diff options
Diffstat (limited to 'common/src/leap/soledad')
| -rw-r--r-- | common/src/leap/soledad/common/couch.py | 23 | ||||
| -rw-r--r-- | common/src/leap/soledad/common/tests/fixture_soledad.conf | 10 | ||||
| -rw-r--r-- | common/src/leap/soledad/common/tests/test_couch.py | 24 | ||||
| -rw-r--r-- | common/src/leap/soledad/common/tests/test_server.py | 36 |
4 files changed, 85 insertions, 8 deletions
diff --git a/common/src/leap/soledad/common/couch.py b/common/src/leap/soledad/common/couch.py index 3dee1473..a801a044 100644 --- a/common/src/leap/soledad/common/couch.py +++ b/common/src/leap/soledad/common/couch.py @@ -372,7 +372,8 @@ class CouchDatabase(CommonBackend): """ @classmethod - def open_database(cls, url, create, replica_uid=None, ensure_ddocs=False): + def open_database(cls, url, create, replica_uid=None, ensure_ddocs=False, + database_security=None): """ Open a U1DB database using CouchDB as backend. @@ -402,9 +403,11 @@ class CouchDatabase(CommonBackend): raise DatabaseDoesNotExist() server.create(dbname) return cls( - url, dbname, replica_uid=replica_uid, ensure_ddocs=ensure_ddocs) + url, dbname, replica_uid=replica_uid, + ensure_ddocs=ensure_ddocs, database_security=database_security) - def __init__(self, url, dbname, replica_uid=None, ensure_ddocs=False): + def __init__(self, url, dbname, replica_uid=None, ensure_ddocs=False, + database_security=None): """ Create a new Couch data container. @@ -435,7 +438,7 @@ class CouchDatabase(CommonBackend): self._set_replica_uid(replica_uid) if ensure_ddocs: self.ensure_ddocs_on_db() - self.ensure_security_ddoc() + self.ensure_security_ddoc(database_security) self._cache = None @property @@ -469,7 +472,7 @@ class CouchDatabase(CommonBackend): getattr(ddocs, ddoc_name))) self._database.save(ddoc) - def ensure_security_ddoc(self): + def ensure_security_ddoc(self, security_config=None): """ Make sure that only soledad user is able to access this database as an unprivileged member, meaning that administration access will @@ -478,10 +481,18 @@ class CouchDatabase(CommonBackend): to the unprivileged CouchDB user set on the server process. This is achieved by creating a _security design document, see: http://docs.couchdb.org/en/latest/api/database/security.html + + :param database_security: security configuration parsed from conf file + :type cache: dict """ + security_config = security_config or {} security = self._database.resource.get_json('_security')[2] - security['members'] = {'names': ['soledad'], 'roles': []} + security['members'] = {'names': [], 'roles': []} + security['members']['names'] = security_config.get('members', ['soledad']) + security['members']['roles'] = security_config.get('members_roles', []) security['admins'] = {'names': [], 'roles': []} + security['admins']['names'] = security_config.get('admins', []) + security['admins']['roles'] = security_config.get('admins_roles', []) self._database.resource.put_json('_security', body=security) def get_sync_target(self): diff --git a/common/src/leap/soledad/common/tests/fixture_soledad.conf b/common/src/leap/soledad/common/tests/fixture_soledad.conf new file mode 100644 index 00000000..c0ffacf6 --- /dev/null +++ b/common/src/leap/soledad/common/tests/fixture_soledad.conf @@ -0,0 +1,10 @@ +[soledad-server] +couch_url = http://soledad:passwd@localhost:5984 +create_cmd = sudo -u soledad-admin /usr/bin/create-user-db +admin_netrc = /etc/couchdb/couchdb-soledad-admin.netrc + +[database-security] +members = user1, user2 +members_roles = role1, role2 +admins = user3, user4 +admins_roles = role3, role3 diff --git a/common/src/leap/soledad/common/tests/test_couch.py b/common/src/leap/soledad/common/tests/test_couch.py index b4797f5e..668a7f64 100644 --- a/common/src/leap/soledad/common/tests/test_couch.py +++ b/common/src/leap/soledad/common/tests/test_couch.py @@ -534,9 +534,11 @@ class CouchDatabaseSyncTargetTests( class IndexedCouchDatabase(couch.CouchDatabase): - def __init__(self, url, dbname, replica_uid=None, ensure_ddocs=True): + def __init__(self, url, dbname, replica_uid=None, ensure_ddocs=True, + database_security=None): old_class.__init__(self, url, dbname, replica_uid=replica_uid, - ensure_ddocs=ensure_ddocs) + ensure_ddocs=ensure_ddocs, + database_security=database_security) self._indexes = {} def _put_doc(self, old_doc, doc): @@ -1515,6 +1517,24 @@ class CouchDatabaseExceptionsTests(CouchDBTestCase): self.assertIn('members', security_ddoc) self.assertIn('soledad', security_ddoc['members']['names']) + def test_ensure_security_from_configuration(self): + """ + Given a configuration, follow it to create the security document + """ + self.create_db(ensure=False) + configuration = {'members': ['user1', 'user2'], + 'members_roles': ['role1', 'role2'], + 'admins': ['admin'], + 'admins_roles': ['administrators'] + } + self.db.ensure_security_ddoc(configuration) + + security_ddoc = self.db._database.resource.get_json('_security')[2] + self.assertEquals(configuration['admins'], security_ddoc['admins']['names']) + self.assertEquals(configuration['admins_roles'], security_ddoc['admins']['roles']) + self.assertEquals(configuration['members'], security_ddoc['members']['names']) + self.assertEquals(configuration['members_roles'], security_ddoc['members']['roles']) + class DatabaseNameValidationTest(unittest.TestCase): diff --git a/common/src/leap/soledad/common/tests/test_server.py b/common/src/leap/soledad/common/tests/test_server.py index 19d2907d..14e17e67 100644 --- a/common/src/leap/soledad/common/tests/test_server.py +++ b/common/src/leap/soledad/common/tests/test_server.py @@ -22,10 +22,12 @@ import tempfile import mock import time import binascii +import pkg_resources from uuid import uuid4 from urlparse import urljoin from twisted.internet import defer +from twisted.trial import unittest from leap.soledad.common.couch import ( CouchServerState, @@ -43,6 +45,8 @@ from leap.soledad.common.tests.util import ( from leap.soledad.common import crypto from leap.soledad.client import Soledad from leap.soledad.server import LockResource +from leap.soledad.server import load_configuration +from leap.soledad.server import CONFIG_DEFAULTS from leap.soledad.server.auth import URLToAuthorization @@ -587,3 +591,35 @@ class LockResourceTestCase( self.assertIsNotNone(lr._shared_db.get_doc('lock-' + lock_uuid)) responder.send_response_json.assert_called_with( 401, error='unlock unauthorized') + + +class ConfigurationParsingTest(unittest.TestCase): + + def setUp(self): + self.maxDiff = None + + def test_use_defaults_on_failure(self): + config = load_configuration('this file will never exist') + expected = CONFIG_DEFAULTS + self.assertEquals(expected, config) + + def test_security_values_configuration(self): + # given + config_path = pkg_resources.resource_filename('leap.soledad.common.tests', + 'fixture_soledad.conf') + # when + config = load_configuration(config_path) + + # then + expected = {'soledad-server': { + 'couch_url': 'http://soledad:passwd@localhost:5984', + 'create_cmd': 'sudo -u soledad-admin /usr/bin/create-user-db', + 'admin_netrc': '/etc/couchdb/couchdb-soledad-admin.netrc', + }, + 'database-security': { + 'members': ['user1', 'user2'], + 'members_roles': ['role1', 'role2'], + 'admins': ['user3', 'user4'], + 'admins_roles': ['role3', 'role3'], + }} + self.assertDictEqual(expected, config) |