Commit 40c8a5b4 authored by Claudia Carballo Gonzalez's avatar Claudia Carballo Gonzalez
Browse files

Fix visibility rules matching and test 101 

- Core: Remove 'userName' check to fix false negatives in API match.
- Core: Add 'updatedAt' tiebreaker to prioritize newer rules.
- Tests: Pass 'userName' as string in test 101 to fix 400 Bad Request.
parent a74bf94e

services/helper/helper_service/services/visibility_control/core/visibility_control_core.py

+13 −6
Original line number Diff line number Diff line
@@ -348,7 +348,14 @@ def _invoker_allowed_for_api(api_invoker_id, api, rules, default_allow_no_match= 
        )

        return default_allow_no_match



    winner_rule = max(matching_rules, key=lambda rule: _rule_specificity(rule))

    #winner_rule = max(matching_rules, key=lambda rule: _rule_specificity(rule))

    winner_rule = max(

        matching_rules, 

        key=lambda rule: (

            _rule_specificity(rule), 

            _parse_datetime(rule.get('updatedAt', rule.get('startsAt', '1970-01-01T00:00:00Z')))

        )

    )

    default_access = _rule_default_access(winner_rule)

    allowed = default_access == 'ALLOW'

    invoker_exception = _rule_matches_invoker_exception(winner_rule, api_invoker_id)
@@ -389,11 +396,11 @@ def _rule_matches_api(rule, api): 
            return False



    # Check userName against apiProvName or provider username if present

    if 'userName' in provider_selector:

        user_names = _as_list(provider_selector['userName'])

        api_user_name = _get_first(api, 'apiProvName', 'api_prov_name')

        if not _matches_any(api_user_name, user_names):

            return False

    # if 'userName' in provider_selector:

    #     user_names = _as_list(provider_selector['userName'])

    #     api_user_name = _get_first(api, 'apiProvName', 'api_prov_name')

    #     if not _matches_any(api_user_name, user_names):

    #         return False



    # Check apiName

    if 'apiName' in provider_selector:

tests/features/Helper/Visibility Control Api/visibility_control.robot

+133 −8
Original line number Diff line number Diff line
@@ -287,7 +287,7 @@ Create and Get Specific Visibility Control Rule 


# ==================== DECISION ENDPOINT TESTS ====================

Discover Published service APIs by Authorised API Invoker Visibility Control

    [Tags]    visibility_control-10

    [Tags]    visibility_control-100

    # Register APF

    ${register_user_info}=    Provider Default Registration
@@ -315,9 +315,9 @@ Discover Published service APIs by Authorised API Invoker Visibility Control 
    List Should Contain Value    ${resp.json()['serviceAPIDescriptions']}    ${service_api_description_published}







# ==========

Discover Published service APIs by Unauthorised API Invoker Visibility Control

    [Tags]    visibility_control-11

    [Tags]    visibility_control-101

    # Register APF

    ${register_user_info}=    Provider Default Registration
@@ -348,8 +348,8 @@ Discover Published service APIs by Unauthorised API Invoker Visibility Control 
    ${aef_list}=    Create List    ${register_user_info['aef_id']}

    ${apiId_list}=    Create List    ${service_api_description_published['apiId']}

    ${apiName_list}=    Create List    ${service_api_description_published['apiName']}

    ${apiProv_list}=    Create List    ${service_api_description_published['apiProvName']}

    ${provider_selector}=    Create Dictionary    aefId=${aef_list}    apiId=${apiId_list}    apiName=${apiName_list}    apiProviderId=${apiProv_list}    userName=${register_user_info['apf_username']}

    

    ${provider_selector}=    Create Dictionary    aefId=${aef_list}    apiId=${apiId_list}    apiName=${apiName_list}    userName=${register_user_info['apf_username']}



    # Prepare the request body

    ${body}=    Create Visibility Control Rule Body 3    ${invoker_id}    ${provider_selector}
@@ -375,19 +375,143 @@ Discover Published service APIs by Unauthorised API Invoker Visibility Control 
    ...    verify=ca.crt

    ...    username=${INVOKER_USERNAME}



    Check Response Variable Type And Values    ${resp}    404    ProblemDetails

    Dictionary Should Contain Key    ${resp.json()}    detail

    Should Be Equal As Strings    ${resp.json()['detail']}    API Invoker ${invoker_id} has no visible APIs after applying visibility rules



    ${resp}=    Delete Request Capif

    ...    /helper/visibility-control/rules/${rule_id}

    ...    server=${CAPIF_HTTPS_URL}

    ...    verify=ca.crt

    ...    username=${SUPERADMIN_USERNAME}



    Status Should Be    204    ${resp}



    # Check empty list

    ${resp}=    Get Request Capif

    ...    /helper/visibility-control/rules

    ...    server=${CAPIF_HTTPS_URL}

    ...    verify=ca.crt

    ...    username=${SUPERADMIN_USERNAME}



    Length Should Be    ${resp.json()['rules']}    0

    

# ==========

Discover Published service APIs by Unauthorised API Invoker Visibility Control (several Apps APIs)

    [Tags]    visibility_control-102

    # Register APF

    ${register_user_info}=    Provider Default Registration



    # Publish API 1

    ${service_api_description_published}    ${resource_url}    ${request_body}=    Publish Service Api

    ...    ${register_user_info}



    # --- Check Published APIs by APF ---

    ${resp}=    Get Request Capif

    ...    /published-apis/v1/${register_user_info['apf_id']}/service-apis

    ...    server=${CAPIF_HTTPS_URL}

    ...    verify=ca.crt

    ...    username=${register_user_info['apf_username']}



    # Check Results

    Status Should Be    200    ${resp}

    Should Not Be Empty    ${resp.json()}

    Length Should Be    ${resp.json()}    1



# ==========

Discover Published service APIs by Unauthorised API Invoker Visibility Control (having several rules)

    [Tags]    visibility_control-103

    # Register APF

    ${register_user_info}=    Provider Default Registration



    # Publish one api

    ${service_api_description_published}    ${resource_url}    ${request_body}=    Publish Service Api

    ...    ${register_user_info}



    # Default Invoker Registration and Onboarding

    ${register_user_info_invoker}    ${url}    ${request_body}=    Invoker Default Onboarding

    ${invoker_id}=    Set Variable    ${register_user_info_invoker['api_invoker_id']}

    

    # Test

    ${resp}=    Get Request Capif

    ...    ${DISCOVER_URL}${register_user_info_invoker['api_invoker_id']}&aef-id=${register_user_info['aef_id']}

    ...    server=${CAPIF_HTTPS_URL}

    ...    verify=ca.crt

    ...    username=${INVOKER_USERNAME}



    Check Response Variable Type And Values    ${resp}    200    DiscoveredAPIs

    Length Should Be    ${resp.json()['serviceAPIDescriptions']}    0



    # Check Results

    Dictionary Should Contain Key    ${resp.json()}    serviceAPIDescriptions

    Should Not Be Empty    ${resp.json()['serviceAPIDescriptions']}

    Length Should Be    ${resp.json()['serviceAPIDescriptions']}    1

    List Should Contain Value    ${resp.json()['serviceAPIDescriptions']}    ${service_api_description_published}



    #Configurar visibility control (añadir una regla), volver a copiar a partir de # Test y check results length 0

    # Build provider selector from published API and provider registration

    ${aef_list}=    Create List    ${register_user_info['aef_id']}

    ${apiId_list}=    Create List    ${service_api_description_published['apiId']}

    ${apiName_list}=    Create List    ${service_api_description_published['apiName']}

    ${provider_selector}=    Create Dictionary    aefId=${aef_list}    apiId=${apiId_list}    apiName=${apiName_list}    userName=${register_user_info['apf_username']}



    # Prepare the request body

    ${body}=    Create Visibility Control Rule Body 3    ${invoker_id}    ${provider_selector}

    

    # Create a new rule using superadmin

    ${resp}=    Post Request Capif

    ...    /helper/visibility-control/rules

    ...    server=${CAPIF_HTTPS_URL}

    ...    verify=ca.crt

    ...    username=${SUPERADMIN_USERNAME}

    ...    json=${body}



    # Verify creation was successful (201 Created)

    Status Should Be    201    ${resp}

    ${rule_id}=    Set Variable    ${resp.json()['ruleId']}

    Dictionary Should Contain Key    ${resp.json()}    providerSelector

    Should Not Be Empty    ${resp.json()['providerSelector']}



    # Test

    ${resp}=    Get Request Capif

    ...    ${DISCOVER_URL}${register_user_info_invoker['api_invoker_id']}&aef-id=${register_user_info['aef_id']}

    ...    server=${CAPIF_HTTPS_URL}

    ...    verify=ca.crt

    ...    username=${INVOKER_USERNAME}



    Check Response Variable Type And Values    ${resp}    404    ProblemDetails

    Dictionary Should Contain Key    ${resp.json()}    detail

    Should Be Equal As Strings    ${resp.json()['detail']}    API Invoker ${invoker_id} has no visible APIs after applying visibility rules



    # Prepare the request body

    ${body}=    Create Visibility Control Rule Body 5    ${invoker_id}    ${provider_selector}

    

    # Create a new rule using superadmin

    ${resp}=    Post Request Capif

    ...    /helper/visibility-control/rules

    ...    server=${CAPIF_HTTPS_URL}

    ...    verify=ca.crt

    ...    username=${SUPERADMIN_USERNAME}

    ...    json=${body}



    # Verify creation was successful (201 Created)

    Status Should Be    201    ${resp}

    ${rule_id}=    Set Variable    ${resp.json()['ruleId']}

    Dictionary Should Contain Key    ${resp.json()}    providerSelector

    Should Not Be Empty    ${resp.json()['providerSelector']}



    # Test

    ${resp}=    Get Request Capif

    ...    ${DISCOVER_URL}${register_user_info_invoker['api_invoker_id']}&aef-id=${register_user_info['aef_id']}

    ...    server=${CAPIF_HTTPS_URL}

    ...    verify=ca.crt

    ...    username=${INVOKER_USERNAME}



    Check Response Variable Type And Values    ${resp}    200    DiscoveredAPIs



    # Check Results

    Dictionary Should Contain Key    ${resp.json()}    serviceAPIDescriptions

    Should Not Be Empty    ${resp.json()['serviceAPIDescriptions']}

    Length Should Be    ${resp.json()['serviceAPIDescriptions']}    1

    List Should Contain Value    ${resp.json()['serviceAPIDescriptions']}    ${service_api_description_published}
@@ -396,6 +520,7 @@ Discover Published service APIs by Unauthorised API Invoker Visibility Control 






# ==========OLD TESTS!

Decision Endpoint Without Active Rules Returns All APIs

    [Tags]    visibility_control-9

    [Documentation]    Test that without any active rules, the decision endpoint returns ALL APIs (default ALLOW)

tests/libraries/helper_service/bodyRequests.py

+48 −0
Original line number Diff line number Diff line
@@ -67,6 +67,54 @@ def create_visibility_control_rule_body_3(invoker_ids=None, provider_selector=No 
        "providerSelector": provider_selector or {}

    }



def create_visibility_control_rule_body_4(invoker_ids=None, provider_selector=None):

    if invoker_ids is None:

        invoker_ids = []

    elif isinstance(invoker_ids, str):

        invoker_ids = [invoker_ids]



    if provider_selector is None:

        provider_selector = {

            "aefId": ["aef-002"],

            "apiId": ["apiId-999"],

            "apiName": ["api-test-cli"],

            "apiProviderId": ["capif-prov-01"],

            "userName": "AMF_ROBOT_TESTING_PROVIDER"

        }



    return {

        "default_access": "ALLOW",

        "enabled": True,

        "invokerExceptions": {

            "apiInvokerId": invoker_ids

        },

        "providerSelector": provider_selector or {}

    }



def create_visibility_control_rule_body_5(invoker_ids=None, provider_selector=None):

    if invoker_ids is None:

        invoker_ids = []

    elif isinstance(invoker_ids, str):

        invoker_ids = [invoker_ids]



    if provider_selector is None:

        provider_selector = {

            "aefId": ["aef-002"],

            "apiId": ["apiId-999"],

            "apiName": ["api-test-cli"],

            "apiProviderId": ["capif-prov-01"],

            "userName": "AMF_ROBOT_TESTING_PROVIDER"

        }



    return {

        "default_access": "DENY",

        "enabled": True,

        "invokerExceptions": {

            "apiInvokerId": invoker_ids

        },

        "providerSelector": provider_selector or {}

    }



# def create_test_api_description(api_id="test-api-001", api_name="test-api", provider_name="capif-prov-01", aef_id="aef-001"):

#     """Create a test API description for filtering tests"""

#     return {