103 lines
3.1 KiB
Ruby
103 lines
3.1 KiB
Ruby
|
# frozen_string_literal: true
|
||
|
|
|
||
|
|
require 'rails_helper'
|
||
|
|
|
||
|
|
describe 'API keys scoped to query#run' do
|
||
|
|
before do
|
||
|
|
SiteSetting.data_explorer_enabled = true
|
||
|
|
end
|
||
|
|
|
||
|
|
fab!(:query1) { DataExplorer::Query.create!(name: "Query 1", sql: "SELECT 1 AS query1_res") }
|
||
|
|
fab!(:query2) { DataExplorer::Query.create!(name: "Query 2", sql: "SELECT 1 AS query2_res") }
|
||
|
|
fab!(:admin) { Fabricate(:admin) }
|
||
|
|
|
||
|
|
let(:all_queries_api_key) do
|
||
|
|
key = ApiKey.create!
|
||
|
|
ApiKeyScope.create!(
|
||
|
|
resource: "data_explorer",
|
||
|
|
action: "run_queries",
|
||
|
|
api_key_id: key.id
|
||
|
|
)
|
||
|
|
key
|
||
|
|
end
|
||
|
|
|
||
|
|
let(:single_query_api_key) do
|
||
|
|
key = ApiKey.create!
|
||
|
|
ApiKeyScope.create!(
|
||
|
|
resource: "data_explorer",
|
||
|
|
action: "run_queries",
|
||
|
|
api_key_id: key.id,
|
||
|
|
allowed_parameters: { "id" => [query1.id.to_s] }
|
||
|
|
)
|
||
|
|
key
|
||
|
|
end
|
||
|
|
|
||
|
|
it 'cannot hit any other endpoints' do
|
||
|
|
get "/latest.json", headers: {
|
||
|
|
"Api-Key" => all_queries_api_key.key,
|
||
|
|
"Api-Username" => admin.username
|
||
|
|
}
|
||
|
|
expect(response.status).to eq(403)
|
||
|
|
|
||
|
|
get "/latest.json", headers: {
|
||
|
|
"Api-Key" => single_query_api_key.key,
|
||
|
|
"Api-Username" => admin.username
|
||
|
|
}
|
||
|
|
expect(response.status).to eq(403)
|
||
|
|
|
||
|
|
get "/u/#{admin.username}.json", headers: {
|
||
|
|
"Api-Key" => all_queries_api_key.key,
|
||
|
|
"Api-Username" => admin.username
|
||
|
|
}
|
||
|
|
expect(response.status).to eq(403)
|
||
|
|
|
||
|
|
get "/u/#{admin.username}.json", headers: {
|
||
|
|
"Api-Key" => single_query_api_key.key,
|
||
|
|
"Api-Username" => admin.username
|
||
|
|
}
|
||
|
|
expect(response.status).to eq(403)
|
||
|
|
end
|
||
|
|
|
||
|
|
it "can only run the queries they're allowed to run" do
|
||
|
|
expect {
|
||
|
|
post "/admin/plugins/explorer/queries/#{query1.id}/run.json", headers: {
|
||
|
|
"Api-Key" => single_query_api_key.key,
|
||
|
|
"Api-Username" => admin.username
|
||
|
|
}
|
||
|
|
}.to change { query1.reload.last_run_at }
|
||
|
|
expect(response.status).to eq(200)
|
||
|
|
expect(response.parsed_body["success"]).to eq(true)
|
||
|
|
expect(response.parsed_body["columns"]).to eq(["query1_res"])
|
||
|
|
|
||
|
|
expect {
|
||
|
|
post "/admin/plugins/explorer/queries/#{query2.id}/run.json", headers: {
|
||
|
|
"Api-Key" => single_query_api_key.key,
|
||
|
|
"Api-Username" => admin.username
|
||
|
|
}
|
||
|
|
}.not_to change { query2.reload.last_run_at }
|
||
|
|
expect(response.status).to eq(403)
|
||
|
|
end
|
||
|
|
|
||
|
|
it "can run all queries if they're not restricted to any queries" do
|
||
|
|
expect {
|
||
|
|
post "/admin/plugins/explorer/queries/#{query1.id}/run.json", headers: {
|
||
|
|
"Api-Key" => all_queries_api_key.key,
|
||
|
|
"Api-Username" => admin.username
|
||
|
|
}
|
||
|
|
}.to change { query1.reload.last_run_at }
|
||
|
|
expect(response.status).to eq(200)
|
||
|
|
expect(response.parsed_body["success"]).to eq(true)
|
||
|
|
expect(response.parsed_body["columns"]).to eq(["query1_res"])
|
||
|
|
|
||
|
|
expect {
|
||
|
|
post "/admin/plugins/explorer/queries/#{query2.id}/run.json", headers: {
|
||
|
|
"Api-Key" => all_queries_api_key.key,
|
||
|
|
"Api-Username" => admin.username
|
||
|
|
}
|
||
|
|
}.to change { query2.reload.last_run_at }
|
||
|
|
expect(response.status).to eq(200)
|
||
|
|
expect(response.parsed_body["success"]).to eq(true)
|
||
|
|
expect(response.parsed_body["columns"]).to eq(["query2_res"])
|
||
|
|
end
|
||
|
|
end
|