inp2p/docs/rbac-regression-checklist.md

INP2P RBAC Regression Checklist

Replace placeholders:

• BASE=http://127.0.0.1:27183
• ADMIN_TOKEN=<tenant admin session token>
• OP_TOKEN=<tenant operator session token>
• APIKEY_TOKEN=<tenant api key>

1) enroll revoke must be admin-only

curl -i -X POST "$BASE/api/v1/enroll/consume/1?status=0" \
  -H "Authorization: Bearer $OP_TOKEN"
# expect: 401/403

curl -i -X POST "$BASE/api/v1/enroll/consume/1?status=0" \
  -H "Authorization: Bearer $APIKEY_TOKEN"
# expect: 401/403

2) apikey cannot mutate

curl -i -X POST "$BASE/api/v1/sdwan/edit" \
  -H "Authorization: Bearer $APIKEY_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"enabled":true,"gatewayCIDR":"10.200.10.0/24"}'
# expect: 403

curl -i -X POST "$BASE/api/v1/nodes/kick" \
  -H "Authorization: Bearer $APIKEY_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"node":"demo-node"}'
# expect: 403

3) operator can mutate common ops

curl -i -X POST "$BASE/api/v1/connect" \
  -H "Authorization: Bearer $OP_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"from":"n1","to":"n2","srcPort":10080,"dstPort":80,"appName":"test"}'
# expect: 200 (if nodes exist)

4) tenant isolation

# operator/admin from tenant A cannot operate tenant B node
curl -i -X POST "$BASE/api/v1/nodes/kick" \
  -H "Authorization: Bearer $OP_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"node":"tenantB-node"}'
# expect: 404

5) verify audit logs created

• actions expected in audit:
  • node_kick
  • node_apps_push
  • connect_request
  • tenant_subnet_reassign
  • sdwan_update