NLnetLabs-krill/tests/auth_check.rs

//! Rust integration test to verify that invoking the restricted create CA
//! REST API requires a valid bearer token.
use std::str::FromStr;

use rpki::ca::idexchange::Handle;

use krill::{
    commons::api::Token,
    test::{
        init_ca, mem_storage, start_krill_with_custom_config, test_config,
    },
};

extern crate krill;

#[tokio::test]
#[should_panic]
async fn auth_check() {
    // Use a copy of the default test Krill config but change the server admin
    // token thereby hopefully causing the bearer token sent by the test
    // suite support functions not to match and thus be rejected which in turn
    // should cause a Rust panic.
    let storage_uri = mem_storage();
    let mut config =
        test_config(&storage_uri, None, false, false, false, false);
    config.admin_token = Token::from("wrong secret");

    // Start Krill with the customized config
    start_krill_with_custom_config(config).await;

    // Try and create a CA. The test suite support function `init_ca()` will
    // invoke the create CA REST API passing the bearer token that is
    // hard-coded into the test support suite functions ('secret').
    let ca_handle = Handle::from_str("dummy_ca").unwrap();
    init_ca(&ca_handle).await;

    // A Rust panic should have occurred. If not, this test will fail due to
    // the use of the #[should_panic] attribute.
}