97 lines
3.4 KiB
Bash
97 lines
3.4 KiB
Bash
|
#!/usr/bin/env bash
|
||
|
|
#
|
||
|
|
# Auth smoke test for the routes closed in the security hotfix.
|
||
|
|
#
|
||
|
|
# For every route that was made non-public, asserts:
|
||
|
|
# - no token -> 401
|
||
|
|
# - low-privilege token -> 403
|
||
|
|
# - super-admin token -> anything but 401/403 (the guard let it through)
|
||
|
|
#
|
||
|
|
# And asserts the genuinely-public routes still answer 200, plus that
|
||
|
|
# GET /customers no longer leaks anything beyond the four login-lookup fields.
|
||
|
|
#
|
||
|
|
# Usage: API=http://localhost:3000/api bash scripts/auth-smoke.sh
|
||
|
|
# Needs the API running and the dev seed applied (npx prisma db seed).
|
||
|
|
|
||
|
|
set -uo pipefail
|
||
|
|
API="${API:-http://localhost:3000/api}"
|
||
|
|
|
||
|
|
SUPER_PHONE=09128081392; SUPER_PASS=09128081392 # ut 85, all rids
|
||
|
|
LOW_PHONE=09123334444; LOW_PASS=admin1234 # ut 88, 5 unrelated rids
|
||
|
|
|
||
|
|
pass=0; fail=0
|
||
|
|
ok() { printf ' \033[32mPASS\033[0m %s\n' "$1"; pass=$((pass+1)); }
|
||
|
|
bad() { printf ' \033[31mFAIL\033[0m %s\n' "$1"; fail=$((fail+1)); }
|
||
|
|
|
||
|
|
login() {
|
||
|
|
curl -s -X POST "$API/admin/auth/login" -H 'Content-Type: application/json' \
|
||
|
|
-d "{\"phone\":\"$1\",\"password\":\"$2\"}" |
|
||
|
|
sed -n 's/.*"api_token":"\([^"]*\)".*/\1/p'
|
||
|
|
}
|
||
|
|
|
||
|
|
code() { # method path [token]
|
||
|
|
local m=$1 p=$2 t=${3:-}
|
||
|
|
if [ -n "$t" ]; then
|
||
|
|
curl -s -o /dev/null -w '%{http_code}' -X "$m" "$API/$p" \
|
||
|
|
-H "Authorization: Bearer $t" -H 'Content-Type: application/json' -d '{}'
|
||
|
|
else
|
||
|
|
curl -s -o /dev/null -w '%{http_code}' -X "$m" "$API/$p" \
|
||
|
|
-H 'Content-Type: application/json' -d '{}'
|
||
|
|
fi
|
||
|
|
}
|
||
|
|
|
||
|
|
SUPER=$(login "$SUPER_PHONE" "$SUPER_PASS")
|
||
|
|
LOW=$(login "$LOW_PHONE" "$LOW_PASS")
|
||
|
|
[ -z "$SUPER" ] && { echo "super-admin login failed — is the seed applied?"; exit 1; }
|
||
|
|
[ -z "$LOW" ] && { echo "low-priv login failed — is the seed applied?"; exit 1; }
|
||
|
|
|
||
|
|
# route | required rid
|
||
|
|
CLOSED=(
|
||
|
|
"GET|accounting/customers/x/balance|wallet.list"
|
||
|
|
"POST|accounting/customers/x/reconcile|wallet.charge"
|
||
|
|
"POST|accounting/repayments/gold|document.create"
|
||
|
|
"POST|accounting/repayments/rial|document.create"
|
||
|
|
"POST|accounting/entries/x/confirm|document.list.confirm"
|
||
|
|
"PATCH|orders/x/status|order.list.sts.submit"
|
||
|
|
)
|
||
|
|
|
||
|
|
echo "Closed routes — no token must be 401:"
|
||
|
|
for row in "${CLOSED[@]}"; do
|
||
|
|
IFS='|' read -r m p _ <<<"$row"
|
||
|
|
c=$(code "$m" "$p")
|
||
|
|
[ "$c" = 401 ] && ok "$m $p -> 401" || bad "$m $p -> $c (want 401)"
|
||
|
|
done
|
||
|
|
|
||
|
|
echo "Closed routes — low-privilege token must be 403:"
|
||
|
|
for row in "${CLOSED[@]}"; do
|
||
|
|
IFS='|' read -r m p rid <<<"$row"
|
||
|
|
c=$(code "$m" "$p" "$LOW")
|
||
|
|
[ "$c" = 403 ] && ok "$m $p [$rid] -> 403" || bad "$m $p [$rid] -> $c (want 403)"
|
||
|
|
done
|
||
|
|
|
||
|
|
echo "Closed routes — super admin must get past the guard:"
|
||
|
|
for row in "${CLOSED[@]}"; do
|
||
|
|
IFS='|' read -r m p _ <<<"$row"
|
||
|
|
c=$(code "$m" "$p" "$SUPER")
|
||
|
|
case "$c" in
|
||
|
|
401|403) bad "$m $p -> $c (guard rejected a super admin)" ;;
|
||
|
|
*) ok "$m $p -> $c (through the guard)" ;;
|
||
|
|
esac
|
||
|
|
done
|
||
|
|
|
||
|
|
echo "Public routes must stay reachable:"
|
||
|
|
for p in "catalog/products" "pricing/latest?karatPerMille=750" "home/slider" "customers"; do
|
||
|
|
c=$(curl -s -o /dev/null -w '%{http_code}' "$API/$p")
|
||
|
|
[ "$c" = 200 ] && ok "GET $p -> 200" || bad "GET $p -> $c (want 200)"
|
||
|
|
done
|
||
|
|
|
||
|
|
echo "GET /customers must expose only the login-lookup fields:"
|
||
|
|
keys=$(curl -s "$API/customers" | sed -n 's/.*\({[^}]*}\).*/\1/p' | head -1 |
|
||
|
|
grep -oE '"[a-zA-Z]+":' | tr -d '":' | sort -u | tr '\n' ' ')
|
||
|
|
want="id isActive isArchived mobile "
|
||
|
|
[ "$keys" = "$want" ] && ok "fields = $keys" || bad "fields = [$keys] want [$want]"
|
||
|
|
|
||
|
|
echo
|
||
|
|
echo "passed: $pass failed: $fail"
|
||
|
|
[ "$fail" -eq 0 ]
|