-
-
Notifications
You must be signed in to change notification settings - Fork 730
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
fix: Allow AuthType None to use valid API tokens (#6247)
Fixes ##5799 and #5785 When you do not provide a token we should resolve to the "default" environment to maintain backward compatibility. If you actually provide a token we should prefer that and even block the request if it is not valid. An interesting fact is that "default" environment is not available on a fresh installation of Unleash. This means that you need to provide a token to actually get access to toggle configurations. --------- Co-authored-by: Thomas Heartman <[email protected]>
- Loading branch information
1 parent
e5fe4a7
commit 4a81f09
Showing
7 changed files
with
216 additions
and
27 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,135 @@ | ||
| import { | ||
| IUnleashTest, | ||
| setupAppWithCustomConfig, | ||
| } from '../../helpers/test-helper'; | ||
| import dbInit, { ITestDb } from '../../helpers/database-init'; | ||
| import getLogger from '../../../fixtures/no-logger'; | ||
| import { DEFAULT_ENV } from '../../../../lib/util/constants'; | ||
| import User from '../../../../lib/types/user'; | ||
| import { ApiTokenType } from '../../../../lib/types/models/api-token'; | ||
|
|
||
| let app: IUnleashTest; | ||
| let db: ITestDb; | ||
| const testUser = { name: 'test', id: -9999 } as User; | ||
| let clientSecret: string; | ||
| let frontendSecret: string; | ||
|
|
||
| beforeAll(async () => { | ||
| db = await dbInit('feature_api_client_auth_none', getLogger); | ||
| app = await setupAppWithCustomConfig( | ||
| db.stores, | ||
| { | ||
| authentication: { | ||
| type: 'none', | ||
| }, | ||
| experimental: { | ||
| flags: { | ||
| strictSchemaValidation: true, | ||
| }, | ||
| }, | ||
| }, | ||
| db.rawDatabase, | ||
| ); | ||
| await app.services.featureToggleService.createFeatureToggle( | ||
| 'default', | ||
| { | ||
| name: 'feature_1', | ||
| description: 'the #1 feature', | ||
| impressionData: true, | ||
| }, | ||
| 'test', | ||
| testUser.id, | ||
| ); | ||
| await app.services.featureToggleService.createFeatureToggle( | ||
| 'default', | ||
| { | ||
| name: 'feature_2', | ||
| description: 'soon to be the #1 feature', | ||
| }, | ||
| 'test', | ||
| testUser.id, | ||
| ); | ||
|
|
||
| await app.services.featureToggleService.createFeatureToggle( | ||
| 'default', | ||
| { | ||
| name: 'feature_3', | ||
| description: 'terrible feature', | ||
| }, | ||
| 'test', | ||
| testUser.id, | ||
| ); | ||
|
|
||
| const token = await app.services.apiTokenService.createApiTokenWithProjects( | ||
| { | ||
| tokenName: 'test', | ||
| type: ApiTokenType.CLIENT, | ||
| environment: DEFAULT_ENV, | ||
| projects: ['default'], | ||
| }, | ||
| ); | ||
| clientSecret = token.secret; | ||
|
|
||
| const frontendToken = | ||
| await app.services.apiTokenService.createApiTokenWithProjects({ | ||
| tokenName: 'test', | ||
| type: ApiTokenType.FRONTEND, | ||
| environment: DEFAULT_ENV, | ||
| projects: ['default'], | ||
| }); | ||
| frontendSecret = frontendToken.secret; | ||
| }); | ||
|
|
||
| afterAll(async () => { | ||
| await app.destroy(); | ||
| await db.destroy(); | ||
| }); | ||
|
|
||
| test('returns three feature toggles', async () => { | ||
| return app.request | ||
| .get('/api/client/features') | ||
| .expect('Content-Type', /json/) | ||
| .expect(200) | ||
| .expect((res) => { | ||
| expect(res.body.features).toHaveLength(3); | ||
| }); | ||
| }); | ||
|
|
||
| test('returns 401 for incorrect api token', async () => { | ||
| return app.request | ||
| .get('/api/client/features') | ||
| .set('Authorization', 'some-invalid-token') | ||
| .expect('Content-Type', /json/) | ||
| .expect(401); | ||
| }); | ||
|
|
||
| test('returns success for correct api token', async () => { | ||
| return app.request | ||
| .get('/api/client/features') | ||
| .set('Authorization', clientSecret) | ||
| .expect('Content-Type', /json/) | ||
| .expect(200); | ||
| }); | ||
|
|
||
| test('returns successful for frontend API without token', async () => { | ||
| return app.request | ||
| .get('/api/frontend') | ||
| .expect('Content-Type', /json/) | ||
| .expect(200); | ||
| }); | ||
|
|
||
| test('returns 401 for frontend API with invalid token', async () => { | ||
| return app.request | ||
| .get('/api/frontend') | ||
| .expect('Content-Type', /json/) | ||
| .set('Authorization', 'some-invalid-token') | ||
| .expect(401); | ||
| }); | ||
|
|
||
| test('returns 200 for frontend API with valid token', async () => { | ||
| return app.request | ||
| .get('/api/frontend') | ||
| .expect('Content-Type', /json/) | ||
| .set('Authorization', frontendSecret) | ||
| .expect(200); | ||
| }); |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters