IAM | IAM Unit test

Signed-off-by: Naveen Paul <[email protected]>

Author: naveenpaul1

src/endpoint/iam/ops/iam_list_attached_user_policies.js

@@ -21,7 +21,7 @@ async function list_attached_user_policies(req, res) {
 
     dbg.log1('To check that we have the user we will run the IAM GET USER', params);
     iam_utils.validate_params(iam_constants.IAM_ACTIONS.GET_USER, params);
-    await req.account_sdk.get_user(params);
+    await req.account_sdk.get_user({ username: params.username });
 
     dbg.log1('IAM LIST ATTACHED USER POLICIES (returns empty list on every request)', params);
 

src/endpoint/iam/ops/iam_list_groups_for_user.js

@@ -17,7 +17,7 @@ async function list_groups_for_user(req, res) {
 
     dbg.log1('To check that we have the user we will run the IAM GET USER', params);
     iam_utils.validate_params(iam_constants.IAM_ACTIONS.GET_USER, params);
-    await req.account_sdk.get_user(params);
+    await req.account_sdk.get_user({ username: params.username });
 
     dbg.log1('IAM LIST GROUPS FOR USER (returns empty list on every request)', params);
 

src/endpoint/iam/ops/iam_list_mfa_devices.js

@@ -18,7 +18,7 @@ async function list_mfa_devices(req, res) {
     if (params.username !== undefined) {
         dbg.log1('To check that we have the user we will run the IAM GET USER', params);
         iam_utils.validate_params(iam_constants.IAM_ACTIONS.GET_USER, params);
-        await req.account_sdk.get_user(params);
+        await req.account_sdk.get_user({ username: params.username });
     }
     dbg.log1('IAM LIST MFA DEVICES (returns empty list on every request)', params);
 

src/endpoint/iam/ops/iam_list_service_specific_credentials.js

@@ -18,7 +18,7 @@ async function list_service_specific_credentials(req, res) {
     if (params.username !== undefined) {
         dbg.log1('To check that we have the user we will run the IAM GET USER', params);
         iam_utils.validate_params(iam_constants.IAM_ACTIONS.GET_USER, params);
-        await req.account_sdk.get_user(params);
+        await req.account_sdk.get_user({ username: params.username });
     }
     dbg.log1('IAM LIST SERVER SPECIFIC CREDENTIALS (returns empty list on every request)', params);
 

src/endpoint/iam/ops/iam_list_signing_certificates.js

@@ -20,7 +20,7 @@ async function list_signing_certificates(req, res) {
     if (params.username !== undefined) {
         dbg.log1('To check that we have the user we will run the IAM GET USER', params);
         iam_utils.validate_params(iam_constants.IAM_ACTIONS.GET_USER, params);
-        await req.account_sdk.get_user(params);
+        await req.account_sdk.get_user({ username: params.username });
     }
     dbg.log1('IAM LIST SIGNING CERTIFICATES (returns empty list on every request)', params);
     const requesting_account_name = req.account_sdk.requesting_account.name instanceof SensitiveString ?

src/endpoint/iam/ops/iam_list_ssh_public_keys.js

@@ -19,7 +19,7 @@ async function list_ssh_public_keys(req, res) {
     if (params.username !== undefined) {
         dbg.log1('To check that we have the user we will run the IAM GET USER', params);
         iam_utils.validate_params(iam_constants.IAM_ACTIONS.GET_USER, params);
-        await req.account_sdk.get_user(params);
+        await req.account_sdk.get_user({ username: params.username });
     }
     dbg.log1('IAM LIST SSH PUBLIC KEYS (returns empty list on every request)', params);
 

src/sdk/accountspace_nb.js

@@ -63,7 +63,6 @@ class AccountSpaceNB {
     }
 
     async get_user(params, account_sdk) {
-
         const requesting_account = system_store.get_account_by_email(account_sdk.requesting_account.email);
         return await account_sdk.rpc_client.account.get_user(params, requesting_account);
     }

src/server/common_services/auth_server.js

@@ -316,7 +316,7 @@ function _authorize_signature_token(req) {
     const auth_token_obj = req.auth_token;
 
     const account = _.find(system_store.data.accounts, function(acc) {
-        return acc.access_keys &&
+        return acc.access_keys && acc.access_keys.length > 0 &&
             acc.access_keys[0].access_key.unwrap() ===
             auth_token_obj.access_key;
     });

src/server/system_services/account_server.js

@@ -1277,10 +1277,10 @@ async function list_users(req) {
     const requesting_account = req.account;
     account_util._check_if_requesting_account_is_root_account(action, requesting_account, { });
     const is_truncated = false; // GAP - no pagination at this point
-
     const requesting_account_iam_users = _.filter(system_store.data.accounts, function(account) {
+        const owner_account_id = account_util.get_owner_account_id(account);
         // Check IAM user owner is same as requesting_account id
-        return account.owner?._id.toString() === requesting_account._id.toString();
+        return owner_account_id === requesting_account._id.toString();
     });
     let members = _.map(requesting_account_iam_users, function(iam_user) {
         const iam_username = account_util.get_iam_username(iam_user.name.unwrap());

src/test/integration_tests/api/iam/test_nc_iam_basic_integration.js renamed to src/test/integration_tests/api/iam/test_iam_basic_integration.js

@@ -7,9 +7,10 @@ const path = require('path');
 const _ = require('lodash');
 const mocha = require('mocha');
 const assert = require('assert');
+const SensitiveString = require('../../../../util/sensitive_string');
 const fs_utils = require('../../../../util/fs_utils');
 const { TMP_PATH, generate_nsfs_account, get_new_buckets_path_by_test_env, generate_iam_client,
-         require_coretest } = require('../../../system_tests/test_utils');
+         require_coretest, is_nc_coretest } = require('../../../system_tests/test_utils');
 const { ListUsersCommand, CreateUserCommand, GetUserCommand, UpdateUserCommand, DeleteUserCommand,
         ListAccessKeysCommand, CreateAccessKeyCommand, GetAccessKeyLastUsedCommand,
         UpdateAccessKeyCommand, DeleteAccessKeyCommand,
@@ -28,37 +29,47 @@ const IamError = require('../../../../endpoint/iam/iam_errors').IamError;
 
 
 const coretest = require_coretest();
-const setup_options = { should_run_iam: true, https_port_iam: 7005, debug: 5 };
+let setup_options;
+if (is_nc_coretest) {
+    setup_options = { should_run_iam: true, https_port_iam: 7005, debug: 5 };
+}
 coretest.setup(setup_options);
 const { rpc_client, EMAIL, get_current_setup_options, stop_nsfs_process, start_nsfs_process } = coretest;
 
-const CORETEST_ENDPOINT_IAM = coretest.get_iam_https_address();
-
-const config_root = path.join(TMP_PATH, 'test_nc_iam');
-// on NC - new_buckets_path is full absolute path
-// on Containerized - new_buckets_path is the directory
-const new_bucket_path_param = get_new_buckets_path_by_test_env(config_root, '/');
-
 let iam_account;
+let account_res;
+let config_root;
 
 mocha.describe('IAM basic integration tests - happy path', async function() {
     this.timeout(50000); // eslint-disable-line no-invalid-this
 
     mocha.before(async () => {
         // we want to make sure that we run this test with a couple of forks (by default setup it is 0)
-        const current_setup_options = get_current_setup_options();
-        const same_setup = _.isEqual(current_setup_options, setup_options);
-        if (!same_setup) {
-            console.log('current_setup_options', current_setup_options, 'same_setup', same_setup);
-            await stop_nsfs_process();
-            await start_nsfs_process(setup_options);
+        if (is_nc_coretest) {
+            config_root = path.join(TMP_PATH, 'test_nc_iam');
+            // on NC - new_buckets_path is full absolute path
+            // on Containerized - new_buckets_path is the directory
+            const new_bucket_path_param = get_new_buckets_path_by_test_env(config_root, '/');
+
+            const current_setup_options = get_current_setup_options();
+            const same_setup = _.isEqual(current_setup_options, setup_options);
+            if (!same_setup) {
+                console.log('current_setup_options', current_setup_options, 'same_setup', same_setup);
+                await stop_nsfs_process();
+                await start_nsfs_process(setup_options);
+            }
+            await fs_utils.create_fresh_path(new_bucket_path_param);
+            await fs_utils.file_must_exist(new_bucket_path_param);
+            account_res = await generate_nsfs_account(rpc_client, EMAIL, new_bucket_path_param, { admin: true });
+        } else {
+            account_res = (await rpc_client.account.read_account({ email: EMAIL })).access_keys[0];
         }
 
         // needed details for creating the account (and then the client)
-        await fs_utils.create_fresh_path(new_bucket_path_param);
-        await fs_utils.file_must_exist(new_bucket_path_param);
-        const res = await generate_nsfs_account(rpc_client, EMAIL, new_bucket_path_param, { admin: true });
-        iam_account = generate_iam_client(res.access_key, res.secret_key, CORETEST_ENDPOINT_IAM);
+        const coretest_endpoint_iam = coretest.get_https_address_iam();
+        const access_key = account_res.access_key instanceof SensitiveString ? account_res.access_key.unwrap() : account_res.access_key;
+        const secret_key = account_res.secret_key instanceof SensitiveString ? account_res.secret_key.unwrap() : account_res.secret_key;
+        iam_account = generate_iam_client(access_key, secret_key, coretest_endpoint_iam);
     });
 
     mocha.after(async () => {
@@ -196,6 +207,8 @@ mocha.describe('IAM basic integration tests - happy path', async function() {
         });
 
         mocha.it('get access key (last used)', async function() {
+            // Skipping for containerized noobaa
+            if (!is_nc_coretest) this.skip(); // eslint-disable-line no-invalid-this
             const input = {
                 AccessKeyId: access_key_id
             };