Skip to content

Commit 12a7267

Browse files
Merge pull request #225 from cyberark/build-fix
Fix Roles API test failures
2 parents 2baf214 + c9fa1a3 commit 12a7267

File tree

4 files changed

+19
-55
lines changed

4 files changed

+19
-55
lines changed

CHANGELOG.md

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,12 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
66

77
## [Unreleased]
88

9+
### Removed
10+
- Removed possible 403 response code from Roles API endpoints. As of Conjur
11+
v1.19.3, requests to the Roles API return 404 when the caller has insufficient
12+
privilege - see [cyberark/conjur#2755](https://github.com/cyberark/conjur/pull/2755).
13+
[cyberark/conjur-openapi-spec#225](https://github.com/cyberark/conjur-openapi-spec/pull/225)
14+
915
## [5.3.0] - 2021-12-22
1016

1117
### Added

spec/roles.yml

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -129,8 +129,6 @@ components:
129129
$ref: 'openapi.yml#/components/responses/BadRequest'
130130
"401":
131131
$ref: 'openapi.yml#/components/responses/UnauthorizedError'
132-
"403":
133-
$ref: 'openapi.yml#/components/responses/InadequatePrivileges'
134132
"404":
135133
$ref: 'openapi.yml#/components/responses/ResourceNotFound'
136134
"422":
@@ -196,8 +194,6 @@ components:
196194
$ref: 'openapi.yml#/components/responses/BadRequest'
197195
"401":
198196
$ref: 'openapi.yml#/components/responses/UnauthorizedError'
199-
"403":
200-
$ref: 'openapi.yml#/components/responses/InadequatePrivileges'
201197
"404":
202198
$ref: 'openapi.yml#/components/responses/ResourceNotFound'
203199
"422":
@@ -263,8 +259,6 @@ components:
263259
$ref: 'openapi.yml#/components/responses/BadRequest'
264260
"401":
265261
$ref: 'openapi.yml#/components/responses/UnauthorizedError'
266-
"403":
267-
$ref: 'openapi.yml#/components/responses/InadequatePrivileges'
268262
"404":
269263
$ref: 'openapi.yml#/components/responses/ResourceNotFound'
270264
"422":

test/python/roles/test_roles_api.py

Lines changed: 0 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -177,26 +177,6 @@ def test_add_member_to_role_401(self):
177177

178178
self.assertEqual(context.exception.status, 401)
179179

180-
def test_add_member_to_role_403(self):
181-
"""Test case for 403 status response when adding role member
182-
403 - the authenticated user lacks the necessary privilege
183-
"""
184-
# establish a new api client as user Bob
185-
bob_client = api_config.get_api_client(username='bob')
186-
bob_roles_api = conjur.RolesApi(bob_client)
187-
188-
# attempt to add Alice as a member of userGroup as Bob
189-
with self.assertRaises(conjur.ApiException) as context:
190-
bob_roles_api.add_member_to_role(
191-
self.account,
192-
'group',
193-
'userGroup',
194-
members='',
195-
member=self.ALICE_ID
196-
)
197-
198-
self.assertEqual(context.exception.status, 403)
199-
200180
def test_add_member_to_role_404(self):
201181
"""Test case for 404 status response when adding role member
202182
404 - the role inteded for assignment as member does not exist
@@ -286,32 +266,6 @@ def test_remove_member_from_role_401(self):
286266

287267
self.assertEqual(context.exception.status, 401)
288268

289-
def test_remove_member_from_role_403(self):
290-
"""Test case for 403 status response when deleting role member
291-
403 - the authenticated client lacks the necessary privilege
292-
"""
293-
# add Alice as a member of userGroup and confirm
294-
self.add_user_to_group('alice')
295-
group_members = self.api.show_role(self.account, 'group', 'userGroup', members='')
296-
self.assertEqual(len(group_members), 2)
297-
self.assertEqual(group_members[1]['member'], self.ALICE_ID)
298-
299-
# establish a new api client as user Bob
300-
bob_client = api_config.get_api_client(username='bob')
301-
bob_roles_api = conjur.RolesApi(bob_client)
302-
303-
# attempt to delete Alice as member of userGroup as Bob
304-
with self.assertRaises(conjur.ApiException) as context:
305-
bob_roles_api.remove_member_from_role(
306-
self.account,
307-
'group',
308-
'userGroup',
309-
members='',
310-
member=self.ALICE_ID
311-
)
312-
313-
self.assertEqual(context.exception.status, 403)
314-
315269
def test_remove_member_from_role_404(self):
316270
"""Test case for 404 status response when deleting role member
317271
404 - the queried role intended for deletion was not found

test/python/roles/test_roles_query_params_api.py

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -179,7 +179,7 @@ def test_parameter_combos_a(self):
179179

180180
def test_parameter_combos_b(self):
181181
"""Test Conjur's response to being given all optional parameters besides `graph`
182-
Conjur responses with `all` results ONLY
182+
Conjur responds with `all` results ONLY
183183
"""
184184
details, status, _ = self.api.show_role_with_http_info(
185185
self.account,
@@ -201,7 +201,17 @@ def test_parameter_combos_b(self):
201201
]
202202

203203
if api_config.ENTERPRISE_TESTS:
204-
target_details.append('!:!:root')
204+
system_memberships = [
205+
'system:group:conjur/replication-sets/full/replicated-data',
206+
'system:policy:conjur',
207+
'system:policy:conjur/replication-sets',
208+
'system:policy:conjur/replication-sets/full',
209+
'system:policy:root',
210+
'system:user:admin',
211+
'!:!:root'
212+
]
213+
for membership in system_memberships:
214+
target_details.append(membership)
205215

206216
self.assertEqual(status, 200)
207217
for i in target_details:
@@ -213,7 +223,7 @@ def test_parameter_combos_b(self):
213223

214224
def test_parameter_combos_c(self):
215225
"""Test Conjur's response to being given both `members` and `memberships`
216-
Conjur response with `memberships` results ONLY
226+
Conjur responds with `memberships` results ONLY
217227
"""
218228
self.add_user_to_group('bob')
219229

0 commit comments

Comments
 (0)