Skip to content

Commit 10e056e

Browse files
ccroncaccronca
authored
feat: add cookie authentication e2e test and refactor to parameterized tests (#413)
* feat: add cookie authentication e2e test and refactor to parameterized tests Add cookie authentication e2e test and refactor all authentication tests to use pytest parameterization * refactor(e2e-tests): remove unnecessary executable from ZAP config The 'executable: zap.sh' parameter is the default for the ZAP scanner and does not need to be explicitly defined in the configuration. This commit removes the redundant container parameter from the E2E authentication test manifests to simplify the configuration.
1 parent d03a4a2 commit 10e056e

File tree

7 files changed

+104
-54
lines changed

7 files changed

+104
-54
lines changed

‎.github/secret_scanning.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,4 +5,5 @@ paths-ignore:
55
# E2E test files with dummy authentication credentials
66
- 'e2e-tests/manifests/rapidast-vapi-configmap-http-basic.yaml'
77
- 'e2e-tests/manifests/rapidast-vapi-configmap-http-header.yaml'
8+
- 'e2e-tests/manifests/rapidast-vapi-configmap-cookie.yaml'
89
- 'e2e-tests/test_authentication.py'

‎.gitleaks.toml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,5 +7,6 @@
77
paths = [
88
'''e2e-tests/manifests/rapidast-vapi-configmap-http-basic\.yaml''',
99
'''e2e-tests/manifests/rapidast-vapi-configmap-http-header\.yaml''',
10+
'''e2e-tests/manifests/rapidast-vapi-configmap-cookie\.yaml''',
1011
'''e2e-tests/test_authentication\.py'''
1112
]

‎e2e-tests/manifests/rapidast-vapi-configmap-cookie.yaml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
apiVersion: v1
2+
data:
3+
config.yaml: |+
4+
config:
5+
configVersion: 5
6+
7+
application:
8+
shortName: "cookie-auth-test"
9+
url: "http://vapi-auth:5000"
10+
11+
scanners:
12+
zap:
13+
apiScan:
14+
apis:
15+
apiUrl: "http://vapi-auth:5000/docs/openapi.json"
16+
17+
authentication:
18+
type: "cookie"
19+
parameters:
20+
# NOTE: These are dummy test cookie values for e2e testing - not real secrets
21+
name: "session_id"
22+
value: "abc123testcookie"
23+
24+
passiveScan:
25+
# Enable passive scanning to capture authentication headers
26+
disabledRules: ""
27+
28+
kind: ConfigMap
29+
metadata:
30+
name: rapidast-vapi-cookie

‎e2e-tests/manifests/rapidast-vapi-configmap-http-basic.yaml‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -25,10 +25,6 @@ data:
2525
# Enable passive scanning to capture authentication headers
2626
disabledRules: ""
2727
28-
container:
29-
parameters:
30-
executable: "zap.sh"
31-
3228
kind: ConfigMap
3329
metadata:
3430
name: rapidast-vapi-http-basic

‎e2e-tests/manifests/rapidast-vapi-configmap-http-header.yaml‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -25,9 +25,6 @@ data:
2525
# Enable passive scanning to capture authentication headers
2626
disabledRules: ""
2727
28-
container:
29-
parameters:
30-
executable: "zap.sh"
3128
3229
kind: ConfigMap
3330
metadata:

‎e2e-tests/manifests/rapidast-vapi-pod-cookie.yaml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
apiVersion: v1
2+
kind: Pod
3+
metadata:
4+
annotations:
5+
name: rapidast-vapi-cookie
6+
spec:
7+
initContainers:
8+
# Run rapidast as initContainer, second container prints the results
9+
- image: ${IMAGE} # quay.io/redhatproductsecurity/rapidast:latest
10+
imagePullPolicy: Always
11+
name: rapidast
12+
resources:
13+
limits:
14+
cpu: 1
15+
memory: 2Gi
16+
requests:
17+
cpu: 250m
18+
memory: 512Mi
19+
volumeMounts:
20+
- name: config-volume
21+
mountPath: /opt/rapidast/config
22+
- name: results
23+
mountPath: /opt/rapidast/results
24+
containers:
25+
# Expects initContainer to already have created results
26+
- command: ["bash", "-c", "cat /opt/rapidast/results/*/*/zap/zap-report.json"]
27+
image: registry.redhat.io/ubi9/ubi-micro
28+
name: results
29+
volumeMounts:
30+
- name: results
31+
mountPath: /opt/rapidast/results
32+
volumes:
33+
- name: config-volume
34+
configMap:
35+
name: rapidast-vapi-cookie
36+
- name: results
37+
emptyDir: {}
38+
restartPolicy: Never

‎e2e-tests/test_authentication.py‎

Lines changed: 34 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
import logging
33
from typing import Dict
44

5+
import pytest
56
from test_integration import get_log_from_pod # pylint: disable=E0611
67

78
from conftest import is_pod_with_field_selector_successfully_completed # pylint: disable=E0611
@@ -18,66 +19,52 @@ def setup_class(cls):
1819
cls.create_from_yaml(cls, f"{cls.tempdir}/vapi-auth-service.yaml")
1920
assert wait_until_ready(label_selector="app=vapi-auth")
2021

21-
def test_http_basic_authentication(self):
22-
"""Test rapidast with HTTP Basic authentication configured"""
22+
@pytest.mark.parametrize(
23+
"auth_type,expected_log,header_name,header_value_func",
24+
[
25+
(
26+
"http-basic",
27+
"ZAP configured with HTTP Basic Authentication",
28+
"Authorization",
29+
lambda: f"Basic {base64.b64encode(b'user:mypassw0rd').decode('utf-8')}",
30+
),
31+
(
32+
"http-header",
33+
"ZAP configured with Authentication using HTTP Header",
34+
"Authorization",
35+
lambda: "MySecretHeader",
36+
),
37+
("cookie", "ZAP configured with Cookie authentication", "Cookie", lambda: "session_id=abc123testcookie"),
38+
],
39+
)
40+
def test_authentication(self, auth_type, expected_log, header_name, header_value_func):
41+
"""Test rapidast with various authentication methods configured"""
42+
43+
self.create_from_yaml(f"{self.tempdir}/rapidast-vapi-configmap-{auth_type}.yaml")
44+
self.create_from_yaml(f"{self.tempdir}/rapidast-vapi-pod-{auth_type}.yaml")
2345

24-
self.create_from_yaml(f"{self.tempdir}/rapidast-vapi-configmap-http-basic.yaml")
25-
self.create_from_yaml(f"{self.tempdir}/rapidast-vapi-pod-http-basic.yaml")
2646
assert is_pod_with_field_selector_successfully_completed(
27-
field_selector="metadata.name=rapidast-vapi-http-basic", timeout=360
47+
field_selector=f"metadata.name=rapidast-vapi-{auth_type}", timeout=360
2848
)
2949

30-
logs = get_log_from_pod(self.tempdir, "rapidast-vapi-http-basic", container="rapidast", log_format="text")
50+
logs = get_log_from_pod(self.tempdir, f"rapidast-vapi-{auth_type}", container="rapidast", log_format="text")
3151
data = get_log_from_pod(
3252
self.tempdir,
33-
"rapidast-vapi-http-basic",
53+
f"rapidast-vapi-{auth_type}",
3454
filename_suffix="results",
3555
container="results",
3656
log_format="json",
3757
)
3858

39-
# Verify that HTTP Basic authentication was configured correctly in logs
40-
assert (
41-
"ZAP configured with HTTP Basic Authentication" in logs
42-
), "ZAP logs should indicate HTTP Basic authentication was configured"
43-
44-
# Verify that the Authorization Basic header with correct credentials is present
45-
# NOTE: "user:mypassw0rd" are dummy test credentials for e2e testing - not real secrets
46-
expected_credentials = base64.b64encode(b"user:mypassw0rd").decode("utf-8")
47-
basic_auth_header_found = verify_specific_auth_header_value(
48-
data, "Authorization", f"Basic {expected_credentials}"
49-
)
50-
assert (
51-
basic_auth_header_found
52-
), "Authorization header with correct Basic credentials should be found in scan results"
53-
54-
def test_http_header_authentication(self):
55-
"""Test rapidast with HTTP Header authentication configured"""
56-
57-
self.create_from_yaml(f"{self.tempdir}/rapidast-vapi-configmap-http-header.yaml")
58-
self.create_from_yaml(f"{self.tempdir}/rapidast-vapi-pod-http-header.yaml")
59-
assert is_pod_with_field_selector_successfully_completed(
60-
field_selector="metadata.name=rapidast-vapi-http-header", timeout=360
61-
)
62-
63-
logs = get_log_from_pod(self.tempdir, "rapidast-vapi-http-header", container="rapidast", log_format="text")
64-
data = get_log_from_pod(
65-
self.tempdir,
66-
"rapidast-vapi-http-header",
67-
filename_suffix="results",
68-
container="results",
69-
log_format="json",
70-
)
71-
72-
assert (
73-
"ZAP configured with Authentication using HTTP Header" in logs
74-
), "ZAP logs should indicate HTTP Header authentication was configured"
59+
assert expected_log in logs, f"ZAP logs should indicate {auth_type} authentication was configured"
7560

76-
# NOTE: "MySecretHeader" is a dummy test header value for e2e testing - not a real secret
77-
custom_header_found = verify_specific_auth_header_value(data, "Authorization", "MySecretHeader")
61+
# Verify authentication header is present in scan results
62+
# NOTE: All authentication values are dummy test credentials - not real secrets
63+
expected_header_value = header_value_func()
64+
auth_header_found = verify_specific_auth_header_value(data, header_name, expected_header_value)
7865
assert (
79-
custom_header_found
80-
), "Authorization header with exact custom value 'MySecretHeader' should be found in scan results"
66+
auth_header_found
67+
), f"{header_name} header with value '{expected_header_value}' should be found in scan results"
8168

8269

8370
def verify_specific_auth_header_value(report_data: Dict, header_name: str, expected_header_value: str) -> bool:

0 commit comments

Comments
 (0)