mirror of
https://github.com/Buriburizaem0n/nezha_domains.git
synced 2026-09-19 09:40:12 +00:00
naibaandnaiba/CloudCode
7c493e8f0b
Auth.Check resolved client_uuid → server.ID via UUIDToID without checking that the resolved server's UserID matched the user that the secret was bound to. An agent presenting one user's secret could target a different user's server UUID and impersonate it — poisoning monitoring state, triggering alerts, or quietly receiving tasks the real owner expected. Add authorizeAgentForUUID: if the UUID is unknown we still allow new registration bound to the secret owner; if the UUID is known but points to someone else's server we reject. The rejection message "client UUID does not belong to the agent secret owner" also helps operators trace which user's secret has leaked. Note: this changes runtime behaviour after batch-move/server — the new owner must reconfigure agents with their own secret. That is the correct contract; the previous behaviour was a cross-user reporting bug. Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>
90 lines
2.7 KiB
Go
90 lines
2.7 KiB
Go
package rpc
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"gorm.io/driver/sqlite"
|
|
"gorm.io/gorm"
|
|
|
|
"github.com/nezhahq/nezha/model"
|
|
"github.com/nezhahq/nezha/service/singleton"
|
|
)
|
|
|
|
// setupAuthAgentFixture seeds an in-memory DB and ServerShared with two
|
|
// servers belonging to different users so we can assert that a secret bound
|
|
// to user A cannot resolve a server UUID owned by user B.
|
|
func setupAuthAgentFixture(t *testing.T) func() {
|
|
t.Helper()
|
|
originalDB := singleton.DB
|
|
originalServerShared := singleton.ServerShared
|
|
|
|
db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
|
|
if err != nil {
|
|
t.Fatalf("open db: %v", err)
|
|
}
|
|
if err := db.AutoMigrate(&model.Server{}); err != nil {
|
|
t.Fatalf("migrate: %v", err)
|
|
}
|
|
if err := db.Create(&model.Server{
|
|
Common: model.Common{ID: 1, UserID: 100},
|
|
UUID: "uuid-alice",
|
|
Name: "alice-srv",
|
|
}).Error; err != nil {
|
|
t.Fatalf("create alice: %v", err)
|
|
}
|
|
if err := db.Create(&model.Server{
|
|
Common: model.Common{ID: 2, UserID: 200},
|
|
UUID: "uuid-bob",
|
|
Name: "bob-srv",
|
|
}).Error; err != nil {
|
|
t.Fatalf("create bob: %v", err)
|
|
}
|
|
singleton.DB = db
|
|
singleton.ServerShared = singleton.NewServerClass()
|
|
|
|
return func() {
|
|
singleton.DB = originalDB
|
|
singleton.ServerShared = originalServerShared
|
|
}
|
|
}
|
|
|
|
func TestAuthorizeAgentForUUIDAcceptsOwnedServer(t *testing.T) {
|
|
defer setupAuthAgentFixture(t)()
|
|
|
|
cid, hasID, err := authorizeAgentForUUID(100, "uuid-alice")
|
|
if err != nil {
|
|
t.Fatalf("alice with her own server UUID must not error, got %v", err)
|
|
}
|
|
if !hasID || cid != 1 {
|
|
t.Fatalf("expected (cid=1, hasID=true), got (cid=%d, hasID=%v)", cid, hasID)
|
|
}
|
|
}
|
|
|
|
// Core regression: an agent presenting user A's secret but user B's server
|
|
// UUID must be rejected. Previously the code returned the resolved server ID
|
|
// without verifying the UserID matched the secret owner, allowing same-tenant
|
|
// (and worse — cross-tenant if UUID leaks) server impersonation.
|
|
func TestAuthorizeAgentForUUIDRejectsForeignServerUUID(t *testing.T) {
|
|
defer setupAuthAgentFixture(t)()
|
|
|
|
_, _, err := authorizeAgentForUUID(100, "uuid-bob") // alice's secret + bob's UUID
|
|
if err == nil {
|
|
t.Fatalf("UUID owned by another user must be rejected")
|
|
}
|
|
}
|
|
|
|
// An unknown UUID must NOT be treated as an impersonation attempt — it is
|
|
// the normal first-time registration path and the caller (Check) creates a
|
|
// new server bound to the secret owner.
|
|
func TestAuthorizeAgentForUUIDPermitsUnknownUUIDForRegistration(t *testing.T) {
|
|
defer setupAuthAgentFixture(t)()
|
|
|
|
cid, hasID, err := authorizeAgentForUUID(100, "uuid-never-seen-before")
|
|
if err != nil {
|
|
t.Fatalf("unknown UUID must be permitted for new registration, got %v", err)
|
|
}
|
|
if hasID {
|
|
t.Fatalf("hasID must be false for unknown UUID, got cid=%d", cid)
|
|
}
|
|
}
|