9285223207

Committed 29 May 2024 11:24AM UTC coverage: 81.342% (+0.1%) from 81.193%

Build # 9285223207

Build Type

push

github

Committed by

web-flow

Commit Message

Fix running tests with tox-docker 5.0.0 (#171)

Run Details

343 of 456 branches covered (75.22%)

Branch coverage included in aggregate %.

1 of 1 new or added line in 1 file covered. (100.0%)

8 existing lines in 2 files now uncovered.

1087 of 1302 relevant lines covered (83.49%)

0.83 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

90.28

/resultsdb/authorization.py

# SPDX-License-Identifier: GPL-2.0+
import logging
from fnmatch import fnmatch

from werkzeug.exceptions import BadGateway, Forbidden, InternalServerError

log = logging.getLogger(__name__)


def get_group_membership(ldap, user, con, ldap_search):
    try:
        results = con.search_s(
            ldap_search["BASE"],
            ldap.SCOPE_SUBTREE,
            ldap_search.get("SEARCH_STRING", "(memberUid={user})").format(user=user),
            ["cn"],
        )
        return [group[1]["cn"][0].decode("utf-8") for group in results]
    except KeyError:
        log.exception("LDAP_SEARCHES parameter should contain the BASE key")
        raise InternalServerError("LDAP_SEARCHES parameter should contain the BASE key")
    except ldap.SERVER_DOWN:
        log.exception("The LDAP server is not reachable")
        raise BadGateway("The LDAP server is not reachable")
    except ldap.LDAPError:
        log.exception("Some error occurred initializing the LDAP connection")
        raise BadGateway("Some error occurred initializing the LDAP connection")


def match_testcase_permissions(testcase, permissions):
    for permission in permissions:
        if "testcases" in permission:
            testcase_match = any(
                fnmatch(testcase, testcase_pattern)
                for testcase_pattern in permission["testcases"]
            )
            if testcase_match:
                yield permission


def verify_authorization(user, testcase, permissions, ldap_host, ldap_searches):
    """
    Raises an exception if the user is not permitted to publish a result for
    the testcase.
    """
    if not (ldap_host and ldap_searches):
        raise InternalServerError(
            "LDAP_HOST and LDAP_SEARCHES also need to be defined if PERMISSIONS is defined"
        )

    allowed_groups = []
    for permission in match_testcase_permissions(testcase, permissions):
        if user in permission.get("users", []):
            return
        allowed_groups += permission.get("groups", [])

    try:
        import ldap
    except ImportError:
        raise InternalServerError(
            "If PERMISSIONS is defined, python-ldap needs to be installed"
        )

    try:
        con = ldap.initialize(ldap_host)
    except ldap.LDAPError:
        log.exception("Some error occurred initializing the LDAP connection")
        raise BadGateway("Some error occurred initializing the LDAP connection")

    any_groups_found = False
    for cur_ldap_search in ldap_searches:
        groups = get_group_membership(ldap, user, con, cur_ldap_search)
        if any(g in groups for g in allowed_groups):
            return
        any_groups_found = any_groups_found or len(groups) > 0

    raise Forbidden(
        f"User {user} is not authorized to submit results for the test case {testcase}"
        + ("" if any_groups_found else "; failed to find the user in LDAP")
    )

1	# SPDX-License-Identifier: GPL-2.0+
2	import logging	1✔
3	from fnmatch import fnmatch	1✔
4
5	from werkzeug.exceptions import BadGateway, Forbidden, InternalServerError	1✔
6
7	log = logging.getLogger(__name__)	1✔
8
9
10	def get_group_membership(ldap, user, con, ldap_search):	1✔
11	try:	1✔
12	results = con.search_s(	1✔
13	ldap_search["BASE"],
14	ldap.SCOPE_SUBTREE,
15	ldap_search.get("SEARCH_STRING", "(memberUid={user})").format(user=user),
16	["cn"],
17	)
18	return [group[1]["cn"][0].decode("utf-8") for group in results]	1!
19	except KeyError:	1✔
20	log.exception("LDAP_SEARCHES parameter should contain the BASE key")	1✔
21	raise InternalServerError("LDAP_SEARCHES parameter should contain the BASE key")	1✔
22	except ldap.SERVER_DOWN:	1✔
23	log.exception("The LDAP server is not reachable")	1✔
24	raise BadGateway("The LDAP server is not reachable")	1✔
25	except ldap.LDAPError:	1✔
26	log.exception("Some error occurred initializing the LDAP connection")	1✔
27	raise BadGateway("Some error occurred initializing the LDAP connection")	1✔
28
29
30	def match_testcase_permissions(testcase, permissions):	1✔
31	for permission in permissions:	1✔
32	if "testcases" in permission:	1!
33	testcase_match = any(	1✔
34	fnmatch(testcase, testcase_pattern)
35	for testcase_pattern in permission["testcases"]
36	)
37	if testcase_match:	1✔
38	yield permission	1✔
39
40
41	def verify_authorization(user, testcase, permissions, ldap_host, ldap_searches):	1✔
42	"""
43	Raises an exception if the user is not permitted to publish a result for
44	the testcase.
45	"""
46	if not (ldap_host and ldap_searches):	1✔
47	raise InternalServerError(	1✔
48	"LDAP_HOST and LDAP_SEARCHES also need to be defined if PERMISSIONS is defined"
49	)
50
51	allowed_groups = []	1✔
52	for permission in match_testcase_permissions(testcase, permissions):	1✔
53	if user in permission.get("users", []):	1✔
54	return	1✔
55	allowed_groups += permission.get("groups", [])	1✔
56
57	try:	1✔
58	import ldap	1✔
UNCOV 59	except ImportError:	×
UNCOV 60	raise InternalServerError(	×
61	"If PERMISSIONS is defined, python-ldap needs to be installed"
62	)
63
64	try:	1✔
65	con = ldap.initialize(ldap_host)	1✔
UNCOV 66	except ldap.LDAPError:	×
UNCOV 67	log.exception("Some error occurred initializing the LDAP connection")	×
UNCOV 68	raise BadGateway("Some error occurred initializing the LDAP connection")	×
69
70	any_groups_found = False	1✔
71	for cur_ldap_search in ldap_searches:	1✔
72	groups = get_group_membership(ldap, user, con, cur_ldap_search)	1✔
73	if any(g in groups for g in allowed_groups):	1✔
74	return	1✔
75	any_groups_found = any_groups_found or len(groups) > 0	1✔
76
77	raise Forbidden(	1✔
78	f"User {user} is not authorized to submit results for the test case {testcase}"
79	+ ("" if any_groups_found else "; failed to find the user in LDAP")
80	)

release-engineering / resultsdb / 9285223207

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous