Skip to content

Commit

Permalink
✅ [#4398] Update object ownership tests with log checks
Browse files Browse the repository at this point in the history
  • Loading branch information
stevenbal committed Nov 5, 2024
1 parent 5f47430 commit 86abe7b
Show file tree
Hide file tree
Showing 15 changed files with 488 additions and 261 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -15,10 +15,10 @@ interactions:
User-Agent:
- python-requests/2.32.2
method: GET
uri: http://localhost:8002/api/v2/objects/d36124c0-752e-48a7-a724-bf3241a2e646
uri: http://localhost:8002/api/v2/objects/300e61aa-e150-459c-aa30-d3f0fe4f5506
response:
body:
string: '{"url":"http://objects-web:8000/api/v2/objects/d36124c0-752e-48a7-a724-bf3241a2e646","uuid":"d36124c0-752e-48a7-a724-bf3241a2e646","type":"http://objecttypes-web:8000/api/v2/objecttypes/8faed0fa-7864-4409-aa6d-533a37616a9e","record":{"index":1,"typeVersion":1,"data":{"bsn":"111222333","foo":"bar"},"geometry":null,"startAt":"2024-10-29","endAt":null,"registrationAt":"2024-10-29","correctionFor":null,"correctedBy":null}}'
string: '{"url":"http://objects-web:8000/api/v2/objects/300e61aa-e150-459c-aa30-d3f0fe4f5506","uuid":"300e61aa-e150-459c-aa30-d3f0fe4f5506","type":"http://objecttypes-web:8000/api/v2/objecttypes/8faed0fa-7864-4409-aa6d-533a37616a9e","record":{"index":1,"typeVersion":1,"data":{"bsn":"111222333","foo":"bar"},"geometry":null,"startAt":"2024-11-05","endAt":null,"registrationAt":"2024-11-05","correctionFor":null,"correctedBy":null}}'
headers:
Allow:
- GET, PUT, PATCH, DELETE, HEAD, OPTIONS
Expand All @@ -33,7 +33,7 @@ interactions:
Cross-Origin-Opener-Policy:
- same-origin
Date:
- Mon, 04 Nov 2024 12:48:04 GMT
- Tue, 05 Nov 2024 14:28:43 GMT
Referrer-Policy:
- same-origin
Server:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -15,10 +15,10 @@ interactions:
User-Agent:
- python-requests/2.32.2
method: GET
uri: http://localhost:8002/api/v2/objects/d36124c0-752e-48a7-a724-bf3241a2e646
uri: http://localhost:8002/api/v2/objects/300e61aa-e150-459c-aa30-d3f0fe4f5506
response:
body:
string: '{"url":"http://objects-web:8000/api/v2/objects/d36124c0-752e-48a7-a724-bf3241a2e646","uuid":"d36124c0-752e-48a7-a724-bf3241a2e646","type":"http://objecttypes-web:8000/api/v2/objecttypes/8faed0fa-7864-4409-aa6d-533a37616a9e","record":{"index":1,"typeVersion":1,"data":{"bsn":"111222333","foo":"bar"},"geometry":null,"startAt":"2024-10-29","endAt":null,"registrationAt":"2024-10-29","correctionFor":null,"correctedBy":null}}'
string: '{"url":"http://objects-web:8000/api/v2/objects/300e61aa-e150-459c-aa30-d3f0fe4f5506","uuid":"300e61aa-e150-459c-aa30-d3f0fe4f5506","type":"http://objecttypes-web:8000/api/v2/objecttypes/8faed0fa-7864-4409-aa6d-533a37616a9e","record":{"index":1,"typeVersion":1,"data":{"bsn":"111222333","foo":"bar"},"geometry":null,"startAt":"2024-11-05","endAt":null,"registrationAt":"2024-11-05","correctionFor":null,"correctedBy":null}}'
headers:
Allow:
- GET, PUT, PATCH, DELETE, HEAD, OPTIONS
Expand All @@ -33,7 +33,7 @@ interactions:
Cross-Origin-Opener-Policy:
- same-origin
Date:
- Mon, 04 Nov 2024 12:48:04 GMT
- Tue, 05 Nov 2024 14:28:43 GMT
Referrer-Policy:
- same-origin
Server:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -15,10 +15,10 @@ interactions:
User-Agent:
- python-requests/2.32.2
method: GET
uri: http://localhost:8002/api/v2/objects/d36124c0-752e-48a7-a724-bf3241a2e646
uri: http://localhost:8002/api/v2/objects/300e61aa-e150-459c-aa30-d3f0fe4f5506
response:
body:
string: '{"url":"http://objects-web:8000/api/v2/objects/d36124c0-752e-48a7-a724-bf3241a2e646","uuid":"d36124c0-752e-48a7-a724-bf3241a2e646","type":"http://objecttypes-web:8000/api/v2/objecttypes/8faed0fa-7864-4409-aa6d-533a37616a9e","record":{"index":1,"typeVersion":1,"data":{"bsn":"111222333","foo":"bar"},"geometry":null,"startAt":"2024-10-29","endAt":null,"registrationAt":"2024-10-29","correctionFor":null,"correctedBy":null}}'
string: '{"url":"http://objects-web:8000/api/v2/objects/300e61aa-e150-459c-aa30-d3f0fe4f5506","uuid":"300e61aa-e150-459c-aa30-d3f0fe4f5506","type":"http://objecttypes-web:8000/api/v2/objecttypes/8faed0fa-7864-4409-aa6d-533a37616a9e","record":{"index":1,"typeVersion":1,"data":{"bsn":"111222333","foo":"bar"},"geometry":null,"startAt":"2024-11-05","endAt":null,"registrationAt":"2024-11-05","correctionFor":null,"correctedBy":null}}'
headers:
Allow:
- GET, PUT, PATCH, DELETE, HEAD, OPTIONS
Expand All @@ -33,7 +33,7 @@ interactions:
Cross-Origin-Opener-Policy:
- same-origin
Date:
- Tue, 29 Oct 2024 13:38:52 GMT
- Tue, 05 Nov 2024 14:28:44 GMT
Referrer-Policy:
- same-origin
Server:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ interactions:
- request:
body: '{"type": "http://objecttypes-web:8000/api/v2/objecttypes/8faed0fa-7864-4409-aa6d-533a37616a9e",
"record": {"typeVersion": 1, "data": {"nested": {"bsn": "111222333"}, "foo":
"bar"}, "startAt": "2024-11-04"}}'
"bar"}, "startAt": "2024-11-05"}}'
headers:
Accept:
- '*/*'
Expand All @@ -24,7 +24,7 @@ interactions:
uri: http://localhost:8002/api/v2/objects
response:
body:
string: '{"url":"http://objects-web:8000/api/v2/objects/9425a239-d592-4e02-b5dd-69609fdc292d","uuid":"9425a239-d592-4e02-b5dd-69609fdc292d","type":"http://objecttypes-web:8000/api/v2/objecttypes/8faed0fa-7864-4409-aa6d-533a37616a9e","record":{"index":1,"typeVersion":1,"data":{"nested":{"bsn":"111222333"},"foo":"bar"},"geometry":null,"startAt":"2024-11-04","endAt":null,"registrationAt":"2024-11-04","correctionFor":null,"correctedBy":null}}'
string: '{"url":"http://objects-web:8000/api/v2/objects/0fd71d89-3ec2-4593-8fb5-9e1822203c95","uuid":"0fd71d89-3ec2-4593-8fb5-9e1822203c95","type":"http://objecttypes-web:8000/api/v2/objecttypes/8faed0fa-7864-4409-aa6d-533a37616a9e","record":{"index":1,"typeVersion":1,"data":{"nested":{"bsn":"111222333"},"foo":"bar"},"geometry":null,"startAt":"2024-11-05","endAt":null,"registrationAt":"2024-11-05","correctionFor":null,"correctedBy":null}}'
headers:
Allow:
- GET, POST, HEAD, OPTIONS
Expand All @@ -39,9 +39,9 @@ interactions:
Cross-Origin-Opener-Policy:
- same-origin
Date:
- Mon, 04 Nov 2024 15:49:09 GMT
- Tue, 05 Nov 2024 14:28:44 GMT
Location:
- http://localhost:8002/api/v2/objects/9425a239-d592-4e02-b5dd-69609fdc292d
- http://localhost:8002/api/v2/objects/0fd71d89-3ec2-4593-8fb5-9e1822203c95
Referrer-Policy:
- same-origin
Server:
Expand Down Expand Up @@ -71,10 +71,10 @@ interactions:
User-Agent:
- python-requests/2.32.2
method: GET
uri: http://localhost:8002/api/v2/objects/9425a239-d592-4e02-b5dd-69609fdc292d
uri: http://localhost:8002/api/v2/objects/0fd71d89-3ec2-4593-8fb5-9e1822203c95
response:
body:
string: '{"url":"http://objects-web:8000/api/v2/objects/9425a239-d592-4e02-b5dd-69609fdc292d","uuid":"9425a239-d592-4e02-b5dd-69609fdc292d","type":"http://objecttypes-web:8000/api/v2/objecttypes/8faed0fa-7864-4409-aa6d-533a37616a9e","record":{"index":1,"typeVersion":1,"data":{"foo":"bar","nested":{"bsn":"111222333"}},"geometry":null,"startAt":"2024-11-04","endAt":null,"registrationAt":"2024-11-04","correctionFor":null,"correctedBy":null}}'
string: '{"url":"http://objects-web:8000/api/v2/objects/0fd71d89-3ec2-4593-8fb5-9e1822203c95","uuid":"0fd71d89-3ec2-4593-8fb5-9e1822203c95","type":"http://objecttypes-web:8000/api/v2/objecttypes/8faed0fa-7864-4409-aa6d-533a37616a9e","record":{"index":1,"typeVersion":1,"data":{"foo":"bar","nested":{"bsn":"111222333"}},"geometry":null,"startAt":"2024-11-05","endAt":null,"registrationAt":"2024-11-05","correctionFor":null,"correctedBy":null}}'
headers:
Allow:
- GET, PUT, PATCH, DELETE, HEAD, OPTIONS
Expand All @@ -89,7 +89,7 @@ interactions:
Cross-Origin-Opener-Policy:
- same-origin
Date:
- Mon, 04 Nov 2024 15:49:09 GMT
- Tue, 05 Nov 2024 14:28:44 GMT
Referrer-Policy:
- same-origin
Server:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -15,10 +15,10 @@ interactions:
User-Agent:
- python-requests/2.32.2
method: GET
uri: http://localhost:8002/api/v2/objects/d36124c0-752e-48a7-a724-bf3241a2e646
uri: http://localhost:8002/api/v2/objects/300e61aa-e150-459c-aa30-d3f0fe4f5506
response:
body:
string: '{"url":"http://objects-web:8000/api/v2/objects/d36124c0-752e-48a7-a724-bf3241a2e646","uuid":"d36124c0-752e-48a7-a724-bf3241a2e646","type":"http://objecttypes-web:8000/api/v2/objecttypes/8faed0fa-7864-4409-aa6d-533a37616a9e","record":{"index":1,"typeVersion":1,"data":{"bsn":"111222333","foo":"bar"},"geometry":null,"startAt":"2024-10-29","endAt":null,"registrationAt":"2024-10-29","correctionFor":null,"correctedBy":null}}'
string: '{"url":"http://objects-web:8000/api/v2/objects/300e61aa-e150-459c-aa30-d3f0fe4f5506","uuid":"300e61aa-e150-459c-aa30-d3f0fe4f5506","type":"http://objecttypes-web:8000/api/v2/objecttypes/8faed0fa-7864-4409-aa6d-533a37616a9e","record":{"index":1,"typeVersion":1,"data":{"bsn":"111222333","foo":"bar"},"geometry":null,"startAt":"2024-11-05","endAt":null,"registrationAt":"2024-11-05","correctionFor":null,"correctedBy":null}}'
headers:
Allow:
- GET, PUT, PATCH, DELETE, HEAD, OPTIONS
Expand All @@ -33,7 +33,7 @@ interactions:
Cross-Origin-Opener-Policy:
- same-origin
Date:
- Tue, 29 Oct 2024 13:38:52 GMT
- Tue, 05 Nov 2024 14:28:44 GMT
Referrer-Policy:
- same-origin
Server:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ interactions:
- request:
body: '{"type": "http://objecttypes-web:8000/api/v2/objecttypes/8faed0fa-7864-4409-aa6d-533a37616a9e",
"record": {"typeVersion": 1, "data": {"bsn": "111222333", "foo": "bar"}, "startAt":
"2024-10-29"}}'
"2024-11-05"}}'
headers:
Accept:
- '*/*'
Expand All @@ -24,7 +24,7 @@ interactions:
uri: http://localhost:8002/api/v2/objects
response:
body:
string: '{"url":"http://objects-web:8000/api/v2/objects/d36124c0-752e-48a7-a724-bf3241a2e646","uuid":"d36124c0-752e-48a7-a724-bf3241a2e646","type":"http://objecttypes-web:8000/api/v2/objecttypes/8faed0fa-7864-4409-aa6d-533a37616a9e","record":{"index":1,"typeVersion":1,"data":{"bsn":"111222333","foo":"bar"},"geometry":null,"startAt":"2024-10-29","endAt":null,"registrationAt":"2024-10-29","correctionFor":null,"correctedBy":null}}'
string: '{"url":"http://objects-web:8000/api/v2/objects/300e61aa-e150-459c-aa30-d3f0fe4f5506","uuid":"300e61aa-e150-459c-aa30-d3f0fe4f5506","type":"http://objecttypes-web:8000/api/v2/objecttypes/8faed0fa-7864-4409-aa6d-533a37616a9e","record":{"index":1,"typeVersion":1,"data":{"bsn":"111222333","foo":"bar"},"geometry":null,"startAt":"2024-11-05","endAt":null,"registrationAt":"2024-11-05","correctionFor":null,"correctedBy":null}}'
headers:
Allow:
- GET, POST, HEAD, OPTIONS
Expand All @@ -39,9 +39,9 @@ interactions:
Cross-Origin-Opener-Policy:
- same-origin
Date:
- Tue, 29 Oct 2024 13:38:51 GMT
- Tue, 05 Nov 2024 14:28:43 GMT
Location:
- http://localhost:8002/api/v2/objects/d36124c0-752e-48a7-a724-bf3241a2e646
- http://localhost:8002/api/v2/objects/300e61aa-e150-459c-aa30-d3f0fe4f5506
Referrer-Policy:
- same-origin
Server:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,8 @@
from openforms.contrib.objects_api.helpers import prepare_data_for_registration
from openforms.contrib.objects_api.tests.factories import ObjectsAPIGroupConfigFactory
from openforms.forms.tests.factories import FormRegistrationBackendFactory
from openforms.logging.models import TimelineLogProxy
from openforms.registrations.contrib.objects_api.plugin import ObjectsAPIRegistration
from openforms.submissions.tests.factories import SubmissionFactory
from openforms.utils.tests.vcr import OFVCRMixin

Expand All @@ -20,6 +22,9 @@
TEST_FILES = (Path(__file__).parent / "files").resolve()


PLUGIN = ObjectsAPIRegistration("test")


@override_settings(
CORS_ALLOW_ALL_ORIGINS=False,
ALLOWED_HOSTS=["*"],
Expand Down Expand Up @@ -89,19 +94,27 @@ def test_user_is_owner_of_object(self):
)

with get_objects_client(self.objects_api_group_used) as client:
validate_object_ownership(submission, client, ["bsn"])
validate_object_ownership(submission, client, ["bsn"], PLUGIN)

@tag("gh-4398")
def test_permission_denied_if_user_is_not_logged_in(self):
submission = SubmissionFactory.create(initial_data_reference=self.object_ref)

with get_objects_client(self.objects_api_group_used) as client:
with self.assertRaises(PermissionDenied) as cm:
validate_object_ownership(submission, client, ["bsn"])
validate_object_ownership(submission, client, ["bsn"], PLUGIN)
self.assertEqual(
str(cm.exception), "Cannot pass data reference as anonymous user"
)

logs = TimelineLogProxy.objects.filter(object_id=submission.id)
self.assertEqual(
logs.filter(
extra_data__log_event="object_ownership_check_anonymous_user"
).count(),
1,
)

@tag("gh-4398")
def test_user_is_not_owner_of_object(self):
submission = SubmissionFactory.create(
Expand All @@ -124,11 +137,17 @@ def test_user_is_not_owner_of_object(self):

with get_objects_client(self.objects_api_group_used) as client:
with self.assertRaises(PermissionDenied) as cm:
validate_object_ownership(submission, client, ["bsn"])
validate_object_ownership(submission, client, ["bsn"], PLUGIN)
self.assertEqual(
str(cm.exception), "User is not the owner of the referenced object"
)

logs = TimelineLogProxy.objects.filter(object_id=submission.id)
self.assertEqual(
logs.filter(extra_data__log_event="object_ownership_check_failure").count(),
1,
)

@tag("gh-4398")
def test_user_is_not_owner_of_object_nested_auth_attribute(self):
with get_objects_client(self.objects_api_group_used) as client:
Expand Down Expand Up @@ -161,7 +180,7 @@ def test_user_is_not_owner_of_object_nested_auth_attribute(self):

with get_objects_client(self.objects_api_group_used) as client:
with self.assertRaises(PermissionDenied) as cm:
validate_object_ownership(submission, client, ["nested", "bsn"])
validate_object_ownership(submission, client, ["nested", "bsn"], PLUGIN)
self.assertEqual(
str(cm.exception), "User is not the owner of the referenced object"
)
Expand Down Expand Up @@ -195,10 +214,10 @@ def test_request_exception_when_doing_permission_check(self, mock_get_object):
)

with get_objects_client(self.objects_api_group_used) as client:
validate_object_ownership(submission, client, ["bsn"])
validate_object_ownership(submission, client, ["bsn"], PLUGIN)

@tag("gh-4398")
def test_no_backends_configured_raises_error(
def test_no_backends_configured_does_not_raise_error(
self,
):
"""
Expand All @@ -213,15 +232,15 @@ def test_no_backends_configured_raises_error(
FormRegistrationBackendFactory.create(form=submission.form, backend="email")

with get_objects_client(self.objects_api_group_used) as client:
validate_object_ownership(submission, client, ["bsn"])
validate_object_ownership(submission, client, ["bsn"], PLUGIN)

@tag("gh-4398")
def test_backend_without_options_raises_error(
def test_backend_without_options_does_not_raise_error(
self,
):
"""
If the object could not be fetched due to misconfiguration, the ownership check
should not fail
If the object could not be fetched due to missing API group configuration,
the ownership check should not fail
"""
submission = SubmissionFactory.create(
auth_info__value="111222333",
Expand All @@ -234,4 +253,4 @@ def test_backend_without_options_raises_error(
)

with get_objects_client(self.objects_api_group_used) as client:
validate_object_ownership(submission, client, ["bsn"])
validate_object_ownership(submission, client, ["bsn"], PLUGIN)
Original file line number Diff line number Diff line change
Expand Up @@ -15,10 +15,10 @@ interactions:
User-Agent:
- python-requests/2.32.2
method: GET
uri: http://localhost:8002/api/v2/objects/351348b1-ff52-440f-8142-5e080b0a1b75
uri: http://localhost:8002/api/v2/objects/d23144bd-1220-42e6-9edf-d7fd31291bff
response:
body:
string: '{"url":"http://objects-web:8000/api/v2/objects/351348b1-ff52-440f-8142-5e080b0a1b75","uuid":"351348b1-ff52-440f-8142-5e080b0a1b75","type":"http://objecttypes-web:8000/api/v2/objecttypes/8faed0fa-7864-4409-aa6d-533a37616a9e","record":{"index":1,"typeVersion":1,"data":{"bsn":"111222333","some":{"path":"foo"}},"geometry":null,"startAt":"2024-11-04","endAt":null,"registrationAt":"2024-11-04","correctionFor":null,"correctedBy":null}}'
string: '{"url":"http://objects-web:8000/api/v2/objects/d23144bd-1220-42e6-9edf-d7fd31291bff","uuid":"d23144bd-1220-42e6-9edf-d7fd31291bff","type":"http://objecttypes-web:8000/api/v2/objecttypes/8faed0fa-7864-4409-aa6d-533a37616a9e","record":{"index":1,"typeVersion":1,"data":{"bsn":"111222333","some":{"path":"foo"}},"geometry":null,"startAt":"2024-11-05","endAt":null,"registrationAt":"2024-11-05","correctionFor":null,"correctedBy":null}}'
headers:
Allow:
- GET, PUT, PATCH, DELETE, HEAD, OPTIONS
Expand All @@ -33,7 +33,7 @@ interactions:
Cross-Origin-Opener-Policy:
- same-origin
Date:
- Mon, 04 Nov 2024 12:48:04 GMT
- Tue, 05 Nov 2024 14:28:44 GMT
Referrer-Policy:
- same-origin
Server:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ interactions:
- request:
body: '{"type": "http://objecttypes-web:8000/api/v2/objecttypes/8faed0fa-7864-4409-aa6d-533a37616a9e",
"record": {"typeVersion": 1, "data": {"bsn": "111222333", "some": {"path": "foo"}},
"startAt": "2024-11-04"}}'
"startAt": "2024-11-05"}}'
headers:
Accept:
- '*/*'
Expand All @@ -24,7 +24,7 @@ interactions:
uri: http://localhost:8002/api/v2/objects
response:
body:
string: '{"url":"http://objects-web:8000/api/v2/objects/351348b1-ff52-440f-8142-5e080b0a1b75","uuid":"351348b1-ff52-440f-8142-5e080b0a1b75","type":"http://objecttypes-web:8000/api/v2/objecttypes/8faed0fa-7864-4409-aa6d-533a37616a9e","record":{"index":1,"typeVersion":1,"data":{"bsn":"111222333","some":{"path":"foo"}},"geometry":null,"startAt":"2024-11-04","endAt":null,"registrationAt":"2024-11-04","correctionFor":null,"correctedBy":null}}'
string: '{"url":"http://objects-web:8000/api/v2/objects/d23144bd-1220-42e6-9edf-d7fd31291bff","uuid":"d23144bd-1220-42e6-9edf-d7fd31291bff","type":"http://objecttypes-web:8000/api/v2/objecttypes/8faed0fa-7864-4409-aa6d-533a37616a9e","record":{"index":1,"typeVersion":1,"data":{"bsn":"111222333","some":{"path":"foo"}},"geometry":null,"startAt":"2024-11-05","endAt":null,"registrationAt":"2024-11-05","correctionFor":null,"correctedBy":null}}'
headers:
Allow:
- GET, POST, HEAD, OPTIONS
Expand All @@ -39,9 +39,9 @@ interactions:
Cross-Origin-Opener-Policy:
- same-origin
Date:
- Mon, 04 Nov 2024 12:48:04 GMT
- Tue, 05 Nov 2024 14:28:44 GMT
Location:
- http://localhost:8002/api/v2/objects/351348b1-ff52-440f-8142-5e080b0a1b75
- http://localhost:8002/api/v2/objects/d23144bd-1220-42e6-9edf-d7fd31291bff
Referrer-Policy:
- same-origin
Server:
Expand Down
Loading

0 comments on commit 86abe7b

Please sign in to comment.