Merge pull request #1412 from fledge-iot/FOGL-8865

FOGL-8865 GET users API restricted for non-admin users
fledge-iot · Jul 5, 2024 · 67b7d80 · 67b7d80
2 parents 021bf2c + 4b1331d
commit 67b7d80
Show file tree

Hide file tree

Showing 2 changed files with 24 additions and 7 deletions.
diff --git a/python/fledge/common/web/middleware.py b/python/fledge/common/web/middleware.py
@@ -200,6 +200,10 @@ async def validate_requests(request):
            - All CRUD's privileges for control pipelines
     """
     user_id = request.user['id']
+    # Only URL's which are specific meant for Admin user
+    if not request.user_is_admin and request.method == 'GET':
+        if str(request.rel_url) == '/fledge/user':
+            raise web.HTTPForbidden
     # Normal/Editor user
     if int(request.user["role_id"]) == 2 and request.method != 'GET':
         # Special case: Allowed control entrypoint update request and handling of rejection in its handler
@@ -216,7 +220,7 @@ async def validate_requests(request):
     elif int(request.user["role_id"]) == 4:
         if request.method == 'GET':
             supported_endpoints = ['/fledge/asset', '/fledge/ping', '/fledge/statistics',
-                                   '/fledge/user?id={}'.format(user_id), '/fledge/user/role']
+                                   '/fledge/user?', '/fledge/user/role']
             if not (str(request.rel_url).startswith(tuple(supported_endpoints)
                                                     ) or str(request.rel_url).endswith('/fledge/service')):
                 raise web.HTTPForbidden
@@ -226,3 +230,4 @@ async def validate_requests(request):
                 raise web.HTTPForbidden
         else:
             raise web.HTTPForbidden
+
diff --git a/tests/system/python/api/test_endpoints_with_different_user_types.py b/tests/system/python/api/test_endpoints_with_different_user_types.py
@@ -110,8 +110,12 @@ def test_login(self, fledge_url, wait_time):
         # health
         ("GET", "/fledge/health/storage", 200), ("GET", "/fledge/health/logging", 200),
         # user & roles
-        ("GET", "/fledge/user", 200), ("PUT", "/fledge/user", 500), ("PUT", "/fledge/user/1/password", 403),
-        ("PUT", "/fledge/user/3/password", 500), ("GET", "/fledge/user/role", 200),
+        ("GET", "/fledge/user", 403), ("GET", "/fledge/user?id=3", 200),
+        ("GET", "/fledge/user?username={}".format(VIEW_USERNAME), 200),
+        ("GET", "/fledge/user?id={}&username={}".format(3, VIEW_USERNAME), 200),
+        ("GET", "/fledge/user?username={}&id={}".format(VIEW_USERNAME, 3), 200),
+        ("PUT", "/fledge/user", 500), ("PUT", "/fledge/user/1/password", 403), ("PUT", "/fledge/user/3/password", 500),
+        ("GET", "/fledge/user/role", 200),
         # auth
         ("POST", "/fledge/login", 403), ("PUT", "/fledge/31/logout", 401),
         ("GET", "/fledge/auth/ott", 200),
@@ -268,8 +272,12 @@ def test_login(self, fledge_url, wait_time):
         # health
         ("GET", "/fledge/health/storage", 403), ("GET", "/fledge/health/logging", 403),
         # user & roles
-        ("GET", "/fledge/user", 403), ("PUT", "/fledge/user", 500), ("PUT", "/fledge/user/1/password", 403),
-        ("PUT", "/fledge/user/4/password", 500), ("GET", "/fledge/user/role", 200),
+        ("GET", "/fledge/user", 403), ("GET", "/fledge/user?id=4", 200),
+        ("GET", "/fledge/user?username={}".format(DATA_VIEW_USERNAME), 200),
+        ("GET", "/fledge/user?id={}&username={}".format(4, DATA_VIEW_USERNAME), 200),
+        ("GET", "/fledge/user?username={}&id={}".format(DATA_VIEW_USERNAME, 4), 200),
+        ("PUT", "/fledge/user", 500), ("PUT", "/fledge/user/1/password", 403), ("PUT", "/fledge/user/4/password", 500),
+        ("GET", "/fledge/user/role", 200),
         # auth
         ("POST", "/fledge/login", 403), ("PUT", "/fledge/31/logout", 401),
         ("GET", "/fledge/auth/ott", 403),
@@ -424,8 +432,12 @@ def test_login(self, fledge_url, wait_time):
         # health
         ("GET", "/fledge/health/storage", 200), ("GET", "/fledge/health/logging", 200),
         # user & roles
-        ("GET", "/fledge/user", 200), ("PUT", "/fledge/user", 500), ("PUT", "/fledge/user/1/password", 500),
-        ("PUT", "/fledge/user/3/password", 500), ("GET", "/fledge/user/role", 200),
+        ("GET", "/fledge/user", 403), ("GET", "/fledge/user?id=5", 200),
+        ("GET", "/fledge/user?username={}".format(CONTROL_USERNAME), 200),
+        ("GET", "/fledge/user?id={}&username={}".format(5, CONTROL_USERNAME), 200),
+        ("GET", "/fledge/user?username={}&id={}".format(CONTROL_USERNAME, 5), 200),
+        ("PUT", "/fledge/user", 500), ("PUT", "/fledge/user/1/password", 500), ("PUT", "/fledge/user/3/password", 500),
+        ("GET", "/fledge/user/role", 200),
         # auth
         ("POST", "/fledge/login", 500), ("PUT", "/fledge/31/logout", 401),
         ("GET", "/fledge/auth/ott", 200),