searchengines-web/MeiliSearch
searchengines-web/MeiliSearch
1
0
Fork 0
mirror of https://github.com/meilisearch/MeiliSearch synced 2024-11-22 21:04:27 +01:00
Code Issues Releases Wiki Activity

add implementation for no master key set and fix tests

Browse Source
This commit is contained in:
vishalsodani 2022-10-25 22:41:48 +05:30
parent 1cf6efa740
commit f0ecacb58d
3 changed files with 53 additions and 29 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
meilisearch-auth/src/lib.rs
View File

@ -173,13 +173,28 @@ impl AuthController {
pub struct AuthFilter { pub struct AuthFilter {
pub search_rules: SearchRules, pub search_rules: SearchRules,
pub allow_index_creation: bool, pub allow_index_creation: bool,
master_key_missing: bool,
} }
impl AuthFilter {
pub fn with_no_master_key() -> AuthFilter {
AuthFilter {
search_rules: SearchRules::default(),
allow_index_creation: true,
master_key_missing: true,
}
}
pub fn is_missing_master_key(&self) -> bool {
self.master_key_missing
}
}
impl Default for AuthFilter { impl Default for AuthFilter {
fn default() -> Self { fn default() -> Self {
Self { Self {
search_rules: SearchRules::default(), search_rules: SearchRules::default(),
allow_index_creation: true, allow_index_creation: true,
master_key_missing: false,
} }
} }
} }

21
meilisearch-http/src/extractors/authentication/mod.rs
View File

@ -50,14 +50,20 @@ impl<P, D> GuardedData<P, D> {
{ {
match Self::authenticate(auth, String::new(), None).await? { match Self::authenticate(auth, String::new(), None).await? {
Some(filters) => match data { Some(filters) => match data {
Some(data) => Ok(Self { Some(data) => {
data, if filters.is_missing_master_key() {
filters, Err(AuthenticationError::MissingMasterKey.into())
_marker: PhantomData, } else {
}), Ok(Self {
data,
filters,
_marker: PhantomData,
})
}
}
None => Err(AuthenticationError::IrretrievableState.into()), None => Err(AuthenticationError::IrretrievableState.into()),
}, },
None => Err(AuthenticationError::MissingMasterKey.into()), None => Err(AuthenticationError::MissingAuthorizationHeader.into()),
} }
} }
@ -171,6 +177,9 @@ pub mod policies {
token: &str, token: &str,
index: Option<&str>, index: Option<&str>,
) -> Option<AuthFilter> { ) -> Option<AuthFilter> {
if auth.get_master_key().is_none() && is_keys_action(A) {
return Some(AuthFilter::with_no_master_key());
}
// authenticate if token is the master key. // authenticate if token is the master key.
// master key can only have access to keys routes. // master key can only have access to keys routes.
// if master key is None only keys routes are inaccessible. // if master key is None only keys routes are inaccessible.

46
meilisearch-http/tests/auth/api_keys.rs
View File

@ -1400,13 +1400,13 @@ async fn error_patch_api_key_indexes_invalid_parameters() {
#[actix_rt::test] #[actix_rt::test]
async fn error_access_api_key_routes_no_master_key_set() { async fn error_access_api_key_routes_no_master_key_set() {
let mut server = Server::new().await; let server = Server::new().await;
let expected_response = json!({ let expected_response = json!({
"message": "The Authorization header is missing. It must use the bearer authorization method.", "message": "Meilisearch is running without a master key. To access this API endpoint, you must have set a master key at launch.",
"code": "missing_authorization_header", "code": "missing_master_key",
"type": "auth", "type": "auth",
"link": "https://docs.meilisearch.com/errors#missing_authorization_header" "link": "https://docs.meilisearch.com/errors#missing_master_key"
}); });
let expected_code = 401; let expected_code = 401;
@ -1430,32 +1430,32 @@ async fn error_access_api_key_routes_no_master_key_set() {
assert_eq!(expected_code, code, "{:?}", &response); assert_eq!(expected_code, code, "{:?}", &response);
assert_eq!(response, expected_response); assert_eq!(response, expected_response);
server.use_api_key("MASTER_KEY"); // server.use_api_key("MASTER_KEY");
let expected_response = json!({"message": "The provided API key is invalid.", // let expected_response = json!({"message": "The provided API key is invalid.",
"code": "invalid_api_key", // "code": "invalid_api_key",
"type": "auth", // "type": "auth",
"link": "https://docs.meilisearch.com/errors#invalid_api_key" // "link": "https://docs.meilisearch.com/errors#invalid_api_key"
}); // });
let expected_code = 403; // let expected_code = 403;
let (response, code) = server.add_api_key(json!({})).await; // let (response, code) = server.add_api_key(json!({})).await;
assert_eq!(expected_code, code, "{:?}", &response); // assert_eq!(expected_code, code, "{:?}", &response);
assert_eq!(response, expected_response); // assert_eq!(response, expected_response);
let (response, code) = server.patch_api_key("content", json!({})).await; // let (response, code) = server.patch_api_key("content", json!({})).await;
assert_eq!(expected_code, code, "{:?}", &response); // assert_eq!(expected_code, code, "{:?}", &response);
assert_eq!(response, expected_response); // assert_eq!(response, expected_response);
let (response, code) = server.get_api_key("content").await; // let (response, code) = server.get_api_key("content").await;
assert_eq!(expected_code, code, "{:?}", &response); // assert_eq!(expected_code, code, "{:?}", &response);
assert_eq!(response, expected_response); // assert_eq!(response, expected_response);
let (response, code) = server.list_api_keys().await; // let (response, code) = server.list_api_keys().await;
assert_eq!(expected_code, code, "{:?}", &response); // assert_eq!(expected_code, code, "{:?}", &response);
assert_eq!(response, expected_response); // assert_eq!(response, expected_response);
} }