k2safe/orbit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: let administrators view and copy encrypted integration credentials

Browse Source
This commit is contained in:
k2safe
2026-09-27 13:48:26 +08:00
parent 5555a7b342
commit d54bdd9847
38 changed files with 905 additions and 71 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
scripts/test-console-applications.py
View File

@@ -32,6 +32,8 @@ def call(path, body=None, token=None, headers=None, expected=200, session=True):
response = error
with response:
status = response.status
if path.startswith("/console/applications"):
assert response.headers.get("Cache-Control") == "no-store"
value = json.load(response)
assert status == expected, f'{path}: HTTP {status}, expected {expected}; code={value.get("error", {}).get("code")}'
return value.get('data', value)
@@ -60,6 +62,16 @@ page = call('/console/applications')
assert any(x['namespace_id'] == op['namespace_id'] for x in page['items'])
detail = call('/console/applications/' + op['namespace_id'])
assert op['token'] not in json.dumps(detail)
assert detail['token_vault_enabled'] and detail['credentials'][0]['token_stored']
token_path = '/console/applications/' + op['namespace_id'] + '/credentials/' + op['credential_id'] + '/token/'
assert call(token_path + 'reveal', {'expected_revision':'1'})['token'] == op['token']
call(token_path + 'reveal', {'expected_revision':'1'}, token=op['token'], session=False, expected=401)
call(token_path + 'reveal', {'expected_revision':'1'}, headers={'Origin':'https://other.invalid'}, expected=403)
call(token_path + 'reveal', {'expected_revision':'1'}, headers={'X-Orbit-Console':''}, expected=403)
call(token_path + 'reveal', {'expected_revision':'1'}, headers={'Sec-Fetch-Site':'cross-site'}, expected=403)
call(token_path + 'reveal', {'expected_revision':'2'}, expected=409)
assert call(token_path + 'import', {'expected_revision':'1', 'token':op['token']})['token'] == op['token']
queue = detail['queues'][0]['id']
assert queue == op['queue_id']
call('/console/applications', token=op['token'], expected=401, session=False)
@@ -85,12 +97,17 @@ assert call('/console/applications/apply', rotate)['deduplicated']
call('/v1/queues/' + queue, token=op['token'], session=False)
call('/v1/queues/' + queue, token=rotate['token'], session=False)
assert call('/console/applications/' + op['namespace_id'])['credentials'][0]['previous_valid_until']
assert call(token_path + 'reveal', {'expected_revision':'3'})['token'] == rotate['token']
call(token_path + 'import', {'expected_revision':'3', 'token':op['token']}, expected=400)
call(token_path + 'reveal', {'expected_revision':'2'}, expected=409)
finalize = call('/console/applications/prepare', {'kind': 'FINALIZE', 'namespace_id': op['namespace_id'], 'credential_id': op['credential_id'], 'expected_revision': '3', 'valid_days': 0, 'reason': 'all services switched'})
if private:
Path(private, 'finalize.operation.json').write_text(json.dumps(finalize))
assert 'token' not in finalize
assert call('/console/applications/apply', finalize)['revision'] == '4'
assert call('/console/applications/apply', finalize)['deduplicated']
assert call(token_path + 'reveal', {'expected_revision':'4'})['token'] == rotate['token']
call('/v1/queues/' + queue, token=op['token'], expected=401, session=False)
call('/v1/queues/' + queue, token=rotate['token'], session=False)
# 重放旧轮换回执不能重新启用已经结束过渡的秘密。
@@ -135,7 +152,8 @@ assert call('/v1/subscriptions/' + subscription_id, token=rotate['token'], sessi
assert call('/console/scope')['entry']['namespace_id'] == original_scope['entry']['namespace_id']
print('PASS: scoped task/schedule/workflow/subscription/retention/archive reads, subscription management/replay, SDK ownership, CSRF and cross-application isolation')
call('/console/auth/logout', {})
call(token_path + 'reveal', {'expected_revision':'4'}, expected=401)
call('/console/applications', expected=401)
call('/v1/tasks/' + task_id, headers=scope_headers, expected=401)
print('PASS: application create/replay, CSRF/session isolation, permanent expiry, overlapping rotation/finalization, original task/subscription preserved, logout')
print('PASS: encrypted Token reveal/import, session/CSRF/no-store/current-generation checks, application create/replay, CSRF/session isolation, permanent expiry, overlapping rotation/finalization, original task/subscription preserved, logout')
print('Test application: ' + name)