feat(auth,policy): add AWS SigV4 authentication and S3 bucket policy support
This commit is contained in:
517
test/test.policy-eval.node.ts
Normal file
517
test/test.policy-eval.node.ts
Normal file
@@ -0,0 +1,517 @@
|
||||
import { expect, tap } from '@git.zone/tstest/tapbundle';
|
||||
import {
|
||||
S3Client,
|
||||
CreateBucketCommand,
|
||||
DeleteBucketCommand,
|
||||
PutObjectCommand,
|
||||
GetObjectCommand,
|
||||
DeleteObjectCommand,
|
||||
PutBucketPolicyCommand,
|
||||
DeleteBucketPolicyCommand,
|
||||
} from '@aws-sdk/client-s3';
|
||||
import { Readable } from 'stream';
|
||||
import * as smarts3 from '../ts/index.js';
|
||||
|
||||
let testSmarts3Instance: smarts3.Smarts3;
|
||||
let authClient: S3Client;
|
||||
|
||||
const TEST_PORT = 3346;
|
||||
const ACCESS_KEY = 'TESTAKID';
|
||||
const SECRET_KEY = 'TESTSECRETKEY123';
|
||||
const BUCKET = 'eval-bucket';
|
||||
const BASE_URL = `http://localhost:${TEST_PORT}`;
|
||||
|
||||
async function streamToString(stream: Readable): Promise<string> {
|
||||
const chunks: Buffer[] = [];
|
||||
return new Promise((resolve, reject) => {
|
||||
stream.on('data', (chunk) => chunks.push(Buffer.from(chunk)));
|
||||
stream.on('error', reject);
|
||||
stream.on('end', () => resolve(Buffer.concat(chunks).toString('utf8')));
|
||||
});
|
||||
}
|
||||
|
||||
async function putPolicy(statements: any[]) {
|
||||
await authClient.send(
|
||||
new PutBucketPolicyCommand({
|
||||
Bucket: BUCKET,
|
||||
Policy: JSON.stringify({ Version: '2012-10-17', Statement: statements }),
|
||||
})
|
||||
);
|
||||
}
|
||||
|
||||
async function clearPolicy() {
|
||||
await authClient.send(new DeleteBucketPolicyCommand({ Bucket: BUCKET }));
|
||||
}
|
||||
|
||||
// ============================
|
||||
// Server setup
|
||||
// ============================
|
||||
|
||||
tap.test('setup: start server, create bucket, upload object', async () => {
|
||||
testSmarts3Instance = await smarts3.Smarts3.createAndStart({
|
||||
server: { port: TEST_PORT, silent: true, region: 'us-east-1' },
|
||||
storage: { cleanSlate: true },
|
||||
auth: {
|
||||
enabled: true,
|
||||
credentials: [{ accessKeyId: ACCESS_KEY, secretAccessKey: SECRET_KEY }],
|
||||
},
|
||||
});
|
||||
|
||||
authClient = new S3Client({
|
||||
endpoint: BASE_URL,
|
||||
region: 'us-east-1',
|
||||
credentials: { accessKeyId: ACCESS_KEY, secretAccessKey: SECRET_KEY },
|
||||
forcePathStyle: true,
|
||||
});
|
||||
|
||||
await authClient.send(new CreateBucketCommand({ Bucket: BUCKET }));
|
||||
await authClient.send(
|
||||
new PutObjectCommand({
|
||||
Bucket: BUCKET,
|
||||
Key: 'test-obj.txt',
|
||||
Body: 'hello policy eval',
|
||||
ContentType: 'text/plain',
|
||||
})
|
||||
);
|
||||
});
|
||||
|
||||
// ============================
|
||||
// Principal matching
|
||||
// ============================
|
||||
|
||||
tap.test('Principal: "*" → anonymous fetch GET succeeds', async () => {
|
||||
await putPolicy([
|
||||
{
|
||||
Sid: 'PrincipalWildcard',
|
||||
Effect: 'Allow',
|
||||
Principal: '*',
|
||||
Action: 's3:GetObject',
|
||||
Resource: `arn:aws:s3:::${BUCKET}/*`,
|
||||
},
|
||||
]);
|
||||
|
||||
const resp = await fetch(`${BASE_URL}/${BUCKET}/test-obj.txt`);
|
||||
expect(resp.status).toEqual(200);
|
||||
const text = await resp.text();
|
||||
expect(text).toEqual('hello policy eval');
|
||||
await clearPolicy();
|
||||
});
|
||||
|
||||
tap.test('Principal: {"AWS": "*"} → anonymous GET fails, authenticated GET succeeds', async () => {
|
||||
await putPolicy([
|
||||
{
|
||||
Sid: 'AwsWildcard',
|
||||
Effect: 'Allow',
|
||||
Principal: { AWS: '*' },
|
||||
Action: 's3:GetObject',
|
||||
Resource: `arn:aws:s3:::${BUCKET}/*`,
|
||||
},
|
||||
]);
|
||||
|
||||
// Anonymous → no identity → Principal AWS:* doesn't match anonymous → NoOpinion → denied
|
||||
const anonResp = await fetch(`${BASE_URL}/${BUCKET}/test-obj.txt`);
|
||||
expect(anonResp.status).toEqual(403);
|
||||
|
||||
// Authenticated → has identity → Principal AWS:* matches → Allow
|
||||
const authResp = await authClient.send(
|
||||
new GetObjectCommand({ Bucket: BUCKET, Key: 'test-obj.txt' })
|
||||
);
|
||||
expect(authResp.$metadata.httpStatusCode).toEqual(200);
|
||||
await clearPolicy();
|
||||
});
|
||||
|
||||
tap.test('Principal: {"AWS": "arn:aws:iam::TESTAKID"} → authenticated GET succeeds', async () => {
|
||||
await putPolicy([
|
||||
{
|
||||
Sid: 'SpecificPrincipal',
|
||||
Effect: 'Allow',
|
||||
Principal: { AWS: `arn:aws:iam::${ACCESS_KEY}` },
|
||||
Action: 's3:GetObject',
|
||||
Resource: `arn:aws:s3:::${BUCKET}/*`,
|
||||
},
|
||||
]);
|
||||
|
||||
const resp = await authClient.send(
|
||||
new GetObjectCommand({ Bucket: BUCKET, Key: 'test-obj.txt' })
|
||||
);
|
||||
expect(resp.$metadata.httpStatusCode).toEqual(200);
|
||||
await clearPolicy();
|
||||
});
|
||||
|
||||
tap.test('Principal: {"AWS": "arn:aws:iam::WRONGKEY"} → authenticated GET still succeeds (default allow)', async () => {
|
||||
await putPolicy([
|
||||
{
|
||||
Sid: 'WrongPrincipal',
|
||||
Effect: 'Allow',
|
||||
Principal: { AWS: 'arn:aws:iam::WRONGKEY' },
|
||||
Action: 's3:GetObject',
|
||||
Resource: `arn:aws:s3:::${BUCKET}/*`,
|
||||
},
|
||||
]);
|
||||
|
||||
// Principal doesn't match our key → NoOpinion → default allow for authenticated
|
||||
const resp = await authClient.send(
|
||||
new GetObjectCommand({ Bucket: BUCKET, Key: 'test-obj.txt' })
|
||||
);
|
||||
expect(resp.$metadata.httpStatusCode).toEqual(200);
|
||||
await clearPolicy();
|
||||
});
|
||||
|
||||
// ============================
|
||||
// Action matching
|
||||
// ============================
|
||||
|
||||
tap.test('Action: "s3:*" → anonymous can GET and PUT (wildcard matches all)', async () => {
|
||||
await putPolicy([
|
||||
{
|
||||
Sid: 'S3Wildcard',
|
||||
Effect: 'Allow',
|
||||
Principal: '*',
|
||||
Action: 's3:*',
|
||||
Resource: `arn:aws:s3:::${BUCKET}/*`,
|
||||
},
|
||||
]);
|
||||
|
||||
const getResp = await fetch(`${BASE_URL}/${BUCKET}/test-obj.txt`);
|
||||
expect(getResp.status).toEqual(200);
|
||||
|
||||
const putResp = await fetch(`${BASE_URL}/${BUCKET}/anon-wildcard.txt`, {
|
||||
method: 'PUT',
|
||||
body: 'wildcard put',
|
||||
});
|
||||
expect(putResp.status).toEqual(200);
|
||||
|
||||
// Clean up the object we created
|
||||
await authClient.send(new DeleteObjectCommand({ Bucket: BUCKET, Key: 'anon-wildcard.txt' }));
|
||||
await clearPolicy();
|
||||
});
|
||||
|
||||
tap.test('Action: "*" → global wildcard matches all actions', async () => {
|
||||
await putPolicy([
|
||||
{
|
||||
Sid: 'GlobalWildcard',
|
||||
Effect: 'Allow',
|
||||
Principal: '*',
|
||||
Action: '*',
|
||||
Resource: `arn:aws:s3:::${BUCKET}/*`,
|
||||
},
|
||||
]);
|
||||
|
||||
const getResp = await fetch(`${BASE_URL}/${BUCKET}/test-obj.txt`);
|
||||
expect(getResp.status).toEqual(200);
|
||||
|
||||
const putResp = await fetch(`${BASE_URL}/${BUCKET}/anon-global.txt`, {
|
||||
method: 'PUT',
|
||||
body: 'global wildcard',
|
||||
});
|
||||
expect(putResp.status).toEqual(200);
|
||||
|
||||
await authClient.send(new DeleteObjectCommand({ Bucket: BUCKET, Key: 'anon-global.txt' }));
|
||||
await clearPolicy();
|
||||
});
|
||||
|
||||
tap.test('Action: "s3:Get*" → anonymous can GET but not PUT (prefix wildcard)', async () => {
|
||||
await putPolicy([
|
||||
{
|
||||
Sid: 'PrefixWildcard',
|
||||
Effect: 'Allow',
|
||||
Principal: '*',
|
||||
Action: 's3:Get*',
|
||||
Resource: `arn:aws:s3:::${BUCKET}/*`,
|
||||
},
|
||||
]);
|
||||
|
||||
const getResp = await fetch(`${BASE_URL}/${BUCKET}/test-obj.txt`);
|
||||
expect(getResp.status).toEqual(200);
|
||||
|
||||
const putResp = await fetch(`${BASE_URL}/${BUCKET}/anon-prefix.txt`, {
|
||||
method: 'PUT',
|
||||
body: 'should fail',
|
||||
});
|
||||
expect(putResp.status).toEqual(403);
|
||||
await clearPolicy();
|
||||
});
|
||||
|
||||
tap.test('Action: ["s3:GetObject", "s3:PutObject"] → anonymous can GET and PUT but not DELETE', async () => {
|
||||
await putPolicy([
|
||||
{
|
||||
Sid: 'MultiAction',
|
||||
Effect: 'Allow',
|
||||
Principal: '*',
|
||||
Action: ['s3:GetObject', 's3:PutObject'],
|
||||
Resource: `arn:aws:s3:::${BUCKET}/*`,
|
||||
},
|
||||
]);
|
||||
|
||||
const getResp = await fetch(`${BASE_URL}/${BUCKET}/test-obj.txt`);
|
||||
expect(getResp.status).toEqual(200);
|
||||
|
||||
const putResp = await fetch(`${BASE_URL}/${BUCKET}/anon-multi.txt`, {
|
||||
method: 'PUT',
|
||||
body: 'multi action',
|
||||
});
|
||||
expect(putResp.status).toEqual(200);
|
||||
|
||||
const delResp = await fetch(`${BASE_URL}/${BUCKET}/anon-multi.txt`, {
|
||||
method: 'DELETE',
|
||||
});
|
||||
expect(delResp.status).toEqual(403);
|
||||
|
||||
// Clean up
|
||||
await authClient.send(new DeleteObjectCommand({ Bucket: BUCKET, Key: 'anon-multi.txt' }));
|
||||
await clearPolicy();
|
||||
});
|
||||
|
||||
// ============================
|
||||
// Resource ARN matching
|
||||
// ============================
|
||||
|
||||
tap.test('Resource: "arn:aws:s3:::eval-bucket/*" → anonymous GET of object succeeds', async () => {
|
||||
await putPolicy([
|
||||
{
|
||||
Sid: 'ResourceWildcard',
|
||||
Effect: 'Allow',
|
||||
Principal: '*',
|
||||
Action: 's3:GetObject',
|
||||
Resource: `arn:aws:s3:::${BUCKET}/*`,
|
||||
},
|
||||
]);
|
||||
|
||||
const resp = await fetch(`${BASE_URL}/${BUCKET}/test-obj.txt`);
|
||||
expect(resp.status).toEqual(200);
|
||||
await clearPolicy();
|
||||
});
|
||||
|
||||
tap.test('Resource: exact key → anonymous GET of that key succeeds, other key fails', async () => {
|
||||
await putPolicy([
|
||||
{
|
||||
Sid: 'ExactResource',
|
||||
Effect: 'Allow',
|
||||
Principal: '*',
|
||||
Action: 's3:GetObject',
|
||||
Resource: `arn:aws:s3:::${BUCKET}/test-obj.txt`,
|
||||
},
|
||||
]);
|
||||
|
||||
const goodResp = await fetch(`${BASE_URL}/${BUCKET}/test-obj.txt`);
|
||||
expect(goodResp.status).toEqual(200);
|
||||
|
||||
// Other key → resource doesn't match → NoOpinion → denied for anonymous
|
||||
const badResp = await fetch(`${BASE_URL}/${BUCKET}/nonexistent.txt`);
|
||||
expect(badResp.status).toEqual(403);
|
||||
await clearPolicy();
|
||||
});
|
||||
|
||||
tap.test('Resource: wrong bucket ARN → NoOpinion → anonymous GET denied', async () => {
|
||||
await putPolicy([
|
||||
{
|
||||
Sid: 'WrongBucket',
|
||||
Effect: 'Allow',
|
||||
Principal: '*',
|
||||
Action: 's3:GetObject',
|
||||
Resource: 'arn:aws:s3:::other-bucket/*',
|
||||
},
|
||||
]);
|
||||
|
||||
const resp = await fetch(`${BASE_URL}/${BUCKET}/test-obj.txt`);
|
||||
expect(resp.status).toEqual(403);
|
||||
await clearPolicy();
|
||||
});
|
||||
|
||||
tap.test('Resource: "*" → matches everything, anonymous GET succeeds', async () => {
|
||||
await putPolicy([
|
||||
{
|
||||
Sid: 'StarResource',
|
||||
Effect: 'Allow',
|
||||
Principal: '*',
|
||||
Action: 's3:GetObject',
|
||||
Resource: '*',
|
||||
},
|
||||
]);
|
||||
|
||||
const resp = await fetch(`${BASE_URL}/${BUCKET}/test-obj.txt`);
|
||||
expect(resp.status).toEqual(200);
|
||||
await clearPolicy();
|
||||
});
|
||||
|
||||
// ============================
|
||||
// Deny-over-Allow priority
|
||||
// ============================
|
||||
|
||||
tap.test('Allow + Deny same action → anonymous GET denied', async () => {
|
||||
await putPolicy([
|
||||
{
|
||||
Sid: 'AllowGet',
|
||||
Effect: 'Allow',
|
||||
Principal: '*',
|
||||
Action: 's3:GetObject',
|
||||
Resource: `arn:aws:s3:::${BUCKET}/*`,
|
||||
},
|
||||
{
|
||||
Sid: 'DenyGet',
|
||||
Effect: 'Deny',
|
||||
Principal: '*',
|
||||
Action: 's3:GetObject',
|
||||
Resource: `arn:aws:s3:::${BUCKET}/*`,
|
||||
},
|
||||
]);
|
||||
|
||||
const resp = await fetch(`${BASE_URL}/${BUCKET}/test-obj.txt`);
|
||||
expect(resp.status).toEqual(403);
|
||||
await clearPolicy();
|
||||
});
|
||||
|
||||
tap.test('Allow s3:* + Deny s3:DeleteObject → anonymous GET succeeds, DELETE denied', async () => {
|
||||
await putPolicy([
|
||||
{
|
||||
Sid: 'AllowAll',
|
||||
Effect: 'Allow',
|
||||
Principal: '*',
|
||||
Action: 's3:*',
|
||||
Resource: `arn:aws:s3:::${BUCKET}/*`,
|
||||
},
|
||||
{
|
||||
Sid: 'DenyDelete',
|
||||
Effect: 'Deny',
|
||||
Principal: '*',
|
||||
Action: 's3:DeleteObject',
|
||||
Resource: `arn:aws:s3:::${BUCKET}/*`,
|
||||
},
|
||||
]);
|
||||
|
||||
const getResp = await fetch(`${BASE_URL}/${BUCKET}/test-obj.txt`);
|
||||
expect(getResp.status).toEqual(200);
|
||||
|
||||
const delResp = await fetch(`${BASE_URL}/${BUCKET}/test-obj.txt`, { method: 'DELETE' });
|
||||
expect(delResp.status).toEqual(403);
|
||||
await clearPolicy();
|
||||
});
|
||||
|
||||
tap.test('Statement order does not matter: Deny first, Allow second → still denied', async () => {
|
||||
await putPolicy([
|
||||
{
|
||||
Sid: 'DenyFirst',
|
||||
Effect: 'Deny',
|
||||
Principal: '*',
|
||||
Action: 's3:GetObject',
|
||||
Resource: `arn:aws:s3:::${BUCKET}/*`,
|
||||
},
|
||||
{
|
||||
Sid: 'AllowSecond',
|
||||
Effect: 'Allow',
|
||||
Principal: '*',
|
||||
Action: 's3:GetObject',
|
||||
Resource: `arn:aws:s3:::${BUCKET}/*`,
|
||||
},
|
||||
]);
|
||||
|
||||
const resp = await fetch(`${BASE_URL}/${BUCKET}/test-obj.txt`);
|
||||
expect(resp.status).toEqual(403);
|
||||
await clearPolicy();
|
||||
});
|
||||
|
||||
// ============================
|
||||
// NoOpinion fallback
|
||||
// ============================
|
||||
|
||||
tap.test('NoOpinion: policy allows PutObject only → authenticated GET falls through (default allow)', async () => {
|
||||
await putPolicy([
|
||||
{
|
||||
Sid: 'AllowPutOnly',
|
||||
Effect: 'Allow',
|
||||
Principal: '*',
|
||||
Action: 's3:PutObject',
|
||||
Resource: `arn:aws:s3:::${BUCKET}/*`,
|
||||
},
|
||||
]);
|
||||
|
||||
// Authenticated → NoOpinion → default allow
|
||||
const resp = await authClient.send(
|
||||
new GetObjectCommand({ Bucket: BUCKET, Key: 'test-obj.txt' })
|
||||
);
|
||||
expect(resp.$metadata.httpStatusCode).toEqual(200);
|
||||
await clearPolicy();
|
||||
});
|
||||
|
||||
tap.test('NoOpinion: same policy → anonymous GET falls through → default deny (403)', async () => {
|
||||
await putPolicy([
|
||||
{
|
||||
Sid: 'AllowPutOnly',
|
||||
Effect: 'Allow',
|
||||
Principal: '*',
|
||||
Action: 's3:PutObject',
|
||||
Resource: `arn:aws:s3:::${BUCKET}/*`,
|
||||
},
|
||||
]);
|
||||
|
||||
// Anonymous → NoOpinion for GetObject → default deny
|
||||
const resp = await fetch(`${BASE_URL}/${BUCKET}/test-obj.txt`);
|
||||
expect(resp.status).toEqual(403);
|
||||
await clearPolicy();
|
||||
});
|
||||
|
||||
// ============================
|
||||
// IAM action mapping
|
||||
// ============================
|
||||
|
||||
tap.test('Policy allows s3:GetObject → anonymous HEAD object succeeds (HeadObject maps to s3:GetObject)', async () => {
|
||||
await putPolicy([
|
||||
{
|
||||
Sid: 'AllowGet',
|
||||
Effect: 'Allow',
|
||||
Principal: '*',
|
||||
Action: 's3:GetObject',
|
||||
Resource: `arn:aws:s3:::${BUCKET}/*`,
|
||||
},
|
||||
]);
|
||||
|
||||
const resp = await fetch(`${BASE_URL}/${BUCKET}/test-obj.txt`, { method: 'HEAD' });
|
||||
expect(resp.status).toEqual(200);
|
||||
await clearPolicy();
|
||||
});
|
||||
|
||||
tap.test('Policy allows s3:ListBucket → anonymous HEAD bucket succeeds', async () => {
|
||||
await putPolicy([
|
||||
{
|
||||
Sid: 'AllowList',
|
||||
Effect: 'Allow',
|
||||
Principal: '*',
|
||||
Action: 's3:ListBucket',
|
||||
Resource: `arn:aws:s3:::${BUCKET}`,
|
||||
},
|
||||
]);
|
||||
|
||||
const resp = await fetch(`${BASE_URL}/${BUCKET}`, { method: 'HEAD' });
|
||||
expect(resp.status).toEqual(200);
|
||||
await clearPolicy();
|
||||
});
|
||||
|
||||
tap.test('Policy allows s3:ListBucket → anonymous GET bucket (list objects) succeeds', async () => {
|
||||
await putPolicy([
|
||||
{
|
||||
Sid: 'AllowList',
|
||||
Effect: 'Allow',
|
||||
Principal: '*',
|
||||
Action: 's3:ListBucket',
|
||||
Resource: `arn:aws:s3:::${BUCKET}`,
|
||||
},
|
||||
]);
|
||||
|
||||
const resp = await fetch(`${BASE_URL}/${BUCKET}`);
|
||||
expect(resp.status).toEqual(200);
|
||||
const text = await resp.text();
|
||||
expect(text).toInclude('ListBucketResult');
|
||||
await clearPolicy();
|
||||
});
|
||||
|
||||
// ============================
|
||||
// Teardown
|
||||
// ============================
|
||||
|
||||
tap.test('teardown: clean up and stop server', async () => {
|
||||
await authClient.send(new DeleteObjectCommand({ Bucket: BUCKET, Key: 'test-obj.txt' }));
|
||||
await authClient.send(new DeleteBucketCommand({ Bucket: BUCKET }));
|
||||
await testSmarts3Instance.stop();
|
||||
});
|
||||
|
||||
export default tap.start();
|
||||
Reference in New Issue
Block a user