mirror of
https://github.com/meilisearch/MeiliSearch
synced 2025-07-03 03:47:02 +02:00
Merge #1989
1989: Extend API keys r=curquiza a=ManyTheFish # Pull Request ## What does this PR do? - Add API keys in snapshots - Add API keys in dumps - fix QA #1979 fix #1979 fix #1995 fix #2001 fix #2003 related to #1890 Co-authored-by: many <maxime@meilisearch.com>
This commit is contained in:
commit
5af51c852c
19 changed files with 418 additions and 204 deletions
|
@ -32,7 +32,7 @@ impl<T, D> Deref for GuardedData<T, D> {
|
|||
}
|
||||
|
||||
impl<P: Policy + 'static, D: 'static + Clone> FromRequest for GuardedData<P, D> {
|
||||
type Config = AuthConfig;
|
||||
type Config = ();
|
||||
|
||||
type Error = ResponseError;
|
||||
|
||||
|
@ -42,49 +42,44 @@ impl<P: Policy + 'static, D: 'static + Clone> FromRequest for GuardedData<P, D>
|
|||
req: &actix_web::HttpRequest,
|
||||
_payload: &mut actix_web::dev::Payload,
|
||||
) -> Self::Future {
|
||||
match req.app_data::<Self::Config>() {
|
||||
Some(config) => match config {
|
||||
AuthConfig::NoAuth => match req.app_data::<D>().cloned() {
|
||||
Some(data) => ok(Self {
|
||||
data,
|
||||
filters: AuthFilter::default(),
|
||||
_marker: PhantomData,
|
||||
}),
|
||||
None => err(AuthenticationError::IrretrievableState.into()),
|
||||
match req.app_data::<AuthController>().cloned() {
|
||||
Some(auth) => match req
|
||||
.headers()
|
||||
.get("Authorization")
|
||||
.map(|type_token| type_token.to_str().unwrap_or_default().splitn(2, ' '))
|
||||
{
|
||||
Some(mut type_token) => match type_token.next() {
|
||||
Some("Bearer") => {
|
||||
// TODO: find a less hardcoded way?
|
||||
let index = req.match_info().get("index_uid");
|
||||
let token = type_token.next().unwrap_or("unknown");
|
||||
match P::authenticate(auth, token, index) {
|
||||
Some(filters) => match req.app_data::<D>().cloned() {
|
||||
Some(data) => ok(Self {
|
||||
data,
|
||||
filters,
|
||||
_marker: PhantomData,
|
||||
}),
|
||||
None => err(AuthenticationError::IrretrievableState.into()),
|
||||
},
|
||||
None => {
|
||||
let token = token.to_string();
|
||||
err(AuthenticationError::InvalidToken(token).into())
|
||||
}
|
||||
}
|
||||
}
|
||||
_otherwise => err(AuthenticationError::MissingAuthorizationHeader.into()),
|
||||
},
|
||||
AuthConfig::Auth => match req.app_data::<AuthController>().cloned() {
|
||||
Some(auth) => match req
|
||||
.headers()
|
||||
.get("Authorization")
|
||||
.map(|type_token| type_token.to_str().unwrap_or_default().splitn(2, ' '))
|
||||
{
|
||||
Some(mut type_token) => match type_token.next() {
|
||||
Some("Bearer") => {
|
||||
// TODO: find a less hardcoded way?
|
||||
let index = req.match_info().get("index_uid");
|
||||
let token = type_token.next().unwrap_or("unknown");
|
||||
match P::authenticate(auth, token, index) {
|
||||
Some(filters) => match req.app_data::<D>().cloned() {
|
||||
Some(data) => ok(Self {
|
||||
data,
|
||||
filters,
|
||||
_marker: PhantomData,
|
||||
}),
|
||||
None => err(AuthenticationError::IrretrievableState.into()),
|
||||
},
|
||||
None => {
|
||||
let token = token.to_string();
|
||||
err(AuthenticationError::InvalidToken(token).into())
|
||||
}
|
||||
}
|
||||
}
|
||||
_otherwise => {
|
||||
err(AuthenticationError::MissingAuthorizationHeader.into())
|
||||
}
|
||||
},
|
||||
None => err(AuthenticationError::MissingAuthorizationHeader.into()),
|
||||
None => match P::authenticate(auth, "", None) {
|
||||
Some(filters) => match req.app_data::<D>().cloned() {
|
||||
Some(data) => ok(Self {
|
||||
data,
|
||||
filters,
|
||||
_marker: PhantomData,
|
||||
}),
|
||||
None => err(AuthenticationError::IrretrievableState.into()),
|
||||
},
|
||||
None => err(AuthenticationError::IrretrievableState.into()),
|
||||
None => err(AuthenticationError::MissingAuthorizationHeader.into()),
|
||||
},
|
||||
},
|
||||
None => err(AuthenticationError::IrretrievableState.into()),
|
||||
|
@ -129,10 +124,8 @@ pub mod policies {
|
|||
index: Option<&str>,
|
||||
) -> Option<AuthFilter> {
|
||||
// authenticate if token is the master key.
|
||||
if let Some(master_key) = auth.get_master_key() {
|
||||
if master_key == token {
|
||||
return Some(AuthFilter::default());
|
||||
}
|
||||
if auth.get_master_key().map_or(true, |mk| mk == token) {
|
||||
return Some(AuthFilter::default());
|
||||
}
|
||||
|
||||
// authenticate if token is allowed.
|
||||
|
@ -147,13 +140,3 @@ pub mod policies {
|
|||
}
|
||||
}
|
||||
}
|
||||
pub enum AuthConfig {
|
||||
NoAuth,
|
||||
Auth,
|
||||
}
|
||||
|
||||
impl Default for AuthConfig {
|
||||
fn default() -> Self {
|
||||
Self::NoAuth
|
||||
}
|
||||
}
|
||||
|
|
|
@ -13,7 +13,6 @@ use std::sync::Arc;
|
|||
use std::time::Duration;
|
||||
|
||||
use crate::error::MeilisearchHttpError;
|
||||
use crate::extractors::authentication::AuthConfig;
|
||||
use actix_web::error::JsonPayloadError;
|
||||
use analytics::Analytics;
|
||||
use error::PayloadError;
|
||||
|
@ -25,31 +24,6 @@ use actix_web::{web, HttpRequest};
|
|||
use extractors::payload::PayloadConfig;
|
||||
use meilisearch_auth::AuthController;
|
||||
use meilisearch_lib::MeiliSearch;
|
||||
use sha2::Digest;
|
||||
|
||||
#[derive(Clone)]
|
||||
pub struct ApiKeys {
|
||||
pub public: Option<String>,
|
||||
pub private: Option<String>,
|
||||
pub master: Option<String>,
|
||||
}
|
||||
|
||||
impl ApiKeys {
|
||||
pub fn generate_missing_api_keys(&mut self) {
|
||||
if let Some(master_key) = &self.master {
|
||||
if self.private.is_none() {
|
||||
let key = format!("{}-private", master_key);
|
||||
let sha = sha2::Sha256::digest(key.as_bytes());
|
||||
self.private = Some(format!("{:x}", sha));
|
||||
}
|
||||
if self.public.is_none() {
|
||||
let key = format!("{}-public", master_key);
|
||||
let sha = sha2::Sha256::digest(key.as_bytes());
|
||||
self.public = Some(format!("{:x}", sha));
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
pub fn setup_meilisearch(opt: &Opt) -> anyhow::Result<MeiliSearch> {
|
||||
let mut meilisearch = MeiliSearch::builder();
|
||||
|
@ -113,16 +87,6 @@ pub fn configure_data(
|
|||
);
|
||||
}
|
||||
|
||||
pub fn configure_auth(config: &mut web::ServiceConfig, opts: &Opt) {
|
||||
let auth_config = if opts.master_key.is_some() {
|
||||
AuthConfig::Auth
|
||||
} else {
|
||||
AuthConfig::NoAuth
|
||||
};
|
||||
|
||||
config.app_data(auth_config);
|
||||
}
|
||||
|
||||
#[cfg(feature = "mini-dashboard")]
|
||||
pub fn dashboard(config: &mut web::ServiceConfig, enable_frontend: bool) {
|
||||
use actix_web::HttpResponse;
|
||||
|
@ -170,17 +134,15 @@ macro_rules! create_app {
|
|||
use meilisearch_error::ResponseError;
|
||||
use meilisearch_http::error::MeilisearchHttpError;
|
||||
use meilisearch_http::routes;
|
||||
use meilisearch_http::{configure_auth, configure_data, dashboard};
|
||||
use meilisearch_http::{configure_data, dashboard};
|
||||
|
||||
App::new()
|
||||
.configure(|s| configure_data(s, $data.clone(), $auth.clone(), &$opt, $analytics))
|
||||
.configure(|s| configure_auth(s, &$opt))
|
||||
.configure(routes::configure)
|
||||
.configure(|s| dashboard(s, $enable_frontend))
|
||||
.wrap(
|
||||
Cors::default()
|
||||
.send_wildcard()
|
||||
.allowed_headers(vec!["content-type", "x-meili-api-key"])
|
||||
.allow_any_origin()
|
||||
.allow_any_method()
|
||||
.max_age(86_400), // 24h
|
||||
|
|
|
@ -1,7 +1,7 @@
|
|||
use std::str;
|
||||
|
||||
use actix_web::{web, HttpRequest, HttpResponse};
|
||||
use chrono::{DateTime, Utc};
|
||||
use chrono::SecondsFormat;
|
||||
use log::debug;
|
||||
use meilisearch_auth::{generate_key, Action, AuthController, Key};
|
||||
use serde::{Deserialize, Serialize};
|
||||
|
@ -84,7 +84,7 @@ pub async fn delete_api_key(
|
|||
// keep 8 first characters that are the ID of the API key.
|
||||
auth_controller.delete_key(&path.api_key).await?;
|
||||
|
||||
Ok(HttpResponse::NoContent().json(()))
|
||||
Ok(HttpResponse::NoContent().finish())
|
||||
}
|
||||
|
||||
#[derive(Deserialize)]
|
||||
|
@ -95,14 +95,13 @@ pub struct AuthParam {
|
|||
#[derive(Debug, Serialize)]
|
||||
#[serde(rename_all = "camelCase")]
|
||||
struct KeyView {
|
||||
#[serde(skip_serializing_if = "Option::is_none")]
|
||||
description: Option<String>,
|
||||
key: String,
|
||||
actions: Vec<Action>,
|
||||
indexes: Vec<String>,
|
||||
expires_at: Option<DateTime<Utc>>,
|
||||
created_at: DateTime<Utc>,
|
||||
updated_at: DateTime<Utc>,
|
||||
expires_at: Option<String>,
|
||||
created_at: String,
|
||||
updated_at: String,
|
||||
}
|
||||
|
||||
impl KeyView {
|
||||
|
@ -118,9 +117,11 @@ impl KeyView {
|
|||
key: generated_key,
|
||||
actions: key.actions,
|
||||
indexes: key.indexes,
|
||||
expires_at: key.expires_at,
|
||||
created_at: key.created_at,
|
||||
updated_at: key.updated_at,
|
||||
expires_at: key
|
||||
.expires_at
|
||||
.map(|dt| dt.to_rfc3339_opts(SecondsFormat::Secs, true)),
|
||||
created_at: key.created_at.to_rfc3339_opts(SecondsFormat::Secs, true),
|
||||
updated_at: key.updated_at.to_rfc3339_opts(SecondsFormat::Secs, true),
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
|
@ -62,7 +62,7 @@ pub struct IndexCreateRequest {
|
|||
}
|
||||
|
||||
pub async fn create_index(
|
||||
meilisearch: GuardedData<ActionPolicy<{ actions::INDEXES_ADD }>, MeiliSearch>,
|
||||
meilisearch: GuardedData<ActionPolicy<{ actions::INDEXES_CREATE }>, MeiliSearch>,
|
||||
body: web::Json<IndexCreateRequest>,
|
||||
req: HttpRequest,
|
||||
analytics: web::Data<dyn Analytics>,
|
||||
|
|
|
@ -1,6 +1,7 @@
|
|||
use actix_web::{web, HttpRequest, HttpResponse};
|
||||
use meilisearch_error::ResponseError;
|
||||
use meilisearch_lib::tasks::task::TaskId;
|
||||
use meilisearch_lib::tasks::TaskFilter;
|
||||
use meilisearch_lib::MeiliSearch;
|
||||
use serde_json::json;
|
||||
|
||||
|
@ -24,8 +25,16 @@ async fn get_tasks(
|
|||
Some(&req),
|
||||
);
|
||||
|
||||
let filters = meilisearch.filters().indexes.as_ref().map(|indexes| {
|
||||
let mut filters = TaskFilter::default();
|
||||
for index in indexes {
|
||||
filters.filter_index(index.to_string());
|
||||
}
|
||||
filters
|
||||
});
|
||||
|
||||
let tasks: TaskListView = meilisearch
|
||||
.list_tasks(None, None, None)
|
||||
.list_tasks(filters, None, None)
|
||||
.await?
|
||||
.into_iter()
|
||||
.map(TaskView::from)
|
||||
|
@ -47,8 +56,16 @@ async fn get_task(
|
|||
Some(&req),
|
||||
);
|
||||
|
||||
let filters = meilisearch.filters().indexes.as_ref().map(|indexes| {
|
||||
let mut filters = TaskFilter::default();
|
||||
for index in indexes {
|
||||
filters.filter_index(index.to_string());
|
||||
}
|
||||
filters
|
||||
});
|
||||
|
||||
let task: TaskView = meilisearch
|
||||
.get_task(task_id.into_inner(), None)
|
||||
.get_task(task_id.into_inner(), filters)
|
||||
.await?
|
||||
.into();
|
||||
|
||||
|
|
|
@ -1,6 +1,7 @@
|
|||
use crate::common::Server;
|
||||
use assert_json_diff::assert_json_include;
|
||||
use serde_json::json;
|
||||
use std::{thread, time};
|
||||
|
||||
#[actix_rt::test]
|
||||
async fn add_valid_api_key() {
|
||||
|
@ -15,7 +16,7 @@ async fn add_valid_api_key() {
|
|||
"documents.add",
|
||||
"documents.get",
|
||||
"documents.delete",
|
||||
"indexes.add",
|
||||
"indexes.create",
|
||||
"indexes.get",
|
||||
"indexes.update",
|
||||
"indexes.delete",
|
||||
|
@ -43,7 +44,7 @@ async fn add_valid_api_key() {
|
|||
"documents.add",
|
||||
"documents.get",
|
||||
"documents.delete",
|
||||
"indexes.add",
|
||||
"indexes.create",
|
||||
"indexes.get",
|
||||
"indexes.update",
|
||||
"indexes.delete",
|
||||
|
@ -71,7 +72,7 @@ async fn add_valid_api_key_no_description() {
|
|||
"actions": [
|
||||
"documents.add"
|
||||
],
|
||||
"expiresAt": "2050-11-13T00:00:00Z"
|
||||
"expiresAt": "2050-11-13T00:00:00"
|
||||
});
|
||||
|
||||
let (response, code) = server.add_api_key(content).await;
|
||||
|
@ -153,9 +154,7 @@ async fn error_add_api_key_missing_parameter() {
|
|||
// missing indexes
|
||||
let content = json!({
|
||||
"description": "Indexing API key",
|
||||
"actions": [
|
||||
"documents.add"
|
||||
],
|
||||
"actions": ["documents.add"],
|
||||
"expiresAt": "2050-11-13T00:00:00Z"
|
||||
});
|
||||
let (response, code) = server.add_api_key(content).await;
|
||||
|
@ -187,6 +186,24 @@ async fn error_add_api_key_missing_parameter() {
|
|||
|
||||
assert_eq!(response, expected_response);
|
||||
assert_eq!(code, 400);
|
||||
|
||||
// missing expiration date
|
||||
let content = json!({
|
||||
"description": "Indexing API key",
|
||||
"indexes": ["products"],
|
||||
"actions": ["documents.add"],
|
||||
});
|
||||
let (response, code) = server.add_api_key(content).await;
|
||||
|
||||
let expected_response = json!({
|
||||
"message": "`expiresAt` field is mandatory.",
|
||||
"code": "missing_parameter",
|
||||
"type": "invalid_request",
|
||||
"link":"https://docs.meilisearch.com/errors#missing_parameter"
|
||||
});
|
||||
|
||||
assert_eq!(response, expected_response);
|
||||
assert_eq!(code, 400);
|
||||
}
|
||||
|
||||
#[actix_rt::test]
|
||||
|
@ -311,6 +328,32 @@ async fn error_add_api_key_invalid_parameters_expires_at() {
|
|||
assert_eq!(code, 400);
|
||||
}
|
||||
|
||||
#[actix_rt::test]
|
||||
async fn error_add_api_key_invalid_parameters_expires_at_in_the_past() {
|
||||
let mut server = Server::new_auth().await;
|
||||
server.use_api_key("MASTER_KEY");
|
||||
|
||||
let content = json!({
|
||||
"description": "Indexing API key",
|
||||
"indexes": ["products"],
|
||||
"actions": [
|
||||
"documents.add"
|
||||
],
|
||||
"expiresAt": "2010-11-13T00:00:00Z"
|
||||
});
|
||||
let (response, code) = server.add_api_key(content).await;
|
||||
|
||||
let expected_response = json!({
|
||||
"message": r#"expiresAt field value `"2010-11-13T00:00:00Z"` is invalid. It should be in ISO-8601 format to represents a date or datetime in the future or specified as a null value. e.g. 'YYYY-MM-DD' or 'YYYY-MM-DDTHH:MM:SS'."#,
|
||||
"code": "invalid_api_key_expires_at",
|
||||
"type": "invalid_request",
|
||||
"link": "https://docs.meilisearch.com/errors#invalid_api_key_expires_at"
|
||||
});
|
||||
|
||||
assert_eq!(response, expected_response);
|
||||
assert_eq!(code, 400);
|
||||
}
|
||||
|
||||
#[actix_rt::test]
|
||||
async fn get_api_key() {
|
||||
let mut server = Server::new_auth().await;
|
||||
|
@ -324,7 +367,7 @@ async fn get_api_key() {
|
|||
"documents.add",
|
||||
"documents.get",
|
||||
"documents.delete",
|
||||
"indexes.add",
|
||||
"indexes.create",
|
||||
"indexes.get",
|
||||
"indexes.update",
|
||||
"indexes.delete",
|
||||
|
@ -359,7 +402,7 @@ async fn get_api_key() {
|
|||
"documents.add",
|
||||
"documents.get",
|
||||
"documents.delete",
|
||||
"indexes.add",
|
||||
"indexes.create",
|
||||
"indexes.get",
|
||||
"indexes.update",
|
||||
"indexes.delete",
|
||||
|
@ -449,7 +492,7 @@ async fn list_api_keys() {
|
|||
"documents.add",
|
||||
"documents.get",
|
||||
"documents.delete",
|
||||
"indexes.add",
|
||||
"indexes.create",
|
||||
"indexes.get",
|
||||
"indexes.update",
|
||||
"indexes.delete",
|
||||
|
@ -468,19 +511,9 @@ async fn list_api_keys() {
|
|||
assert_eq!(code, 201);
|
||||
|
||||
let (response, code) = server.list_api_keys().await;
|
||||
assert!(response.is_array());
|
||||
let response = &response.as_array().unwrap();
|
||||
|
||||
let created_key = response
|
||||
.iter()
|
||||
.find(|x| x["description"] == "Indexing API key")
|
||||
.unwrap();
|
||||
assert!(created_key["key"].is_string());
|
||||
assert!(created_key["expiresAt"].is_string());
|
||||
assert!(created_key["createdAt"].is_string());
|
||||
assert!(created_key["updatedAt"].is_string());
|
||||
|
||||
let expected_response = json!({
|
||||
let expected_response = json!([
|
||||
{
|
||||
"description": "Indexing API key",
|
||||
"indexes": ["products"],
|
||||
"actions": [
|
||||
|
@ -488,7 +521,7 @@ async fn list_api_keys() {
|
|||
"documents.add",
|
||||
"documents.get",
|
||||
"documents.delete",
|
||||
"indexes.add",
|
||||
"indexes.create",
|
||||
"indexes.get",
|
||||
"indexes.update",
|
||||
"indexes.delete",
|
||||
|
@ -500,49 +533,21 @@ async fn list_api_keys() {
|
|||
"dumps.get"
|
||||
],
|
||||
"expiresAt": "2050-11-13T00:00:00Z"
|
||||
});
|
||||
|
||||
assert_json_include!(actual: created_key, expected: expected_response);
|
||||
assert_eq!(code, 200);
|
||||
|
||||
// check if default admin key is present.
|
||||
let admin_key = response
|
||||
.iter()
|
||||
.find(|x| x["description"] == "Default Admin API Key (Use it for all other operations. Caution! Do not use it on a public frontend)")
|
||||
.unwrap();
|
||||
assert!(created_key["key"].is_string());
|
||||
assert!(created_key["expiresAt"].is_string());
|
||||
assert!(created_key["createdAt"].is_string());
|
||||
assert!(created_key["updatedAt"].is_string());
|
||||
|
||||
let expected_response = json!({
|
||||
"description": "Default Admin API Key (Use it for all other operations. Caution! Do not use it on a public frontend)",
|
||||
"indexes": ["*"],
|
||||
"actions": ["*"],
|
||||
"expiresAt": serde_json::Value::Null,
|
||||
});
|
||||
|
||||
assert_json_include!(actual: admin_key, expected: expected_response);
|
||||
assert_eq!(code, 200);
|
||||
|
||||
// check if default search key is present.
|
||||
let admin_key = response
|
||||
.iter()
|
||||
.find(|x| x["description"] == "Default Search API Key (Use it to search from the frontend)")
|
||||
.unwrap();
|
||||
assert!(created_key["key"].is_string());
|
||||
assert!(created_key["expiresAt"].is_string());
|
||||
assert!(created_key["createdAt"].is_string());
|
||||
assert!(created_key["updatedAt"].is_string());
|
||||
|
||||
let expected_response = json!({
|
||||
},
|
||||
{
|
||||
"description": "Default Search API Key (Use it to search from the frontend)",
|
||||
"indexes": ["*"],
|
||||
"actions": ["search"],
|
||||
"expiresAt": serde_json::Value::Null,
|
||||
});
|
||||
},
|
||||
{
|
||||
"description": "Default Admin API Key (Use it for all other operations. Caution! Do not use it on a public frontend)",
|
||||
"indexes": ["*"],
|
||||
"actions": ["*"],
|
||||
"expiresAt": serde_json::Value::Null,
|
||||
}]);
|
||||
|
||||
assert_json_include!(actual: admin_key, expected: expected_response);
|
||||
assert_json_include!(actual: response, expected: expected_response);
|
||||
assert_eq!(code, 200);
|
||||
}
|
||||
|
||||
|
@ -594,7 +599,7 @@ async fn delete_api_key() {
|
|||
"documents.add",
|
||||
"documents.get",
|
||||
"documents.delete",
|
||||
"indexes.add",
|
||||
"indexes.create",
|
||||
"indexes.get",
|
||||
"indexes.update",
|
||||
"indexes.delete",
|
||||
|
@ -694,7 +699,7 @@ async fn patch_api_key_description() {
|
|||
"documents.add",
|
||||
"documents.get",
|
||||
"documents.delete",
|
||||
"indexes.add",
|
||||
"indexes.create",
|
||||
"indexes.get",
|
||||
"indexes.update",
|
||||
"indexes.delete",
|
||||
|
@ -719,6 +724,7 @@ async fn patch_api_key_description() {
|
|||
// Add a description
|
||||
let content = json!({ "description": "Indexing API key" });
|
||||
|
||||
thread::sleep(time::Duration::new(1, 0));
|
||||
let (response, code) = server.patch_api_key(&key, content).await;
|
||||
assert!(response["key"].is_string());
|
||||
assert!(response["expiresAt"].is_string());
|
||||
|
@ -734,7 +740,7 @@ async fn patch_api_key_description() {
|
|||
"documents.add",
|
||||
"documents.get",
|
||||
"documents.delete",
|
||||
"indexes.add",
|
||||
"indexes.create",
|
||||
"indexes.get",
|
||||
"indexes.update",
|
||||
"indexes.delete",
|
||||
|
@ -764,7 +770,7 @@ async fn patch_api_key_description() {
|
|||
"documents.add",
|
||||
"documents.get",
|
||||
"documents.delete",
|
||||
"indexes.add",
|
||||
"indexes.create",
|
||||
"indexes.get",
|
||||
"indexes.update",
|
||||
"indexes.delete",
|
||||
|
@ -793,7 +799,7 @@ async fn patch_api_key_description() {
|
|||
"documents.add",
|
||||
"documents.get",
|
||||
"documents.delete",
|
||||
"indexes.add",
|
||||
"indexes.create",
|
||||
"indexes.get",
|
||||
"indexes.update",
|
||||
"indexes.delete",
|
||||
|
@ -821,7 +827,7 @@ async fn patch_api_key_indexes() {
|
|||
"documents.add",
|
||||
"documents.get",
|
||||
"documents.delete",
|
||||
"indexes.add",
|
||||
"indexes.create",
|
||||
"indexes.get",
|
||||
"indexes.update",
|
||||
"indexes.delete",
|
||||
|
@ -845,6 +851,7 @@ async fn patch_api_key_indexes() {
|
|||
|
||||
let content = json!({ "indexes": ["products", "prices"] });
|
||||
|
||||
thread::sleep(time::Duration::new(1, 0));
|
||||
let (response, code) = server.patch_api_key(&key, content).await;
|
||||
assert!(response["key"].is_string());
|
||||
assert!(response["expiresAt"].is_string());
|
||||
|
@ -860,7 +867,7 @@ async fn patch_api_key_indexes() {
|
|||
"documents.add",
|
||||
"documents.get",
|
||||
"documents.delete",
|
||||
"indexes.add",
|
||||
"indexes.create",
|
||||
"indexes.get",
|
||||
"indexes.update",
|
||||
"indexes.delete",
|
||||
|
@ -888,7 +895,7 @@ async fn patch_api_key_actions() {
|
|||
"documents.add",
|
||||
"documents.get",
|
||||
"documents.delete",
|
||||
"indexes.add",
|
||||
"indexes.create",
|
||||
"indexes.get",
|
||||
"indexes.update",
|
||||
"indexes.delete",
|
||||
|
@ -920,6 +927,7 @@ async fn patch_api_key_actions() {
|
|||
],
|
||||
});
|
||||
|
||||
thread::sleep(time::Duration::new(1, 0));
|
||||
let (response, code) = server.patch_api_key(&key, content).await;
|
||||
assert!(response["key"].is_string());
|
||||
assert!(response["expiresAt"].is_string());
|
||||
|
@ -957,7 +965,7 @@ async fn patch_api_key_expiration_date() {
|
|||
"documents.add",
|
||||
"documents.get",
|
||||
"documents.delete",
|
||||
"indexes.add",
|
||||
"indexes.create",
|
||||
"indexes.get",
|
||||
"indexes.update",
|
||||
"indexes.delete",
|
||||
|
@ -965,7 +973,7 @@ async fn patch_api_key_expiration_date() {
|
|||
"dumps.create",
|
||||
"dumps.get"
|
||||
],
|
||||
"expiresAt": "205-11-13T00:00:00Z"
|
||||
"expiresAt": "2050-11-13T00:00:00Z"
|
||||
});
|
||||
|
||||
let (response, code) = server.add_api_key(content).await;
|
||||
|
@ -981,6 +989,7 @@ async fn patch_api_key_expiration_date() {
|
|||
|
||||
let content = json!({ "expiresAt": "2055-11-13T00:00:00Z" });
|
||||
|
||||
thread::sleep(time::Duration::new(1, 0));
|
||||
let (response, code) = server.patch_api_key(&key, content).await;
|
||||
assert!(response["key"].is_string());
|
||||
assert!(response["expiresAt"].is_string());
|
||||
|
@ -996,7 +1005,7 @@ async fn patch_api_key_expiration_date() {
|
|||
"documents.add",
|
||||
"documents.get",
|
||||
"documents.delete",
|
||||
"indexes.add",
|
||||
"indexes.create",
|
||||
"indexes.get",
|
||||
"indexes.update",
|
||||
"indexes.delete",
|
||||
|
@ -1166,3 +1175,65 @@ async fn error_patch_api_key_indexes_invalid_parameters() {
|
|||
assert_eq!(response, expected_response);
|
||||
assert_eq!(code, 400);
|
||||
}
|
||||
|
||||
#[actix_rt::test]
|
||||
async fn error_access_api_key_routes_no_master_key_set() {
|
||||
let mut server = Server::new().await;
|
||||
|
||||
let expected_response = json!({
|
||||
"message": "The Authorization header is missing. It must use the bearer authorization method.",
|
||||
"code": "missing_authorization_header",
|
||||
"type": "auth",
|
||||
"link": "https://docs.meilisearch.com/errors#missing_authorization_header"
|
||||
});
|
||||
let expected_code = 401;
|
||||
|
||||
let (response, code) = server.add_api_key(json!({})).await;
|
||||
|
||||
assert_eq!(response, expected_response);
|
||||
assert_eq!(code, expected_code);
|
||||
|
||||
let (response, code) = server.patch_api_key("content", json!({})).await;
|
||||
|
||||
assert_eq!(response, expected_response);
|
||||
assert_eq!(code, expected_code);
|
||||
|
||||
let (response, code) = server.get_api_key("content").await;
|
||||
|
||||
assert_eq!(response, expected_response);
|
||||
assert_eq!(code, expected_code);
|
||||
|
||||
let (response, code) = server.list_api_keys().await;
|
||||
|
||||
assert_eq!(response, expected_response);
|
||||
assert_eq!(code, expected_code);
|
||||
|
||||
server.use_api_key("MASTER_KEY");
|
||||
|
||||
let expected_response = json!({"message": "The provided API key is invalid.",
|
||||
"code": "invalid_api_key",
|
||||
"type": "auth",
|
||||
"link": "https://docs.meilisearch.com/errors#invalid_api_key"
|
||||
});
|
||||
let expected_code = 403;
|
||||
|
||||
let (response, code) = server.add_api_key(json!({})).await;
|
||||
|
||||
assert_eq!(response, expected_response);
|
||||
assert_eq!(code, expected_code);
|
||||
|
||||
let (response, code) = server.patch_api_key("content", json!({})).await;
|
||||
|
||||
assert_eq!(response, expected_response);
|
||||
assert_eq!(code, expected_code);
|
||||
|
||||
let (response, code) = server.get_api_key("content").await;
|
||||
|
||||
assert_eq!(response, expected_response);
|
||||
assert_eq!(code, expected_code);
|
||||
|
||||
let (response, code) = server.list_api_keys().await;
|
||||
|
||||
assert_eq!(response, expected_response);
|
||||
assert_eq!(code, expected_code);
|
||||
}
|
||||
|
|
|
@ -1,4 +1,5 @@
|
|||
use crate::common::Server;
|
||||
use chrono::{Duration, Utc};
|
||||
use maplit::hashmap;
|
||||
use once_cell::sync::Lazy;
|
||||
use serde_json::{json, Value};
|
||||
|
@ -19,7 +20,7 @@ static AUTHORIZATIONS: Lazy<HashMap<(&'static str, &'static str), &'static str>>
|
|||
("PUT", "/indexes/products/") => "indexes.update",
|
||||
("GET", "/indexes/products/") => "indexes.get",
|
||||
("DELETE", "/indexes/products/") => "indexes.delete",
|
||||
("POST", "/indexes") => "indexes.add",
|
||||
("POST", "/indexes") => "indexes.create",
|
||||
("GET", "/indexes") => "indexes.get",
|
||||
("GET", "/indexes/products/settings") => "settings.get",
|
||||
("GET", "/indexes/products/settings/displayed-attributes") => "settings.get",
|
||||
|
@ -61,13 +62,15 @@ static INVALID_RESPONSE: Lazy<Value> = Lazy::new(|| {
|
|||
|
||||
#[actix_rt::test]
|
||||
async fn error_access_expired_key() {
|
||||
use std::{thread, time};
|
||||
|
||||
let mut server = Server::new_auth().await;
|
||||
server.use_api_key("MASTER_KEY");
|
||||
|
||||
let content = json!({
|
||||
"indexes": ["products"],
|
||||
"actions": ALL_ACTIONS.clone(),
|
||||
"expiresAt": "2020-11-13T00:00:00Z"
|
||||
"expiresAt": (Utc::now() + Duration::seconds(1)),
|
||||
});
|
||||
|
||||
let (response, code) = server.add_api_key(content).await;
|
||||
|
@ -77,6 +80,9 @@ async fn error_access_expired_key() {
|
|||
let key = response["key"].as_str().unwrap();
|
||||
server.use_api_key(&key);
|
||||
|
||||
// wait until the key is expired.
|
||||
thread::sleep(time::Duration::new(1, 0));
|
||||
|
||||
for (method, route) in AUTHORIZATIONS.keys() {
|
||||
let (response, code) = server.dummy_request(method, route).await;
|
||||
|
||||
|
@ -93,7 +99,7 @@ async fn error_access_unauthorized_index() {
|
|||
let content = json!({
|
||||
"indexes": ["sales"],
|
||||
"actions": ALL_ACTIONS.clone(),
|
||||
"expiresAt": "2050-11-13T00:00:00Z"
|
||||
"expiresAt": Utc::now() + Duration::hours(1),
|
||||
});
|
||||
|
||||
let (response, code) = server.add_api_key(content).await;
|
||||
|
@ -123,7 +129,7 @@ async fn error_access_unauthorized_action() {
|
|||
let content = json!({
|
||||
"indexes": ["products"],
|
||||
"actions": [],
|
||||
"expiresAt": "2050-11-13T00:00:00Z"
|
||||
"expiresAt": Utc::now() + Duration::hours(1),
|
||||
});
|
||||
|
||||
let (response, code) = server.add_api_key(content).await;
|
||||
|
@ -159,7 +165,7 @@ async fn access_authorized_restricted_index() {
|
|||
let content = json!({
|
||||
"indexes": ["products"],
|
||||
"actions": [],
|
||||
"expiresAt": "2050-11-13T00:00:00Z"
|
||||
"expiresAt": Utc::now() + Duration::hours(1),
|
||||
});
|
||||
|
||||
let (response, code) = server.add_api_key(content).await;
|
||||
|
@ -210,7 +216,7 @@ async fn access_authorized_no_index_restriction() {
|
|||
let content = json!({
|
||||
"indexes": ["*"],
|
||||
"actions": [],
|
||||
"expiresAt": "2050-11-13T00:00:00Z"
|
||||
"expiresAt": Utc::now() + Duration::hours(1),
|
||||
});
|
||||
|
||||
let (response, code) = server.add_api_key(content).await;
|
||||
|
@ -272,7 +278,7 @@ async fn access_authorized_stats_restricted_index() {
|
|||
let content = json!({
|
||||
"indexes": ["products"],
|
||||
"actions": ["stats.get"],
|
||||
"expiresAt": "2050-11-13T00:00:00Z"
|
||||
"expiresAt": Utc::now() + Duration::hours(1),
|
||||
});
|
||||
let (response, code) = server.add_api_key(content).await;
|
||||
assert_eq!(code, 201);
|
||||
|
@ -311,7 +317,7 @@ async fn access_authorized_stats_no_index_restriction() {
|
|||
let content = json!({
|
||||
"indexes": ["*"],
|
||||
"actions": ["stats.get"],
|
||||
"expiresAt": "2050-11-13T00:00:00Z"
|
||||
"expiresAt": Utc::now() + Duration::hours(1),
|
||||
});
|
||||
let (response, code) = server.add_api_key(content).await;
|
||||
assert_eq!(code, 201);
|
||||
|
@ -350,7 +356,7 @@ async fn list_authorized_indexes_restricted_index() {
|
|||
let content = json!({
|
||||
"indexes": ["products"],
|
||||
"actions": ["indexes.get"],
|
||||
"expiresAt": "2050-11-13T00:00:00Z"
|
||||
"expiresAt": Utc::now() + Duration::hours(1),
|
||||
});
|
||||
let (response, code) = server.add_api_key(content).await;
|
||||
assert_eq!(code, 201);
|
||||
|
@ -390,7 +396,7 @@ async fn list_authorized_indexes_no_index_restriction() {
|
|||
let content = json!({
|
||||
"indexes": ["*"],
|
||||
"actions": ["indexes.get"],
|
||||
"expiresAt": "2050-11-13T00:00:00Z"
|
||||
"expiresAt": Utc::now() + Duration::hours(1),
|
||||
});
|
||||
let (response, code) = server.add_api_key(content).await;
|
||||
assert_eq!(code, 201);
|
||||
|
@ -410,3 +416,83 @@ async fn list_authorized_indexes_no_index_restriction() {
|
|||
// key should have access on `test` index.
|
||||
assert!(response.iter().any(|index| index["uid"] == "test"));
|
||||
}
|
||||
|
||||
#[actix_rt::test]
|
||||
async fn list_authorized_tasks_restricted_index() {
|
||||
let mut server = Server::new_auth().await;
|
||||
server.use_api_key("MASTER_KEY");
|
||||
|
||||
// create index `test`
|
||||
let index = server.index("test");
|
||||
let (_, code) = index.create(Some("id")).await;
|
||||
assert_eq!(code, 202);
|
||||
// create index `products`
|
||||
let index = server.index("products");
|
||||
let (_, code) = index.create(Some("product_id")).await;
|
||||
assert_eq!(code, 202);
|
||||
index.wait_task(0).await;
|
||||
|
||||
// create key with access on `products` index only.
|
||||
let content = json!({
|
||||
"indexes": ["products"],
|
||||
"actions": ["tasks.get"],
|
||||
"expiresAt": Utc::now() + Duration::hours(1),
|
||||
});
|
||||
let (response, code) = server.add_api_key(content).await;
|
||||
assert_eq!(code, 201);
|
||||
assert!(response["key"].is_string());
|
||||
|
||||
// use created key.
|
||||
let key = response["key"].as_str().unwrap();
|
||||
server.use_api_key(&key);
|
||||
|
||||
let (response, code) = server.service.get("/tasks").await;
|
||||
assert_eq!(code, 200);
|
||||
println!("{}", response);
|
||||
let response = response["results"].as_array().unwrap();
|
||||
// key should have access on `products` index.
|
||||
assert!(response.iter().any(|task| task["indexUid"] == "products"));
|
||||
|
||||
// key should not have access on `test` index.
|
||||
assert!(!response.iter().any(|task| task["indexUid"] == "test"));
|
||||
}
|
||||
|
||||
#[actix_rt::test]
|
||||
async fn list_authorized_tasks_no_index_restriction() {
|
||||
let mut server = Server::new_auth().await;
|
||||
server.use_api_key("MASTER_KEY");
|
||||
|
||||
// create index `test`
|
||||
let index = server.index("test");
|
||||
let (_, code) = index.create(Some("id")).await;
|
||||
assert_eq!(code, 202);
|
||||
// create index `products`
|
||||
let index = server.index("products");
|
||||
let (_, code) = index.create(Some("product_id")).await;
|
||||
assert_eq!(code, 202);
|
||||
index.wait_task(0).await;
|
||||
|
||||
// create key with access on all indexes.
|
||||
let content = json!({
|
||||
"indexes": ["*"],
|
||||
"actions": ["tasks.get"],
|
||||
"expiresAt": Utc::now() + Duration::hours(1),
|
||||
});
|
||||
let (response, code) = server.add_api_key(content).await;
|
||||
assert_eq!(code, 201);
|
||||
assert!(response["key"].is_string());
|
||||
|
||||
// use created key.
|
||||
let key = response["key"].as_str().unwrap();
|
||||
server.use_api_key(&key);
|
||||
|
||||
let (response, code) = server.service.get("/tasks").await;
|
||||
assert_eq!(code, 200);
|
||||
|
||||
let response = response["results"].as_array().unwrap();
|
||||
// key should have access on `products` index.
|
||||
assert!(response.iter().any(|task| task["indexUid"] == "products"));
|
||||
|
||||
// key should have access on `test` index.
|
||||
assert!(response.iter().any(|task| task["indexUid"] == "test"));
|
||||
}
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue