validator edits

tests/test_auth_boundary.py

@@ -0,0 +1,208 @@
+"""Alpha issues 01/02/20 (ADR-0017): unified auth boundary.
+
+Forfeit accepts only the validator service token or an admin session; client
+API keys and garbage bearers are rejected. Financial reads require an admin
+session. Hive gossip mutations require a fresh HMAC signature — unsigned
+requests apply nothing.
+"""
+
+import json
+import time
+import urllib.error
+import urllib.request
+
+import pytest
+
+from meshnet_tracker.accounts import AccountStore
+from meshnet_tracker.auth import sign_hive_request, verify_hive_request
+from meshnet_tracker.billing import BillingLedger
+from meshnet_tracker.server import TrackerServer
+
+MODEL = "stub-model"
+SERVICE_TOKEN = "svc-validator-secret-token"
+HIVE_SECRET = "hive-shared-secret"
+
+
+def _request(url, *, method="GET", payload=None, token=None, extra_headers=None):
+    headers = {"Content-Type": "application/json", **(extra_headers or {})}
+    if token:
+        headers["Authorization"] = f"Bearer {token}"
+    req = urllib.request.Request(
+        url,
+        data=json.dumps(payload).encode() if payload is not None else None,
+        headers=headers,
+        method=method,
+    )
+    with urllib.request.urlopen(req) as r:
+        return json.loads(r.read())
+
+
+def _status_of(callable_):
+    try:
+        callable_()
+    except urllib.error.HTTPError as exc:
+        return exc.code
+    return 200
+
+
+@pytest.fixture
+def secured_tracker():
+    accounts = AccountStore()
+    admin = accounts.register(email="admin@example.com", password="admin-pass-123")
+    user = accounts.register(email="user@example.com", password="user-pass-1234")
+    admin_session = accounts.create_session(admin["account_id"])
+    user_session = accounts.create_session(user["account_id"])
+    client_api_key = accounts.create_api_key(user["account_id"])
+
+    ledger = BillingLedger(starting_credit=1.0, default_price_per_1k=0.02)
+    ledger.charge_request("client", MODEL, 1000, [("wallet-x", 12)])
+
+    tracker = TrackerServer(
+        billing=ledger,
+        accounts=accounts,
+        validator_service_token=SERVICE_TOKEN,
+        hive_secret=HIVE_SECRET,
+    )
+    port = tracker.start()
+    yield {
+        "url": f"http://127.0.0.1:{port}",
+        "ledger": ledger,
+        "admin_session": admin_session,
+        "user_session": user_session,
+        "client_api_key": client_api_key,
+    }
+    tracker.stop()
+
+
+# ---------------------------------------------------------------- forfeit
+
+
+def test_forfeit_rejects_missing_garbage_and_api_key(secured_tracker):
+    url = f"{secured_tracker['url']}/v1/billing/forfeit"
+    payload = {"wallet": "wallet-x", "reason": "fraud"}
+
+    assert _status_of(lambda: _request(url, method="POST", payload=payload)) == 401
+    assert _status_of(lambda: _request(url, method="POST", payload=payload, token="garbage")) == 403
+    # a *valid* client API key must still be rejected on operator endpoints
+    assert _status_of(lambda: _request(
+        url, method="POST", payload=payload, token=secured_tracker["client_api_key"],
+    )) == 403
+    # nothing was forfeited by any of the rejected attempts
+    assert secured_tracker["ledger"].get_node_pending("wallet-x") > 0
+
+
+def test_forfeit_accepts_service_token_and_admin_session(secured_tracker):
+    url = f"{secured_tracker['url']}/v1/billing/forfeit"
+    result = _request(
+        url, method="POST", payload={"wallet": "wallet-x"}, token=SERVICE_TOKEN,
+    )
+    assert result["forfeited"] == pytest.approx(0.02 * 0.90)
+    assert secured_tracker["ledger"].get_node_pending("wallet-x") == pytest.approx(0.0)
+
+    # admin session is the operator override (idempotent second call: 0 pending)
+    result = _request(
+        url, method="POST", payload={"wallet": "wallet-x"},
+        token=secured_tracker["admin_session"],
+    )
+    assert result["forfeited"] == pytest.approx(0.0)
+
+
+# ------------------------------------------------------- financial reads
+
+
+@pytest.mark.parametrize("path", [
+    "/v1/billing/summary",
+    "/v1/billing/settlements",
+    "/v1/registry/wallets",
+])
+def test_financial_reads_require_admin_session(secured_tracker, path):
+    url = f"{secured_tracker['url']}{path}"
+    assert _status_of(lambda: _request(url)) == 401
+    assert _status_of(lambda: _request(url, token=secured_tracker["user_session"])) == 403
+    assert _status_of(lambda: _request(url, token=secured_tracker["client_api_key"])) == 403
+    assert _status_of(lambda: _request(url, token=secured_tracker["admin_session"])) == 200
+
+
+def test_benchmark_endpoints_require_admin_or_service(secured_tracker):
+    url = f"{secured_tracker['url']}/v1/benchmark/results"
+    assert _status_of(lambda: _request(url)) == 401
+    assert _status_of(lambda: _request(url, token=secured_tracker["user_session"])) == 403
+    assert _status_of(lambda: _request(url, token=SERVICE_TOKEN)) == 200
+    assert _status_of(lambda: _request(url, token=secured_tracker["admin_session"])) == 200
+
+
+def test_dashboard_stays_public(secured_tracker):
+    assert _status_of(lambda: urllib.request.urlopen(
+        f"{secured_tracker['url']}/dashboard"
+    )) == 200
+
+
+# ---------------------------------------------------------------- gossip
+
+
+def _gossip_events():
+    peer = BillingLedger(starting_credit=0.0)
+    peer.credit_client("injected-client", 999.0)
+    events, _ = peer.events_since(0)
+    return events
+
+
+def test_unsigned_gossip_is_rejected_and_applies_nothing(secured_tracker):
+    url = f"{secured_tracker['url']}/v1/billing/gossip"
+    payload = {"events": _gossip_events()}
+    assert _status_of(lambda: _request(url, method="POST", payload=payload)) == 401
+    # a bearer token is not a hive signature either
+    assert _status_of(lambda: _request(
+        url, method="POST", payload=payload, token=secured_tracker["admin_session"],
+    )) == 401
+    assert secured_tracker["ledger"].get_client_balance("injected-client") == 0.0
+
+
+def test_signed_gossip_applies_and_wrong_secret_rejected(secured_tracker):
+    url = f"{secured_tracker['url']}/v1/billing/gossip"
+    body = json.dumps({"events": _gossip_events()}).encode()
+
+    bad = sign_hive_request("not-the-hive-secret", body)
+    assert _status_of(lambda: _request(
+        url, method="POST", payload=json.loads(body), extra_headers=bad,
+    )) == 401
+
+    good = sign_hive_request(HIVE_SECRET, body)
+    req = urllib.request.Request(
+        url, data=body,
+        headers={"Content-Type": "application/json", **good},
+        method="POST",
+    )
+    with urllib.request.urlopen(req) as r:
+        assert json.loads(r.read())["applied"] == 1
+    assert secured_tracker["ledger"].get_client_balance("injected-client") == pytest.approx(999.0)
+
+
+def test_stale_signature_rejected():
+    body = b'{"events": []}'
+    stale = sign_hive_request(HIVE_SECRET, body, timestamp=time.time() - 3600)
+    assert not verify_hive_request(HIVE_SECRET, stale, body)
+    fresh = sign_hive_request(HIVE_SECRET, body)
+    assert verify_hive_request(HIVE_SECRET, fresh, body)
+    # signature must cover the body
+    assert not verify_hive_request(HIVE_SECRET, fresh, b'{"events": [1]}')
+    # fail closed without a configured secret
+    assert not verify_hive_request(None, fresh, body)
+
+
+def test_accounts_and_stats_gossip_also_gated(secured_tracker):
+    for path in ("/v1/accounts/gossip", "/v1/stats/gossip"):
+        url = f"{secured_tracker['url']}{path}"
+        assert _status_of(lambda: _request(url, method="POST", payload={})) == 401
+
+
+def test_push_to_peers_signs_so_peers_accept(secured_tracker):
+    """Outgoing gossip from a tracker with the shared secret lands on a peer."""
+    sender = TrackerServer(
+        billing=BillingLedger(starting_credit=0.0),
+        cluster_peers=[secured_tracker["url"]],
+        hive_secret=HIVE_SECRET,
+    )
+    body = json.dumps({"events": _gossip_events()}).encode()
+    assert sender._push_to_peers("/v1/billing/gossip", body) is True
+    assert secured_tracker["ledger"].get_client_balance("injected-client") == pytest.approx(999.0)