def testWithFlowsWithoutVfsAndSingleProperlyLabeledAndApprovedClient(self):
self.RequestAndGrantClientApproval(self.client_urn)
params = api_router.ApiLabelsRestrictedCallRouterParams(
labels_whitelist=["foo"], allow_flows_access=True)
router = api_router.ApiLabelsRestrictedCallRouter(params=params)
self.CheckOnlyFollowingMethodsArePermitted(
router,
[
# Clients methods.
"SearchClients",
"ListClientApprovals",
"GetClient",
"GetClientVersions",
"GetClientVersionTimes",
"CreateClientApproval",
"GetClientApproval",
# Flows methods.
"ListFlows",
"GetFlow",
"CreateFlow",
"CancelFlow",
"ListFlowResults",
"GetFlowResultsExportCommand",
"GetFlowFilesArchive",
"ListFlowOutputPlugins",
"ListFlowOutputPluginLogs",
"ListFlowOutputPluginErrors",
"ListFlowLogs",
] + self.NON_ACLED_METHODS) # pyformat: disable
def testWithoutFlowsWithVfsAndSingleProperlyLabeledAndApprovedClient(self):
self.RequestAndGrantClientApproval(self.client_urn)
params = api_router.ApiLabelsRestrictedCallRouterParams(
labels_whitelist=["foo"], allow_vfs_access=True)
router = api_router.ApiLabelsRestrictedCallRouter(params=params)
self.CheckOnlyFollowingMethodsArePermitted(
router,
[
# Client methods.
"SearchClients",
"ListClientApprovals",
"GetClient",
"GetClientVersions",
"GetClientVersionTimes",
"CreateClientApproval",
"GetClientApproval",
# VFS methods
"ListFiles",
"GetFileDetails",
"GetFileText",
"GetFileBlob",
"GetFileVersionTimes",
"GetFileDownloadCommand",
"CreateVfsRefreshOperation",
"GetVfsRefreshOperationState",
"GetVfsTimeline",
"GetVfsTimelineAsCsv"
] + self.NON_ACLED_METHODS) # pyformat: disable
def testWithoutFlowsWithoutVfsAndUnapprovedClientWithWrongLabelOwner(self):
params = api_router.ApiLabelsRestrictedCallRouterParams(
labels_whitelist=["foo"], labels_owners_whitelist=["somebody"])
router = api_router.ApiLabelsRestrictedCallRouter(params=params)
self.CheckOnlyFollowingMethodsArePermitted(
router, ["SearchClients", "ListClientApprovals"] +
self.NON_ACLED_METHODS) # pyformat: disable
def testWithoutFlowsWithoutVfsAndUnapprovedClientWithWrongLabelName(self):
params = api_router.ApiLabelsRestrictedCallRouterParams(
allow_labels=["bar"])
router = api_router.ApiLabelsRestrictedCallRouter(params=params)
self.CheckOnlyFollowingMethodsArePermitted(
router, ["SearchClients", "ListClientApprovals"] +
self.NON_ACLED_METHODS) # pyformat: disable
def testWithFlowsWithoutVfsAndSingleMislabeledUnapprovedClient(self):
params = api_router.ApiLabelsRestrictedCallRouterParams(
allow_flows_access=True)
router = api_router.ApiLabelsRestrictedCallRouter(params=params)
self.CheckOnlyFollowingMethodsArePermitted(router, [
"SearchClients",
"ListClientApprovals",
] + self.NON_ACLED_METHODS) # pyformat: disable
def testWithoutFlowsWithoutVfsAndSingleProperlyLabeledApprovedClient(self):
self.RequestAndGrantClientApproval(self.client_urn)
params = api_router.ApiLabelsRestrictedCallRouterParams(
labels_whitelist=["foo"])
router = api_router.ApiLabelsRestrictedCallRouter(params=params)
self.CheckOnlyFollowingMethodsArePermitted(router, [
"SearchClients", "ListClientApprovals", "GetClient",
"GetClientVersions", "GetClientVersionTimes",
"CreateClientApproval", "GetClientApproval"
] + self.NON_ACLED_METHODS) # pyformat: disable
def testWithoutFlowsWithVfsAndSingleMislabeledUnapprovedClient(self):
params = api_router.ApiLabelsRestrictedCallRouterParams(
allow_vfs_access=True)
router = api_router.ApiLabelsRestrictedCallRouter(params=params)
self.CheckOnlyFollowingMethodsArePermitted(router, [
"SearchClients",
"ListClientApprovals",
# This operation is always allowed as it doesn't depend on a client
# id.
"GetVfsRefreshOperationState"
] + self.NON_ACLED_METHODS) # pyformat: disable
def testWithFlowsWithoutVfsAndSingleProperlyLabeledUnapprovedClient(self):
params = api_router.ApiLabelsRestrictedCallRouterParams(
labels_whitelist=["foo"], allow_flows_access=True)
router = api_router.ApiLabelsRestrictedCallRouter(params=params)
self.CheckOnlyFollowingMethodsArePermitted(router, [
"SearchClients",
"ListClientApprovals",
"GetClient",
"GetClientVersions",
"GetClientVersionTimes",
"CreateClientApproval",
"GetClientApproval",
] + self.NON_ACLED_METHODS) # pyformat: disable