ic-auth 0.23.0

Portable authentication, delegation proof verification and local session machinery
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90

//! Structural evidence is immutable and independent of authority/proof admission.
use ic_auth::{
    canonical::CanonicalAuthError, certificate_issuance::GrantValidationError as Error,
    portable::ValidatedGrants,
};
use ic_auth_protocol_types::DelegatedRoleGrant;

fn grants(roles: usize, scopes: usize) -> Vec<DelegatedRoleGrant> {
    (0..roles)
        .map(|role| DelegatedRoleGrant {
            target: format!("role{role:02}").parse().unwrap(),
            scopes: (0..scopes)
                .map(|scope| format!("scope{scope:02}"))
                .collect(),
        })
        .collect()
}

#[test]
fn exact_portable_cardinality_limits_preserve_original_grants() {
    for (roles, scopes) in [(1, 1), (16, 32)] {
        let original = grants(roles, scopes);
        let checked = ValidatedGrants::new(original.clone()).unwrap();
        assert_eq!(checked.as_slice(), original);
        assert_eq!(checked.clone(), checked);
        assert_eq!(checked.into_vec(), original);
    }
    assert_eq!(ValidatedGrants::new(vec![]), Err(Error::Empty));
    assert_eq!(
        ValidatedGrants::new(grants(17, 1)),
        Err(Error::TooMany { found: 17, max: 16 })
    );
    assert!(matches!(
        ValidatedGrants::new(grants(1, 0)),
        Err(Error::EmptyScopes { .. })
    ));
    assert!(matches!(
        ValidatedGrants::new(grants(1, 33)),
        Err(Error::TooManyScopes {
            found: 33,
            max: 32,
            ..
        })
    ));
}

#[test]
fn reject_noncanonical_or_invalid_labels_without_reordering_or_normalizing() {
    let original = grants(2, 2);
    let mut bad = original.clone();
    bad.reverse();
    assert_eq!(
        ValidatedGrants::new(bad),
        Err(Error::Canonical(CanonicalAuthError::NonCanonicalRoles))
    );
    let mut bad = original.clone();
    bad[1].target = bad[0].target.clone();
    assert_eq!(
        ValidatedGrants::new(bad),
        Err(Error::Canonical(CanonicalAuthError::NonCanonicalRoles))
    );
    for scopes in [
        vec!["write".into(), "read".into()],
        vec!["read".into(), "read".into()],
    ] {
        let mut bad = original.clone();
        bad[0].scopes = scopes;
        assert_eq!(
            ValidatedGrants::new(bad),
            Err(Error::Canonical(CanonicalAuthError::NonCanonicalScopes))
        );
    }
    for label in [
        "".to_owned(),
        "READ".into(),
        "read..write".into(),
        "x".repeat(65),
    ] {
        let mut bad = original.clone();
        bad[0].scopes = vec![label];
        assert!(matches!(
            ValidatedGrants::new(bad),
            Err(Error::Canonical(_))
        ));
    }
    assert_eq!(
        ValidatedGrants::new(original.clone()).unwrap().as_slice(),
        original
    );
}