fixup! multi: validate macaroons for lit calls

Author: ellemouton

itest/litd_mode_integrated_test.go

@@ -139,79 +139,55 @@ var (
 	}
 
 	endpoints = []struct {
-		name                        string
-		macaroonFn                  macaroonFn
-		requestFn                   requestFn
-		successPattern              string
-		supportsMacAuthOnLndPort    bool
-		supportsMacAuthOnLitPort    bool
-		supportsUIPasswordOnLndPort bool
-		supportsUIPasswordOnLitPort bool
-		allowedThroughLNC           bool
-		grpcWebURI                  string
-		restWebURI                  string
+		name              string
+		macaroonFn        macaroonFn
+		requestFn         requestFn
+		successPattern    string
+		allowedThroughLNC bool
+		grpcWebURI        string
+		restWebURI        string
 	}{{
-		name:                        "lnrpc",
-		macaroonFn:                  lndMacaroonFn,
-		requestFn:                   lndRequestFn,
-		successPattern:              "\"identity_pubkey\":\"0",
-		supportsMacAuthOnLndPort:    true,
-		supportsMacAuthOnLitPort:    true,
-		supportsUIPasswordOnLndPort: false,
-		supportsUIPasswordOnLitPort: true,
-		allowedThroughLNC:           true,
-		grpcWebURI:                  "/lnrpc.Lightning/GetInfo",
-		restWebURI:                  "/v1/getinfo",
+		name:              "lnrpc",
+		macaroonFn:        lndMacaroonFn,
+		requestFn:         lndRequestFn,
+		successPattern:    "\"identity_pubkey\":\"0",
+		allowedThroughLNC: true,
+		grpcWebURI:        "/lnrpc.Lightning/GetInfo",
+		restWebURI:        "/v1/getinfo",
 	}, {
-		name:                        "frdrpc",
-		macaroonFn:                  faradayMacaroonFn,
-		requestFn:                   faradayRequestFn,
-		successPattern:              "\"reports\":[]",
-		supportsMacAuthOnLndPort:    true,
-		supportsMacAuthOnLitPort:    true,
-		supportsUIPasswordOnLndPort: false,
-		supportsUIPasswordOnLitPort: true,
-		allowedThroughLNC:           true,
-		grpcWebURI:                  "/frdrpc.FaradayServer/RevenueReport",
-		restWebURI:                  "/v1/faraday/revenue",
+		name:              "frdrpc",
+		macaroonFn:        faradayMacaroonFn,
+		requestFn:         faradayRequestFn,
+		successPattern:    "\"reports\":[]",
+		allowedThroughLNC: true,
+		grpcWebURI:        "/frdrpc.FaradayServer/RevenueReport",
+		restWebURI:        "/v1/faraday/revenue",
 	}, {
-		name:                        "looprpc",
-		macaroonFn:                  loopMacaroonFn,
-		requestFn:                   loopRequestFn,
-		successPattern:              "\"swaps\":[]",
-		supportsMacAuthOnLndPort:    true,
-		supportsMacAuthOnLitPort:    true,
-		supportsUIPasswordOnLndPort: false,
-		supportsUIPasswordOnLitPort: true,
-		allowedThroughLNC:           true,
-		grpcWebURI:                  "/looprpc.SwapClient/ListSwaps",
-		restWebURI:                  "/v1/loop/swaps",
+		name:              "looprpc",
+		macaroonFn:        loopMacaroonFn,
+		requestFn:         loopRequestFn,
+		successPattern:    "\"swaps\":[]",
+		allowedThroughLNC: true,
+		grpcWebURI:        "/looprpc.SwapClient/ListSwaps",
+		restWebURI:        "/v1/loop/swaps",
 	}, {
-		name:                        "poolrpc",
-		macaroonFn:                  poolMacaroonFn,
-		requestFn:                   poolRequestFn,
-		successPattern:              "\"accounts_active\":0",
-		supportsMacAuthOnLndPort:    true,
-		supportsMacAuthOnLitPort:    true,
-		supportsUIPasswordOnLndPort: false,
-		supportsUIPasswordOnLitPort: true,
-		allowedThroughLNC:           true,
-		grpcWebURI:                  "/poolrpc.Trader/GetInfo",
-		restWebURI:                  "/v1/pool/info",
+		name:              "poolrpc",
+		macaroonFn:        poolMacaroonFn,
+		requestFn:         poolRequestFn,
+		successPattern:    "\"accounts_active\":0",
+		allowedThroughLNC: true,
+		grpcWebURI:        "/poolrpc.Trader/GetInfo",
+		restWebURI:        "/v1/pool/info",
 	}, {
 		name:       "litrpc",
 		macaroonFn: litMacaroonFn,
 		requestFn:  litRequestFn,
 		// In some test cases we actually expect some sessions, so we
 		// don't explicitly check for an empty array but just the
 		// existence of the array in the response.
-		successPattern:              "\"sessions\":[",
-		supportsMacAuthOnLndPort:    true,
-		supportsMacAuthOnLitPort:    true,
-		supportsUIPasswordOnLndPort: false,
-		supportsUIPasswordOnLitPort: false,
-		allowedThroughLNC:           false,
-		grpcWebURI:                  "/litrpc.Sessions/ListSessions",
+		successPattern:    "\"sessions\":[",
+		allowedThroughLNC: false,
+		grpcWebURI:        "/litrpc.Sessions/ListSessions",
 	}}
 )
 
@@ -239,10 +215,6 @@ func testModeIntegrated(net *NetworkHarness, t *harnessTest) {
 		for _, endpoint := range endpoints {
 			endpoint := endpoint
 			tt.Run(endpoint.name+" lnd port", func(ttt *testing.T) {
-				if !endpoint.supportsMacAuthOnLndPort {
-					return
-				}
-
 				runGRPCAuthTest(
 					ttt, cfg.RPCAddr(), cfg.TLSCertPath,
 					endpoint.macaroonFn(cfg),
@@ -252,10 +224,6 @@ func testModeIntegrated(net *NetworkHarness, t *harnessTest) {
 			})
 
 			tt.Run(endpoint.name+" lit port", func(ttt *testing.T) {
-				if !endpoint.supportsMacAuthOnLitPort {
-					return
-				}
-
 				runGRPCAuthTest(
 					ttt, cfg.LitAddr(), cfg.TLSCertPath,
 					endpoint.macaroonFn(cfg),
@@ -275,8 +243,7 @@ func testModeIntegrated(net *NetworkHarness, t *harnessTest) {
 				runUIPasswordCheck(
 					ttt, cfg.RPCAddr(), cfg.TLSCertPath,
 					cfg.UIPassword,
-					endpoint.requestFn, true,
-					!endpoint.supportsUIPasswordOnLndPort,
+					endpoint.requestFn,
 					endpoint.successPattern,
 				)
 			})
@@ -285,8 +252,7 @@ func testModeIntegrated(net *NetworkHarness, t *harnessTest) {
 				runUIPasswordCheck(
 					ttt, cfg.LitAddr(), cfg.TLSCertPath,
 					cfg.UIPassword,
-					endpoint.requestFn, false,
-					!endpoint.supportsUIPasswordOnLitPort,
+					endpoint.requestFn,
 					endpoint.successPattern,
 				)
 			})
@@ -324,10 +290,6 @@ func testModeIntegrated(net *NetworkHarness, t *harnessTest) {
 		for _, endpoint := range endpoints {
 			endpoint := endpoint
 			tt.Run(endpoint.name+" lnd port", func(ttt *testing.T) {
-				if !endpoint.supportsMacAuthOnLndPort {
-					return
-				}
-
 				runGRPCAuthTest(
 					ttt, cfg.RPCAddr(), cfg.TLSCertPath,
 					superMacFile,
@@ -337,10 +299,6 @@ func testModeIntegrated(net *NetworkHarness, t *harnessTest) {
 			})
 
 			tt.Run(endpoint.name+" lit port", func(ttt *testing.T) {
-				if !endpoint.supportsMacAuthOnLitPort {
-					return
-				}
-
 				runGRPCAuthTest(
 					ttt, cfg.LitAddr(), cfg.TLSCertPath,
 					superMacFile,
@@ -457,8 +415,7 @@ func runGRPCAuthTest(t *testing.T, hostPort, tlsCertPath, macPath string,
 
 // runUIPasswordCheck tests UI password authentication.
 func runUIPasswordCheck(t *testing.T, hostPort, tlsCertPath, uiPassword string,
-	makeRequest requestFn, shouldFailWithoutMacaroon,
-	shouldFailWithDummyMacaroon bool, successContent string) {
+	makeRequest requestFn, successContent string) {
 
 	ctxb := context.Background()
 	ctxt, cancel := context.WithTimeout(ctxb, defaultTimeout)
@@ -493,28 +450,6 @@ func runUIPasswordCheck(t *testing.T, hostPort, tlsCertPath, uiPassword string,
 	ctxm = uiPasswordContext(ctxt, uiPassword, false)
 	resp, err := makeRequest(ctxm, rawConn)
 
-	// On lnd's gRPC interface we don't support using the UI password.
-	if shouldFailWithoutMacaroon {
-		require.Error(t, err)
-		require.Contains(t, err.Error(), "expected 1 macaroon, got 0")
-
-		// Sending a dummy macaroon will allow us to not get an error in
-		// case of the litrpc calls, where we don't support macaroons
-		// but have the extraction call in the validator anyway. So we
-		// provide a dummy macaroon but still the UI password must be
-		// correct to pass.
-		ctxm = uiPasswordContext(ctxt, uiPassword, true)
-		resp, err = makeRequest(ctxm, rawConn)
-
-		if shouldFailWithDummyMacaroon {
-			require.Error(t, err)
-			require.Contains(
-				t, err.Error(), "cannot get macaroon: root",
-			)
-			return
-		}
-	}
-
 	// We expect the call to succeed.
 	require.NoError(t, err)
 

itest/litd_mode_remote_test.go

@@ -43,10 +43,6 @@ func testModeRemote(net *NetworkHarness, t *harnessTest) {
 		for _, endpoint := range endpoints {
 			endpoint := endpoint
 			tt.Run(endpoint.name+" lit port", func(ttt *testing.T) {
-				if !endpoint.supportsMacAuthOnLitPort {
-					return
-				}
-
 				runGRPCAuthTest(
 					ttt, cfg.LitAddr(), cfg.LitTLSCertPath,
 					endpoint.macaroonFn(cfg),
@@ -67,7 +63,6 @@ func testModeRemote(net *NetworkHarness, t *harnessTest) {
 					ttt, cfg.LitAddr(), cfg.LitTLSCertPath,
 					cfg.UIPassword,
 					endpoint.requestFn, false,
-					!endpoint.supportsUIPasswordOnLitPort,
 					endpoint.successPattern,
 				)
 			})