kitos
a3f86c7b31
Aegis CI / lint-and-test (push) Has been cancelled
Snyk Security Scan / Python vulnerabilities (backend) (push) Has been cancelled
Snyk Security Scan / npm vulnerabilities (frontend) (push) Has been cancelled
Snyk Security Scan / Docker image vulnerabilities (backend) (push) Has been cancelled
Admin still bypassed require_any_role (non-strict) on the pure operator actions: start-execution, submit-red, start-blue-work, submit-blue, pause/resume-timer, and the red/blue field-edit + general test create/update/remediation/import-rt/template endpoints all used the loose dependency even where admin wasn't in the role tuple. Switched every one of these to require_any_role_strict, matching the review/validate/dispute/hold/assign endpoints already fixed earlier. Frontend: removed every remaining role === "admin" disjunct gating Start Execution, Submit to Blue Team, blue evaluating actions, timer control, red/blue field editing, test creation, and template creation. Team-blindness visibility (isBlind) deliberately keeps the admin bypass — admin still sees both sides unmasked for oversight, since that's visibility, not operating. Updated ~20 tests whose fixtures used the admin account as a convenience shortcut to create/drive tests through the workflow — switched them to a red_lead account, fixing an incidental fixture-resolution-order cookie bug along the way (client's cookie jar prefers the last-logged-in role's cookie over any Bearer header explicitly passed to a later request).
65 lines
3.3 KiB
Python
65 lines
3.3 KiB
Python
"""Admin must be locked out of every Test-workflow *action* endpoint.
|
|
|
|
Admin administers the site; leads/managers/operators run the test workflow.
|
|
The permission dependency runs before any DB lookup, so a random UUID is
|
|
enough to prove the 403 — the request never reaches the handler body.
|
|
"""
|
|
|
|
import uuid
|
|
|
|
import pytest
|
|
|
|
DUMMY_ID = str(uuid.uuid4())
|
|
|
|
|
|
@pytest.mark.parametrize(
|
|
"method,path,payload",
|
|
[
|
|
("post", f"/api/v1/tests/{DUMMY_ID}/review-red", {"decision": "approve"}),
|
|
("post", f"/api/v1/tests/{DUMMY_ID}/review-blue", {"decision": "approve"}),
|
|
("post", f"/api/v1/tests/{DUMMY_ID}/validate-red", {"red_validation_status": "approved"}),
|
|
("post", f"/api/v1/tests/{DUMMY_ID}/validate-blue", {"blue_validation_status": "approved"}),
|
|
("post", f"/api/v1/tests/{DUMMY_ID}/resolve-dispute", {"target_team": "red"}),
|
|
("post", f"/api/v1/tests/{DUMMY_ID}/request-discussion", None),
|
|
("post", f"/api/v1/tests/{DUMMY_ID}/reopen", None),
|
|
("post", f"/api/v1/tests/{DUMMY_ID}/hold", {"reason": "x"}),
|
|
("post", f"/api/v1/tests/{DUMMY_ID}/resume", None),
|
|
("post", f"/api/v1/tests/{DUMMY_ID}/assign", {"red_tech_assignee": DUMMY_ID}),
|
|
("patch", f"/api/v1/tests/{DUMMY_ID}/classification", {"data_classification": "pii"}),
|
|
("post", f"/api/v1/tests/{DUMMY_ID}/start-execution", None),
|
|
("post", f"/api/v1/tests/{DUMMY_ID}/submit-red", None),
|
|
("post", f"/api/v1/tests/{DUMMY_ID}/start-blue-work", None),
|
|
("post", f"/api/v1/tests/{DUMMY_ID}/submit-blue", None),
|
|
("post", f"/api/v1/tests/{DUMMY_ID}/pause-timer", None),
|
|
("post", f"/api/v1/tests/{DUMMY_ID}/resume-timer", None),
|
|
("patch", f"/api/v1/tests/{DUMMY_ID}/red", {"procedure_text": "x"}),
|
|
("patch", f"/api/v1/tests/{DUMMY_ID}/blue", {"detection_result": "detected"}),
|
|
("patch", f"/api/v1/tests/{DUMMY_ID}", {"name": "x"}),
|
|
("patch", f"/api/v1/tests/{DUMMY_ID}/remediation", {"remediation_status": "completed"}),
|
|
("post", "/api/v1/tests", {"technique_id": DUMMY_ID, "name": "x"}),
|
|
("post", "/api/v1/tests/from-template", {"template_id": DUMMY_ID, "technique_id": DUMMY_ID}),
|
|
("post", "/api/v1/tests/import-rt", {"name": "x", "techniques": []}),
|
|
],
|
|
)
|
|
def test_admin_forbidden(client, auth_headers, method, path, payload):
|
|
resp = getattr(client, method)(path, json=payload, headers=auth_headers)
|
|
assert resp.status_code == 403, f"{method.upper()} {path} -> {resp.status_code}: {resp.text}"
|
|
|
|
|
|
@pytest.mark.parametrize(
|
|
"method,path,payload",
|
|
[
|
|
("post", "/api/v1/test-templates", {"name": "x", "mitre_technique_id": "T1059"}),
|
|
("patch", f"/api/v1/test-templates/{DUMMY_ID}", {"name": "x"}),
|
|
("patch", f"/api/v1/test-templates/{DUMMY_ID}/toggle-active", None),
|
|
("delete", f"/api/v1/test-templates/{DUMMY_ID}", None),
|
|
("patch", "/api/v1/test-templates/bulk-activate", {"template_ids": [DUMMY_ID], "is_active": True}),
|
|
],
|
|
)
|
|
def test_admin_forbidden_templates(client, auth_headers, method, path, payload):
|
|
kwargs = {"headers": auth_headers}
|
|
if payload is not None:
|
|
kwargs["json"] = payload
|
|
resp = getattr(client, method)(path, **kwargs)
|
|
assert resp.status_code == 403, f"{method.upper()} {path} -> {resp.status_code}: {resp.text}"
|