|
| 1 | +package io.jenkins.plugins.casc; |
| 2 | + |
| 3 | +import com.cloudbees.jenkins.plugins.awscredentials.AWSCredentialsImpl; |
| 4 | +import com.cloudbees.jenkins.plugins.sshcredentials.impl.BasicSSHUserPrivateKey; |
| 5 | +import com.cloudbees.plugins.credentials.Credentials; |
| 6 | +import com.cloudbees.plugins.credentials.CredentialsNameProvider; |
| 7 | +import com.cloudbees.plugins.credentials.CredentialsProvider; |
| 8 | +import com.cloudbees.plugins.credentials.CredentialsScope; |
| 9 | +import com.cloudbees.plugins.credentials.SecretBytes; |
| 10 | +import com.cloudbees.plugins.credentials.common.StandardUsernamePasswordCredentials; |
| 11 | +import com.cloudbees.plugins.credentials.common.UsernamePasswordCredentials; |
| 12 | +import com.cloudbees.plugins.credentials.impl.CertificateCredentialsImpl; |
| 13 | +import com.cloudbees.plugins.credentials.impl.CertificateCredentialsImpl.UploadedKeyStoreSource; |
| 14 | +import io.jenkins.plugins.casc.misc.ConfiguredWithReadme; |
| 15 | +import io.jenkins.plugins.casc.misc.Env; |
| 16 | +import io.jenkins.plugins.casc.misc.EnvVarsRule; |
| 17 | +import io.jenkins.plugins.casc.misc.Envs; |
| 18 | +import io.jenkins.plugins.casc.misc.JenkinsConfiguredWithReadmeRule; |
| 19 | +import java.nio.charset.StandardCharsets; |
| 20 | +import java.nio.file.Files; |
| 21 | +import java.nio.file.Paths; |
| 22 | +import java.util.Base64; |
| 23 | +import java.util.Collections; |
| 24 | +import java.util.List; |
| 25 | +import jenkins.model.Jenkins; |
| 26 | +import org.apache.commons.io.IOUtils; |
| 27 | +import org.jenkinsci.plugins.plaincredentials.FileCredentials; |
| 28 | +import org.jenkinsci.plugins.plaincredentials.StringCredentials; |
| 29 | +import org.junit.Rule; |
| 30 | +import org.junit.Test; |
| 31 | +import org.junit.rules.RuleChain; |
| 32 | + |
| 33 | +import static org.hamcrest.MatcherAssert.assertThat; |
| 34 | +import static org.hamcrest.Matchers.anyOf; |
| 35 | +import static org.hamcrest.Matchers.containsString; |
| 36 | +import static org.hamcrest.Matchers.equalTo; |
| 37 | +import static org.hamcrest.Matchers.hasSize; |
| 38 | +import static org.hamcrest.Matchers.is; |
| 39 | +import static org.jvnet.hudson.test.JenkinsMatchers.hasPlainText; |
| 40 | + |
| 41 | +public class CredentialsReadmeTest { |
| 42 | + |
| 43 | + public static final String PASSPHRASE = "passphrase"; |
| 44 | + public static final String PRIVATE_KEY = "-----BEGIN RSA PRIVATE KEY-----\n" |
| 45 | + + "MIICXgIBAAKBgQC2xOoDBS+RQiwYN+rY0YXYQ/WwmC9ICH7BCXfLUBSHAkF2Dvd0\n" |
| 46 | + + "cvM2Ph2nOPiHdntrvD8JkzIv+S1RIqlBrzK6NRQ0ojoCvyawzY3cgzfQ4dfaOqUF\n" |
| 47 | + + "2bn4PscioLlq+Pbi3KYYwWUFue2iagRIxp0+/3F5WqOWPPy1twW7ddWPLQIDAQAB\n" |
| 48 | + + "AoGBAKOX7DKZ4LLvfRKMcpxyJpCme/L+tUuPtw1IUT7dxhH2deubh+lmvsXtoZM9\n" |
| 49 | + + "jk+KQPz0+aOzanfAXMzD7qZJkGfQ91aG8OiD+YJnRqOc6C6vQBXiZgeHRqWH0VMG\n" |
| 50 | + + "rp9Xqd8MxEYScaJYMwoHiBCG/cb3c4kpEpZ03IzkekZdXlmhAkEA7iFEk5k1BZ1+\n" |
| 51 | + + "BnKN9LxLR0EOKoSFJjxBihRP6+UD9BF+/1AlKlLW4hSq4458ppV5Wt4glHTcAQi/\n" |
| 52 | + + "U+wOOz6DyQJBAMR8G0yjtmLjMBy870GaDxmwWjqSeYwPoHbvRTOml8Fz9fP4gBMi\n" |
| 53 | + + "PUEGJaEHMuPECIegZ93kwAGBT51Q7AZcukUCQGGmnNOWISsjUXndYh85U/ltURzY\n" |
| 54 | + + "aS2rygiQmdGXgY6F2jliqUr424ushAN6+9zoMPK1YlDetxVpe+QzSga7dRkCQQCB\n" |
| 55 | + + "+DI6rORdXziZGeUNuPGaJYxZyEA8hK25Xqag9ubVYXZlLpDRl0l7dKx5awCfpzGZ\n" |
| 56 | + + "PWLXZZQYqsfWIQwvXTEdAkEA2bziyReYAb9fi17alcvwZXGzyyMY8WOGns8NZKcq\n" |
| 57 | + + "INF8D3PDpcCyOvQI/TS3qHYmGyWdHiKCWsgBqE6kyjqpNQ==\n" |
| 58 | + + "-----END RSA PRIVATE KEY-----\n"; |
| 59 | + public static final String PASSWORD = "password"; |
| 60 | + public static final String TEXT = "text"; |
| 61 | + public static final String ACCESS_KEY = "access-key"; |
| 62 | + public static final String SECRET_ACCESS_KEY = "secret-access-key"; |
| 63 | + public static final String MYSECRETFILE_TXT = "mysecretfile.txt"; |
| 64 | + public static final String TEST_CERT = "test.p12"; |
| 65 | + public JenkinsConfiguredWithReadmeRule j = new JenkinsConfiguredWithReadmeRule(); |
| 66 | + |
| 67 | + public EnvVarsRule environment = new EnvVarsRule(); |
| 68 | + |
| 69 | + @Rule |
| 70 | + public RuleChain chain = RuleChain |
| 71 | + .outerRule(environment) |
| 72 | + .around(j); |
| 73 | + |
| 74 | + @Test |
| 75 | + @ConfiguredWithReadme("credentials/README.md#0") |
| 76 | + @Envs({ |
| 77 | + @Env(name = "SUDO_PASSWORD", value = "SUDO") |
| 78 | + }) |
| 79 | + public void testDomainScopedCredentials() { |
| 80 | + List<StandardUsernamePasswordCredentials> creds = CredentialsProvider |
| 81 | + .lookupCredentials(StandardUsernamePasswordCredentials.class, |
| 82 | + Jenkins.getInstanceOrNull(), null, Collections.emptyList()); |
| 83 | + assertThat(creds.size(), is(1)); |
| 84 | + StandardUsernamePasswordCredentials cred = creds.get(0); |
| 85 | + assertThat(cred.getId(), is("sudo_password")); |
| 86 | + assertThat(cred.getUsername(), is("root")); |
| 87 | + assertThat(cred.getPassword(), hasPlainText("SUDO")); |
| 88 | + } |
| 89 | + |
| 90 | + @Test |
| 91 | + @ConfiguredWithReadme("credentials/README.md#1") |
| 92 | + @Envs({ |
| 93 | + @Env(name = "SSH_KEY_PASSWORD", value = PASSPHRASE), |
| 94 | + @Env(name = "SSH_PRIVATE_KEY", value = PRIVATE_KEY), |
| 95 | + @Env(name = "SSH_PRIVATE_FILE_PATH", value = "private-key.pem"), |
| 96 | + @Env(name = "SOME_USER_PASSWORD", value = PASSWORD), |
| 97 | + @Env(name = "SECRET_TEXT", value = TEXT), |
| 98 | + @Env(name = "AWS_ACCESS_KEY", value = ACCESS_KEY), |
| 99 | + @Env(name = "AWS_SECRET_ACCESS_KEY", value = SECRET_ACCESS_KEY), |
| 100 | + @Env(name = "SECRET_FILE_PATH", value = MYSECRETFILE_TXT), |
| 101 | + @Env(name = "SECRET_PASSWORD_CERT", value = PASSWORD), |
| 102 | + @Env(name = "SECRET_CERT_FILE_PATH", value = TEST_CERT), |
| 103 | + }) |
| 104 | + public void testGlobalScopedCredentials() throws Exception { |
| 105 | + List<Credentials> creds = CredentialsProvider.lookupCredentials( |
| 106 | + Credentials.class, Jenkins.get(), null, Collections.emptyList()); |
| 107 | + assertThat(creds, hasSize(8)); |
| 108 | + for (Credentials credentials : creds) { |
| 109 | + if (credentials instanceof BasicSSHUserPrivateKey) { |
| 110 | + BasicSSHUserPrivateKey key = (BasicSSHUserPrivateKey) credentials; |
| 111 | + assertThat(key.getPassphrase(), hasPlainText(PASSPHRASE)); |
| 112 | + assertThat(key.getPrivateKey(), equalTo(PRIVATE_KEY)); |
| 113 | + assertThat(key.getId(), anyOf( |
| 114 | + is("ssh_with_passphrase_provided"), |
| 115 | + is("ssh_with_passphrase_provided_via_file"))); |
| 116 | + assertThat(key.getUsername(), is("ssh_root")); |
| 117 | + assertThat(key.getScope(), is(CredentialsScope.SYSTEM)); |
| 118 | + } else if (credentials instanceof UsernamePasswordCredentials) { |
| 119 | + UsernamePasswordCredentials user = (UsernamePasswordCredentials) credentials; |
| 120 | + assertThat(user.getUsername(), is("some-user")); |
| 121 | + assertThat(user.getPassword(), hasPlainText(PASSWORD)); |
| 122 | + assertThat(user.getScope(), is(CredentialsScope.GLOBAL)); |
| 123 | + } else if (credentials instanceof StringCredentials) { |
| 124 | + StringCredentials string = (StringCredentials) credentials; |
| 125 | + assertThat(string.getId(), is("secret-text")); |
| 126 | + assertThat(string.getSecret(), hasPlainText(TEXT)); |
| 127 | + assertThat(string.getScope(), is(CredentialsScope.GLOBAL)); |
| 128 | + } else if (credentials instanceof AWSCredentialsImpl) { |
| 129 | + AWSCredentialsImpl aws = (AWSCredentialsImpl) credentials; |
| 130 | + assertThat(aws.getId(), is("AWS")); |
| 131 | + assertThat(aws.getAccessKey(), equalTo(ACCESS_KEY)); |
| 132 | + assertThat(aws.getSecretKey(), hasPlainText(SECRET_ACCESS_KEY)); |
| 133 | + assertThat(aws.getScope(), is(CredentialsScope.GLOBAL)); |
| 134 | + } else if (credentials instanceof FileCredentials) { |
| 135 | + FileCredentials file = (FileCredentials) credentials; |
| 136 | + assertThat(file.getId(), anyOf(is("secret-file"), is("secret-file_via_binary_file"))); |
| 137 | + assertThat(file.getFileName(), is(MYSECRETFILE_TXT)); |
| 138 | + String fileContent = IOUtils.toString(file.getContent(), StandardCharsets.UTF_8); |
| 139 | + assertThat(fileContent, containsString("SUPER SECRET")); |
| 140 | + assertThat(file.getScope(), is(CredentialsScope.GLOBAL)); |
| 141 | + } else if (credentials instanceof CertificateCredentialsImpl) { |
| 142 | + CertificateCredentialsImpl cert = (CertificateCredentialsImpl) credentials; |
| 143 | + assertThat(cert.getId(), is("secret-certificate")); |
| 144 | + assertThat(cert.getPassword(), hasPlainText(PASSWORD)); |
| 145 | + byte[] fileContent = Files.readAllBytes(Paths.get(getClass().getResource(TEST_CERT).toURI())); |
| 146 | + SecretBytes secretBytes = SecretBytes |
| 147 | + .fromString(Base64.getEncoder().encodeToString(fileContent)); |
| 148 | + UploadedKeyStoreSource keyStoreSource = (UploadedKeyStoreSource) cert.getKeyStoreSource(); |
| 149 | + assertThat(keyStoreSource.getUploadedKeystore().getPlainData(), |
| 150 | + is(secretBytes.getPlainData())); |
| 151 | + assertThat(cert.getKeyStore().containsAlias("1"), is(true)); |
| 152 | + assertThat(cert.getKeyStore().getCertificate("1").getType(), is("X.509")); |
| 153 | + assertThat( CredentialsNameProvider. name( cert), is( "[email protected], CN=pkcs12, O=Fort-Funston, L=SanFrancisco, ST=CA, C=US (my secret cert)")); |
| 154 | + assertThat(cert.getScope(), is(CredentialsScope.GLOBAL)); |
| 155 | + } |
| 156 | + } |
| 157 | + } |
| 158 | + |
| 159 | +} |
0 commit comments