mirror of
https://github.com/trustgraph-ai/trustgraph.git
synced 2026-05-19 12:25:13 +02:00
da7d10e995
Adds `no-auth-svc`, a lightweight IAM service that permits all access unconditionally — no database, no bootstrap, no signing keys. Deploy it in place of `iam-svc` for development, demos, and single-user setups where authentication overhead is unwanted. The gateway no longer hard-codes a 401 on missing credentials. Instead it asks the IAM regime via a new `authenticate-anonymous` operation whether token-free access is allowed. This keeps the gateway regime-agnostic: `iam-svc` rejects anonymous auth (preserving existing security), while `no-auth-svc` grants it with a configurable default user and workspace. Includes a tech spec (docs/tech-specs/no-auth-regime.md) and tests that pin the safety boundary — malformed tokens never fall through to the anonymous path, and a contract test ensures the full iam-svc always rejects `authenticate-anonymous`.
580 lines
20 KiB
Python
580 lines
20 KiB
Python
"""
|
|
Tests for gateway/auth.py — IamAuth, JWT verification, API key
|
|
resolution cache.
|
|
|
|
JWTs are signed with real Ed25519 keypairs generated per-test, so
|
|
the crypto path is exercised end-to-end without mocks. API-key
|
|
resolution is tested against a stubbed IamClient since the real
|
|
one requires pub/sub.
|
|
"""
|
|
|
|
import base64
|
|
import json
|
|
import time
|
|
from unittest.mock import AsyncMock, Mock, patch
|
|
|
|
import pytest
|
|
from aiohttp import web
|
|
from cryptography.hazmat.primitives import serialization
|
|
from cryptography.hazmat.primitives.asymmetric import ed25519
|
|
|
|
from trustgraph.gateway.auth import (
|
|
IamAuth, Identity,
|
|
_b64url_decode, _verify_jwt_eddsa,
|
|
API_KEY_CACHE_TTL,
|
|
)
|
|
|
|
|
|
# -- helpers ---------------------------------------------------------------
|
|
|
|
|
|
def _b64url(data: bytes) -> str:
|
|
return base64.urlsafe_b64encode(data).rstrip(b"=").decode("ascii")
|
|
|
|
|
|
def make_keypair():
|
|
priv = ed25519.Ed25519PrivateKey.generate()
|
|
public_pem = priv.public_key().public_bytes(
|
|
encoding=serialization.Encoding.PEM,
|
|
format=serialization.PublicFormat.SubjectPublicKeyInfo,
|
|
).decode("ascii")
|
|
return priv, public_pem
|
|
|
|
|
|
def sign_jwt(priv, claims, alg="EdDSA"):
|
|
header = {"alg": alg, "typ": "JWT", "kid": "kid-test"}
|
|
h = _b64url(json.dumps(header, separators=(",", ":"), sort_keys=True).encode())
|
|
p = _b64url(json.dumps(claims, separators=(",", ":"), sort_keys=True).encode())
|
|
signing_input = f"{h}.{p}".encode("ascii")
|
|
if alg == "EdDSA":
|
|
sig = priv.sign(signing_input)
|
|
else:
|
|
raise ValueError(f"test helper doesn't sign {alg}")
|
|
return f"{h}.{p}.{_b64url(sig)}"
|
|
|
|
|
|
def make_request(auth_header):
|
|
"""Minimal stand-in for an aiohttp request — IamAuth only reads
|
|
``request.headers["Authorization"]``."""
|
|
req = Mock()
|
|
req.headers = {}
|
|
if auth_header is not None:
|
|
req.headers["Authorization"] = auth_header
|
|
return req
|
|
|
|
|
|
# -- pure helpers ----------------------------------------------------------
|
|
|
|
|
|
class TestB64UrlDecode:
|
|
|
|
def test_round_trip_without_padding(self):
|
|
data = b"hello"
|
|
encoded = _b64url(data)
|
|
assert _b64url_decode(encoded) == data
|
|
|
|
def test_handles_various_lengths(self):
|
|
for s in (b"a", b"ab", b"abc", b"abcd", b"abcde"):
|
|
assert _b64url_decode(_b64url(s)) == s
|
|
|
|
|
|
# -- JWT verification -----------------------------------------------------
|
|
|
|
|
|
class TestVerifyJwtEddsa:
|
|
|
|
def test_valid_jwt_passes(self):
|
|
priv, pub = make_keypair()
|
|
claims = {
|
|
"sub": "user-1", "workspace": "default",
|
|
"iat": int(time.time()),
|
|
"exp": int(time.time()) + 60,
|
|
}
|
|
token = sign_jwt(priv, claims)
|
|
got = _verify_jwt_eddsa(token, pub)
|
|
assert got["sub"] == "user-1"
|
|
assert got["workspace"] == "default"
|
|
|
|
def test_expired_jwt_rejected(self):
|
|
priv, pub = make_keypair()
|
|
claims = {
|
|
"sub": "user-1", "workspace": "default",
|
|
"iat": int(time.time()) - 3600,
|
|
"exp": int(time.time()) - 1,
|
|
}
|
|
token = sign_jwt(priv, claims)
|
|
with pytest.raises(ValueError, match="expired"):
|
|
_verify_jwt_eddsa(token, pub)
|
|
|
|
def test_bad_signature_rejected(self):
|
|
priv_a, _ = make_keypair()
|
|
_, pub_b = make_keypair()
|
|
claims = {
|
|
"sub": "user-1", "workspace": "default",
|
|
"iat": int(time.time()),
|
|
"exp": int(time.time()) + 60,
|
|
}
|
|
token = sign_jwt(priv_a, claims)
|
|
# pub_b never signed this token.
|
|
with pytest.raises(Exception):
|
|
_verify_jwt_eddsa(token, pub_b)
|
|
|
|
def test_malformed_jwt_rejected(self):
|
|
_, pub = make_keypair()
|
|
with pytest.raises(ValueError, match="malformed"):
|
|
_verify_jwt_eddsa("not-a-jwt", pub)
|
|
|
|
def test_unsupported_algorithm_rejected(self):
|
|
priv, pub = make_keypair()
|
|
# Manually build an "alg":"HS256" header — no signer needed
|
|
# since we expect it to bail before verifying.
|
|
header = {"alg": "HS256", "typ": "JWT", "kid": "x"}
|
|
payload = {
|
|
"sub": "user-1", "workspace": "default",
|
|
"iat": int(time.time()), "exp": int(time.time()) + 60,
|
|
}
|
|
h = _b64url(json.dumps(header, separators=(",", ":")).encode())
|
|
p = _b64url(json.dumps(payload, separators=(",", ":")).encode())
|
|
sig = _b64url(b"not-a-real-sig")
|
|
token = f"{h}.{p}.{sig}"
|
|
with pytest.raises(ValueError, match="unsupported alg"):
|
|
_verify_jwt_eddsa(token, pub)
|
|
|
|
|
|
# -- Identity --------------------------------------------------------------
|
|
|
|
|
|
class TestIdentity:
|
|
|
|
def test_fields(self):
|
|
i = Identity(
|
|
handle="u", workspace="w",
|
|
principal_id="u", source="api-key",
|
|
)
|
|
assert i.handle == "u"
|
|
assert i.workspace == "w"
|
|
assert i.principal_id == "u"
|
|
assert i.source == "api-key"
|
|
|
|
|
|
# -- IamAuth.authenticate --------------------------------------------------
|
|
|
|
|
|
class TestIamAuthDispatch:
|
|
"""``authenticate()`` chooses between the JWT and API-key paths
|
|
by shape of the bearer."""
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_no_authorization_header_tries_anonymous(self):
|
|
auth = IamAuth(backend=Mock())
|
|
|
|
async def fake_with_client(op):
|
|
raise RuntimeError("auth-failed: anonymous access not permitted")
|
|
|
|
with patch.object(auth, "_with_client", side_effect=fake_with_client):
|
|
with pytest.raises(web.HTTPUnauthorized):
|
|
await auth.authenticate(make_request(None))
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_non_bearer_header_tries_anonymous(self):
|
|
auth = IamAuth(backend=Mock())
|
|
|
|
async def fake_with_client(op):
|
|
raise RuntimeError("auth-failed: anonymous access not permitted")
|
|
|
|
with patch.object(auth, "_with_client", side_effect=fake_with_client):
|
|
with pytest.raises(web.HTTPUnauthorized):
|
|
await auth.authenticate(make_request("Basic whatever"))
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_empty_bearer_tries_anonymous(self):
|
|
auth = IamAuth(backend=Mock())
|
|
|
|
async def fake_with_client(op):
|
|
raise RuntimeError("auth-failed: anonymous access not permitted")
|
|
|
|
with patch.object(auth, "_with_client", side_effect=fake_with_client):
|
|
with pytest.raises(web.HTTPUnauthorized):
|
|
await auth.authenticate(make_request("Bearer "))
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_unknown_format_raises_401(self):
|
|
# Not tg_... and not dotted-JWT shape.
|
|
auth = IamAuth(backend=Mock())
|
|
with pytest.raises(web.HTTPUnauthorized):
|
|
await auth.authenticate(make_request("Bearer garbage"))
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_valid_jwt_resolves_to_identity(self):
|
|
priv, pub = make_keypair()
|
|
claims = {
|
|
"sub": "user-1", "workspace": "default",
|
|
"iat": int(time.time()),
|
|
"exp": int(time.time()) + 60,
|
|
}
|
|
token = sign_jwt(priv, claims)
|
|
|
|
auth = IamAuth(backend=Mock())
|
|
auth._signing_public_pem = pub
|
|
|
|
ident = await auth.authenticate(
|
|
make_request(f"Bearer {token}")
|
|
)
|
|
assert ident.handle == "user-1"
|
|
assert ident.workspace == "default"
|
|
assert ident.principal_id == "user-1"
|
|
assert ident.source == "jwt"
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_jwt_without_public_key_fails(self):
|
|
# If the gateway hasn't fetched IAM's public key yet, JWTs
|
|
# must not validate — even ones that would otherwise pass.
|
|
priv, _ = make_keypair()
|
|
claims = {
|
|
"sub": "user-1", "workspace": "default",
|
|
"iat": int(time.time()), "exp": int(time.time()) + 60,
|
|
}
|
|
token = sign_jwt(priv, claims)
|
|
auth = IamAuth(backend=Mock())
|
|
# _signing_public_pem defaults to None
|
|
with pytest.raises(web.HTTPUnauthorized):
|
|
await auth.authenticate(make_request(f"Bearer {token}"))
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_api_key_path(self):
|
|
auth = IamAuth(backend=Mock())
|
|
|
|
async def fake_resolve(api_key):
|
|
assert api_key == "tg_testkey"
|
|
# Roles are returned by the regime as a hint but the
|
|
# gateway ignores them — kept here so the resolve
|
|
# protocol shape is exercised.
|
|
return ("user-xyz", "default", ["admin"])
|
|
|
|
async def fake_with_client(op):
|
|
return await op(Mock(resolve_api_key=fake_resolve))
|
|
|
|
with patch.object(auth, "_with_client", side_effect=fake_with_client):
|
|
ident = await auth.authenticate(
|
|
make_request("Bearer tg_testkey")
|
|
)
|
|
assert ident.handle == "user-xyz"
|
|
assert ident.workspace == "default"
|
|
assert ident.principal_id == "user-xyz"
|
|
assert ident.source == "api-key"
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_api_key_rejection_masked_as_401(self):
|
|
auth = IamAuth(backend=Mock())
|
|
|
|
async def fake_with_client(op):
|
|
raise RuntimeError("auth-failed: unknown api key")
|
|
|
|
with patch.object(auth, "_with_client", side_effect=fake_with_client):
|
|
with pytest.raises(web.HTTPUnauthorized):
|
|
await auth.authenticate(
|
|
make_request("Bearer tg_bogus")
|
|
)
|
|
|
|
|
|
# -- API key cache ---------------------------------------------------------
|
|
|
|
|
|
class TestApiKeyCache:
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_cache_hit_skips_iam(self):
|
|
auth = IamAuth(backend=Mock())
|
|
calls = {"n": 0}
|
|
|
|
async def fake_with_client(op):
|
|
calls["n"] += 1
|
|
return await op(Mock(
|
|
resolve_api_key=AsyncMock(
|
|
return_value=("u", "default", ["reader"]),
|
|
)
|
|
))
|
|
|
|
with patch.object(auth, "_with_client", side_effect=fake_with_client):
|
|
await auth.authenticate(make_request("Bearer tg_k1"))
|
|
await auth.authenticate(make_request("Bearer tg_k1"))
|
|
await auth.authenticate(make_request("Bearer tg_k1"))
|
|
|
|
# Only the first lookup reaches IAM; the rest are cache hits.
|
|
assert calls["n"] == 1
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_different_keys_are_separately_cached(self):
|
|
auth = IamAuth(backend=Mock())
|
|
seen = []
|
|
|
|
async def fake_with_client(op):
|
|
async def resolve(plaintext):
|
|
seen.append(plaintext)
|
|
return ("u-" + plaintext, "default", ["reader"])
|
|
return await op(Mock(resolve_api_key=resolve))
|
|
|
|
with patch.object(auth, "_with_client", side_effect=fake_with_client):
|
|
a = await auth.authenticate(make_request("Bearer tg_a"))
|
|
b = await auth.authenticate(make_request("Bearer tg_b"))
|
|
|
|
assert a.handle == "u-tg_a"
|
|
assert b.handle == "u-tg_b"
|
|
assert seen == ["tg_a", "tg_b"]
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_cache_has_ttl_constant_set(self):
|
|
# Not a behaviour test — just ensures we don't accidentally
|
|
# set TTL to 0 (which would defeat the cache) or to a week.
|
|
assert 10 <= API_KEY_CACHE_TTL <= 3600
|
|
|
|
|
|
# -- IamAuth.authorise -----------------------------------------------------
|
|
|
|
|
|
class TestAuthorise:
|
|
"""``authorise()`` is the gateway's only authorisation entry
|
|
point under the IAM contract. It calls iam-svc, caches the
|
|
decision for the regime's TTL (clamped above), and raises 403
|
|
on deny / 401 on regime error (fail closed)."""
|
|
|
|
def _make_identity(self, handle="u-1", workspace="default"):
|
|
return Identity(
|
|
handle=handle, workspace=workspace,
|
|
principal_id=handle, source="api-key",
|
|
)
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_allow_returns_no_exception(self):
|
|
auth = IamAuth(backend=Mock())
|
|
|
|
async def fake_with_client(op):
|
|
return await op(Mock(
|
|
authorise=AsyncMock(return_value=(True, 30)),
|
|
))
|
|
|
|
with patch.object(auth, "_with_client", side_effect=fake_with_client):
|
|
await auth.authorise(
|
|
self._make_identity(),
|
|
"graph:read",
|
|
{"workspace": "default"},
|
|
{},
|
|
)
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_deny_raises_403(self):
|
|
auth = IamAuth(backend=Mock())
|
|
|
|
async def fake_with_client(op):
|
|
return await op(Mock(
|
|
authorise=AsyncMock(return_value=(False, 30)),
|
|
))
|
|
|
|
with patch.object(auth, "_with_client", side_effect=fake_with_client):
|
|
with pytest.raises(web.HTTPForbidden):
|
|
await auth.authorise(
|
|
self._make_identity(),
|
|
"users:admin",
|
|
{},
|
|
{"workspace": "acme"},
|
|
)
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_regime_error_fails_closed_as_401(self):
|
|
# If iam-svc errors, the gateway must NOT silently allow.
|
|
auth = IamAuth(backend=Mock())
|
|
|
|
async def fake_with_client(op):
|
|
raise RuntimeError("iam-svc down")
|
|
|
|
with patch.object(auth, "_with_client", side_effect=fake_with_client):
|
|
with pytest.raises(web.HTTPUnauthorized):
|
|
await auth.authorise(
|
|
self._make_identity(),
|
|
"graph:read",
|
|
{"workspace": "default"},
|
|
{},
|
|
)
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_allow_decision_is_cached(self):
|
|
auth = IamAuth(backend=Mock())
|
|
calls = {"n": 0}
|
|
|
|
async def fake_with_client(op):
|
|
calls["n"] += 1
|
|
return await op(Mock(
|
|
authorise=AsyncMock(return_value=(True, 30)),
|
|
))
|
|
|
|
with patch.object(auth, "_with_client", side_effect=fake_with_client):
|
|
ident = self._make_identity()
|
|
for _ in range(5):
|
|
await auth.authorise(
|
|
ident, "graph:read", {"workspace": "default"}, {},
|
|
)
|
|
|
|
assert calls["n"] == 1
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_deny_decision_is_cached(self):
|
|
auth = IamAuth(backend=Mock())
|
|
calls = {"n": 0}
|
|
|
|
async def fake_with_client(op):
|
|
calls["n"] += 1
|
|
return await op(Mock(
|
|
authorise=AsyncMock(return_value=(False, 30)),
|
|
))
|
|
|
|
with patch.object(auth, "_with_client", side_effect=fake_with_client):
|
|
ident = self._make_identity()
|
|
for _ in range(5):
|
|
with pytest.raises(web.HTTPForbidden):
|
|
await auth.authorise(
|
|
ident, "users:admin", {}, {"workspace": "acme"},
|
|
)
|
|
|
|
# Denies are cached too — repeated attempts don't re-hit IAM.
|
|
assert calls["n"] == 1
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_different_resources_cached_separately(self):
|
|
auth = IamAuth(backend=Mock())
|
|
calls = {"n": 0}
|
|
|
|
async def fake_with_client(op):
|
|
calls["n"] += 1
|
|
return await op(Mock(
|
|
authorise=AsyncMock(return_value=(True, 30)),
|
|
))
|
|
|
|
with patch.object(auth, "_with_client", side_effect=fake_with_client):
|
|
ident = self._make_identity()
|
|
await auth.authorise(
|
|
ident, "graph:read", {"workspace": "a"}, {},
|
|
)
|
|
await auth.authorise(
|
|
ident, "graph:read", {"workspace": "b"}, {},
|
|
)
|
|
|
|
# Different resource → different cache key → two IAM calls.
|
|
assert calls["n"] == 2
|
|
|
|
|
|
# -- Anonymous authentication boundary ------------------------------------
|
|
|
|
|
|
class TestAnonymousAuthBoundary:
|
|
"""The gateway must only attempt anonymous auth when no credential
|
|
is presented. A malformed token must NOT fall through to the
|
|
anonymous path — that would let an attacker bypass a broken token
|
|
by simply sending garbage."""
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_no_header_attempts_anonymous(self):
|
|
auth = IamAuth(backend=Mock())
|
|
|
|
async def fake_with_client(op):
|
|
return await op(Mock(
|
|
authenticate_anonymous=AsyncMock(
|
|
return_value=("anon", "default", ["reader"]),
|
|
)
|
|
))
|
|
|
|
with patch.object(auth, "_with_client", side_effect=fake_with_client):
|
|
ident = await auth.authenticate(make_request(None))
|
|
assert ident.handle == "anon"
|
|
assert ident.source == "anonymous"
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_empty_bearer_attempts_anonymous(self):
|
|
auth = IamAuth(backend=Mock())
|
|
|
|
async def fake_with_client(op):
|
|
return await op(Mock(
|
|
authenticate_anonymous=AsyncMock(
|
|
return_value=("anon", "default", ["reader"]),
|
|
)
|
|
))
|
|
|
|
with patch.object(auth, "_with_client", side_effect=fake_with_client):
|
|
ident = await auth.authenticate(make_request("Bearer "))
|
|
assert ident.handle == "anon"
|
|
assert ident.source == "anonymous"
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_malformed_token_does_not_fall_through_to_anonymous(self):
|
|
auth = IamAuth(backend=Mock())
|
|
called = {"anonymous": False}
|
|
|
|
original = auth._authenticate_anonymous
|
|
|
|
async def spy_anonymous():
|
|
called["anonymous"] = True
|
|
return await original()
|
|
|
|
auth._authenticate_anonymous = spy_anonymous
|
|
|
|
with pytest.raises(web.HTTPUnauthorized):
|
|
await auth.authenticate(make_request("Bearer garbage"))
|
|
assert not called["anonymous"]
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_bad_api_key_does_not_fall_through_to_anonymous(self):
|
|
auth = IamAuth(backend=Mock())
|
|
called = {"anonymous": False}
|
|
|
|
async def spy_anonymous():
|
|
called["anonymous"] = True
|
|
|
|
auth._authenticate_anonymous = spy_anonymous
|
|
|
|
async def fake_with_client(op):
|
|
raise RuntimeError("auth-failed: unknown key")
|
|
|
|
with patch.object(auth, "_with_client", side_effect=fake_with_client):
|
|
with pytest.raises(web.HTTPUnauthorized):
|
|
await auth.authenticate(make_request("Bearer tg_bad"))
|
|
assert not called["anonymous"]
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_bad_jwt_does_not_fall_through_to_anonymous(self):
|
|
auth = IamAuth(backend=Mock())
|
|
auth._signing_public_pem = "not-a-real-pem"
|
|
called = {"anonymous": False}
|
|
|
|
async def spy_anonymous():
|
|
called["anonymous"] = True
|
|
|
|
auth._authenticate_anonymous = spy_anonymous
|
|
|
|
with pytest.raises(web.HTTPUnauthorized):
|
|
await auth.authenticate(make_request("Bearer a.b.c"))
|
|
assert not called["anonymous"]
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_anonymous_rejected_by_iam_raises_401(self):
|
|
auth = IamAuth(backend=Mock())
|
|
|
|
async def fake_with_client(op):
|
|
raise RuntimeError("auth-failed: anonymous access not permitted")
|
|
|
|
with patch.object(auth, "_with_client", side_effect=fake_with_client):
|
|
with pytest.raises(web.HTTPUnauthorized):
|
|
await auth.authenticate(make_request(None))
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_anonymous_with_empty_user_id_raises_401(self):
|
|
auth = IamAuth(backend=Mock())
|
|
|
|
async def fake_with_client(op):
|
|
return await op(Mock(
|
|
authenticate_anonymous=AsyncMock(
|
|
return_value=("", "default", []),
|
|
)
|
|
))
|
|
|
|
with patch.object(auth, "_with_client", side_effect=fake_with_client):
|
|
with pytest.raises(web.HTTPUnauthorized):
|
|
await auth.authenticate(make_request(None))
|