Differential D7544

gitlab: create a storage container per application
ClosedPublic
Actions

Authored by vsellier on Apr 8 2022, 7:01 PM.

Details

Reviewers

None

Group Reviewers

System administrators

Maniphest Tasks

T4046: Bootstrap a gitlab instance hosted on our infrastructure

Commits

rSPRE2630acf0415a: gitlab: create a storage container per application

Summary

It's the recommended setup

Related to T4046

Diff Detail

Repository

rSPRE sysadm-provisioning

Branch

master

Lint

No Linters Available

Unit

No Unit Test Coverage

Build Status

Buildable 28367
Build 44356: arc lint + arc unit

Event Timeline

vsellier requested review of this revision.Apr 8 2022, 7:01 PM

vsellier created this revision.

Harbormaster completed remote builds in B28366: Diff 27350.Apr 8 2022, 7:01 PM

vsellier retitled this revision from gitlab: create a container per application to gitlab: create a storage container per application.Apr 8 2022, 7:03 PM

Update the commit title

Harbormaster completed remote builds in B28367: Diff 27351.Apr 8 2022, 7:04 PM

This revision was not accepted when it landed; it landed in state Needs Review.Apr 11 2022, 9:35 AM

Closed by commit rSPRE2630acf0415a: gitlab: create a storage container per application (authored by vsellier). · Explain Why

This revision was automatically updated to reflect the committed changes.

vsellier added a commit: rSPRE2630acf0415a: gitlab: create a storage container per application.

Revision Contents
Changeset List

Path

Size

azure/

terraform/

modules/

gitlab/

main.tf

3 lines

variables.tf

9 lines

Diff 27351

View Options

azure/terraform/modules/gitlab/main.tf

	# Copyright (C) 2020 The Software Heritage developers			# Copyright (C) 2020 The Software Heritage developers
	# See the AUTHORS file at the top-level directory of this distribution			# See the AUTHORS file at the top-level directory of this distribution
	# License: GNU Affero General Public License version 3, or any later version			# License: GNU Affero General Public License version 3, or any later version
	# See top-level LICENSE file for more information			# See top-level LICENSE file for more information

	from datetime import datetime, timedelta			from datetime import datetime, timedelta

	from django.contrib.auth import authenticate, get_backends			from django.contrib.auth import authenticate, get_backends

	import pytest			import pytest

	from django.conf import settings			from django.conf import settings

				from rest_framework.exceptions import AuthenticationFailed

				from swh.web.auth.backends import OIDCBearerTokenAuthentication
	from swh.web.auth.models import OIDCUser			from swh.web.auth.models import OIDCUser
	from swh.web.common.utils import reverse			from swh.web.common.utils import reverse

	from . import sample_data			from . import sample_data
	from .keycloak_mock import mock_keycloak			from .keycloak_mock import mock_keycloak


	def _authenticate_user(request_factory):			def _authenticate_user(request_factory):
	▲ Show 20 Lines • Show All 52 Lines • ▼ Show 20 Lines

	@pytest.mark.django_db			@pytest.mark.django_db
	def test_oidc_code_pkce_auth_backend_failure(mocker, request_factory):			def test_oidc_code_pkce_auth_backend_failure(mocker, request_factory):
	mock_keycloak(mocker, auth_success=False)			mock_keycloak(mocker, auth_success=False)

	user = _authenticate_user(request_factory)			user = _authenticate_user(request_factory)

	assert user is None			assert user is None


				@pytest.mark.django_db
				def test_drf_oidc_bearer_token_auth_backend_success(mocker,
				api_request_factory):
				url = reverse('api-1-stat-counters')
				drf_auth_backend = OIDCBearerTokenAuthentication()

				kc_oidc_mock = mock_keycloak(mocker)

				access_token = sample_data.oidc_profile['access_token']

				request = api_request_factory.get(
				url, HTTP_AUTHORIZATION=f"Bearer {access_token}")

				# first authentication
				user, _ = drf_auth_backend.authenticate(request)
				_check_authenticated_user(user)
				# oidc_profile is not filled when authenticating through bearer token
				assert hasattr(user, 'access_token') and user.access_token is None

				# second authentication, should fetch userinfo from cache
				# until token expires
				user, _ = drf_auth_backend.authenticate(request)
				_check_authenticated_user(user)
				assert hasattr(user, 'access_token') and user.access_token is None

				# check user request to keycloak has been sent only once
				kc_oidc_mock.userinfo.assert_called_once_with(access_token)


				@pytest.mark.django_db
				def test_drf_oidc_bearer_token_auth_backend_failure(mocker,
				api_request_factory):

				url = reverse('api-1-stat-counters')
				drf_auth_backend = OIDCBearerTokenAuthentication()

				# simulate a failed authentication with a bearer token in expected format
				mock_keycloak(mocker, auth_success=False)

				access_token = sample_data.oidc_profile['access_token']

				request = api_request_factory.get(
				url, HTTP_AUTHORIZATION=f"Bearer {access_token}")

				with pytest.raises(AuthenticationFailed):
				drf_auth_backend.authenticate(request)

				# simulate a failed authentication with an invalid bearer token format
				mock_keycloak(mocker)

				request = api_request_factory.get(
				url, HTTP_AUTHORIZATION=f"Bearer invalid-token-format")

				with pytest.raises(AuthenticationFailed):
				drf_auth_backend.authenticate(request)


				def test_drf_oidc_auth_invalid_or_missing_auth_type(api_request_factory):

				url = reverse('api-1-stat-counters')
				drf_auth_backend = OIDCBearerTokenAuthentication()

				access_token = sample_data.oidc_profile['access_token']

				# Invalid authorization type
				request = api_request_factory.get(
				url, HTTP_AUTHORIZATION=f"Foo token")

				with pytest.raises(AuthenticationFailed):
				drf_auth_backend.authenticate(request)

				# Missing authorization type
				request = api_request_factory.get(
				url, HTTP_AUTHORIZATION=f"{access_token}")

				with pytest.raises(AuthenticationFailed):
				drf_auth_backend.authenticate(request)