kitos
4809c4a662
Aegis CI / lint-and-test (push) Has been cancelled
Snyk Security Scan / Python vulnerabilities (backend) (push) Has been cancelled
Snyk Security Scan / npm vulnerabilities (frontend) (push) Has been cancelled
Snyk Security Scan / Docker image vulnerabilities (backend) (push) Has been cancelled
A manager organizes and validates work, so their own campaigns skip the draft -> submit -> pending_approval queue and go straight to active with the start_date they provide (they're the same role that would otherwise approve it). Manager can also now create tests from the catalog, same as red_lead/blue_lead.
57 lines
2.1 KiB
Python
57 lines
2.1 KiB
Python
"""Manager role — creating tests from templates.
|
|
|
|
A manager organizes and validates work rather than executing it, but they
|
|
should still be able to seed a test from the catalog directly (same as a
|
|
red_lead/blue_lead), not just approve/reject what leads submit.
|
|
"""
|
|
|
|
|
|
def test_manager_can_create_test_from_template(api, auth_headers, red_lead_headers, manager_headers):
|
|
technique = api(
|
|
"post", "/api/v1/techniques", auth_headers,
|
|
json={"mitre_id": "T1059.400", "name": "Command Line Manager Test"},
|
|
)
|
|
assert technique.status_code == 201, technique.text
|
|
technique_id = technique.json()["id"]
|
|
|
|
template = api(
|
|
"post", "/api/v1/test-templates", red_lead_headers,
|
|
json={
|
|
"mitre_technique_id": "T1059.400",
|
|
"name": "Manager-usable template",
|
|
"attack_procedure": "Run a discovery command.",
|
|
},
|
|
)
|
|
assert template.status_code == 201, template.text
|
|
template_id = template.json()["id"]
|
|
|
|
resp = api(
|
|
"post", "/api/v1/tests/from-template", manager_headers,
|
|
json={"template_id": template_id, "technique_id": technique_id},
|
|
)
|
|
assert resp.status_code == 201, resp.text
|
|
assert resp.json()["name"] == "Manager-usable template"
|
|
|
|
|
|
def test_admin_still_cannot_create_test_from_template(api, red_lead_headers, auth_headers):
|
|
"""require_any_role_strict keeps site-admin separate from workflow
|
|
actions — adding manager to the allow-list must not accidentally
|
|
reintroduce an admin bypass here."""
|
|
technique = api(
|
|
"post", "/api/v1/techniques", auth_headers,
|
|
json={"mitre_id": "T1059.401", "name": "Command Line Admin Test"},
|
|
)
|
|
technique_id = technique.json()["id"]
|
|
|
|
template = api(
|
|
"post", "/api/v1/test-templates", red_lead_headers,
|
|
json={"mitre_technique_id": "T1059.401", "name": "Admin-blocked template"},
|
|
)
|
|
template_id = template.json()["id"]
|
|
|
|
resp = api(
|
|
"post", "/api/v1/tests/from-template", auth_headers,
|
|
json={"template_id": template_id, "technique_id": technique_id},
|
|
)
|
|
assert resp.status_code == 403
|