mirror of
https://github.com/hanzoai/deploy.git
synced 2026-10-07 08:44:50 +00:00
zeekayandHanzo Dev
472238ddb0
House rule: /v1/ is the API prefix, everywhere, and /api/ is never added on top of it. The api.* subdomain names the API; a path prefix restating it is noise. This applies it to the whole route surface: /api/v1/* -> /v1/* 106 proto annotations, 109 gateway patterns /api/version -> /v1/version /api/badge -> /v1/badge /api/webhook -> /v1/webhook (server + applicationset controller) /api/dex/* -> /v1/dex/* (constants; dex is built, not deployed) The grpc-gateway .pb.gw.go files are generated, and the plugin toolchain is not on this machine, so they were rewritten by a script that applies exactly the transform codegen would: for /api/v1 paths, drop the leading "api" literal-push opcode pair and decrement every LitPush(2,N)/Capture(5,N) pool index; for /api/version, rename the segment. ConcatN(4,N) operands are counts, not pool indexes, and are untouched. The .proto annotations moved in the same commit, so the next real codegen run is a no-op against these files. MustPattern panics at package init on a malformed pattern, so every rewritten pattern is validated by any import of pkg/apiclient — those tests pass. Also moved: assets/swagger.json (82 paths), the UI's two roots (apiRoot() '/v1', version-service '/v1/version') and its two relative composers (app logs download, badge panel), the five audit-pattern regexes in server.go, and the tests that asserted the old paths. terminal_test's request URL claimed /api/v1/terminal, a route that never existed — the handler is mounted at /terminal; the fixture now says so. NOT touched, deliberately: /api/v3 in GitHub Enterprise base-url examples (GitHub's URL shape, not ours), util/vendored/kubeclientmetrics (parses the KUBERNETES API server's /api/v1 paths), and util/http's cookie-path fixture (arbitrary string exercising slash normalization). go build ./... clean. Pre-existing failures in badge/session/webhook/account tests reproduce identically on the parent commit (rebrand fallout — badge colors, cookie name length, dex issuer) and are not made worse here. External consumers checked: universe has zero references to cd.hanzo.ai/api; the CLI speaks gRPC, not the REST gateway; UI and server ship in one image so they move together. Co-authored-by: Hanzo Dev <[email protected]>
342 lines
9.2 KiB
Go
342 lines
9.2 KiB
Go
package application
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/hanzoai/cd/gitops-engine/pkg/utils/kube"
|
|
"github.com/stretchr/testify/assert"
|
|
corev1 "k8s.io/api/core/v1"
|
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
|
|
|
appv1 "github.com/hanzoai/cd/pkg/apis/application/v1alpha1"
|
|
"github.com/hanzoai/cd/util/cd"
|
|
"github.com/hanzoai/cd/util/security"
|
|
)
|
|
|
|
func TestPodExists(t *testing.T) {
|
|
for _, tcase := range []struct {
|
|
name string
|
|
podName string
|
|
namespace string
|
|
treeNodes []appv1.ResourceNode
|
|
expectedResult bool
|
|
}{
|
|
{
|
|
name: "empty tree nodes",
|
|
podName: "test-pod",
|
|
namespace: "test",
|
|
treeNodes: []appv1.ResourceNode{},
|
|
expectedResult: false,
|
|
},
|
|
{
|
|
name: "matched Pod but empty UID",
|
|
podName: "test-pod",
|
|
namespace: "test",
|
|
treeNodes: []appv1.ResourceNode{{ResourceRef: appv1.ResourceRef{Name: "test-pod", Namespace: "test", UID: "", Kind: kube.PodKind}}},
|
|
expectedResult: false,
|
|
},
|
|
{
|
|
name: "matched Pod",
|
|
podName: "test-pod",
|
|
namespace: "test",
|
|
treeNodes: []appv1.ResourceNode{{ResourceRef: appv1.ResourceRef{Name: "test-pod", Namespace: "test", UID: "testUID", Kind: kube.PodKind}}},
|
|
expectedResult: true,
|
|
},
|
|
{
|
|
name: "unmatched Pod Namespace",
|
|
podName: "test-pod",
|
|
namespace: "test",
|
|
treeNodes: []appv1.ResourceNode{{ResourceRef: appv1.ResourceRef{Name: "test-pod", Namespace: "test-A", UID: "testUID", Kind: kube.PodKind}}},
|
|
expectedResult: false,
|
|
},
|
|
{
|
|
name: "unmatched Kind",
|
|
podName: "test-pod",
|
|
namespace: "test",
|
|
treeNodes: []appv1.ResourceNode{{ResourceRef: appv1.ResourceRef{Name: "test-pod", Namespace: "test-A", UID: "testUID", Kind: kube.DeploymentKind}}},
|
|
expectedResult: false,
|
|
},
|
|
{
|
|
name: "unmatched Group",
|
|
podName: "test-pod",
|
|
namespace: "test",
|
|
treeNodes: []appv1.ResourceNode{{ResourceRef: appv1.ResourceRef{Name: "test-pod", Namespace: "test", UID: "testUID", Group: "A", Kind: kube.PodKind}}},
|
|
expectedResult: false,
|
|
},
|
|
{
|
|
name: "unmatched Pod Name",
|
|
podName: "test-pod",
|
|
namespace: "test",
|
|
treeNodes: []appv1.ResourceNode{{ResourceRef: appv1.ResourceRef{Name: "test", Namespace: "test", UID: "testUID", Kind: kube.PodKind}}},
|
|
expectedResult: false,
|
|
},
|
|
} {
|
|
t.Run(tcase.name, func(t *testing.T) {
|
|
result := podExists(tcase.treeNodes, tcase.podName, tcase.namespace)
|
|
assert.Equalf(t, tcase.expectedResult, result, "Expected result %v, but got %v", tcase.expectedResult, result)
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestContainerRunning(t *testing.T) {
|
|
for _, tcase := range []struct {
|
|
name string
|
|
pod *corev1.Pod
|
|
containerName string
|
|
expectedResult bool
|
|
}{
|
|
{
|
|
name: "empty container",
|
|
pod: &corev1.Pod{},
|
|
containerName: "",
|
|
expectedResult: false,
|
|
},
|
|
{
|
|
name: "container not found",
|
|
pod: &corev1.Pod{},
|
|
containerName: "not-found",
|
|
expectedResult: false,
|
|
},
|
|
{
|
|
name: "container running",
|
|
pod: &corev1.Pod{
|
|
Status: corev1.PodStatus{
|
|
ContainerStatuses: []corev1.ContainerStatus{
|
|
{
|
|
Name: "test",
|
|
State: corev1.ContainerState{
|
|
Running: &corev1.ContainerStateRunning{
|
|
StartedAt: metav1.NewTime(time.Now()),
|
|
},
|
|
},
|
|
},
|
|
},
|
|
},
|
|
},
|
|
containerName: "test",
|
|
expectedResult: true,
|
|
},
|
|
{
|
|
name: "init container running",
|
|
pod: &corev1.Pod{
|
|
Status: corev1.PodStatus{
|
|
ContainerStatuses: []corev1.ContainerStatus{
|
|
{
|
|
Name: "test",
|
|
State: corev1.ContainerState{
|
|
Running: &corev1.ContainerStateRunning{
|
|
StartedAt: metav1.NewTime(time.Now()),
|
|
},
|
|
},
|
|
},
|
|
},
|
|
InitContainerStatuses: []corev1.ContainerStatus{
|
|
{
|
|
Name: "test-init",
|
|
State: corev1.ContainerState{
|
|
Running: &corev1.ContainerStateRunning{
|
|
StartedAt: metav1.NewTime(time.Now()),
|
|
},
|
|
},
|
|
},
|
|
},
|
|
},
|
|
},
|
|
containerName: "test-init",
|
|
expectedResult: true,
|
|
},
|
|
{
|
|
name: "container not running",
|
|
pod: &corev1.Pod{
|
|
Status: corev1.PodStatus{
|
|
ContainerStatuses: []corev1.ContainerStatus{
|
|
{
|
|
Name: "test",
|
|
State: corev1.ContainerState{
|
|
Running: nil,
|
|
},
|
|
},
|
|
},
|
|
},
|
|
},
|
|
containerName: "test",
|
|
expectedResult: false,
|
|
},
|
|
{
|
|
name: "init container not running",
|
|
pod: &corev1.Pod{
|
|
Status: corev1.PodStatus{
|
|
InitContainerStatuses: []corev1.ContainerStatus{
|
|
{
|
|
Name: "test-init",
|
|
State: corev1.ContainerState{
|
|
Running: nil,
|
|
},
|
|
},
|
|
},
|
|
},
|
|
},
|
|
containerName: "test-init",
|
|
expectedResult: false,
|
|
},
|
|
} {
|
|
t.Run(tcase.name, func(t *testing.T) {
|
|
result := containerRunning(tcase.pod, tcase.containerName)
|
|
assert.Equalf(t, tcase.expectedResult, result, "Expected result %v, but got %v", tcase.expectedResult, result)
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestIsValidPodName(t *testing.T) {
|
|
for _, tcase := range []struct {
|
|
name string
|
|
resourceName string
|
|
expectedResult bool
|
|
}{
|
|
{
|
|
name: "valid pod name",
|
|
resourceName: "cd-server-794644486d-r8v9d",
|
|
expectedResult: true,
|
|
},
|
|
{
|
|
name: "not valid contains spaces",
|
|
resourceName: "kubectl delete pods",
|
|
expectedResult: false,
|
|
},
|
|
{
|
|
name: "not valid",
|
|
resourceName: "kubectl -n kube-system delete pods --all",
|
|
expectedResult: false,
|
|
},
|
|
{
|
|
name: "not valid contains special characters",
|
|
resourceName: "delete+*+from+etcd%3b",
|
|
expectedResult: false,
|
|
},
|
|
} {
|
|
t.Run(tcase.name, func(t *testing.T) {
|
|
result := cd.IsValidPodName(tcase.resourceName)
|
|
assert.Equalf(t, tcase.expectedResult, result, "Expected result %v, but got %v", tcase.expectedResult, result)
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestIsValidNamespaceName(t *testing.T) {
|
|
for _, tcase := range []struct {
|
|
name string
|
|
resourceName string
|
|
expectedResult bool
|
|
}{
|
|
{
|
|
name: "valid pod namespace name",
|
|
resourceName: "cd",
|
|
expectedResult: true,
|
|
},
|
|
{
|
|
name: "not valid contains spaces",
|
|
resourceName: "kubectl delete ns cd",
|
|
expectedResult: false,
|
|
},
|
|
{
|
|
name: "not valid contains special characters",
|
|
resourceName: "delete+*+from+etcd%3b",
|
|
expectedResult: false,
|
|
},
|
|
} {
|
|
t.Run(tcase.name, func(t *testing.T) {
|
|
result := cd.IsValidNamespaceName(tcase.resourceName)
|
|
assert.Equalf(t, tcase.expectedResult, result, "Expected result %v, but got %v", tcase.expectedResult, result)
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestIsValidContainerNameName(t *testing.T) {
|
|
for _, tcase := range []struct {
|
|
name string
|
|
resourceName string
|
|
expectedResult bool
|
|
}{
|
|
{
|
|
name: "valid container name",
|
|
resourceName: "cd-server",
|
|
expectedResult: true,
|
|
},
|
|
{
|
|
name: "not valid contains spaces",
|
|
resourceName: "kubectl delete pods",
|
|
expectedResult: false,
|
|
},
|
|
{
|
|
name: "not valid contains special characters",
|
|
resourceName: "delete+*+from+etcd%3b",
|
|
expectedResult: false,
|
|
},
|
|
} {
|
|
t.Run(tcase.name, func(t *testing.T) {
|
|
result := cd.IsValidContainerName(tcase.resourceName)
|
|
assert.Equalf(t, tcase.expectedResult, result, "Expected result %v, but got %v", tcase.expectedResult, result)
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestTerminalHandler_ServeHTTP_empty_params(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
testKeys := []string{
|
|
"pod",
|
|
"container",
|
|
"app",
|
|
"project",
|
|
"namespace",
|
|
}
|
|
|
|
// test both empty and invalid
|
|
testValues := []string{"", "invalid%20name"}
|
|
|
|
for _, testKey := range testKeys {
|
|
testKeyCopy := testKey
|
|
|
|
for _, testValue := range testValues {
|
|
testValueCopy := testValue
|
|
|
|
t.Run(testKeyCopy+" "+testValueCopy, func(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
handler := terminalHandler{}
|
|
params := map[string]string{
|
|
"pod": "valid",
|
|
"container": "valid",
|
|
"app": "valid",
|
|
"project": "valid",
|
|
"namespace": "valid",
|
|
}
|
|
params[testKeyCopy] = testValueCopy
|
|
var paramsArray []string
|
|
for key, value := range params {
|
|
paramsArray = append(paramsArray, key+"="+value)
|
|
}
|
|
paramsString := strings.Join(paramsArray, "&")
|
|
request := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "https://cd.example.com/terminal?"+paramsString, http.NoBody)
|
|
recorder := httptest.NewRecorder()
|
|
handler.ServeHTTP(recorder, request)
|
|
response := recorder.Result()
|
|
assert.Equal(t, http.StatusBadRequest, response.StatusCode)
|
|
})
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestTerminalHandler_ServeHTTP_disallowed_namespace(t *testing.T) {
|
|
handler := terminalHandler{namespace: "cd", enabledNamespaces: []string{"allowed"}}
|
|
request := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "https://cd.example.com/terminal?pod=valid&container=valid&appName=valid&projectName=valid&namespace=test&appNamespace=disallowed", http.NoBody)
|
|
recorder := httptest.NewRecorder()
|
|
handler.ServeHTTP(recorder, request)
|
|
response := recorder.Result()
|
|
assert.Equal(t, http.StatusForbidden, response.StatusCode)
|
|
assert.Equal(t, security.NamespaceNotPermittedError("disallowed").Error()+"\n", recorder.Body.String())
|
|
}
|