Skip to content

Commit 54ffd23

Browse files
strantalisstrantalis
authored
fix(policy): properly formatted pem in test fixtures (#2409)
### Proposed Changes * ### Checklist - [ ] I have added or updated unit tests - [ ] I have added or updated integration tests (if appropriate) - [ ] I have added or updated documentation ### Testing Instructions
1 parent a52b8f9 commit 54ffd23

File tree

8 files changed

+83
-69
lines changed

8 files changed

+83
-69
lines changed

‎docs/Configuring.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -88,11 +88,12 @@ Root level key `server`
8888
| `auth.cache_refresh` | Interval in which the IDP jwks should be refreshed | `15m` | OPENTDF_SERVER_AUTH_CACHE_REFRESH |
8989
| `auth.dpopskew` | The amount of time drift allowed between when the client generated a dpop proof and the server time. | `1h` | OPENTDF_SERVER_AUTH |
9090
| `auth.skew` | The amount of time drift allowed between a tokens `exp` claim and the server time. | `1m` | OPENTDF_SERVER_AUTH_SKEW |
91-
| `auth.public_client_id` | [DEPRECATED] The oidc client id. This is leveraged by otdfctl. | | OPENTDF_SERVER_AUTH_PUBLIC_CLIENT_ID |
91+
| `auth.public_client_id` | [DEPRECATED] The oidc client id. This is leveraged by otdfctl. | | OPENTDF_SERVER_AUTH_PUBLIC_CLIENT_ID |
9292
| `auth.enforceDPoP` | If true, DPoP bindings on Access Tokens are enforced. | `false` | OPENTDF_SERVER_AUTH_ENFORCEDPOP |
9393
| `cryptoProvider` | A list of public/private keypairs and their use. Described [below](#crypto-provider) | empty | |
9494
| `enable_pprof` | Enable golang performance profiling | `false` | OPENTDF_SERVER_ENABLE_PPROF |
9595
| `grpc.reflection` | The configuration for the grpc server. | `true` | OPENTDF_SERVER_GRPC_REFLECTION |
96+
| `public_hostname` | The public facing hostname for the server. | | OPENTDF_SERVER_PUBLIC_HOSTNAME |
9697
| `host` | The host address for the server. | `""` | OPENTDF_SERVER_HOST |
9798
| `port` | The port number for the server. | `9000` | OPENTDF_SERVER_PORT |
9899
| `tls.enabled` | Enable tls. | `false` | OPENTDF_SERVER_TLS_ENABLED |

‎opentdf-dev.yaml‎

Lines changed: 18 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,10 @@ logger:
1919
# health_check_period_seconds: 60
2020
services:
2121
kas:
22+
preview:
23+
ec_tdf_enabled: false
24+
key_management: false
25+
root_key: a8c4824daafcfa38ed0d13002e92b08720e6c4fcee67d52e954c1a6e045907d1 # For local development testing only
2226
keyring:
2327
- kid: e1
2428
alg: ec:secp256r1
@@ -47,6 +51,7 @@ services:
4751
# list_request_limit_default: 1000
4852
# list_request_limit_max: 2500
4953
server:
54+
public_hostname: localhost
5055
tls:
5156
enabled: false
5257
cert: ./keys/platform.crt
@@ -92,20 +97,20 @@ server:
9297
file:
9398
path: "./traces/traces.log"
9499
prettyPrint: true # Optional, default is compact JSON
95-
maxSize: 50 # Optional, default 20MB
96-
maxBackups: 5 # Optional, default 10
97-
maxAge: 14 # Optional, default 30 days
98-
compress: true # Optional, default false
100+
maxSize: 50 # Optional, default 20MB
101+
maxBackups: 5 # Optional, default 10
102+
maxAge: 14 # Optional, default 30 days
103+
compress: true # Optional, default false
99104
# otlp:
100-
# protocol: grpc # Optional, defaults to grpc
101-
# endpoint: "localhost:4317"
102-
# insecure: true # Set to false if Jaeger requires TLS
103-
# headers: {} # Add if authentication is needed
104-
# HTTP
105-
# protocol: "http/protobuf"
106-
# endpoint: "http://localhost:4318" # Default OTLP HTTP port
107-
# insecure: true # If collector is just HTTP, not HTTPS
108-
# headers: {} # Add if authentication is needed
105+
# protocol: grpc # Optional, defaults to grpc
106+
# endpoint: "localhost:4317"
107+
# insecure: true # Set to false if Jaeger requires TLS
108+
# headers: {} # Add if authentication is needed
109+
# HTTP
110+
# protocol: "http/protobuf"
111+
# endpoint: "http://localhost:4318" # Default OTLP HTTP port
112+
# insecure: true # If collector is just HTTP, not HTTPS
113+
# headers: {} # Add if authentication is needed
109114
cors:
110115
# "*" to allow any origin or a specific domain like "https://yourdomain.com"
111116
allowedorigins:

‎opentdf-kas-mode.yaml‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,10 @@ logger:
1313
output: stdout
1414
services:
1515
kas:
16+
preview:
17+
ec_tdf_enabled: false
18+
key_management: false
19+
# root_key: # create key `openssl rand 32 -hex`
1620
keyring:
1721
- kid: e1
1822
alg: ec:secp256r1
@@ -25,14 +29,15 @@ services:
2529
alg: rsa:2048
2630
legacy: true
2731
server:
32+
public_hostname: localhost
2833
tls:
2934
enabled: false
3035
cert: ./keys/platform.crt
3136
key: ./keys/platform-key.pem
3237
auth:
3338
enabled: true
3439
enforceDPoP: false
35-
audience: 'http://localhost:8080'
40+
audience: "http://localhost:8080"
3641
issuer: http://localhost:8888/auth/realms/opentdf
3742
policy:
3843
## Default policy for all requests
@@ -69,7 +74,7 @@ server:
6974
enabled: false
7075
# "*" to allow any origin or a specific domain like "https://yourdomain.com"
7176
allowedorigins:
72-
- '*'
77+
- "*"
7378
# List of methods. Examples: "GET,POST,PUT"
7479
allowedmethods:
7580
- GET

‎service/go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,6 @@ require (
1616
github.com/casbin/casbin/v2 v2.106.0
1717
github.com/creasty/defaults v1.8.0
1818
github.com/dgraph-io/ristretto v0.2.0
19-
github.com/docker/docker v28.2.2+incompatible
2019
github.com/docker/go-connections v0.5.0
2120
github.com/eko/gocache/lib/v4 v4.2.0
2221
github.com/eko/gocache/store/ristretto/v4 v4.2.2
@@ -61,6 +60,7 @@ require (
6160
github.com/containerd/errdefs v1.0.0 // indirect
6261
github.com/containerd/errdefs/pkg v0.3.0 // indirect
6362
github.com/dgryski/go-farm v0.0.0-20240924180020-3414d57e47da // indirect
63+
github.com/docker/docker v28.2.2+incompatible // indirect
6464
github.com/ebitengine/purego v0.8.2 // indirect
6565
github.com/moby/go-archive v0.1.0 // indirect
6666
github.com/moby/sys/atomicwriter v0.1.0 // indirect

‎service/integration/kas_registry_key_test.go‎

Lines changed: 24 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -180,7 +180,11 @@ func (s *KasRegistryKeySuite) Test_GetKasKeyById_Success() {
180180
s.NotNil(resp)
181181
s.Equal(s.kasKeys[0].KeyAccessServerID, resp.GetKasId())
182182
s.Equal(s.kasKeys[0].ID, resp.GetKey().GetId())
183-
s.Equal(s.kasKeys[0].ProviderConfigID, resp.GetKey().GetProviderConfig().GetId())
183+
if s.kasKeys[0].ProviderConfigID == nil {
184+
s.Nil(resp.GetKey().GetProviderConfig())
185+
} else {
186+
s.Equal(*s.kasKeys[0].ProviderConfigID, resp.GetKey().GetProviderConfig().GetId())
187+
}
184188
}
185189

186190
func (s *KasRegistryKeySuite) Test_GetKasKeyByKey_WrongKas_Fail() {
@@ -232,7 +236,7 @@ func (s *KasRegistryKeySuite) Test_GetKasKeyByKeyId_Success() {
232236
s.Equal(s.kasKeys[0].KeyAccessServerID, resp.GetKasId())
233237
s.Equal(s.kasKeys[0].ID, resp.GetKey().GetId())
234238
validatePrivatePublicCtx(&s.Suite, []byte(s.kasKeys[0].PrivateKeyCtx), []byte(s.kasKeys[0].PublicKeyCtx), resp)
235-
s.Equal(s.kasKeys[0].ProviderConfigID, resp.GetKey().GetProviderConfig().GetId())
239+
s.Equal(*s.kasKeys[0].ProviderConfigID, resp.GetKey().GetProviderConfig().GetId())
236240
}
237241

238242
func (s *KasRegistryKeySuite) Test_GetKasKey_WithKasName_Success() {
@@ -255,7 +259,11 @@ func (s *KasRegistryKeySuite) Test_GetKasKey_WithKasName_Success() {
255259
s.Equal(s.kasKeys[0].KeyAccessServerID, resp.GetKasId())
256260
s.Equal(s.kasKeys[0].ID, resp.GetKey().GetId())
257261
validatePrivatePublicCtx(&s.Suite, []byte(s.kasKeys[0].PrivateKeyCtx), []byte(s.kasKeys[0].PublicKeyCtx), resp)
258-
s.Equal(s.kasKeys[0].ProviderConfigID, resp.GetKey().GetProviderConfig().GetId())
262+
if s.kasKeys[0].ProviderConfigID == nil {
263+
s.Nil(resp.GetKey().GetProviderConfig())
264+
} else {
265+
s.Equal(*s.kasKeys[0].ProviderConfigID, resp.GetKey().GetProviderConfig().GetId())
266+
}
259267
}
260268

261269
func (s *KasRegistryKeySuite) Test_GetKasKey_WithKasUri_Success() {
@@ -279,7 +287,7 @@ func (s *KasRegistryKeySuite) Test_GetKasKey_WithKasUri_Success() {
279287
s.Equal(s.kasKeys[0].ID, resp.GetKey().GetId())
280288
validatePrivatePublicCtx(&s.Suite, []byte(s.kasKeys[0].PrivateKeyCtx), []byte(s.kasKeys[0].PublicKeyCtx), resp)
281289
s.Require().NoError(err)
282-
s.Equal(s.kasKeys[0].ProviderConfigID, resp.GetKey().GetProviderConfig().GetId())
290+
s.Equal(*s.kasKeys[0].ProviderConfigID, resp.GetKey().GetProviderConfig().GetId())
283291
}
284292

285293
func (s *KasRegistryKeySuite) Test_UpdateKey_InvalidKeyId_Fails() {
@@ -325,7 +333,7 @@ func (s *KasRegistryKeySuite) Test_ListKeys_KasID_Success() {
325333
},
326334
}
327335
resp, err := s.db.PolicyClient.ListKeys(s.ctx, &req)
328-
s.validateListKeysResponse(resp, err)
336+
s.validateListKeysResponse(resp, 2, err)
329337
}
330338

331339
func (s *KasRegistryKeySuite) Test_ListKeys_KasName_Success() {
@@ -335,7 +343,7 @@ func (s *KasRegistryKeySuite) Test_ListKeys_KasName_Success() {
335343
},
336344
}
337345
resp, err := s.db.PolicyClient.ListKeys(s.ctx, &req)
338-
s.validateListKeysResponse(resp, err)
346+
s.validateListKeysResponse(resp, 2, err)
339347
}
340348

341349
func (s *KasRegistryKeySuite) Test_ListKeys_KasURI_Success() {
@@ -345,7 +353,7 @@ func (s *KasRegistryKeySuite) Test_ListKeys_KasURI_Success() {
345353
},
346354
}
347355
resp, err := s.db.PolicyClient.ListKeys(s.ctx, &req)
348-
s.validateListKeysResponse(resp, err)
356+
s.validateListKeysResponse(resp, 2, err)
349357
}
350358

351359
func (s *KasRegistryKeySuite) Test_ListKeys_FilterAlgo_NoKeysWithAlgo_Success() {
@@ -369,7 +377,7 @@ func (s *KasRegistryKeySuite) Test_ListKeys_FilterAlgo_TwoKeys_Success() {
369377
KeyAlgorithm: policy.Algorithm_ALGORITHM_RSA_2048,
370378
}
371379
resp, err := s.db.PolicyClient.ListKeys(s.ctx, &req)
372-
s.validateListKeysResponse(resp, err)
380+
s.validateListKeysResponse(resp, 1, err)
373381
}
374382

375383
func (s *KasRegistryKeySuite) Test_ListKeys_KasID_Limit_Success() {
@@ -387,7 +395,7 @@ func (s *KasRegistryKeySuite) Test_ListKeys_KasID_Limit_Success() {
387395
s.NotNil(resp)
388396
s.Len(resp.GetKasKeys(), 1)
389397
s.GreaterOrEqual(int32(2), resp.GetPagination().GetTotal())
390-
s.Equal(int32(1), resp.GetPagination().GetNextOffset())
398+
s.Equal(int32(0), resp.GetPagination().GetNextOffset())
391399
s.Equal(int32(0), resp.GetPagination().GetCurrentOffset())
392400
}
393401

@@ -1332,10 +1340,10 @@ func (s *KasRegistryKeySuite) getKasRegistryFixtures() []fixtures.FixtureDataKas
13321340
}
13331341
}
13341342

1335-
func (s *KasRegistryKeySuite) validateListKeysResponse(resp *kasregistry.ListKeysResponse, err error) {
1343+
func (s *KasRegistryKeySuite) validateListKeysResponse(resp *kasregistry.ListKeysResponse, numKeys int, err error) {
13361344
s.Require().NoError(err)
13371345
s.NotNil(resp)
1338-
s.GreaterOrEqual(len(resp.GetKasKeys()), 2)
1346+
s.GreaterOrEqual(len(resp.GetKasKeys()), numKeys)
13391347
s.GreaterOrEqual(int32(2), resp.GetPagination().GetTotal())
13401348

13411349
for _, key := range resp.GetKasKeys() {
@@ -1351,7 +1359,11 @@ func (s *KasRegistryKeySuite) validateListKeysResponse(resp *kasregistry.ListKey
13511359
s.Require().NotNil(fixtureKey, "No matching KAS key found for ID: %s", key.GetKey().GetId())
13521360
s.Equal(fixtureKey.KeyAccessServerID, key.GetKasId())
13531361
s.Equal(fixtureKey.ID, key.GetKey().GetId())
1354-
s.Equal(fixtureKey.ProviderConfigID, key.GetKey().GetProviderConfig().GetId())
1362+
if fixtureKey.ProviderConfigID == nil {
1363+
s.Nil(key.GetKey().GetProviderConfig())
1364+
} else {
1365+
s.Equal(*fixtureKey.ProviderConfigID, key.GetKey().GetProviderConfig().GetId())
1366+
}
13551367
validatePrivatePublicCtx(&s.Suite, []byte(fixtureKey.PrivateKeyCtx), []byte(fixtureKey.PublicKeyCtx), key)
13561368
s.Require().NoError(err)
13571369
}

‎service/integration/main_test.go‎

Lines changed: 6 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,8 @@ import (
1010
"time"
1111

1212
"github.com/creasty/defaults"
13-
"github.com/docker/docker/api/types/container"
1413
"github.com/docker/go-connections/nat"
14+
"github.com/google/uuid"
1515
"github.com/opentdf/platform/service/internal/fixtures"
1616
tc "github.com/testcontainers/testcontainers-go"
1717
"github.com/testcontainers/testcontainers-go/wait"
@@ -69,37 +69,28 @@ func TestMain(m *testing.M) {
6969
providerType = tc.ProviderDocker
7070
}
7171

72+
randomSuffix := uuid.NewString()[:8]
73+
containerName := "testcontainer-postgres-" + randomSuffix
74+
7275
req := tc.GenericContainerRequest{
7376
ProviderType: providerType,
7477
ContainerRequest: tc.ContainerRequest{
7578
Image: "postgres:15-alpine",
76-
Name: "testcontainer-postgres",
79+
Name: containerName,
7780
ExposedPorts: []string{"5432/tcp"},
78-
HostConfigModifier: func(config *container.HostConfig) {
79-
config.PortBindings = nat.PortMap{
80-
"5432/tcp": []nat.PortBinding{
81-
{
82-
HostIP: "0.0.0.0",
83-
HostPort: "54322",
84-
},
85-
},
86-
}
87-
},
8881
Env: map[string]string{
8982
"POSTGRES_USER": conf.DB.User,
9083
"POSTGRES_PASSWORD": conf.DB.Password,
9184
"POSTGRES_DB": conf.DB.Database,
9285
},
93-
9486
WaitingFor: wait.ForSQL(nat.Port("5432/tcp"), "pgx", func(host string, port nat.Port) string {
95-
net.JoinHostPort(host, port.Port())
9687
return fmt.Sprintf("postgres://%s:%s@%s/%s?sslmode=disable",
9788
conf.DB.User,
9889
conf.DB.Password,
9990
net.JoinHostPort(host, port.Port()),
10091
conf.DB.Database,
10192
)
102-
}).WithStartupTimeout(time.Second * 5).WithQuery("SELECT 10"),
93+
}).WithStartupTimeout(time.Second * 60).WithQuery("SELECT 1"), // Increased timeout and simplified query
10394
},
10495
Started: true,
10596
}

‎service/internal/fixtures/fixtures.go‎

Lines changed: 14 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -144,15 +144,15 @@ type FixtureDataRegisteredResourceActionAttributeValue struct {
144144
}
145145

146146
type FixtureDataKasRegistryKey struct {
147-
ID string `yaml:"id"`
148-
KeyAccessServerID string `yaml:"key_access_server_id"`
149-
KeyAlgorithm string `yaml:"key_algorithm"`
150-
KeyID string `yaml:"key_id"`
151-
KeyMode string `yaml:"key_mode"`
152-
KeyStatus string `yaml:"key_status"`
153-
PrivateKeyCtx string `yaml:"private_key_ctx"`
154-
PublicKeyCtx string `yaml:"public_key_ctx"`
155-
ProviderConfigID string `yaml:"provider_config_id"`
147+
ID string `yaml:"id"`
148+
KeyAccessServerID string `yaml:"key_access_server_id"`
149+
KeyAlgorithm string `yaml:"key_algorithm"`
150+
KeyID string `yaml:"key_id"`
151+
KeyMode string `yaml:"key_mode"`
152+
KeyStatus string `yaml:"key_status"`
153+
PrivateKeyCtx string `yaml:"private_key_ctx"`
154+
PublicKeyCtx string `yaml:"public_key_ctx"`
155+
ProviderConfigID *string `yaml:"provider_config_id"`
156156
}
157157

158158
type FixtureDataProviderConfig struct {
@@ -702,10 +702,13 @@ func (f *Fixtures) provisionKasRegistryKeys() int64 {
702702
f.db.StringWrap(d.KeyStatus),
703703
f.db.StringWrap(string(privateCtx)),
704704
f.db.StringWrap(string(pubCtx)),
705-
f.db.StringWrap(d.ProviderConfigID),
706705
})
706+
providerConfigIDSQL := "NULL"
707+
if d.ProviderConfigID != nil {
708+
providerConfigIDSQL = f.db.StringWrap(*d.ProviderConfigID)
709+
}
710+
values[len(values)-1] = append(values[len(values)-1], providerConfigIDSQL)
707711
}
708-
709712
return f.provision(fixtureData.KasRegistryKeys.Metadata.TableName, fixtureData.KasRegistryKeys.Metadata.Columns, values)
710713
}
711714

0 commit comments

Comments
 (0)