Skip to content

Commit 9604375

Browse files
msmithstubbsmsmithstubbs
committed
feat: admin scope required for /api/teams and /api/backends
1 parent a3cbe33 commit 9604375

3 files changed

Lines changed: 114 additions & 36 deletions

File tree

‎lib/logflare_web/router.ex‎

Lines changed: 17 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -104,10 +104,14 @@ defmodule LogflareWeb.Router do
104104
plug(LogflareWeb.Plugs.BufferLimiter)
105105
end
106106

107-
pipeline :require_mgmt_api_auth do
107+
pipeline :require_private_api_auth do
108108
plug(LogflareWeb.Plugs.VerifyApiAccess, scopes: ~w(private))
109109
end
110110

111+
pipeline :require_admin_api_auth do
112+
plug(LogflareWeb.Plugs.VerifyApiAccess, scopes: ~w(private:admin))
113+
end
114+
111115
pipeline :require_auth do
112116
plug(LogflareWeb.Plugs.RequireAuth)
113117
end
@@ -391,9 +395,9 @@ defmodule LogflareWeb.Router do
391395
get("/", HealthCheckController, :check)
392396
end
393397

394-
# Account management API.
398+
# Account resource API
395399
scope "/api", LogflareWeb do
396-
pipe_through([:api, :require_mgmt_api_auth])
400+
pipe_through([:api, :require_private_api_auth])
397401

398402
get("/account", UserController, :api_show)
399403
get("/query", Api.QueryController, :query)
@@ -426,7 +430,16 @@ defmodule LogflareWeb.Router do
426430

427431
resources("/teams", Api.TeamController,
428432
param: "token",
429-
only: [:index, :show, :create, :update, :delete]
433+
only: [:index, :show]
434+
)
435+
end
436+
437+
scope "/api", LogflareWeb do
438+
pipe_through([:api, :require_admin_api_auth])
439+
440+
resources("/teams", Api.TeamController,
441+
param: "token",
442+
only: [:create, :update, :delete]
430443
)
431444

432445
resources("/backends", Api.BackendController,

‎test/logflare_web/controllers/api/backend_controller_test.exs‎

Lines changed: 64 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ defmodule LogflareWeb.Api.BackendControllerTest do
1616

1717
assert [%{"id" => ^id, "inserted_at" => _, "updated_at" => _}] =
1818
conn
19-
|> add_access_token(user, "private")
19+
|> add_access_token(user, "private:admin")
2020
|> get(~p"/api/backends")
2121
|> json_response(200)
2222
end
@@ -27,12 +27,19 @@ defmodule LogflareWeb.Api.BackendControllerTest do
2727

2828
assert [result] =
2929
conn
30-
|> add_access_token(user, "private")
30+
|> add_access_token(user, "private:admin")
3131
|> get(~p"/api/backends?#{%{metadata: %{my: "field", data: true}}}")
3232
|> json_response(200)
3333

3434
assert result["id"] == backend.id
3535
end
36+
37+
test "admin scope is required", %{conn: conn, user: user} do
38+
assert conn
39+
|> add_access_token(user, "private")
40+
|> get(~p"/api/backends")
41+
|> response(401) == ~s|{"error":"Unauthorized"}|
42+
end
3643
end
3744

3845
describe "show/2" do
@@ -41,7 +48,7 @@ defmodule LogflareWeb.Api.BackendControllerTest do
4148

4249
response =
4350
conn
44-
|> add_access_token(user, "private")
51+
|> add_access_token(user, "private:admin")
4552
|> get("/api/backends/#{backend.token}")
4653
|> json_response(200)
4754

@@ -53,10 +60,19 @@ defmodule LogflareWeb.Api.BackendControllerTest do
5360
invalid_user = insert(:user)
5461

5562
conn
56-
|> add_access_token(invalid_user, "private")
63+
|> add_access_token(invalid_user, "private:admin")
5764
|> get("/api/backends/#{backend.token}")
5865
|> response(404)
5966
end
67+
68+
test "admin scope is required", %{conn: conn, user: user} do
69+
backend = insert(:backend, user: user)
70+
71+
assert conn
72+
|> add_access_token(user, "private")
73+
|> get("/api/backends/#{backend.token}")
74+
|> response(401) == ~s|{"error":"Unauthorized"}|
75+
end
6076
end
6177

6278
describe "create/2" do
@@ -65,7 +81,7 @@ defmodule LogflareWeb.Api.BackendControllerTest do
6581

6682
response =
6783
conn
68-
|> add_access_token(user, "private")
84+
|> add_access_token(user, "private:admin")
6985
|> post("/api/backends", %{
7086
name: name,
7187
type: "webhook",
@@ -84,7 +100,7 @@ defmodule LogflareWeb.Api.BackendControllerTest do
84100

85101
conn =
86102
conn
87-
|> add_access_token(user, "private")
103+
|> add_access_token(user, "private:admin")
88104
|> post("/api/backends", %{
89105
name: name,
90106
type: "postgres",
@@ -117,7 +133,7 @@ defmodule LogflareWeb.Api.BackendControllerTest do
117133

118134
conn =
119135
conn
120-
|> add_access_token(user, "private")
136+
|> add_access_token(user, "private:admin")
121137
|> post("/api/backends", %{
122138
name: name,
123139
type: "clickhouse",
@@ -159,7 +175,7 @@ defmodule LogflareWeb.Api.BackendControllerTest do
159175

160176
conn =
161177
conn
162-
|> add_access_token(user, "private")
178+
|> add_access_token(user, "private:admin")
163179
|> post("/api/backends", %{
164180
name: name,
165181
type: "datadog",
@@ -188,7 +204,7 @@ defmodule LogflareWeb.Api.BackendControllerTest do
188204

189205
conn =
190206
conn
191-
|> add_access_token(user, "private")
207+
|> add_access_token(user, "private:admin")
192208
|> post("/api/backends", %{
193209
name: name,
194210
type: "elastic",
@@ -218,7 +234,7 @@ defmodule LogflareWeb.Api.BackendControllerTest do
218234

219235
conn =
220236
conn
221-
|> add_access_token(user, "private")
237+
|> add_access_token(user, "private:admin")
222238
|> post("/api/backends", %{
223239
name: name,
224240
type: "loki",
@@ -246,7 +262,7 @@ defmodule LogflareWeb.Api.BackendControllerTest do
246262
test "returns 422 on missing arguments", %{conn: conn, user: user} do
247263
resp =
248264
conn
249-
|> add_access_token(user, "private")
265+
|> add_access_token(user, "private:admin")
250266
|> post("/api/backends")
251267
|> json_response(422)
252268

@@ -256,7 +272,7 @@ defmodule LogflareWeb.Api.BackendControllerTest do
256272
test "returns 422 on bad arguments", %{conn: conn, user: user} do
257273
resp =
258274
conn
259-
|> add_access_token(user, "private")
275+
|> add_access_token(user, "private:admin")
260276
|> post("/api/backends", %{name: 123})
261277
|> json_response(422)
262278

@@ -268,7 +284,7 @@ defmodule LogflareWeb.Api.BackendControllerTest do
268284

269285
response =
270286
conn
271-
|> add_access_token(user, "private")
287+
|> add_access_token(user, "private:admin")
272288
|> post("/api/backends", %{
273289
name: name,
274290
type: "clickhouse",
@@ -289,7 +305,7 @@ defmodule LogflareWeb.Api.BackendControllerTest do
289305

290306
response =
291307
conn
292-
|> add_access_token(user, "private")
308+
|> add_access_token(user, "private:admin")
293309
|> post("/api/backends", %{
294310
name: name,
295311
type: "clickhouse",
@@ -300,6 +316,13 @@ defmodule LogflareWeb.Api.BackendControllerTest do
300316
assert response["name"] == name
301317
assert response["default_ingest?"] == false
302318
end
319+
320+
test "admin scope is required", %{conn: conn, user: user} do
321+
assert conn
322+
|> add_access_token(user, "private")
323+
|> post("/api/backends", %{name: TestUtils.random_string(), type: "webhook"})
324+
|> response(401) == ~s|{"error":"Unauthorized"}|
325+
end
303326
end
304327

305328
describe "update/2" do
@@ -312,7 +335,7 @@ defmodule LogflareWeb.Api.BackendControllerTest do
312335

313336
response =
314337
conn
315-
|> add_access_token(user, "private")
338+
|> add_access_token(user, "private:admin")
316339
|> patch("/api/backends/#{backend.token}", %{name: name})
317340
|> response(204)
318341

@@ -324,7 +347,7 @@ defmodule LogflareWeb.Api.BackendControllerTest do
324347
backend = insert(:backend, user: user)
325348

326349
conn
327-
|> add_access_token(invalid_user, "private")
350+
|> add_access_token(invalid_user, "private:admin")
328351
|> patch("/api/backends/#{backend.token}", %{name: TestUtils.random_string()})
329352
|> response(404)
330353
end
@@ -334,7 +357,7 @@ defmodule LogflareWeb.Api.BackendControllerTest do
334357

335358
resp =
336359
conn
337-
|> add_access_token(user, "private")
360+
|> add_access_token(user, "private:admin")
338361
|> patch("/api/backends/#{backend.token}", %{name: 123})
339362
|> json_response(422)
340363

@@ -346,13 +369,13 @@ defmodule LogflareWeb.Api.BackendControllerTest do
346369
source = insert(:source, user: user, default_ingest_backend_enabled?: true)
347370

348371
conn
349-
|> add_access_token(user, "private")
372+
|> add_access_token(user, "private:admin")
350373
|> patch("/api/backends/#{backend.token}", %{default_ingest?: true, source_id: source.id})
351374
|> response(204)
352375

353376
response =
354377
conn
355-
|> add_access_token(user, "private")
378+
|> add_access_token(user, "private:admin")
356379
|> get("/api/backends/#{backend.token}")
357380
|> json_response(200)
358381

@@ -370,7 +393,7 @@ defmodule LogflareWeb.Api.BackendControllerTest do
370393

371394
response =
372395
conn
373-
|> add_access_token(user, "private")
396+
|> add_access_token(user, "private:admin")
374397
|> patch("/api/backends/#{backend.token}", %{default_ingest?: true})
375398
|> json_response(422)
376399

@@ -380,6 +403,15 @@ defmodule LogflareWeb.Api.BackendControllerTest do
380403
}
381404
}
382405
end
406+
407+
test "admin scope is required", %{conn: conn, user: user} do
408+
backend = insert(:backend, user: user)
409+
410+
assert conn
411+
|> add_access_token(user, "private")
412+
|> patch("/api/backends/#{backend.token}", %{name: TestUtils.random_string()})
413+
|> response(401) == ~s|{"error":"Unauthorized"}|
414+
end
383415
end
384416

385417
describe "delete/2" do
@@ -391,12 +423,12 @@ defmodule LogflareWeb.Api.BackendControllerTest do
391423
backend = insert(:backend, user: user)
392424

393425
assert conn
394-
|> add_access_token(user, "private")
426+
|> add_access_token(user, "private:admin")
395427
|> delete("/api/backends/#{backend.token}", %{name: name})
396428
|> response(204)
397429

398430
assert conn
399-
|> add_access_token(user, "private")
431+
|> add_access_token(user, "private:admin")
400432
|> get("/api/backends/#{backend.token}")
401433
|> response(404)
402434
end
@@ -409,9 +441,18 @@ defmodule LogflareWeb.Api.BackendControllerTest do
409441
backend = insert(:backend, user: user)
410442

411443
assert conn
412-
|> add_access_token(invalid_user, "private")
444+
|> add_access_token(invalid_user, "private:admin")
413445
|> delete("/api/backends/#{backend.token}")
414446
|> response(404)
415447
end
448+
449+
test "admin scope is required", %{conn: conn, user: user} do
450+
backend = insert(:backend, user: user)
451+
452+
assert conn
453+
|> add_access_token(user, "private")
454+
|> delete("/api/backends/#{backend.token}")
455+
|> response(401) == ~s|{"error":"Unauthorized"}|
456+
end
416457
end
417458
end

0 commit comments

Comments
 (0)