authentik.enterprise.lifecycle.tests.test_api

  1from django.contrib.contenttypes.models import ContentType
  2from django.urls import reverse
  3from rest_framework.test import APITestCase
  4
  5from authentik.core.models import Application, Group
  6from authentik.core.tests.utils import create_test_admin_user, create_test_user
  7from authentik.enterprise.lifecycle.models import LifecycleIteration, LifecycleRule, ReviewState
  8from authentik.enterprise.reports.tests.utils import patch_license
  9from authentik.lib.generators import generate_id
 10
 11
 12@patch_license
 13class TestLifecycleRuleAPI(APITestCase):
 14
 15    def setUp(self):
 16        self.user = create_test_admin_user()
 17        self.client.force_login(self.user)
 18        self.app = Application.objects.create(name=generate_id(), slug=generate_id())
 19        self.content_type = ContentType.objects.get_for_model(Application)
 20        self.reviewer_group = Group.objects.create(name=generate_id())
 21
 22    def test_list_rules(self):
 23        rule = LifecycleRule.objects.create(
 24            name=generate_id(),
 25            content_type=self.content_type,
 26            object_id=str(self.app.pk),
 27        )
 28        rule.reviewer_groups.add(self.reviewer_group)
 29
 30        response = self.client.get(reverse("authentik_api:lifecyclerule-list"))
 31        self.assertEqual(response.status_code, 200)
 32        self.assertGreaterEqual(len(response.data["results"]), 1)
 33
 34    def test_create_rule_with_reviewer_group(self):
 35        response = self.client.post(
 36            reverse("authentik_api:lifecyclerule-list"),
 37            {
 38                "name": generate_id(),
 39                "content_type": f"{self.content_type.app_label}.{self.content_type.model}",
 40                "object_id": str(self.app.pk),
 41                "interval": "days=30",
 42                "grace_period": "days=10",
 43                "reviewer_groups": [str(self.reviewer_group.pk)],
 44                "reviewers": [],
 45                "min_reviewers": 1,
 46            },
 47        )
 48        self.assertEqual(response.status_code, 201)
 49        self.assertEqual(response.data["object_id"], str(self.app.pk))
 50        self.assertEqual(response.data["interval"], "days=30")
 51
 52    def test_create_rule_with_explicit_reviewer(self):
 53        reviewer = create_test_user()
 54        response = self.client.post(
 55            reverse("authentik_api:lifecyclerule-list"),
 56            {
 57                "name": generate_id(),
 58                "content_type": f"{self.content_type.app_label}.{self.content_type.model}",
 59                "object_id": str(self.app.pk),
 60                "interval": "days=60",
 61                "grace_period": "days=15",
 62                "reviewer_groups": [],
 63                "reviewers": [str(reviewer.uuid)],
 64                "min_reviewers": 1,
 65            },
 66        )
 67        self.assertEqual(response.status_code, 201)
 68        self.assertIn(reviewer.uuid, response.data["reviewers"])
 69
 70    def test_create_rule_type_level(self):
 71        response = self.client.post(
 72            reverse("authentik_api:lifecyclerule-list"),
 73            {
 74                "name": generate_id(),
 75                "content_type": f"{self.content_type.app_label}.{self.content_type.model}",
 76                "object_id": None,
 77                "interval": "days=90",
 78                "grace_period": "days=30",
 79                "reviewer_groups": [str(self.reviewer_group.pk)],
 80                "reviewers": [],
 81                "min_reviewers": 1,
 82            },
 83        )
 84        self.assertEqual(response.status_code, 201)
 85        self.assertIsNone(response.data["object_id"])
 86
 87    def test_create_rule_fails_without_reviewers(self):
 88        response = self.client.post(
 89            reverse("authentik_api:lifecyclerule-list"),
 90            {
 91                "name": generate_id(),
 92                "content_type": f"{self.content_type.app_label}.{self.content_type.model}",
 93                "object_id": str(self.app.pk),
 94                "interval": "days=30",
 95                "grace_period": "days=10",
 96                "reviewer_groups": [],
 97                "reviewers": [],
 98                "min_reviewers": 1,
 99            },
100        )
101        self.assertEqual(response.status_code, 400)
102
103    def test_create_rule_fails_grace_period_longer_than_interval(self):
104        response = self.client.post(
105            reverse("authentik_api:lifecyclerule-list"),
106            {
107                "name": generate_id(),
108                "content_type": f"{self.content_type.app_label}.{self.content_type.model}",
109                "object_id": str(self.app.pk),
110                "interval": "days=10",
111                "grace_period": "days=30",
112                "reviewer_groups": [str(self.reviewer_group.pk)],
113                "reviewers": [],
114                "min_reviewers": 1,
115            },
116        )
117        self.assertEqual(response.status_code, 400)
118        self.assertIn("grace_period", response.data)
119
120    def test_create_rule_fails_invalid_object_id(self):
121        response = self.client.post(
122            reverse("authentik_api:lifecyclerule-list"),
123            {
124                "name": generate_id(),
125                "content_type": f"{self.content_type.app_label}.{self.content_type.model}",
126                "object_id": "00000000-0000-0000-0000-000000000000",
127                "interval": "days=30",
128                "grace_period": "days=10",
129                "reviewer_groups": [str(self.reviewer_group.pk)],
130                "reviewers": [],
131                "min_reviewers": 1,
132            },
133        )
134        self.assertEqual(response.status_code, 400)
135        self.assertIn("object_id", response.data)
136
137    def test_retrieve_rule(self):
138        rule = LifecycleRule.objects.create(
139            name=generate_id(),
140            content_type=self.content_type,
141            object_id=str(self.app.pk),
142        )
143        rule.reviewer_groups.add(self.reviewer_group)
144
145        response = self.client.get(
146            reverse("authentik_api:lifecyclerule-detail", kwargs={"pk": rule.pk})
147        )
148        self.assertEqual(response.status_code, 200)
149        self.assertEqual(response.data["id"], str(rule.pk))
150
151    def test_update_rule(self):
152        rule = LifecycleRule.objects.create(
153            name=generate_id(),
154            content_type=self.content_type,
155            object_id=str(self.app.pk),
156            interval="days=30",
157        )
158        rule.reviewer_groups.add(self.reviewer_group)
159
160        response = self.client.patch(
161            reverse("authentik_api:lifecyclerule-detail", kwargs={"pk": rule.pk}),
162            {"interval": "days=60"},
163        )
164        self.assertEqual(response.status_code, 200)
165        self.assertEqual(response.data["interval"], "days=60")
166
167    def test_delete_rule(self):
168        rule = LifecycleRule.objects.create(
169            name=generate_id(),
170            content_type=self.content_type,
171            object_id=str(self.app.pk),
172        )
173        rule.reviewer_groups.add(self.reviewer_group)
174
175        response = self.client.delete(
176            reverse("authentik_api:lifecyclerule-detail", kwargs={"pk": rule.pk})
177        )
178        self.assertEqual(response.status_code, 204)
179        self.assertFalse(LifecycleRule.objects.filter(pk=rule.pk).exists())
180
181
182@patch_license
183class TestIterationAPI(APITestCase):
184
185    def setUp(self):
186        self.user = create_test_admin_user()
187        self.client.force_login(self.user)
188        self.app = Application.objects.create(name=generate_id(), slug=generate_id())
189        self.content_type = ContentType.objects.get_for_model(Application)
190        self.reviewer_group = Group.objects.create(name=generate_id())
191        self.reviewer_group.users.add(self.user)
192
193    def test_open_iterations(self):
194        rule = LifecycleRule.objects.create(
195            name=generate_id(),
196            content_type=self.content_type,
197            object_id=str(self.app.pk),
198        )
199        rule.reviewer_groups.add(self.reviewer_group)
200
201        response = self.client.get(reverse("authentik_api:lifecycleiteration-open-iterations"))
202        self.assertEqual(response.status_code, 200)
203        self.assertGreaterEqual(len(response.data["results"]), 1)
204
205        for iteration in response.data["results"]:
206            self.assertEqual(iteration["state"], ReviewState.PENDING)
207
208    def test_open_iterations_filter_user_is_reviewer(self):
209        rule = LifecycleRule.objects.create(
210            name=generate_id(),
211            content_type=self.content_type,
212            object_id=str(self.app.pk),
213        )
214        rule.reviewer_groups.add(self.reviewer_group)
215
216        response = self.client.get(
217            reverse("authentik_api:lifecycleiteration-open-iterations"),
218            {"user_is_reviewer": "true"},
219        )
220        self.assertEqual(response.status_code, 200)
221        # User is in reviewer_group, so should see the iteration
222        self.assertGreaterEqual(len(response.data["results"]), 1)
223
224    def test_latest_iteration(self):
225        rule = LifecycleRule.objects.create(
226            name=generate_id(),
227            content_type=self.content_type,
228            object_id=str(self.app.pk),
229        )
230        rule.reviewer_groups.add(self.reviewer_group)
231
232        response = self.client.get(
233            reverse(
234                "authentik_api:lifecycleiteration-latest-iteration",
235                kwargs={
236                    "content_type": f"{self.content_type.app_label}.{self.content_type.model}",
237                    "object_id": str(self.app.pk),
238                },
239            )
240        )
241        self.assertEqual(response.status_code, 200)
242        self.assertEqual(response.data["object_id"], str(self.app.pk))
243
244    def test_latest_iteration_not_found(self):
245        response = self.client.get(
246            reverse(
247                "authentik_api:lifecycleiteration-latest-iteration",
248                kwargs={
249                    "content_type": f"{self.content_type.app_label}.{self.content_type.model}",
250                    "object_id": "00000000-0000-0000-0000-000000000000",
251                },
252            )
253        )
254        self.assertEqual(response.status_code, 404)
255
256    def test_iteration_includes_user_can_review(self):
257        rule = LifecycleRule.objects.create(
258            name=generate_id(),
259            content_type=self.content_type,
260            object_id=str(self.app.pk),
261        )
262        rule.reviewer_groups.add(self.reviewer_group)
263
264        response = self.client.get(reverse("authentik_api:lifecycleiteration-open-iterations"))
265        self.assertEqual(response.status_code, 200)
266        self.assertGreaterEqual(len(response.data["results"]), 1)
267        # user_can_review should be present
268        self.assertIn("user_can_review", response.data["results"][0])
269
270
271@patch_license
272class TestReviewAPI(APITestCase):
273
274    def setUp(self):
275        self.user = create_test_admin_user()
276        self.client.force_login(self.user)
277        self.app = Application.objects.create(name=generate_id(), slug=generate_id())
278        self.content_type = ContentType.objects.get_for_model(Application)
279        self.reviewer_group = Group.objects.create(name=generate_id())
280        self.reviewer_group.users.add(self.user)
281
282    def test_create_review(self):
283        rule = LifecycleRule.objects.create(
284            name=generate_id(),
285            content_type=self.content_type,
286            object_id=str(self.app.pk),
287            min_reviewers=1,
288        )
289        rule.reviewer_groups.add(self.reviewer_group)
290
291        # Get the auto-created iteration
292        iteration = LifecycleIteration.objects.get(
293            content_type=self.content_type, object_id=str(self.app.pk), rule=rule
294        )
295
296        response = self.client.post(
297            reverse("authentik_api:review-list"),
298            {
299                "iteration": str(iteration.pk),
300                "note": "Reviewed and approved",
301            },
302        )
303        self.assertEqual(response.status_code, 201)
304        self.assertEqual(response.data["iteration"], iteration.pk)
305        self.assertEqual(response.data["note"], "Reviewed and approved")
306        self.assertEqual(response.data["reviewer"]["pk"], self.user.pk)
307
308    def test_create_review_completes_iteration(self):
309        rule = LifecycleRule.objects.create(
310            name=generate_id(),
311            content_type=self.content_type,
312            object_id=str(self.app.pk),
313            min_reviewers=1,
314        )
315        rule.reviewer_groups.add(self.reviewer_group)
316
317        iteration = LifecycleIteration.objects.get(
318            content_type=self.content_type, object_id=str(self.app.pk), rule=rule
319        )
320        self.assertEqual(iteration.state, ReviewState.PENDING)
321
322        response = self.client.post(
323            reverse("authentik_api:review-list"),
324            {
325                "iteration": str(iteration.pk),
326            },
327        )
328        self.assertEqual(response.status_code, 201)
329
330        iteration.refresh_from_db()
331        self.assertEqual(iteration.state, ReviewState.REVIEWED)
332
333    def test_create_review_sets_reviewer_from_request(self):
334        rule = LifecycleRule.objects.create(
335            name=generate_id(),
336            content_type=self.content_type,
337            object_id=str(self.app.pk),
338            min_reviewers=1,
339        )
340        rule.reviewer_groups.add(self.reviewer_group)
341
342        iteration = LifecycleIteration.objects.get(
343            content_type=self.content_type, object_id=str(self.app.pk), rule=rule
344        )
345
346        response = self.client.post(
347            reverse("authentik_api:review-list"),
348            {
349                "iteration": str(iteration.pk),
350            },
351        )
352        self.assertEqual(response.status_code, 201)
353        # Reviewer should be the logged-in user
354        self.assertEqual(response.data["reviewer"]["pk"], self.user.pk)
355
356    def test_non_reviewer_cannot_review(self):
357        other_group = Group.objects.create(name=generate_id())
358        other_user = create_test_user()
359        other_group.users.add(other_user)
360
361        rule = LifecycleRule.objects.create(
362            name=generate_id(),
363            content_type=self.content_type,
364            object_id=str(self.app.pk),
365            min_reviewers=1,
366        )
367        rule.reviewer_groups.add(other_group)
368
369        iteration = LifecycleIteration.objects.get(
370            content_type=self.content_type, object_id=str(self.app.pk), rule=rule
371        )
372
373        # Current user is not in the reviewer group
374        self.assertFalse(iteration.user_can_review(self.user))
375
376    def test_non_reviewer_review_via_api_rejected(self):
377        other_group = Group.objects.create(name=generate_id())
378        other_user = create_test_user()
379        other_group.users.add(other_user)
380
381        rule = LifecycleRule.objects.create(
382            name=generate_id(),
383            content_type=self.content_type,
384            object_id=str(self.app.pk),
385            min_reviewers=1,
386        )
387        rule.reviewer_groups.add(other_group)
388
389        iteration = LifecycleIteration.objects.get(
390            content_type=self.content_type, object_id=str(self.app.pk), rule=rule
391        )
392
393        # Current user (self.user) is NOT in the reviewer group
394        response = self.client.post(
395            reverse("authentik_api:review-list"),
396            {"iteration": str(iteration.pk)},
397        )
398        self.assertEqual(response.status_code, 400)
399
400    def test_duplicate_review_via_api_rejected(self):
401        rule = LifecycleRule.objects.create(
402            name=generate_id(),
403            content_type=self.content_type,
404            object_id=str(self.app.pk),
405            min_reviewers=2,
406        )
407        rule.reviewer_groups.add(self.reviewer_group)
408
409        iteration = LifecycleIteration.objects.get(
410            content_type=self.content_type, object_id=str(self.app.pk), rule=rule
411        )
412
413        # First review should succeed
414        response = self.client.post(
415            reverse("authentik_api:review-list"),
416            {"iteration": str(iteration.pk)},
417        )
418        self.assertEqual(response.status_code, 201)
419
420        # Second review by same user should be rejected
421        response = self.client.post(
422            reverse("authentik_api:review-list"),
423            {"iteration": str(iteration.pk)},
424        )
425        self.assertEqual(response.status_code, 400)