66 lines
1.6 KiB
Markdown
66 lines
1.6 KiB
Markdown
# INP2P RBAC Regression Checklist
|
|
|
|
> Replace placeholders:
|
|
> - `BASE=http://127.0.0.1:27183`
|
|
> - `ADMIN_TOKEN=<tenant admin session token>`
|
|
> - `OP_TOKEN=<tenant operator session token>`
|
|
> - `APIKEY_TOKEN=<tenant api key>`
|
|
|
|
## 1) enroll revoke must be admin-only
|
|
|
|
```bash
|
|
curl -i -X POST "$BASE/api/v1/enroll/consume/1?status=0" \
|
|
-H "Authorization: Bearer $OP_TOKEN"
|
|
# expect: 401/403
|
|
|
|
curl -i -X POST "$BASE/api/v1/enroll/consume/1?status=0" \
|
|
-H "Authorization: Bearer $APIKEY_TOKEN"
|
|
# expect: 401/403
|
|
```
|
|
|
|
## 2) apikey cannot mutate
|
|
|
|
```bash
|
|
curl -i -X POST "$BASE/api/v1/sdwan/edit" \
|
|
-H "Authorization: Bearer $APIKEY_TOKEN" \
|
|
-H 'Content-Type: application/json' \
|
|
-d '{"enabled":true,"gatewayCIDR":"10.200.10.0/24"}'
|
|
# expect: 403
|
|
|
|
curl -i -X POST "$BASE/api/v1/nodes/kick" \
|
|
-H "Authorization: Bearer $APIKEY_TOKEN" \
|
|
-H 'Content-Type: application/json' \
|
|
-d '{"node":"demo-node"}'
|
|
# expect: 403
|
|
```
|
|
|
|
## 3) operator can mutate common ops
|
|
|
|
```bash
|
|
curl -i -X POST "$BASE/api/v1/connect" \
|
|
-H "Authorization: Bearer $OP_TOKEN" \
|
|
-H 'Content-Type: application/json' \
|
|
-d '{"from":"n1","to":"n2","srcPort":10080,"dstPort":80,"appName":"test"}'
|
|
# expect: 200 (if nodes exist)
|
|
```
|
|
|
|
## 4) tenant isolation
|
|
|
|
```bash
|
|
# operator/admin from tenant A cannot operate tenant B node
|
|
curl -i -X POST "$BASE/api/v1/nodes/kick" \
|
|
-H "Authorization: Bearer $OP_TOKEN" \
|
|
-H 'Content-Type: application/json' \
|
|
-d '{"node":"tenantB-node"}'
|
|
# expect: 404
|
|
```
|
|
|
|
## 5) verify audit logs created
|
|
|
|
- actions expected in audit:
|
|
- `node_kick`
|
|
- `node_apps_push`
|
|
- `connect_request`
|
|
- `tenant_subnet_reassign`
|
|
- `sdwan_update`
|