89 lines
3.2 KiB
Markdown
89 lines
3.2 KiB
Markdown
# INP2P RBAC Regression Checklist
|
||
|
||
> Replace placeholders:
|
||
> - `BASE=http://127.0.0.1:27183`
|
||
> - `ADMIN_TOKEN=<tenant admin session token>`
|
||
> - `OP_TOKEN=<tenant operator session token>`
|
||
> - `APIKEY_TOKEN=<tenant api key>`
|
||
|
||
## 1) enroll revoke must be admin-only
|
||
|
||
```bash
|
||
curl -i -X POST "$BASE/api/v1/enroll/consume/1?status=0" \
|
||
-H "Authorization: Bearer $OP_TOKEN"
|
||
# expect: 401/403
|
||
|
||
curl -i -X POST "$BASE/api/v1/enroll/consume/1?status=0" \
|
||
-H "Authorization: Bearer $APIKEY_TOKEN"
|
||
# expect: 401/403
|
||
```
|
||
|
||
## 2) apikey cannot mutate
|
||
|
||
```bash
|
||
curl -i -X POST "$BASE/api/v1/sdwan/edit" \
|
||
-H "Authorization: Bearer $APIKEY_TOKEN" \
|
||
-H 'Content-Type: application/json' \
|
||
-d '{"enabled":true,"gatewayCIDR":"10.200.10.0/24"}'
|
||
# expect: 403
|
||
|
||
curl -i -X POST "$BASE/api/v1/nodes/kick" \
|
||
-H "Authorization: Bearer $APIKEY_TOKEN" \
|
||
-H 'Content-Type: application/json' \
|
||
-d '{"node":"demo-node"}'
|
||
# expect: 403
|
||
```
|
||
|
||
## 3) operator can mutate common ops
|
||
|
||
```bash
|
||
curl -i -X POST "$BASE/api/v1/connect" \
|
||
-H "Authorization: Bearer $OP_TOKEN" \
|
||
-H 'Content-Type: application/json' \
|
||
-d '{"from":"n1","to":"n2","srcPort":10080,"dstPort":80,"appName":"test"}'
|
||
# expect: 200 (if nodes exist)
|
||
```
|
||
|
||
## 4) tenant isolation
|
||
|
||
```bash
|
||
# operator/admin from tenant A cannot operate tenant B node
|
||
curl -i -X POST "$BASE/api/v1/nodes/kick" \
|
||
-H "Authorization: Bearer $OP_TOKEN" \
|
||
-H 'Content-Type: application/json' \
|
||
-d '{"node":"tenantB-node"}'
|
||
# expect: 404
|
||
```
|
||
|
||
## 5) verify audit logs created
|
||
|
||
- actions expected in audit:
|
||
- `node_kick`
|
||
- `node_apps_push`
|
||
- `connect_request`
|
||
- `tenant_subnet_reassign`
|
||
- `sdwan_update`
|
||
|
||
## 6) 2026-09-13 回归实测结果（build.43）
|
||
|
||
| 用例 | 结果 |
|
||
|---|---|
|
||
| master token 禁入 admin/tenant API | PASS（401） |
|
||
| tenant admin/operator 禁入系统管理 API | PASS（401） |
|
||
| apikey 基线拒绝 mutation（sdwan/kick/connect） | PASS（403） |
|
||
| apikey + allow_apikey_mutate_sdwan 越权放行 sdwan/edit | PASS（200，audit rbac_override_used + sdwan_update） |
|
||
| operator 同租户 connect/kick 基线放行 | PASS（200，audit connect_request/node_kick） |
|
||
| 跨租户 connect source 不匹配拒绝 | PASS（404，audit connect_request_denied tenant_mismatch_source） |
|
||
| enroll revoke operator/apikey 拒绝 | PASS（401） |
|
||
| enroll revoke 跨租户 admin 拒绝 | PASS（404，**本轮修复**：曾为 200 越权，已加 token 归属校验） |
|
||
| audit API action/actor/target/from/to 筛选 | PASS（6 种筛选全通过） |
|
||
| 前端 operator：禁用 tab 隐藏、常用 tab 可见 | PASS |
|
||
| 前端 tenant-2 admin：系统管理 tab 不可见 | PASS |
|
||
| 前端 sysadmin：全 tab + 审计页 + 高级设置页 | PASS |
|
||
|
||
## 已知问题（本轮发现）
|
||
|
||
- **enroll revoke 缺租户归属校验**：已修复（84c709b），revoke 前校验 enroll token 归属租户。
|
||
- /api/v1/nodes/kick 的 `allow_operator_kick_cross_node` 子开关**未接入 override 路径**（仍走 TenantCan 基线+租户匹配 404），开关当前无实际效果。跨租户隔离靠租户匹配兜底，无安全风险，但开关语义与文档不符，待后续接线。
|
||
- 老种子账号（admin@local/operator@local 等）因含 @/数字不符合 `IsValidGlobalUsername`（仅纯字母≥6），无法用于登录，只作为历史数据存在。
|