mirror of
https://github.com/google/nomulus.git
synced 2025-07-25 12:08:36 +02:00
Remove the ability to download service account credentials
------------- Created by MOE: https://github.com/google/moe MOE_MIGRATED_REVID=224034254
This commit is contained in:
jianglai
parent
879c48b079
commit
aeedc427ad
12 changed files with 32 additions and 278 deletions
|
|
@ -16,10 +16,8 @@ package google.registry.keyring.kms;
|
|||
|
||||
import static com.google.common.truth.Truth.assertThat;
|
||||
import static google.registry.testing.DatastoreHelper.persistResources;
|
||||
import static java.nio.charset.StandardCharsets.UTF_8;
|
||||
|
||||
import com.google.common.collect.ImmutableList;
|
||||
import com.google.common.io.BaseEncoding;
|
||||
import google.registry.keyring.api.KeySerializer;
|
||||
import google.registry.model.server.KmsSecret;
|
||||
import google.registry.model.server.KmsSecretRevision;
|
||||
|
|
@ -29,7 +27,6 @@ import google.registry.testing.BouncyCastleProviderRule;
|
|||
import org.bouncycastle.openpgp.PGPKeyPair;
|
||||
import org.bouncycastle.openpgp.PGPPrivateKey;
|
||||
import org.bouncycastle.openpgp.PGPPublicKey;
|
||||
import org.bouncycastle.util.Arrays;
|
||||
import org.junit.Before;
|
||||
import org.junit.Rule;
|
||||
import org.junit.Test;
|
||||
|
|
@ -177,30 +174,6 @@ public class KmsKeyringTest {
|
|||
assertThat(jsonCredential).isEqualTo("json-credential-stringmoo");
|
||||
}
|
||||
|
||||
@Test
|
||||
public void test_getEncryptedJsonCredential() {
|
||||
saveCleartextSecret("json-credential-string");
|
||||
|
||||
String encryptedJsonCredential = keyring.getEncryptedData("json-credential-string");
|
||||
|
||||
assertThat(
|
||||
new String(
|
||||
Arrays.reverse(BaseEncoding.base64().decode(encryptedJsonCredential)), UTF_8))
|
||||
.isEqualTo("json-credential-stringmoo");
|
||||
}
|
||||
|
||||
@Test
|
||||
public void test_decryptJsonCredential() {
|
||||
saveCleartextSecret("json-credential-string");
|
||||
|
||||
String encryptedJsonCredential = keyring.getEncryptedData("json-credential-string");
|
||||
|
||||
assertThat(
|
||||
new String(
|
||||
keyring.getDecryptedData("json-credential-string", encryptedJsonCredential), UTF_8))
|
||||
.isEqualTo("json-credential-stringmoo");
|
||||
}
|
||||
|
||||
private static void persistSecret(String secretName, byte[] secretValue) {
|
||||
KmsConnection kmsConnection = new FakeKmsConnection();
|
||||
|
||||
|
|
|
|||
|
|
@ -1,22 +1,21 @@
|
|||
PATH CLASS METHODS OK AUTH_METHODS MIN USER_POLICY
|
||||
/_dr/admin/createGroups CreateGroupsAction POST n INTERNAL,API APP ADMIN
|
||||
/_dr/admin/createPremiumList CreatePremiumListAction POST n INTERNAL,API APP ADMIN
|
||||
/_dr/admin/deleteEntity DeleteEntityAction GET n INTERNAL,API APP ADMIN
|
||||
/_dr/admin/downloadCredential DownloadServiceAccountCredentialAction GET n INTERNAL APP IGNORED
|
||||
/_dr/admin/list/domains ListDomainsAction GET,POST n INTERNAL,API APP ADMIN
|
||||
/_dr/admin/list/hosts ListHostsAction GET,POST n INTERNAL,API APP ADMIN
|
||||
/_dr/admin/list/premiumLists ListPremiumListsAction GET,POST n INTERNAL,API APP ADMIN
|
||||
/_dr/admin/list/registrars ListRegistrarsAction GET,POST n INTERNAL,API APP ADMIN
|
||||
/_dr/admin/list/reservedLists ListReservedListsAction GET,POST n INTERNAL,API APP ADMIN
|
||||
/_dr/admin/list/tlds ListTldsAction GET,POST n INTERNAL,API APP ADMIN
|
||||
/_dr/admin/updatePremiumList UpdatePremiumListAction POST n INTERNAL,API APP ADMIN
|
||||
/_dr/admin/verifyOte VerifyOteAction POST n INTERNAL,API APP ADMIN
|
||||
/_dr/epptool EppToolAction POST n INTERNAL,API APP ADMIN
|
||||
/_dr/loadtest LoadTestAction POST y INTERNAL,API APP ADMIN
|
||||
/_dr/task/generateZoneFiles GenerateZoneFilesAction POST n INTERNAL,API APP ADMIN
|
||||
/_dr/task/killAllCommitLogs KillAllCommitLogsAction POST n INTERNAL APP IGNORED
|
||||
/_dr/task/killAllEppResources KillAllEppResourcesAction POST n INTERNAL APP IGNORED
|
||||
/_dr/task/pollMapreduce PollMapreduceAction POST n INTERNAL APP IGNORED
|
||||
/_dr/task/refreshDnsForAllDomains RefreshDnsForAllDomainsAction GET n INTERNAL,API APP ADMIN
|
||||
/_dr/task/resaveAllHistoryEntries ResaveAllHistoryEntriesAction GET n INTERNAL,API APP ADMIN
|
||||
/_dr/task/restoreCommitLogs RestoreCommitLogsAction POST y INTERNAL,API APP ADMIN
|
||||
PATH CLASS METHODS OK AUTH_METHODS MIN USER_POLICY
|
||||
/_dr/admin/createGroups CreateGroupsAction POST n INTERNAL,API APP ADMIN
|
||||
/_dr/admin/createPremiumList CreatePremiumListAction POST n INTERNAL,API APP ADMIN
|
||||
/_dr/admin/deleteEntity DeleteEntityAction GET n INTERNAL,API APP ADMIN
|
||||
/_dr/admin/list/domains ListDomainsAction GET,POST n INTERNAL,API APP ADMIN
|
||||
/_dr/admin/list/hosts ListHostsAction GET,POST n INTERNAL,API APP ADMIN
|
||||
/_dr/admin/list/premiumLists ListPremiumListsAction GET,POST n INTERNAL,API APP ADMIN
|
||||
/_dr/admin/list/registrars ListRegistrarsAction GET,POST n INTERNAL,API APP ADMIN
|
||||
/_dr/admin/list/reservedLists ListReservedListsAction GET,POST n INTERNAL,API APP ADMIN
|
||||
/_dr/admin/list/tlds ListTldsAction GET,POST n INTERNAL,API APP ADMIN
|
||||
/_dr/admin/updatePremiumList UpdatePremiumListAction POST n INTERNAL,API APP ADMIN
|
||||
/_dr/admin/verifyOte VerifyOteAction POST n INTERNAL,API APP ADMIN
|
||||
/_dr/epptool EppToolAction POST n INTERNAL,API APP ADMIN
|
||||
/_dr/loadtest LoadTestAction POST y INTERNAL,API APP ADMIN
|
||||
/_dr/task/generateZoneFiles GenerateZoneFilesAction POST n INTERNAL,API APP ADMIN
|
||||
/_dr/task/killAllCommitLogs KillAllCommitLogsAction POST n INTERNAL APP IGNORED
|
||||
/_dr/task/killAllEppResources KillAllEppResourcesAction POST n INTERNAL APP IGNORED
|
||||
/_dr/task/pollMapreduce PollMapreduceAction POST n INTERNAL APP IGNORED
|
||||
/_dr/task/refreshDnsForAllDomains RefreshDnsForAllDomainsAction GET n INTERNAL,API APP ADMIN
|
||||
/_dr/task/resaveAllHistoryEntries ResaveAllHistoryEntriesAction GET n INTERNAL,API APP ADMIN
|
||||
/_dr/task/restoreCommitLogs RestoreCommitLogsAction POST y INTERNAL,API APP ADMIN
|
||||
|
|
|
|||
|
|
@ -150,17 +150,6 @@ public final class FakeKeyringModule {
|
|||
return rdeReceiverKey;
|
||||
}
|
||||
|
||||
@Override
|
||||
public String getEncryptedData(String keyName) {
|
||||
throw new RuntimeException(
|
||||
"Fake keyring does not support the retrieval of encrypted data.");
|
||||
}
|
||||
|
||||
@Override
|
||||
public byte[] getDecryptedData(String keyName, String encryptedData) {
|
||||
throw new RuntimeException("Fake keyring does not support decrypting of supplied data.");
|
||||
}
|
||||
|
||||
@Override
|
||||
public void close() {}
|
||||
};
|
||||
|
|
|
|||
|
|
@ -1,66 +0,0 @@
|
|||
// Copyright 2018 The Nomulus Authors. All Rights Reserved.
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
package google.registry.tools.server;
|
||||
|
||||
import static com.google.common.truth.Truth.assertThat;
|
||||
import static java.nio.charset.StandardCharsets.UTF_8;
|
||||
import static javax.servlet.http.HttpServletResponse.SC_INTERNAL_SERVER_ERROR;
|
||||
import static javax.servlet.http.HttpServletResponse.SC_OK;
|
||||
|
||||
import com.google.common.io.BaseEncoding;
|
||||
import com.google.common.net.MediaType;
|
||||
import google.registry.testing.FakeResponse;
|
||||
import java.util.function.Function;
|
||||
import org.junit.Before;
|
||||
import org.junit.Test;
|
||||
import org.junit.runner.RunWith;
|
||||
import org.junit.runners.JUnit4;
|
||||
|
||||
/** Unit tests for {@link google.registry.tools.server.DownloadServiceAccountCredentialAction}. */
|
||||
@RunWith(JUnit4.class)
|
||||
public class DownloadServiceAccountCredentialActionTest {
|
||||
|
||||
private final DownloadServiceAccountCredentialAction action =
|
||||
new DownloadServiceAccountCredentialAction();
|
||||
private final FakeResponse response = new FakeResponse();
|
||||
private final Function<String, String> encryptedDataRetriever = input -> input + "_mohaha";
|
||||
|
||||
@Before
|
||||
public void setUp() {
|
||||
action.response = response;
|
||||
action.encryptedDataRetriever = encryptedDataRetriever;
|
||||
}
|
||||
|
||||
@Test
|
||||
public void testSuccess_returnServiceAccountCredential() {
|
||||
action.run();
|
||||
assertThat(response.getStatus()).isEqualTo(SC_OK);
|
||||
assertThat(response.getContentType()).isEqualTo(MediaType.APPLICATION_BINARY);
|
||||
assertThat(new String(BaseEncoding.base64().decode(response.getPayload()), UTF_8))
|
||||
.isEqualTo("json-credential-string_mohaha");
|
||||
}
|
||||
|
||||
@Test
|
||||
public void testFailure_cannotGetEncryptedCredential() {
|
||||
action.encryptedDataRetriever =
|
||||
input -> {
|
||||
throw new RuntimeException("Something went wrong.");
|
||||
};
|
||||
action.run();
|
||||
assertThat(response.getStatus()).isEqualTo(SC_INTERNAL_SERVER_ERROR);
|
||||
assertThat(response.getContentType()).isEqualTo(MediaType.HTML_UTF_8);
|
||||
assertThat(response.getPayload()).isEqualTo("Something went wrong.");
|
||||
}
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue