Skip to content

Commit a81f688

Browse files
DaneEverittDaneEveritt
committed
Add test coverage for API key generation and deletion
1 parent 7a5f7b9 commit a81f688

File tree

2 files changed

+222
-0
lines changed

2 files changed

+222
-0
lines changed

‎app/Http/Controllers/Api/Client/ApiKeyController.php‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -103,6 +103,7 @@ public function store(StoreApiKeyRequest $request)
103103
public function delete(ClientApiRequest $request, string $identifier)
104104
{
105105
$response = $this->repository->deleteWhere([
106+
'key_type' => ApiKey::TYPE_ACCOUNT,
106107
'user_id' => $request->user()->id,
107108
'identifier' => $identifier,
108109
]);

‎tests/Integration/Api/Client/ApiKeyControllerTest.php‎

Lines changed: 221 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,221 @@
1+
<?php
2+
3+
namespace Pterodactyl\Tests\Integration\Api\Client;
4+
5+
use Pterodactyl\Models\User;
6+
use Illuminate\Http\Response;
7+
use Pterodactyl\Models\ApiKey;
8+
use Pterodactyl\Tests\Integration\IntegrationTestCase;
9+
10+
class ApiKeyControllerTest extends IntegrationTestCase
11+
{
12+
/**
13+
* Cleanup after tests.
14+
*/
15+
protected function tearDown(): void
16+
{
17+
ApiKey::query()->forceDelete();
18+
User::query()->forceDelete();
19+
20+
parent::tearDown();
21+
}
22+
23+
/**
24+
* Test that the client's API key can be returned successfully.
25+
*/
26+
public function testApiKeysAreReturned()
27+
{
28+
/** @var \Pterodactyl\Models\User $user */
29+
$user = factory(User::class)->create();
30+
/** @var \Pterodactyl\Models\ApiKey $key */
31+
$key = factory(ApiKey::class)->create([
32+
'user_id' => $user->id,
33+
'key_type' => ApiKey::TYPE_ACCOUNT,
34+
]);
35+
36+
$response = $this->actingAs($user)->get('/api/client/account/api-keys');
37+
38+
$response->assertOk();
39+
$response->assertJson([
40+
'object' => 'list',
41+
'data' => [
42+
[
43+
'object' => 'api_key',
44+
'attributes' => [
45+
'identifier' => $key->identifier,
46+
'description' => $key->memo,
47+
'allowed_ips' => $key->allowed_ips,
48+
'last_used_at' => null,
49+
'created_at' => $key->created_at->toIso8601String(),
50+
],
51+
],
52+
],
53+
]);
54+
}
55+
56+
/**
57+
* Test that an API key can be created for the client account. This also checks that the
58+
* API key secret is returned as metadata in the response since it will not be returned
59+
* after that point.
60+
*/
61+
public function testApiKeyCanBeCreatedForAccount()
62+
{
63+
/** @var \Pterodactyl\Models\User $user */
64+
$user = factory(User::class)->create();
65+
66+
// Small sub-test to ensure we're always comparing the number of keys to the
67+
// specific logged in account, and not just the total number of keys stored in
68+
// the database.
69+
factory(ApiKey::class)->create([
70+
'user_id' => factory(User::class)->create()->id,
71+
'key_type' => ApiKey::TYPE_ACCOUNT,
72+
]);
73+
74+
$response = $this->actingAs($user)->postJson('/api/client/account/api-keys', [
75+
'description' => 'Test Description',
76+
'allowed_ips' => ['127.0.0.1'],
77+
]);
78+
79+
$response->assertOk();
80+
81+
/** @var \Pterodactyl\Models\ApiKey $key */
82+
$key = ApiKey::query()->where('identifier', $response->json('attributes.identifier'))->firstOrFail();
83+
84+
$response->assertJson([
85+
'object' => 'api_key',
86+
'attributes' => [
87+
'identifier' => $key->identifier,
88+
'description' => 'Test Description',
89+
'allowed_ips' => ['127.0.0.1'],
90+
'last_used_at' => null,
91+
'created_at' => $key->created_at->toIso8601String(),
92+
],
93+
'meta' => [
94+
'secret_token' => decrypt($key->token),
95+
],
96+
]);
97+
}
98+
99+
/**
100+
* Test that no more than 5 API keys can exist at any one time for an account. This prevents
101+
* a DoS attack vector against the panel.
102+
*
103+
* @see https://github.com/pterodactyl/panel/security/advisories/GHSA-pjmh-7xfm-r4x9
104+
*/
105+
public function testNoMoreThanFiveApiKeysCanBeCreatedForAnAccount()
106+
{
107+
/** @var \Pterodactyl\Models\User $user */
108+
$user = factory(User::class)->create();
109+
factory(ApiKey::class)->times(5)->create([
110+
'user_id' => $user->id,
111+
'key_type' => ApiKey::TYPE_ACCOUNT,
112+
]);
113+
114+
$response = $this->actingAs($user)->postJson('/api/client/account/api-keys', [
115+
'description' => 'Test Description',
116+
'allowed_ips' => ['127.0.0.1'],
117+
]);
118+
119+
$response->assertStatus(Response::HTTP_BAD_REQUEST);
120+
$response->assertJsonPath('errors.0.code', 'DisplayException');
121+
$response->assertJsonPath('errors.0.detail', 'You have reached the account limit for number of API keys.');
122+
}
123+
124+
/**
125+
* Test that a bad request results in a validation error being returned by the API.
126+
*/
127+
public function testValidationErrorIsReturnedForBadRequests()
128+
{
129+
/** @var \Pterodactyl\Models\User $user */
130+
$user = factory(User::class)->create();
131+
132+
$response = $this->actingAs($user)->postJson('/api/client/account/api-keys', [
133+
'description' => '',
134+
'allowed_ips' => ['127.0.0.1'],
135+
]);
136+
137+
$response->assertStatus(Response::HTTP_UNPROCESSABLE_ENTITY);
138+
$response->assertJsonPath('errors.0.code', 'required');
139+
$response->assertJsonPath('errors.0.detail', 'The description field is required.');
140+
}
141+
142+
/**
143+
* Tests that an API key can be deleted from the account.
144+
*/
145+
public function testApiKeyCanBeDeleted()
146+
{
147+
/** @var \Pterodactyl\Models\User $user */
148+
$user = factory(User::class)->create();
149+
/** @var \Pterodactyl\Models\ApiKey $key */
150+
$key = factory(ApiKey::class)->create([
151+
'user_id' => $user->id,
152+
'key_type' => ApiKey::TYPE_ACCOUNT,
153+
]);
154+
155+
$response = $this->actingAs($user)->delete('/api/client/account/api-keys/' . $key->identifier);
156+
$response->assertStatus(Response::HTTP_NO_CONTENT);
157+
158+
$this->assertDatabaseMissing('api_keys', ['id' => $key->id]);
159+
}
160+
161+
/**
162+
* Test that trying to delete an API key that does not exist results in a 404.
163+
*/
164+
public function testNonExistentApiKeyDeletionReturns404Error()
165+
{
166+
/** @var \Pterodactyl\Models\User $user */
167+
$user = factory(User::class)->create();
168+
/** @var \Pterodactyl\Models\ApiKey $key */
169+
$key = factory(ApiKey::class)->create([
170+
'user_id' => $user->id,
171+
'key_type' => ApiKey::TYPE_ACCOUNT,
172+
]);
173+
174+
$response = $this->actingAs($user)->delete('/api/client/account/api-keys/1234');
175+
$response->assertNotFound();
176+
177+
$this->assertDatabaseHas('api_keys', ['id' => $key->id]);
178+
}
179+
180+
/**
181+
* Test that an API key that exists on the system cannot be deleted if the user
182+
* who created it is not the authenticated user.
183+
*/
184+
public function testApiKeyBelongingToAnotherUserCannotBeDeleted()
185+
{
186+
/** @var \Pterodactyl\Models\User $user */
187+
$user = factory(User::class)->create();
188+
/** @var \Pterodactyl\Models\User $user2 */
189+
$user2 = factory(User::class)->create();
190+
/** @var \Pterodactyl\Models\ApiKey $key */
191+
$key = factory(ApiKey::class)->create([
192+
'user_id' => $user2->id,
193+
'key_type' => ApiKey::TYPE_ACCOUNT,
194+
]);
195+
196+
$response = $this->actingAs($user)->delete('/api/client/account/api-keys/' . $key->identifier);
197+
$response->assertNotFound();
198+
199+
$this->assertDatabaseHas('api_keys', ['id' => $key->id]);
200+
}
201+
202+
/**
203+
* Tests that an application API key also belonging to the logged in user cannot be
204+
* deleted through this endpoint if it exists.
205+
*/
206+
public function testApplicationApiKeyCannotBeDeleted()
207+
{
208+
/** @var \Pterodactyl\Models\User $user */
209+
$user = factory(User::class)->create();
210+
/** @var \Pterodactyl\Models\ApiKey $key */
211+
$key = factory(ApiKey::class)->create([
212+
'user_id' => $user->id,
213+
'key_type' => ApiKey::TYPE_APPLICATION,
214+
]);
215+
216+
$response = $this->actingAs($user)->delete('/api/client/account/api-keys/' . $key->identifier);
217+
$response->assertNotFound();
218+
219+
$this->assertDatabaseHas('api_keys', ['id' => $key->id]);
220+
}
221+
}

0 commit comments

Comments
 (0)