:read)

            @authconfig.allowed?(@request)
        end

        it "should use a name right if it exists" do
            right = stub 'right'

            @rights.stubs(:include?).with("name").returns(true)
            @rights.stubs(:[]).with("name").returns(right)

            right.expects(:allowed?).with("me", "1.2.3.4")

            @authconfig.allowed?(@request)
        end

        it "should use a namespace right otherwise" do
            right = stub 'right'

            @rights.stubs(:include?).with("name").returns(false)
            @rights.stubs(:include?).with("handler").returns(true)
            @rights.stubs(:[]).with("handler").returns(right)

            right.expects(:allowed?).with("me", "1.2.3.4")

            @authconfig.allowed?(@request)
        end

        it "should return whatever the found rights returns" do
            right = stub 'right'

            @rights.stubs(:include?).with("name").returns(true)
            @rights.stubs(:[]).with("name").returns(right)

            right.stubs(:allowed?).with("me", "1.2.3.4").returns(:returned)

            @authconfig.allowed?(@request).should == :returned
        end

    end

    describe "when parsing authconfig file" do
        before :each do
            @fd = stub 'fd'
            File.stubs(:open).yields(@fd)
            @rights.stubs(:include?).returns(false)
            @rights.stubs(:[])
        end

        it "should skip comments" do
            @fd.stubs(:each).yields('  # comment')

            @rights.expects(:newright).never

            @authconfig.read
        end

        it "should increment line number even on commented lines" do
            @fd.stubs(:each).multiple_yields('  # comment','[puppetca]')

            @rights.expects(:newright).with('[puppetca]', 2, 'dummy')

            @authconfig.read
        end

        it "should skip blank lines" do
            @fd.stubs(:each).yields('  ')

            @rights.expects(:newright).never

            @authconfig.read
        end

        it "should increment line number even on blank lines" do
            @fd.stubs(:each).multiple_yields('  ','[puppetca]')

            @rights.expects(:newright).with('[puppetca]', 2, 'dummy')

            @authconfig.read
        end

        it "should throw an error if the current namespace right already exist" do
            @fd.stubs(:each).yields('[puppetca]')

            @rights.stubs(:include?).with("puppetca").returns(true)

            lambda { @authconfig.read }.should raise_error
        end

        it "should not throw an error if the current path right already exist" do
            @fd.stubs(:each).yields('path /hello')

            @rights.stubs(:newright).with("/hello",1, 'dummy')
            @rights.stubs(:include?).with("/hello").returns(true)

            lambda { @authconfig.read }.should_not raise_error
        end

        it "should create a new right for found namespaces" do
            @fd.stubs(:each).yields('[puppetca]')

            @rights.expects(:newright).with("[puppetca]", 1, 'dummy')

            @authconfig.read
        end

        it "should create a new right for each found namespace line" do
            @fd.stubs(:each).multiple_yields('[puppetca]', '[fileserver]')

            @rights.expects(:newright).with("[puppetca]", 1, 'dummy')
            @rights.expects(:newright).with("[fileserver]", 2, 'dummy')

            @authconfig.read
        end

        it "should create a new right for each found path line" do
            @fd.stubs(:each).multiple_yields('path /certificates')

            @rights.expects(:newright).with("/certificates", 1, 'dummy')

            @authconfig.read
        end

        it "should create a new right for each found regex line" do
            @fd.stubs(:each).multiple_yields('path ~ .rb$')

            @rights.expects(:newright).with("~ .rb$", 1, 'dummy')

            @authconfig.read
        end

        it "should create an allow ACE on each subsequent allow" do
            acl = stub 'acl', :info

            @fd.stubs(:each).multiple_yields('[puppetca]', 'allow 127.0.0.1')
            @rights.stubs(:newright).with("[puppetca]", 1, 'dummy').returns(acl)

            acl.expects(:allow).with('127.0.0.1')

            @authconfig.read
        end

        it "should create a deny ACE on each subsequent deny" do
            acl = stub 'acl', :info

            @fd.stubs(:each).multiple_yields('[puppetca]', 'deny 127.0.0.1')
            @rights.stubs(:newright).with("[puppetca]", 1, 'dummy').returns(acl)

            acl.expects(:deny).with('127.0.0.1')

            @authconfig.read
        end

        it "should inform the current ACL if we get the 'method' directive" do
            acl = stub 'acl', :info
            acl.stubs(:acl_type).returns(:regex)

            @fd.stubs(:each).multiple_yields('path /certificates', 'method search,find')
            @rights.stubs(:newright).with("/certificates", 1, 'dummy').returns(acl)

            acl.expects(:restrict_method).with('search')
            acl.expects(:restrict_method).with('find')

            @authconfig.read
        end

        it "should raise an error if the 'method' directive is used in a right different than a path/regex one" do
            acl = stub 'acl', :info
            acl.stubs(:acl_type).returns(:regex)

            @fd.stubs(:each).multiple_yields('[puppetca]', 'method search,find')
            @rights.stubs(:newright).with("puppetca", 1, 'dummy').returns(acl)

            lambda { @authconfig.read }.should raise_error
        end

        it "should inform the current ACL if we get the 'environment' directive" do
            acl = stub 'acl', :info
            acl.stubs(:acl_type).returns(:regex)

            @fd.stubs(:each).multiple_yields('path /certificates', 'environment production,development')
            @rights.stubs(:newright).with("/certificates", 1, 'dummy').returns(acl)

            acl.expects(:restrict_environment).with('production')
            acl.expects(:restrict_environment).with('development')

            @authconfig.read
        end

        it "should raise an error if the 'environment' directive is used in a right different than a path/regex one" do
            acl = stub 'acl', :info
            acl.stubs(:acl_type).returns(:regex)

            @fd.stubs(:each).multiple_yields('[puppetca]', 'environment env')
            @rights.stubs(:newright).with("puppetca", 1, 'dummy').returns(acl)

            lambda { @authconfig.read }.should raise_error
        end

        it "should inform the current ACL if we get the 'auth' directive" do
            acl = stub 'acl', :info
            acl.stubs(:acl_type).returns(:regex)

            @fd.stubs(:each).multiple_yields('path /certificates', 'auth yes')
            @rights.stubs(:newright).with("/certificates", 1, 'dummy').returns(acl)

            acl.expects(:restrict_authenticated).with('yes')

            @authconfig.read
        end

        it "should also allow the longest 'authenticated' directive" do
            acl = stub 'acl', :info
            acl.stubs(:acl_type).returns(:regex)

            @fd.stubs(:each).multiple_yields('path /certificates', 'authenticated yes')
            @rights.stubs(:newright).with("/certificates", 1, 'dummy').returns(acl)

            acl.expects(:restrict_authenticated).with('yes')

            @authconfig.read
        end

        it "should raise an error if the 'auth' directive is used in a right different than a path/regex one" do
            acl = stub 'acl', :info
            acl.stubs(:acl_type).returns(:regex)

            @fd.stubs(:each).multiple_yields('[puppetca]', 'auth yes')
            @rights.stubs(:newright).with("puppetca", 1, 'dummy').returns(acl)

            lambda { @authconfig.read }.should raise_error
        end

    end

end