i/Aether
1
0
Fork 0
mirror of https://github.com/fawney19/Aether.git synced 2026-09-02 01:10:23 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: align management token oauth permissions and jsonb schema

Browse Source
This commit is contained in:
Entropy.Xu
2026-05-10 01:47:48 +08:00
parent 4a64d078f3
commit 545299fc62
11 changed files with 308 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

79
apps/aether-gateway/src/control/management_token_permissions.rs
View File

@@ -515,4 +515,83 @@ mod tests {
}
}
}
#[test]
fn catalog_covers_admin_route_signatures_from_route_sources() {
let route_sources = [
("route/admin.rs", include_str!("route/admin.rs")),
("route/oauth.rs", include_str!("route/oauth.rs")),
(
"route/public_support.rs",
include_str!("route/public_support.rs"),
),
(
"route/admin/basic_families.rs",
include_str!("route/admin/basic_families.rs"),
),
(
"route/admin/endpoints_families.rs",
include_str!("route/admin/endpoints_families.rs"),
),
(
"route/admin/model_provider_families.rs",
include_str!("route/admin/model_provider_families.rs"),
),
(
"route/admin/observability_families.rs",
include_str!("route/admin/observability_families.rs"),
),
(
"route/admin/operations_families.rs",
include_str!("route/admin/operations_families.rs"),
),
(
"route/admin/provider_ops_routes.rs",
include_str!("route/admin/provider_ops_routes.rs"),
),
(
"route/admin/system_families.rs",
include_str!("route/admin/system_families.rs"),
),
];
let mut route_scopes = BTreeSet::new();
for (file, source) in route_sources {
for scope in extract_admin_route_scopes(source) {
assert!(
is_known_management_token_permission_scope(scope),
"missing management token permission scope {scope} referenced by {file}"
);
route_scopes.insert(scope);
}
}
assert!(
!route_scopes.is_empty(),
"admin route scope scanner did not find any route signatures"
);
}
fn extract_admin_route_scopes(source: &'static str) -> BTreeSet<&'static str> {
let mut scopes = BTreeSet::new();
let mut remaining = source;
while let Some(start) = remaining.find("\"admin:") {
let signature_start = start + 1;
let after_start = &remaining[signature_start..];
let Some(end) = after_start.find('"') else {
break;
};
let signature = &after_start[..end];
let mut parts = signature.split(':');
if parts.next() == Some("admin") {
if let (Some(scope), None) = (parts.next(), parts.next()) {
scopes.insert(scope);
}
}
remaining = &after_start[end + 1..];
}
scopes
}
}

6
apps/aether-gateway/src/control/route/oauth.rs
View File

@@ -230,7 +230,7 @@ pub(super) fn classify_oauth_route(
"admin_proxy",
"provider_oauth_manage",
"batch_import_oauth",
"admin:provider_oauth",
"admin:pool",
false,
))
} else if method == http::Method::POST
@@ -241,7 +241,7 @@ pub(super) fn classify_oauth_route(
"admin_proxy",
"provider_oauth_manage",
"start_batch_import_oauth_task",
"admin:provider_oauth",
"admin:pool",
false,
))
} else if method == http::Method::GET
@@ -252,7 +252,7 @@ pub(super) fn classify_oauth_route(
"admin_proxy",
"provider_oauth_manage",
"get_batch_import_task_status",
"admin:provider_oauth",
"admin:pool",
false,
))
} else if method == http::Method::POST

34
apps/aether-gateway/src/control/tests/admin_oauth.rs
View File

@@ -1,5 +1,7 @@
use http::Uri;
use crate::control::management_token_required_permission;
use super::{classify_control_route, headers};
#[test]
@@ -66,7 +68,11 @@ fn classifies_admin_provider_oauth_batch_import_task_status_as_admin_proxy_route
);
assert_eq!(
decision.auth_endpoint_signature.as_deref(),
Some("admin:provider_oauth")
Some("admin:pool")
);
assert_eq!(
management_token_required_permission(&http::Method::GET, &decision).as_deref(),
Some("admin:pool:read")
);
assert!(!decision.is_execution_runtime_candidate());
}
@@ -74,51 +80,69 @@ fn classifies_admin_provider_oauth_batch_import_task_status_as_admin_proxy_route
#[test]
fn classifies_admin_provider_oauth_maintenance_routes_as_admin_proxy_route() {
let headers = headers(&[]);
for (method, path, route_kind) in [
for (method, path, route_kind, expected_signature, expected_required_permission) in [
(
http::Method::POST,
"/api/admin/provider-oauth/keys/key-123/complete",
"complete_key_oauth",
"admin:provider_oauth",
"admin:provider_oauth:write",
),
(
http::Method::POST,
"/api/admin/provider-oauth/keys/key-123/refresh",
"refresh_key_oauth",
"admin:provider_oauth",
"admin:provider_oauth:write",
),
(
http::Method::POST,
"/api/admin/provider-oauth/providers/provider-123/complete",
"complete_provider_oauth",
"admin:provider_oauth",
"admin:provider_oauth:write",
),
(
http::Method::POST,
"/api/admin/provider-oauth/providers/provider-123/import-refresh-token",
"import_refresh_token",
"admin:provider_oauth",
"admin:provider_oauth:write",
),
(
http::Method::POST,
"/api/admin/provider-oauth/providers/provider-123/batch-import",
"batch_import_oauth",
"admin:pool",
"admin:pool:write",
),
(
http::Method::POST,
"/api/admin/provider-oauth/providers/provider-123/batch-import/tasks",
"start_batch_import_oauth_task",
"admin:pool",
"admin:pool:write",
),
(
http::Method::GET,
"/api/admin/provider-oauth/providers/provider-123/batch-import/tasks/task-123",
"get_batch_import_task_status",
"admin:pool",
"admin:pool:read",
),
(
http::Method::POST,
"/api/admin/provider-oauth/providers/provider-123/device-authorize",
"device_authorize",
"admin:provider_oauth",
"admin:provider_oauth:write",
),
(
http::Method::POST,
"/api/admin/provider-oauth/providers/provider-123/device-poll",
"device_poll",
"admin:provider_oauth",
"admin:provider_oauth:write",
),
] {
let uri: Uri = path.parse().expect("uri should parse");
@@ -133,7 +157,11 @@ fn classifies_admin_provider_oauth_maintenance_routes_as_admin_proxy_route() {
assert_eq!(decision.route_kind.as_deref(), Some(route_kind));
assert_eq!(
decision.auth_endpoint_signature.as_deref(),
Some("admin:provider_oauth")
Some(expected_signature)
);
assert_eq!(
management_token_required_permission(&method, &decision).as_deref(),
Some(expected_required_permission)
);
assert!(!decision.is_execution_runtime_candidate());
}

125
apps/aether-gateway/src/tests/control/admin/oauth.rs
View File

@@ -25,9 +25,9 @@ use http::{HeaderMap, HeaderValue, StatusCode};
use serde_json::json;
use super::super::{
build_router_with_state, build_state_with_execution_runtime_override, sample_endpoint,
sample_key, sample_management_token, sample_oauth_provider_config, sample_provider,
sample_proxy_node, start_server, AppState,
build_router_with_state, build_state_with_execution_runtime_override, hash_management_token,
sample_endpoint, sample_key, sample_management_token, sample_oauth_provider_config,
sample_provider, sample_proxy_node, start_server, AppState,
};
use crate::admin_api::{
maybe_build_local_admin_provider_oauth_response, AdminAppState, AdminRequestContext,
@@ -7201,6 +7201,125 @@ async fn gateway_creates_updates_and_regenerates_admin_management_token_locally_
drop(upstream_url);
}
#[tokio::test]
async fn gateway_allows_management_token_with_pool_write_for_provider_oauth_batch_import() {
let raw_token = "ae-provider-oauth-batch-pool-write";
let state = AppState::new().expect("gateway should build");
let admin_user = state
.create_local_auth_user_with_settings(
Some("provider-oauth-pool@example.com".to_string()),
true,
"admin".to_string(),
"hash".to_string(),
"admin".to_string(),
None,
None,
None,
None,
)
.await
.expect("admin user should be created")
.expect("admin user should exist");
let mut management_token = sample_management_token(
"token-provider-oauth-batch-pool",
&admin_user.id,
"provider-oauth-pool",
true,
);
management_token.token.allowed_ips = None;
management_token.token.permissions = Some(json!(["admin:pool:read", "admin:pool:write"]));
let management_token_repository =
Arc::new(InMemoryManagementTokenRepository::seed_with_hashes(
vec![management_token],
vec![(
hash_management_token(raw_token),
"token-provider-oauth-batch-pool".to_string(),
)],
));
let gateway = build_router_with_state(state.with_data_state_for_tests(
GatewayDataState::with_management_token_repository_for_tests(management_token_repository),
));
let (gateway_url, gateway_handle) = start_server(gateway).await;
let response = reqwest::Client::new()
.post(format!(
"{gateway_url}/api/admin/provider-oauth/providers/provider-123/batch-import"
))
.header(crate::constants::GATEWAY_HEADER, "rust-phase3b")
.bearer_auth(raw_token)
.send()
.await
.expect("request should succeed");
let status = response.status();
let payload: serde_json::Value = response.json().await.expect("json body should parse");
assert_eq!(status, StatusCode::SERVICE_UNAVAILABLE, "{payload}");
assert_eq!(payload["detail"], "Admin provider OAuth data unavailable");
gateway_handle.abort();
}
#[tokio::test]
async fn gateway_rejects_management_token_without_pool_write_for_provider_oauth_batch_import() {
let raw_token = "ae-provider-oauth-batch-pool-denied";
let state = AppState::new().expect("gateway should build");
let admin_user = state
.create_local_auth_user_with_settings(
Some("provider-oauth-pool-denied@example.com".to_string()),
true,
"admin".to_string(),
"hash".to_string(),
"admin".to_string(),
None,
None,
None,
None,
)
.await
.expect("admin user should be created")
.expect("admin user should exist");
let mut management_token = sample_management_token(
"token-provider-oauth-batch-denied",
&admin_user.id,
"provider-oauth-denied",
true,
);
management_token.token.allowed_ips = None;
management_token.token.permissions = Some(json!(["admin:usage:read"]));
let management_token_repository =
Arc::new(InMemoryManagementTokenRepository::seed_with_hashes(
vec![management_token],
vec![(
hash_management_token(raw_token),
"token-provider-oauth-batch-denied".to_string(),
)],
));
let gateway = build_router_with_state(state.with_data_state_for_tests(
GatewayDataState::with_management_token_repository_for_tests(management_token_repository),
));
let (gateway_url, gateway_handle) = start_server(gateway).await;
let response = reqwest::Client::new()
.post(format!(
"{gateway_url}/api/admin/provider-oauth/providers/provider-123/batch-import"
))
.header(crate::constants::GATEWAY_HEADER, "rust-phase3b")
.bearer_auth(raw_token)
.send()
.await
.expect("request should succeed");
assert_eq!(response.status(), StatusCode::FORBIDDEN);
let payload: serde_json::Value = response.json().await.expect("json body should parse");
assert_eq!(payload["detail"], "management token permission denied");
assert_eq!(payload["required_permission"], "admin:pool:write");
assert_eq!(payload["route_family"], "provider_oauth_manage");
gateway_handle.abort();
}
#[tokio::test]
async fn gateway_deletes_admin_management_token_locally_with_trusted_admin_principal() {
let upstream_hits = Arc::new(Mutex::new(0usize));