Skip to content

Commit b309e18

Browse files
derekhigginsderekhiggins
committed
test(ci): add ABAC testing with files API to auth tests
Add ABAC testing to integration-auth-tests workflow: o Enable files and inference APIs o Configure localfs files provider o Add access policy for file ownership validation o Create multiple service accounts (user1, user2) o Move API Access tests into standalone script o Test file policy with both users Signed-off-by: Derek Higgins <derekh@redhat.com>
1 parent fc4fc03 commit b309e18

File tree

2 files changed

+135
-41
lines changed

2 files changed

+135
-41
lines changed

‎.github/workflows/integration-auth-tests.yml‎

Lines changed: 34 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ on:
2020
- 'pyproject.toml'
2121
- 'requirements.txt'
2222
- '.github/workflows/integration-auth-tests.yml' # This workflow
23+
- 'scripts/integration-auth-tests.sh'
2324

2425
concurrency:
2526
group: ${{ github.workflow }}-${{ github.ref == 'refs/heads/main' && github.run_id || github.ref }}
@@ -54,8 +55,10 @@ jobs:
5455
if: ${{ matrix.auth-provider == 'oauth2_token' }}
5556
run: |
5657
kubectl create namespace llama-stack
57-
kubectl create serviceaccount llama-stack-auth -n llama-stack
58-
kubectl create token llama-stack-auth -n llama-stack > llama-stack-auth-token
58+
for account in llama-stack-auth llama-stack-user1 llama-stack-user2; do
59+
kubectl create serviceaccount $account -n llama-stack
60+
kubectl create token $account -n llama-stack > $account-token
61+
done
5962
6063
- name: Set Kubernetes Config
6164
if: ${{ matrix.auth-provider == 'oauth2_token' }}
@@ -75,8 +78,18 @@ jobs:
7578
cat <<EOF > $run_dir/run.yaml
7679
version: '2'
7780
image_name: kube
78-
apis: []
79-
providers: {}
81+
apis:
82+
- files
83+
- inference
84+
providers:
85+
files:
86+
- provider_id: meta-reference-files
87+
provider_type: inline::localfs
88+
config:
89+
storage_dir: $run_dir/files
90+
metadata_store:
91+
table_name: files_metadata
92+
backend: sql_default
8093
storage:
8194
backends:
8295
kv_default:
@@ -100,6 +113,21 @@ jobs:
100113
backend: kv_default
101114
server:
102115
port: 8321
116+
auth:
117+
access_policy:
118+
- permit:
119+
actions: [read, delete]
120+
resource: sql_record::openai_files::*
121+
when:
122+
- user with system:serviceaccount:llama-stack:llama-stack-user1 in roles
123+
- user in owners roles
124+
description: User1 can read and delete their Files
125+
- permit:
126+
actions: [read]
127+
resource: sql_record::openai_files::*
128+
when:
129+
- user in owners roles
130+
description: Owners can read their Files
103131
EOF
104132
yq eval '.server.auth.provider_config.type = "${{ matrix.auth-provider }}"' -i $run_dir/run.yaml
105133
yq eval '.server.auth.provider_config.tls_cafile = "${{ env.KUBERNETES_CA_CERT_PATH }}"' -i $run_dir/run.yaml
@@ -137,40 +165,5 @@ jobs:
137165
138166
- name: Test auth
139167
run: |
140-
# Function to test API endpoint with authentication
141-
# Usage: test_endpoint <curl_args> <user_token_file> <expected_status> [output_file]
142-
test_endpoint() {
143-
local curl_args="$1"
144-
local user_token_file=$2
145-
local expected_status=$3
146-
local output_file=${4:-/dev/null}
147-
148-
local status
149-
local extra_curl_args=(-s -L -o "$output_file" -w "%{http_code}")
150-
151-
if [ "$user_token_file" != "none" ]; then
152-
extra_curl_args+=(-H "Authorization: Bearer $(cat $user_token_file)")
153-
fi
154-
155-
set -x
156-
status=$(curl $curl_args "${extra_curl_args[@]}")
157-
set +x
158-
159-
if [ "$status" = "$expected_status" ]; then
160-
echo " ✓ Status: $status (expected $expected_status)"
161-
return 0
162-
else
163-
echo " ✗ Status: $status (expected $expected_status)"
164-
exit 1
165-
fi
166-
}
167-
168-
echo "Testing /v1/version without token (should succeed)..."
169-
test_endpoint "http://127.0.0.1:8321/v1/version" "none" "200" || exit 1
170-
171-
echo "Testing /v1/providers without token (should fail with 401)..."
172-
test_endpoint "http://127.0.0.1:8321/v1/providers" "none" "401" || exit 1
173-
174-
echo "Testing /v1/providers with valid token (should succeed)..."
175-
test_endpoint "http://127.0.0.1:8321/v1/providers" "llama-stack-auth-token" "200" "providers.json" || exit 1
176-
cat providers.json | jq . > /dev/null && echo " ✓ Valid JSON response"
168+
# Run the auth tests
169+
./scripts/integration-auth-tests.sh

‎scripts/integration-auth-tests.sh‎

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
#!/bin/bash
2+
# Copyright (c) Meta Platforms, Inc. and affiliates.
3+
# All rights reserved.
4+
#
5+
# This source code is licensed under the terms described in the LICENSE file in
6+
# the root directory of this source tree.
7+
8+
set -euo pipefail
9+
10+
# Integration auth tests for Llama Stack
11+
# This script tests authentication and authorization (ABAC) functionality
12+
# Expects token files to be created before running (e.g., by CI workflow or manual setup)
13+
14+
# Function to test API endpoint with authentication
15+
# Usage: test_endpoint <curl_args> <user_token_file> <expected_status> [output_file]
16+
test_endpoint() {
17+
local curl_args="$1"
18+
local user_token_file=$2
19+
local expected_status=$3
20+
local output_file=${4:-/dev/null}
21+
22+
local status
23+
local extra_curl_args=(-s -L -o "$output_file" -w "%{http_code}")
24+
25+
if [ "$user_token_file" != "none" ]; then
26+
extra_curl_args+=(-H "Authorization: Bearer $(cat $user_token_file)")
27+
fi
28+
29+
set -x
30+
status=$(curl $curl_args "${extra_curl_args[@]}")
31+
set +x
32+
33+
if [ "$status" = "$expected_status" ]; then
34+
echo " ✓ Status: $status (expected $expected_status)"
35+
return 0
36+
else
37+
echo " ✗ Status: $status (expected $expected_status)"
38+
exit 1
39+
fi
40+
}
41+
42+
# Check if user tokens exist for ABAC testing
43+
if [ ! -f "llama-stack-auth-token" ] || [ ! -f "llama-stack-user1-token" ] || [ ! -f "llama-stack-user2-token" ]; then
44+
echo ""
45+
echo "❌ User tokens not found - expected llama-stack-user1-token and llama-stack-user2-token"
46+
exit 1
47+
fi
48+
49+
echo "Testing /v1/version without token (should succeed)..."
50+
test_endpoint "http://127.0.0.1:8321/v1/version" "none" "200" || exit 1
51+
52+
echo "Testing /v1/providers without token (should fail with 401)..."
53+
test_endpoint "http://127.0.0.1:8321/v1/providers" "none" "401" || exit 1
54+
55+
echo "Testing /v1/providers with valid token (should succeed)..."
56+
test_endpoint "http://127.0.0.1:8321/v1/providers" "llama-stack-auth-token" "200" "providers.json" || exit 1
57+
cat providers.json | jq . > /dev/null && echo " ✓ Valid JSON response"
58+
59+
echo ""
60+
echo "Running ABAC tests with user tokens..."
61+
62+
# Create test file
63+
echo "test content" > test-file.txt
64+
65+
echo "Both user1 and user2 can create files..."
66+
test_endpoint "http://127.0.0.1:8321/v1/files -F file=@test-file.txt -F purpose=assistants" "llama-stack-user1-token" "200" "user1-files.json" || exit 1
67+
test_endpoint "http://127.0.0.1:8321/v1/files -F file=@test-file.txt -F purpose=assistants" "llama-stack-user2-token" "200" "user2-files.json" || exit 1
68+
69+
echo "user1 can only read their own files..."
70+
test_endpoint "http://127.0.0.1:8321/v1/files" "llama-stack-user1-token" "200" "user1-files-list.json" || exit 1
71+
USER1_FILE_COUNT=$(jq '.data|length' user1-files-list.json)
72+
echo "User1 has $USER1_FILE_COUNT file(s)"
73+
[ $USER1_FILE_COUNT -eq 1 ] || ( echo " ✗ User1 should have 1 file, but has $USER1_FILE_COUNT" && exit 1 )
74+
echo " ✓ User1 can see exactly 1 file"
75+
76+
echo "user2 can read their own file..."
77+
test_endpoint "http://127.0.0.1:8321/v1/files" "llama-stack-user2-token" "200" "user2-files-list.json" || exit 1
78+
USER2_FILE_COUNT=$(jq '.data|length' user2-files-list.json)
79+
echo "User2 has $USER2_FILE_COUNT file(s)"
80+
[ $USER2_FILE_COUNT -eq 1 ] || ( echo " ✗ User2 should have 1 file, but has $USER2_FILE_COUNT" && exit 1 )
81+
echo " ✓ User2 can see their own file"
82+
83+
echo "Both file ids should differ"
84+
FILEID_USER1=$(jq -r '.data[0].id' user1-files-list.json)
85+
FILEID_USER2=$(jq -r '.data[0].id' user2-files-list.json)
86+
[ "$FILEID_USER1" != "$FILEID_USER2" ] || ( echo " ✗ File IDs should differ" && exit 1 )
87+
echo " ✓ File IDs differ"
88+
89+
echo "user2 can't delete their own file or other users' files..."
90+
test_endpoint "http://127.0.0.1:8321/v1/files/$FILEID_USER2 -X DELETE" "llama-stack-user2-token" "404" || exit 1
91+
test_endpoint "http://127.0.0.1:8321/v1/files/$FILEID_USER1 -X DELETE" "llama-stack-user2-token" "404" || exit 1
92+
echo " ✓ Delete correctly blocked"
93+
94+
echo "user1 can delete their own files but not other users' files..."
95+
test_endpoint "http://127.0.0.1:8321/v1/files/$FILEID_USER1 -X DELETE" "llama-stack-user1-token" "200" || exit 1
96+
echo " ✓ Delete successful"
97+
test_endpoint "http://127.0.0.1:8321/v1/files/$FILEID_USER2 -X DELETE" "llama-stack-user1-token" "404" || exit 1
98+
echo " ✓ Delete correctly blocked"
99+
100+
echo ""
101+
echo "✓ ABAC test completed successfully!"

0 commit comments

Comments
 (0)