kitos
60ab2e558f
Aegis CI / lint-and-test (push) Has been cancelled
Snyk Security Scan / Python vulnerabilities (backend) (push) Has been cancelled
Snyk Security Scan / npm vulnerabilities (frontend) (push) Has been cancelled
Snyk Security Scan / Docker image vulnerabilities (backend) (push) Has been cancelled
- Campaign creation and generate-from-threat-actor now use the strict
role check — admin no longer gets a free pass into campaign content,
same principle already applied to test-template creation.
- New manager-only DELETE /tests/{id}: removes a standalone test still
in draft (not started, not linked to any campaign).
- Replaced the orange/indigo stand-ins used across team badges, tabs,
action buttons, and timers with true red/blue so Red Team and Blue
Team read unambiguously at a glance.
67 lines
3.4 KiB
Python
67 lines
3.4 KiB
Python
"""Admin must be locked out of every Test-workflow *action* endpoint.
|
|
|
|
Admin administers the site; leads/managers/operators run the test workflow.
|
|
The permission dependency runs before any DB lookup, so a random UUID is
|
|
enough to prove the 403 — the request never reaches the handler body.
|
|
"""
|
|
|
|
import uuid
|
|
|
|
import pytest
|
|
|
|
DUMMY_ID = str(uuid.uuid4())
|
|
|
|
|
|
@pytest.mark.parametrize(
|
|
"method,path,payload",
|
|
[
|
|
("post", f"/api/v1/tests/{DUMMY_ID}/review-red", {"decision": "approve"}),
|
|
("post", f"/api/v1/tests/{DUMMY_ID}/review-blue", {"decision": "approve"}),
|
|
("post", f"/api/v1/tests/{DUMMY_ID}/validate-red", {"red_validation_status": "approved"}),
|
|
("post", f"/api/v1/tests/{DUMMY_ID}/validate-blue", {"blue_validation_status": "approved"}),
|
|
("post", f"/api/v1/tests/{DUMMY_ID}/resolve-dispute", {"target_team": "red"}),
|
|
("post", f"/api/v1/tests/{DUMMY_ID}/request-discussion", None),
|
|
("post", f"/api/v1/tests/{DUMMY_ID}/reopen", None),
|
|
("post", f"/api/v1/tests/{DUMMY_ID}/hold", {"reason": "x"}),
|
|
("post", f"/api/v1/tests/{DUMMY_ID}/resume", None),
|
|
("post", f"/api/v1/tests/{DUMMY_ID}/assign", {"red_tech_assignee": DUMMY_ID}),
|
|
("patch", f"/api/v1/tests/{DUMMY_ID}/classification", {"data_classification": "pii"}),
|
|
("post", f"/api/v1/tests/{DUMMY_ID}/start-execution", None),
|
|
("post", f"/api/v1/tests/{DUMMY_ID}/submit-red", None),
|
|
("post", f"/api/v1/tests/{DUMMY_ID}/start-blue-work", None),
|
|
("post", f"/api/v1/tests/{DUMMY_ID}/submit-blue", None),
|
|
("post", f"/api/v1/tests/{DUMMY_ID}/pause-timer", None),
|
|
("post", f"/api/v1/tests/{DUMMY_ID}/resume-timer", None),
|
|
("patch", f"/api/v1/tests/{DUMMY_ID}/red", {"procedure_text": "x"}),
|
|
("patch", f"/api/v1/tests/{DUMMY_ID}/blue", {"detection_result": "detected"}),
|
|
("patch", f"/api/v1/tests/{DUMMY_ID}", {"name": "x"}),
|
|
("patch", f"/api/v1/tests/{DUMMY_ID}/remediation", {"remediation_status": "completed"}),
|
|
("post", "/api/v1/tests", {"technique_id": DUMMY_ID, "name": "x"}),
|
|
("post", "/api/v1/tests/from-template", {"template_id": DUMMY_ID, "technique_id": DUMMY_ID}),
|
|
("post", "/api/v1/tests/import-rt", {"name": "x", "techniques": []}),
|
|
("post", "/api/v1/campaigns", {"name": "x"}),
|
|
("post", f"/api/v1/campaigns/from-threat-actor/{DUMMY_ID}", None),
|
|
],
|
|
)
|
|
def test_admin_forbidden(client, auth_headers, method, path, payload):
|
|
resp = getattr(client, method)(path, json=payload, headers=auth_headers)
|
|
assert resp.status_code == 403, f"{method.upper()} {path} -> {resp.status_code}: {resp.text}"
|
|
|
|
|
|
@pytest.mark.parametrize(
|
|
"method,path,payload",
|
|
[
|
|
("post", "/api/v1/test-templates", {"name": "x", "mitre_technique_id": "T1059"}),
|
|
("patch", f"/api/v1/test-templates/{DUMMY_ID}", {"name": "x"}),
|
|
("patch", f"/api/v1/test-templates/{DUMMY_ID}/toggle-active", None),
|
|
("delete", f"/api/v1/test-templates/{DUMMY_ID}", None),
|
|
("patch", "/api/v1/test-templates/bulk-activate", {"template_ids": [DUMMY_ID], "is_active": True}),
|
|
],
|
|
)
|
|
def test_admin_forbidden_templates(client, auth_headers, method, path, payload):
|
|
kwargs = {"headers": auth_headers}
|
|
if payload is not None:
|
|
kwargs["json"] = payload
|
|
resp = getattr(client, method)(path, **kwargs)
|
|
assert resp.status_code == 403, f"{method.upper()} {path} -> {resp.status_code}: {resp.text}"
|