mirror of
https://github.com/NginxProxyManager/nginx-proxy-manager.git
synced 2026-09-28 13:10:20 +01:00
302 lines
9.2 KiB
JavaScript
302 lines
9.2 KiB
JavaScript
/// <reference types="cypress" />
|
|
|
|
describe('Per-path Access Lists', () => {
|
|
const domain = 'website3.example.com';
|
|
|
|
const alpha = {
|
|
name: 'Path Alpha',
|
|
username: 'alpha-user',
|
|
password: 'alpha-pass',
|
|
};
|
|
|
|
const beta = {
|
|
name: 'Path Beta',
|
|
username: 'beta-user',
|
|
password: 'beta-pass',
|
|
};
|
|
|
|
let token;
|
|
let alphaListId;
|
|
let betaListId;
|
|
let hostId;
|
|
|
|
/**
|
|
* Requests a path on the proxy host directly (bypassing squid)
|
|
* and yields the HTTP status code and response body
|
|
*
|
|
* @param {string} path
|
|
* @param {object} [creds]
|
|
* @param {string} creds.username
|
|
* @param {string} creds.password
|
|
*/
|
|
const request = (path, creds) => {
|
|
const auth = creds ? `-u '${creds.username}:${creds.password}'` : '';
|
|
return cy.exec(`curl --noproxy '*' -s -w '\n%{http_code}' ${auth} http://${domain}${path}`)
|
|
.then((result) => {
|
|
expect(result.exitCode).to.eq(0);
|
|
const lines = result.stdout.trim().split('\n');
|
|
const status = lines.pop();
|
|
return { status: status, body: lines.join('\n') };
|
|
});
|
|
};
|
|
|
|
// nginx reloads are signalled and return immediately, so the old
|
|
// config can still be served for a moment after an API change.
|
|
// Retry until the expected response is seen.
|
|
const waitForResponse = (path, creds, check, description) => {
|
|
// Copy now, the callback runs later and creds may have been changed by then
|
|
const credsCopy = creds ? { ...creds } : null;
|
|
let last = null;
|
|
cy.waitUntil(() => request(path, credsCopy).then((res) => {
|
|
last = res;
|
|
return check(res);
|
|
}), {
|
|
timeout: 15000,
|
|
interval: 500,
|
|
errorMsg: () => `${path} did not return ${description}, last status: ${last?.status}`,
|
|
});
|
|
};
|
|
|
|
const expectStatus = (path, creds, status) => {
|
|
waitForResponse(path, creds, (res) => res.status === status, status);
|
|
};
|
|
|
|
// Also checks the body so we know the page came from examplesite
|
|
// and not the NPM default site
|
|
const expectPage = (path, creds, text) => {
|
|
waitForResponse(path, creds, (res) => res.status === '200' && res.body.includes(text), `200 with "${text}"`);
|
|
};
|
|
|
|
const createAccessList = (list) => {
|
|
return cy.task('backendApiPost', {
|
|
token: token,
|
|
path: '/api/nginx/access-lists',
|
|
data: {
|
|
name: list.name,
|
|
satisfy_any: false,
|
|
pass_auth: false,
|
|
items: [
|
|
{
|
|
username: list.username,
|
|
password: list.password,
|
|
}
|
|
],
|
|
clients: [],
|
|
}
|
|
}).then((data) => {
|
|
cy.validateSwaggerSchema('post', 201, '/nginx/access-lists', data);
|
|
expect(data).to.have.property('id');
|
|
expect(data.id).to.be.greaterThan(0);
|
|
return cy.wrap(data.id);
|
|
});
|
|
};
|
|
|
|
const location = (path, accessListId) => {
|
|
return {
|
|
path: path,
|
|
forward_scheme: 'http',
|
|
forward_host: 'examplesite',
|
|
forward_port: 80,
|
|
access_list_id: accessListId,
|
|
};
|
|
};
|
|
|
|
before(() => {
|
|
cy.resetUsers();
|
|
cy.getToken().then((tok) => {
|
|
token = tok;
|
|
});
|
|
});
|
|
|
|
it('Should be able to create multiple access lists with credentials', () => {
|
|
createAccessList(alpha).then((id) => {
|
|
alphaListId = id;
|
|
});
|
|
createAccessList(beta).then((id) => {
|
|
betaListId = id;
|
|
expect(betaListId).to.not.equal(alphaListId);
|
|
});
|
|
});
|
|
|
|
it('Should be able to create a proxy host with a different access list per location', () => {
|
|
cy.task('backendApiPost', {
|
|
token: token,
|
|
path: '/api/nginx/proxy-hosts',
|
|
data: {
|
|
domain_names: [domain],
|
|
forward_scheme: 'http',
|
|
forward_host: 'examplesite',
|
|
forward_port: 80,
|
|
access_list_id: 0,
|
|
certificate_id: 0,
|
|
meta: {
|
|
dns_challenge: false
|
|
},
|
|
advanced_config: '',
|
|
locations: [
|
|
location('/dashboard', alphaListId),
|
|
location('/profile', betaListId),
|
|
],
|
|
block_exploits: false,
|
|
caching_enabled: false,
|
|
allow_websocket_upgrade: false,
|
|
http2_support: false,
|
|
hsts_enabled: false,
|
|
hsts_subdomains: false,
|
|
ssl_forced: false
|
|
}
|
|
}).then((data) => {
|
|
cy.validateSwaggerSchema('post', 201, '/nginx/proxy-hosts', data);
|
|
expect(data).to.have.property('id');
|
|
expect(data.id).to.be.greaterThan(0);
|
|
hostId = data.id;
|
|
expect(data).to.have.property('enabled', true);
|
|
expect(data).to.have.property('access_list_id', 0);
|
|
expect(data.locations).to.have.length(2);
|
|
expect(data.locations[0]).to.have.property('access_list_id', alphaListId);
|
|
expect(data.locations[1]).to.have.property('access_list_id', betaListId);
|
|
});
|
|
});
|
|
|
|
it('Should persist the location access lists on the proxy host', () => {
|
|
cy.task('backendApiGet', {
|
|
token: token,
|
|
path: `/api/nginx/proxy-hosts/${hostId}`,
|
|
}).then((data) => {
|
|
cy.validateSwaggerSchema('get', 200, '/nginx/proxy-hosts/{hostID}', data);
|
|
expect(data.locations[0]).to.have.property('path', '/dashboard');
|
|
expect(data.locations[0]).to.have.property('access_list_id', alphaListId);
|
|
expect(data.locations[1]).to.have.property('path', '/profile');
|
|
expect(data.locations[1]).to.have.property('access_list_id', betaListId);
|
|
});
|
|
});
|
|
|
|
it('Should not require auth for the host root', () => {
|
|
expectPage('/', null, 'this is the index page');
|
|
});
|
|
|
|
it('Should only accept the alpha credentials on /dashboard', () => {
|
|
expectStatus('/dashboard', null, '401');
|
|
expectStatus('/dashboard', beta, '401');
|
|
expectPage('/dashboard', alpha, 'this is the dashboard page');
|
|
});
|
|
|
|
it('Should only accept the beta credentials on /profile', () => {
|
|
expectStatus('/profile', null, '401');
|
|
expectStatus('/profile', alpha, '401');
|
|
expectPage('/profile', beta, 'this is the profile page');
|
|
});
|
|
|
|
it('Should apply access list credential changes to locations using it', () => {
|
|
const newPassword = 'alpha-pass-changed';
|
|
|
|
cy.task('backendApiPut', {
|
|
token: token,
|
|
path: `/api/nginx/access-lists/${alphaListId}`,
|
|
data: {
|
|
name: alpha.name,
|
|
satisfy_any: false,
|
|
pass_auth: false,
|
|
items: [
|
|
{
|
|
username: alpha.username,
|
|
password: newPassword,
|
|
}
|
|
],
|
|
clients: [],
|
|
}
|
|
}).then((data) => {
|
|
cy.validateSwaggerSchema('put', 200, '/nginx/access-lists/{listID}', data);
|
|
expect(data).to.have.property('id', alphaListId);
|
|
});
|
|
|
|
expectStatus('/dashboard', alpha, '401');
|
|
expectPage('/dashboard', { username: alpha.username, password: newPassword }, 'this is the dashboard page');
|
|
alpha.password = newPassword;
|
|
|
|
// Other locations are unaffected
|
|
expectStatus('/profile', null, '401');
|
|
expectPage('/profile', beta, 'this is the profile page');
|
|
});
|
|
|
|
it('Should inherit the host access list on locations without their own', () => {
|
|
// Host uses beta, /dashboard overrides with alpha, /missing has none and should inherit beta
|
|
cy.task('backendApiPut', {
|
|
token: token,
|
|
path: `/api/nginx/proxy-hosts/${hostId}`,
|
|
data: {
|
|
access_list_id: betaListId,
|
|
locations: [
|
|
location('/dashboard', alphaListId),
|
|
location('/profile', betaListId),
|
|
location('/missing', 0),
|
|
],
|
|
}
|
|
}).then((data) => {
|
|
// No swagger validation here: with a host access list set, the expanded
|
|
// access_list in the response has no proxy_host_count, which the schema requires
|
|
expect(data).to.have.property('access_list_id', betaListId);
|
|
expect(data.locations[2]).to.have.property('access_list_id', 0);
|
|
});
|
|
|
|
expectStatus('/', null, '401');
|
|
expectStatus('/', alpha, '401');
|
|
expectPage('/', beta, 'this is the index page');
|
|
|
|
// examplesite returns 404 for this path, once past the access list
|
|
expectStatus('/missing', null, '401');
|
|
expectStatus('/missing', alpha, '401');
|
|
expectStatus('/missing', beta, '404');
|
|
|
|
expectStatus('/dashboard', beta, '401');
|
|
expectPage('/dashboard', alpha, 'this is the dashboard page');
|
|
});
|
|
|
|
it('Should remove a deleted access list from the host and locations using it', () => {
|
|
cy.task('backendApiDelete', {
|
|
token: token,
|
|
path: `/api/nginx/access-lists/${betaListId}`,
|
|
}).then((data) => {
|
|
cy.validateSwaggerSchema('delete', 200, '/nginx/access-lists/{listID}', data);
|
|
expect(data).to.be.equal(true);
|
|
});
|
|
|
|
cy.task('backendApiGet', {
|
|
token: token,
|
|
path: `/api/nginx/proxy-hosts/${hostId}`,
|
|
}).then((data) => {
|
|
expect(data).to.have.property('access_list_id', 0);
|
|
expect(data.locations[0]).to.have.property('access_list_id', alphaListId);
|
|
expect(data.locations[1]).to.have.property('access_list_id', 0);
|
|
expect(data.locations[2]).to.have.property('access_list_id', 0);
|
|
});
|
|
|
|
expectPage('/', null, 'this is the index page');
|
|
expectPage('/profile', null, 'this is the profile page');
|
|
expectStatus('/missing', null, '404');
|
|
|
|
// Remaining location access list must still be enforced
|
|
expectStatus('/dashboard', null, '401');
|
|
expectPage('/dashboard', alpha, 'this is the dashboard page');
|
|
});
|
|
|
|
it('Should be able to delete the proxy host and remaining access list', () => {
|
|
cy.task('backendApiDelete', {
|
|
token: token,
|
|
path: `/api/nginx/proxy-hosts/${hostId}`,
|
|
}).then((data) => {
|
|
cy.validateSwaggerSchema('delete', 200, '/nginx/proxy-hosts/{hostID}', data);
|
|
expect(data).to.be.equal(true);
|
|
});
|
|
|
|
cy.task('backendApiDelete', {
|
|
token: token,
|
|
path: `/api/nginx/access-lists/${alphaListId}`,
|
|
}).then((data) => {
|
|
cy.validateSwaggerSchema('delete', 200, '/nginx/access-lists/{listID}', data);
|
|
expect(data).to.be.equal(true);
|
|
});
|
|
});
|
|
|
|
});
|