Skip to content

Commit 47b99c5

Browse files
jaapmarcusjaapmarcus
authored
Add tests to test API + Fix issues with api (hestiacp#2587)
* Remove + sign from key generator * Also % caused issues + Add support for v-make-tmp-file * Adjust hash_valid function to allow for Access:Secret key fromat * Resolve issues with api Legacy api broke due to changes for PHP8.1 causing v-add-user package field was empty New API didn't support v-make-tmp-file causing DNS cluster to break * Fix issue with v-make-tmp-file not working (Hash / PW) * Check if permissions alllow creation of tmp file * Fix issue with sync-dns-cluster not working When Debug mode is enable it will log commands to /var/log/hestia/api.log
1 parent 9f45b3f commit 47b99c5

File tree

8 files changed

+233
-91
lines changed

8 files changed

+233
-91
lines changed

‎bin/v-add-access-key‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ keygen() {
3131

3232
local MATRIX='0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz'
3333
if [[ "$USE_SPECIAL_CHARACTERS" == "yes" ]]; then
34-
MATRIX+='_-+^~=%'
34+
MATRIX+='_-^~='
3535
fi
3636

3737
local PASS N

‎func/main.sh‎

Lines changed: 21 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1108,7 +1108,7 @@ is_service_format_valid() {
11081108
}
11091109

11101110
is_hash_format_valid() {
1111-
if ! [[ "$1" =~ ^[-_A-Za-z0-9]{1,32}$ ]]; then
1111+
if ! [[ "$1" =~ ^[[:alnum:]|\:|\=|_|-]{1,80}$ ]]; then
11121112
check_result "$E_INVALID" "invalid $2 format :: $1"
11131113
fi
11141114
}
@@ -1297,16 +1297,33 @@ check_access_key_cmd() {
12971297
local access_key_id="$(basename "$1")"
12981298
local cmd=$2
12991299
local -n user_arg_position=$3
1300-
1300+
1301+
if [[ "$DEBUG_MODE" = "true" ]]; then
1302+
new_timestamp
1303+
echo "[$date:$time] $1 $2" >> /var/log/hestia/api.log
1304+
fi
13011305
if [[ -z "$access_key_id" || ! -f "$HESTIA/data/access-keys/${access_key_id}" ]]; then
13021306
check_result "$E_FORBIDEN" "Access key $access_key_id doesn't exist"
13031307
fi
1304-
1308+
13051309
if [[ -z "$cmd" ]]; then
13061310
check_result "$E_FORBIDEN" "Command not provided"
1311+
elif [[ "$cmd" = 'v-make-tmp-file' ]]; then
1312+
USER="" PERMISSIONS=""
1313+
source_conf "${HESTIA}/data/access-keys/${access_key_id}"
1314+
local allowed_commands
1315+
if [[ -n "$PERMISSIONS" ]]; then
1316+
allowed_commands="$(get_apis_commands "$PERMISSIONS")"
1317+
if [[ -z "$(echo ",${allowed_commands}," | grep ",${hst_command},")" ]]; then
1318+
check_result "$E_FORBIDEN" "Key $access_key_id don't have permission to run the command $hst_command"
1319+
fi
1320+
elif [[ -z "$PERMISSIONS" && "$USER" != "admin" ]]; then
1321+
check_result "$E_FORBIDEN" "Key $access_key_id don't have permission to run the command $hst_command"
1322+
fi
1323+
user_arg_position="0"
13071324
elif [[ ! -e "$BIN/$cmd" ]]; then
13081325
check_result "$E_FORBIDEN" "Command $cmd not found"
1309-
else
1326+
else
13101327
USER="" PERMISSIONS=""
13111328
source_conf "${HESTIA}/data/access-keys/${access_key_id}"
13121329

‎install/deb/api/billing‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
11
ROLE='admin'
2-
COMMANDS='v-add-user,v-delete-user,v-suspend-user,v-unsuspend-user,v-change-user-shell,v-list-user,v-list-users,v-make-tmp-file,v-add-domain,v-change-user-package'
2+
COMMANDS='v-add-user,v-delete-user,v-suspend-user,v-unsuspend-user,v-change-user-shell,v-list-user,v-list-users,v-make-tmp-file,v-add-domain,v-change-user-package,v-make-tmp-file'

‎install/deb/api/sync-dns-cluster‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
11
ROLE='admin'
2-
COMMANDS='v-delete-dns-domains-src,v-insert-dns-domain,v-insert-dns-records,v-rebuild-dns-domains,v-delete-dns-record'
2+
COMMANDS='v-list-sys-config,v-list-user,v-add-cron-restart-job,v-delete-dns-domains-src,v-insert-dns-domain,v-insert-dns-record,v-insert-dns-records,v-rebuild-dns-domains,v-delete-dns-record,v-make-tmp-file,v-insert-dns-domain'

‎install/upgrade/versions/1.6.0.sh‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -69,9 +69,8 @@ if [ -z "$(grep v-update-lets $HESTIA/data/users/admin/cron.conf)" ]; then
6969
fi
7070

7171
# Add apis if they don't exist
72-
if [[ ! -d $HESTIA/data/api ]]; then
73-
cp -rf $HESTIA_INSTALL_DIR/api $HESTIA/data/
74-
fi
72+
# Changes have been made make sure to overwrite them to prevent issues in the future
73+
cp -rf $HESTIA_INSTALL_DIR/api $HESTIA/data/
7574

7675
# Update Cloudflare address
7776
if [ -f /etc/nginx/nginx.conf ] && [ "$(grep 'set_real_ip_from 2405:8100::/32' /etc/nginx/nginx.conf)" = "" ];then

‎test/api.bats‎

Lines changed: 151 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,151 @@
1+
#!/usr/bin/env bats
2+
3+
if [ "${PATH#*/usr/local/hestia/bin*}" = "$PATH" ]; then
4+
. /etc/profile.d/hestia.sh
5+
fi
6+
7+
load 'test_helper/bats-support/load'
8+
load 'test_helper/bats-assert/load'
9+
load 'test_helper/bats-file/load'
10+
11+
12+
function random() {
13+
head /dev/urandom | tr -dc 0-9 | head -c$1
14+
}
15+
16+
function setup() {
17+
source /tmp/hestia-api-env.sh
18+
source $HESTIA/func/main.sh
19+
source $HESTIA/conf/hestia.conf
20+
source $HESTIA/func/ip.sh
21+
}
22+
23+
@test "[Success][ Admin/password ] List users" {
24+
run curl -k -s -X POST -H "Content-Type: application/x-www-form-urlencoded" -d "user=admin&password=$password&returncode=no&cmd=v-list-users&arg1=plain" "https://$server:$port/api/index.php"
25+
assert_success
26+
assert_output --partial "admin"
27+
}
28+
29+
@test "[Success][ Hash ] List users" {
30+
run curl -k -s -X POST -H "Content-Type: application/x-www-form-urlencoded" -d "hash=$apikey&returncode=no&cmd=v-list-users&arg1=plain" "https://$server:$port/api/index.php"
31+
assert_success
32+
assert_output --partial "admin"
33+
}
34+
35+
@test "[Fail][ APIV2 ] Create new user" {
36+
run curl -k -s -X POST -H "Content-Type: application/x-www-form-urlencoded" -d "hash=$accesskey&returncode=yes&cmd=v-add-user&arg1=hestiatest&arg2=strongpassword&arg3=info@hestiacp.com" "https://$server:$port/api/index.php"
37+
assert_success
38+
assert_output --partial "don't have permission to run the command v-add-user"
39+
}
40+
41+
@test "[Success][ Hash ] Create tmp file" {
42+
run curl -k -s -X POST -H "Content-Type: application/x-www-form-urlencoded" -d "hash=$apikey&cmd=v-make-tmp-file&arg1=strongpassword&arg2=clusterpassword" "https://$server:$port/api/index.php"
43+
assert_success
44+
assert_output --partial "OK"
45+
}
46+
47+
@test "[Success][ Hash ] Create new user" {
48+
run curl -k -s -X POST -H "Content-Type: application/x-www-form-urlencoded" -d "hash=$apikey&cmd=v-add-user&arg1=hestiatest&arg2=/tmp/clusterpassword&arg3=info@hestiacp.com&arg4=default" "https://$server:$port/api/index.php"
49+
assert_success
50+
assert_output --partial "OK"
51+
}
52+
53+
@test "[Success][ Hash ] Check password" {
54+
run curl -k -s -X POST -H "Content-Type: application/x-www-form-urlencoded" -d "hash=$apikey&cmd=v-check-user-password&arg1=hestiatest&arg2=strongpassword" "https://$server:$port/api/index.php"
55+
assert_success
56+
assert_output --partial "OK"
57+
}
58+
59+
60+
@test "[Success][ Local ] Add user" {
61+
run v-add-user hestiatest 1234BCD info@hestiacp.com
62+
assert_success
63+
}
64+
65+
@test "[Success][ Local ] Add DNS domain" {
66+
run v-add-dns-domain hestiatest ilovehestiacp.com 127.0.0.1
67+
assert_success
68+
}
69+
70+
@test "[Success][ APIV2 ] Add remote DNS host" {
71+
run v-add-remote-dns-host $server $port "$accesskey" '' api 'hestiatest'
72+
assert_success
73+
}
74+
75+
@test "[Success][ APIV2 ] Sync DNS cluster 1" {
76+
run v-sync-dns-cluster
77+
assert_success
78+
}
79+
80+
@test "[Success][ Local ] nslookup ilovehestiacp.com" {
81+
run nslookup ilovehestiacp.com $server
82+
assert_success
83+
assert_output --partial "127.0.0.1"
84+
}
85+
86+
@test "[Success][ Local ] Add DNS domain 2" {
87+
run v-add-dns-domain hestiatest ilovehestiacp.org 127.0.0.1
88+
assert_success
89+
}
90+
91+
@test "[Success][ Local ] Add DNS record" {
92+
run v-add-dns-record hestiatest ilovehestiacp.org test A 127.0.0.1 yes 20
93+
assert_success
94+
}
95+
96+
@test "[Success][ Local ] nslookup test.ilovehestiacp.org" {
97+
run nslookup test.ilovehestiacp.org $server
98+
assert_failure 1
99+
assert_output --partial "REFUSED"
100+
101+
run nslookup test.ilovehestiacp.org localhost
102+
assert_success
103+
assert_output --partial "127.0.0.1"
104+
}
105+
106+
@test "[Success][ APIV2 ] Sync DNS cluster 2" {
107+
run v-sync-dns-cluster
108+
assert_success
109+
110+
run nslookup test.ilovehestiacp.org $server
111+
assert_success
112+
assert_output --partial "127.0.0.1"
113+
}
114+
115+
@test "[Success][ Local ] Delete DNS record" {
116+
run v-delete-dns-record hestiatest ilovehestiacp.org 20
117+
assert_success
118+
}
119+
120+
@test "[Success][ Local ] nslookup test.ilovehestiacp.org 2" {
121+
run nslookup test.ilovehestiacp.org $server
122+
assert_success
123+
assert_output --partial "127.0.0.1"
124+
125+
run nslookup test.ilovehestiacp.org localhost
126+
assert_failure
127+
}
128+
129+
@test "[Success][ APIV2 ] Sync DNS cluster 3" {
130+
run v-sync-dns-cluster
131+
assert_success
132+
133+
run nslookup test.ilovehestiacp.org $server
134+
assert_failure
135+
}
136+
137+
138+
@test "[Success][ APIV2 ] Delete remote DNS host" {
139+
run v-delete-remote-dns-host $server
140+
assert_success
141+
}
142+
143+
144+
@test "[Success][ Local ] Delete user" {
145+
run v-delete-user hestiatest
146+
assert_success
147+
}
148+
149+
@test "[Success][ Hash ] Delete user" {
150+
run curl -k -s -X POST -H "Content-Type: application/x-www-form-urlencoded" -d "hash=$apikey&cmd=v-delete-user&arg1=hestiatest" "https://$server:$port/api/index.php"
151+
}

‎test/checks.bats‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,10 @@ function setup() {
3535
source $HESTIA/func/ip.sh
3636
}
3737

38+
@test "is_hash_format_valid accesskey:secret valid" {
39+
run is_hash_format_valid 'bxDaKPyAfLPRgSkoqlkI:Pc8czGPRECp3GxTNMr3LF6zWc8cjfPrNHy_-=A' "hash"
40+
assert_success
41+
}
3842
@test "is_access_key_id_format_valid valid" {
3943
run is_access_key_id_format_valid 'M0ocDoIKbsoXSqtk1mgc' "key"
4044
assert_success

0 commit comments

Comments
 (0)