tests: added some more artifact access tests.

rhodecode/apps/file_store/tests/test_upload_file.py

@@ -1,126 +1,261 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2019 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 import os
 import pytest
 
 from rhodecode.lib.ext_json import json
-from rhodecode.model.db import Session, FileStore
+from rhodecode.model.auth_token import AuthTokenModel
+from rhodecode.model.db import Session, FileStore, Repository, User
 from rhodecode.tests import TestController
 from rhodecode.apps.file_store import utils, config_keys
 
 
 def route_path(name, params=None, **kwargs):
     import urllib
 
     base_url = {
         'upload_file': '/_file_store/upload',
         'download_file': '/_file_store/download/{fid}',
+        'download_file_by_token': '/_file_store/token-download/{_auth_token}/{fid}'
 
     }[name].format(**kwargs)
 
     if params:
         base_url = '{}?{}'.format(base_url, urllib.urlencode(params))
     return base_url
 
 
 class TestFileStoreViews(TestController):
 
     @pytest.mark.parametrize("fid, content, exists", [
         ('abcde-0.jpg', "xxxxx", True),
         ('abcde-0.exe', "1234567", True),
         ('abcde-0.jpg', "xxxxx", False),
     ])
     def test_get_files_from_store(self, fid, content, exists, tmpdir, user_util):
         user = self.log_user()
         user_id = user['user_id']
         repo_id = user_util.create_repo().repo_id
         store_path = self.app._pyramid_settings[config_keys.store_path]
         store_uid = fid
 
         if exists:
             status = 200
             store = utils.get_file_storage({config_keys.store_path: store_path})
             filesystem_file = os.path.join(str(tmpdir), fid)
             with open(filesystem_file, 'wb') as f:
                 f.write(content)
 
             with open(filesystem_file, 'rb') as f:
                 store_uid, metadata = store.save_file(f, fid, extra_metadata={'filename': fid})
 
             entry = FileStore.create(
                 file_uid=store_uid, filename=metadata["filename"],
                 file_hash=metadata["sha256"], file_size=metadata["size"],
                 file_display_name='file_display_name',
                 file_description='repo artifact `{}`'.format(metadata["filename"]),
                 check_acl=True, user_id=user_id,
                 scope_repo_id=repo_id
             )
             Session().add(entry)
             Session().commit()
 
         else:
             status = 404
 
         response = self.app.get(route_path('download_file', fid=store_uid), status=status)
 
         if exists:
             assert response.text == content
             file_store_path = os.path.dirname(store.resolve_name(store_uid, store_path)[1])
             metadata_file = os.path.join(file_store_path, store_uid + '.meta')
             assert os.path.exists(metadata_file)
             with open(metadata_file, 'rb') as f:
                 json_data = json.loads(f.read())
 
             assert json_data
             assert 'size' in json_data
 
     def test_upload_files_without_content_to_store(self):
         self.log_user()
         response = self.app.post(
             route_path('upload_file'),
             params={'csrf_token': self.csrf_token},
             status=200)
 
         assert response.json == {
             u'error': u'store_file data field is missing',
             u'access_path': None,
             u'store_fid': None}
 
     def test_upload_files_bogus_content_to_store(self):
         self.log_user()
         response = self.app.post(
             route_path('upload_file'),
             params={'csrf_token': self.csrf_token, 'store_file': 'bogus'},
             status=200)
 
         assert response.json == {
             u'error': u'filename cannot be read from the data field',
             u'access_path': None,
             u'store_fid': None}
 
     def test_upload_content_to_store(self):
         self.log_user()
         response = self.app.post(
             route_path('upload_file'),
             upload_files=[('store_file', 'myfile.txt', 'SOME CONTENT')],
             params={'csrf_token': self.csrf_token},
             status=200)
 
         assert response.json['store_fid']
+
+    @pytest.fixture()
+    def create_artifact_factory(self, tmpdir):
+        def factory(user_id, content):
+            store_path = self.app._pyramid_settings[config_keys.store_path]
+            store = utils.get_file_storage({config_keys.store_path: store_path})
+            fid = 'example.txt'
+
+            filesystem_file = os.path.join(str(tmpdir), fid)
+            with open(filesystem_file, 'wb') as f:
+                f.write(content)
+
+            with open(filesystem_file, 'rb') as f:
+                store_uid, metadata = store.save_file(f, fid, extra_metadata={'filename': fid})
+
+            entry = FileStore.create(
+                file_uid=store_uid, filename=metadata["filename"],
+                file_hash=metadata["sha256"], file_size=metadata["size"],
+                file_display_name='file_display_name',
+                file_description='repo artifact `{}`'.format(metadata["filename"]),
+                check_acl=True, user_id=user_id,
+            )
+            Session().add(entry)
+            Session().commit()
+            return entry
+        return factory
+
+    def test_download_file_non_scoped(self, user_util, create_artifact_factory):
+        user = self.log_user()
+        user_id = user['user_id']
+        content = 'HELLO MY NAME IS ARTIFACT !'
+
+        artifact = create_artifact_factory(user_id, content)
+        file_uid = artifact.file_uid
+        response = self.app.get(route_path('download_file', fid=file_uid), status=200)
+        assert response.text == content
+
+        # log-in to new user and test download again
+        user = user_util.create_user(password='qweqwe')
+        self.log_user(user.username, 'qweqwe')
+        response = self.app.get(route_path('download_file', fid=file_uid), status=200)
+        assert response.text == content
+
+    def test_download_file_scoped_to_repo(self, user_util, create_artifact_factory):
+        user = self.log_user()
+        user_id = user['user_id']
+        content = 'HELLO MY NAME IS ARTIFACT !'
+
+        artifact = create_artifact_factory(user_id, content)
+        # bind to repo
+        repo = user_util.create_repo()
+        repo_id = repo.repo_id
+        artifact.scope_repo_id = repo_id
+        Session().add(artifact)
+        Session().commit()
+
+        file_uid = artifact.file_uid
+        response = self.app.get(route_path('download_file', fid=file_uid), status=200)
+        assert response.text == content
+
+        # log-in to new user and test download again
+        user = user_util.create_user(password='qweqwe')
+        self.log_user(user.username, 'qweqwe')
+        response = self.app.get(route_path('download_file', fid=file_uid), status=200)
+        assert response.text == content
+
+        # forbid user the rights to repo
+        repo = Repository.get(repo_id)
+        user_util.grant_user_permission_to_repo(repo, user, 'repository.none')
+        self.app.get(route_path('download_file', fid=file_uid), status=404)
+
+    def test_download_file_scoped_to_user(self, user_util, create_artifact_factory):
+        user = self.log_user()
+        user_id = user['user_id']
+        content = 'HELLO MY NAME IS ARTIFACT !'
+
+        artifact = create_artifact_factory(user_id, content)
+        # bind to user
+        user = user_util.create_user(password='qweqwe')
+
+        artifact.scope_user_id = user.user_id
+        Session().add(artifact)
+        Session().commit()
+
+        # artifact creator doesn't have access since it's bind to another user
+        file_uid = artifact.file_uid
+        self.app.get(route_path('download_file', fid=file_uid), status=404)
+
+        # log-in to new user and test download again, should be ok since we're bind to this artifact
+        self.log_user(user.username, 'qweqwe')
+        response = self.app.get(route_path('download_file', fid=file_uid), status=200)
+        assert response.text == content
+
+    def test_download_file_scoped_to_repo_with_bad_token(self, user_util, create_artifact_factory):
+        user_id = User.get_first_super_admin().user_id
+        content = 'HELLO MY NAME IS ARTIFACT !'
+
+        artifact = create_artifact_factory(user_id, content)
+        # bind to repo
+        repo = user_util.create_repo()
+        repo_id = repo.repo_id
+        artifact.scope_repo_id = repo_id
+        Session().add(artifact)
+        Session().commit()
+
+        file_uid = artifact.file_uid
+        self.app.get(route_path('download_file_by_token',
+                                _auth_token='bogus', fid=file_uid), status=302)
+
+    def test_download_file_scoped_to_repo_with_token(self, user_util, create_artifact_factory):
+        user = User.get_first_super_admin()
+        AuthTokenModel().create(user, 'test artifact token',
+                                role=AuthTokenModel.cls.ROLE_ARTIFACT_DOWNLOAD)
+
+        user = User.get_first_super_admin()
+        artifact_token = user.artifact_token
+
+        user_id = User.get_first_super_admin().user_id
+        content = 'HELLO MY NAME IS ARTIFACT !'
+
+        artifact = create_artifact_factory(user_id, content)
+        # bind to repo
+        repo = user_util.create_repo()
+        repo_id = repo.repo_id
+        artifact.scope_repo_id = repo_id
+        Session().add(artifact)
+        Session().commit()
+
+        file_uid = artifact.file_uid
+        response = self.app.get(
+            route_path('download_file_by_token',
+                       _auth_token=artifact_token, fid=file_uid), status=200)
+        assert response.text == content

rhodecode/apps/file_store/views.py

@@ -1,166 +1,174 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2016-2019 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 import logging
 
 from pyramid.view import view_config
 from pyramid.response import FileResponse
 from pyramid.httpexceptions import HTTPFound, HTTPNotFound
 
 from rhodecode.apps._base import BaseAppView
 from rhodecode.apps.file_store import utils
 from rhodecode.apps.file_store.exceptions import (
     FileNotAllowedException, FileOverSizeException)
 
 from rhodecode.lib import helpers as h
 from rhodecode.lib import audit_logger
 from rhodecode.lib.auth import (
     CSRFRequired, NotAnonymous, HasRepoPermissionAny, HasRepoGroupPermissionAny,
     LoginRequired)
 from rhodecode.model.db import Session, FileStore, UserApiKeys
 
 log = logging.getLogger(__name__)
 
 
 class FileStoreView(BaseAppView):
     upload_key = 'store_file'
 
     def load_default_context(self):
         c = self._get_local_tmpl_context()
         self.storage = utils.get_file_storage(self.request.registry.settings)
         return c
 
     @LoginRequired()
     @NotAnonymous()
     @CSRFRequired()
     @view_config(route_name='upload_file', request_method='POST', renderer='json_ext')
     def upload_file(self):
         self.load_default_context()
         file_obj = self.request.POST.get(self.upload_key)
 
         if file_obj is None:
             return {'store_fid': None,
                     'access_path': None,
                     'error': '{} data field is missing'.format(self.upload_key)}
 
         if not hasattr(file_obj, 'filename'):
             return {'store_fid': None,
                     'access_path': None,
                     'error': 'filename cannot be read from the data field'}
 
         filename = file_obj.filename
 
         metadata = {
             'user_uploaded': {'username': self._rhodecode_user.username,
                               'user_id': self._rhodecode_user.user_id,
                               'ip': self._rhodecode_user.ip_addr}}
         try:
             store_uid, metadata = self.storage.save_file(
                 file_obj.file, filename, extra_metadata=metadata)
         except FileNotAllowedException:
             return {'store_fid': None,
                     'access_path': None,
                     'error': 'File {} is not allowed.'.format(filename)}
 
         except FileOverSizeException:
             return {'store_fid': None,
                     'access_path': None,
                     'error': 'File {} is exceeding allowed limit.'.format(filename)}
 
         try:
             entry = FileStore.create(
                 file_uid=store_uid, filename=metadata["filename"],
                 file_hash=metadata["sha256"], file_size=metadata["size"],
-                file_description='upload attachment',
+                file_description=u'upload attachment',
                 check_acl=False, user_id=self._rhodecode_user.user_id
             )
             Session().add(entry)
             Session().commit()
             log.debug('Stored upload in DB as %s', entry)
         except Exception:
             log.exception('Failed to store file %s', filename)
             return {'store_fid': None,
                     'access_path': None,
                     'error': 'File {} failed to store in DB.'.format(filename)}
 
         return {'store_fid': store_uid,
                 'access_path': h.route_path('download_file', fid=store_uid)}
 
     def _serve_file(self, file_uid):
 
         if not self.storage.exists(file_uid):
             store_path = self.storage.store_path(file_uid)
             log.debug('File with FID:%s not found in the store under `%s`',
                       file_uid, store_path)
             raise HTTPNotFound()
 
         db_obj = FileStore().query().filter(FileStore.file_uid == file_uid).scalar()
         if not db_obj:
             raise HTTPNotFound()
 
         # private upload for user
         if db_obj.check_acl and db_obj.scope_user_id:
+            log.debug('Artifact: checking scope access for bound artifact user: `%s`',
+                      db_obj.scope_user_id)
             user = db_obj.user
             if self._rhodecode_db_user.user_id != user.user_id:
                 log.warning('Access to file store object forbidden')
                 raise HTTPNotFound()
 
         # scoped to repository permissions
         if db_obj.check_acl and db_obj.scope_repo_id:
+            log.debug('Artifact: checking scope access for bound artifact repo: `%s`',
+                      db_obj.scope_repo_id)
             repo = db_obj.repo
             perm_set = ['repository.read', 'repository.write', 'repository.admin']
             has_perm = HasRepoPermissionAny(*perm_set)(repo.repo_name, 'FileStore check')
             if not has_perm:
                 log.warning('Access to file store object `%s` forbidden', file_uid)
                 raise HTTPNotFound()
 
         # scoped to repository group permissions
         if db_obj.check_acl and db_obj.scope_repo_group_id:
+            log.debug('Artifact: checking scope access for bound artifact repo group: `%s`',
+                      db_obj.scope_repo_group_id)
             repo_group = db_obj.repo_group
             perm_set = ['group.read', 'group.write', 'group.admin']
             has_perm = HasRepoGroupPermissionAny(*perm_set)(repo_group.group_name, 'FileStore check')
             if not has_perm:
                 log.warning('Access to file store object `%s` forbidden', file_uid)
                 raise HTTPNotFound()
 
         FileStore.bump_access_counter(file_uid)
 
         file_path = self.storage.store_path(file_uid)
         return FileResponse(file_path)
 
     # ACL is checked by scopes, if no scope the file is accessible to all
     @view_config(route_name='download_file')
     def download_file(self):
         self.load_default_context()
         file_uid = self.request.matchdict['fid']
         log.debug('Requesting FID:%s from store %s', file_uid, self.storage)
         return self._serve_file(file_uid)
 
+    # in addition to @LoginRequired ACL is checked by scopes
     @LoginRequired(auth_token_access=[UserApiKeys.ROLE_ARTIFACT_DOWNLOAD])
+    @NotAnonymous()
     @view_config(route_name='download_file_by_token')
     def download_file_by_token(self):
         """
         Special view that allows to access the download file by special URL that
         is stored inside the URL.
 
         http://example.com/_file_store/token-download/TOKEN/FILE_UID
         """
         self.load_default_context()
         file_uid = self.request.matchdict['fid']
         return self._serve_file(file_uid)