Only allow explicitly whitelisted users to issue lease requests to Machine Provider

appengine/machine_provider/handlers_endpoints_test.py

Index: appengine/machine_provider/handlers_endpoints_test.py
diff --git a/appengine/machine_provider/handlers_endpoints_test.py b/appengine/machine_provider/handlers_endpoints_test.py
index 2a97ab97a556cb3966b1cdf7ab97859e7b66aa08..f420107f1bda7d28bba336beb1fa4e40a0be2c10 100755
--- a/appengine/machine_provider/handlers_endpoints_test.py
+++ b/appengine/machine_provider/handlers_endpoints_test.py
@@ -17,7 +17,6 @@ from google.appengine import runtime
 from protorpc.remote import protojson
 import webtest
 
-from components import auth_testing
 from components import utils
 from components.machine_provider import rpc_messages
 from test_support import test_case
@@ -561,6 +560,7 @@ class MachineProviderReleaseTest(test_case.EndpointsTestCase):
     self.app = webtest.TestApp(app)
 
   def test_release(self):
+    self.mock(acl.auth, 'is_group_member', lambda *args, **kwargs: True)

[M-A Ruel, 2017/02/15 23:59:02]

I'd prefer one that check the group name (so probably extracted itself in a
function) but I don't mind much.

[smut, 2017/02/16 01:15:10]

Done.

     self.mock(
         handlers_endpoints.MachineProviderEndpoints,
         '_release',
@@ -570,7 +570,6 @@ class MachineProviderReleaseTest(test_case.EndpointsTestCase):
     request = rpc_to_json(rpc_messages.LeaseReleaseRequest(
         request_id='request-id',
     ))
-    auth_testing.mock_get_current_identity(self)
 
     response = jsonish_dict_to_rpc(
         self.call_api('release', request).json,
@@ -590,6 +589,7 @@ class MachineProviderBatchedReleaseTest(test_case.EndpointsTestCase):
     self.app = webtest.TestApp(app)
 
   def test_batch(self):
+    self.mock(acl.auth, 'is_group_member', lambda *args, **kwargs: True)
     ts = utils.utcnow()
     self.mock(utils, 'utcnow', lambda *args, **kwargs: ts)
 
@@ -600,7 +600,6 @@ class MachineProviderBatchedReleaseTest(test_case.EndpointsTestCase):
             ),
         ],
     ))
-    auth_testing.mock_get_current_identity(self)
 
     release_responses = jsonish_dict_to_rpc(
         self.call_api('batched_release', release_requests).json,
@@ -615,6 +614,7 @@ class MachineProviderBatchedReleaseTest(test_case.EndpointsTestCase):
     )
 
   def test_deadline_exceeded(self):
+    self.mock(acl.auth, 'is_group_member', lambda *args, **kwargs: True)
     class utcnow(object):
       def __init__(self, init_ts):
         self.last_ts = init_ts
@@ -630,7 +630,6 @@ class MachineProviderBatchedReleaseTest(test_case.EndpointsTestCase):
             ),
         ],
     ))
-    auth_testing.mock_get_current_identity(self)
 
     release_responses = jsonish_dict_to_rpc(
         self.call_api('batched_release', release_requests).json,
@@ -645,6 +644,7 @@ class MachineProviderBatchedReleaseTest(test_case.EndpointsTestCase):
     )
 
   def test_exception(self):
+    self.mock(acl.auth, 'is_group_member', lambda *args, **kwargs: True)
     ts = utils.utcnow()
     self.mock(utils, 'utcnow', lambda *args, **kwargs: ts)
 
@@ -659,7 +659,6 @@ class MachineProviderBatchedReleaseTest(test_case.EndpointsTestCase):
             ),
         ],
     ))
-    auth_testing.mock_get_current_identity(self)
 
     release_responses = jsonish_dict_to_rpc(
         self.call_api('batched_release', release_requests).json,
@@ -684,6 +683,7 @@ class MachineProviderBatchedLeaseTest(test_case.EndpointsTestCase):
     self.app = webtest.TestApp(app)
 
   def test_batch(self):
+    self.mock(acl.auth, 'is_group_member', lambda *args, **kwargs: True)
     ts = utils.utcnow()
     self.mock(utils, 'utcnow', lambda *args, **kwargs: ts)
 
@@ -696,7 +696,6 @@ class MachineProviderBatchedLeaseTest(test_case.EndpointsTestCase):
             request_id='request-id',
         ),
     ]))
-    auth_testing.mock_get_current_identity(self)
 
     lease_responses = jsonish_dict_to_rpc(
         self.call_api('batched_lease', lease_requests).json,
@@ -708,6 +707,7 @@ class MachineProviderBatchedLeaseTest(test_case.EndpointsTestCase):
     self.assertFalse(lease_responses.responses[0].error)
 
   def test_deadline_exceeded(self):
+    self.mock(acl.auth, 'is_group_member', lambda *args, **kwargs: True)
     class utcnow(object):
       def __init__(self, init_ts):
         self.last_ts = init_ts
@@ -725,7 +725,6 @@ class MachineProviderBatchedLeaseTest(test_case.EndpointsTestCase):
             request_id='request-id',
         ),
     ]))
-    auth_testing.mock_get_current_identity(self)
 
     lease_responses = jsonish_dict_to_rpc(
         self.call_api('batched_lease', lease_requests).json,
@@ -740,6 +739,7 @@ class MachineProviderBatchedLeaseTest(test_case.EndpointsTestCase):
     )
 
   def test_exception(self):
+    self.mock(acl.auth, 'is_group_member', lambda *args, **kwargs: True)
     ts = utils.utcnow()
     self.mock(utils, 'utcnow', lambda *args, **kwargs: ts)
 
@@ -756,7 +756,6 @@ class MachineProviderBatchedLeaseTest(test_case.EndpointsTestCase):
             request_id='request-id',
         ),
     ]))
-    auth_testing.mock_get_current_identity(self)
 
     lease_responses = jsonish_dict_to_rpc(
         self.call_api('batched_lease', lease_requests).json,
@@ -781,6 +780,7 @@ class MachineProviderLeaseTest(test_case.EndpointsTestCase):
     self.app = webtest.TestApp(app)
 
   def test_lease_duration(self):
+    self.mock(acl.auth, 'is_group_member', lambda *args, **kwargs: True)
     lease_request = rpc_to_json(rpc_messages.LeaseRequest(
         dimensions=rpc_messages.Dimensions(
             os_family=rpc_messages.OSFamily.LINUX,
@@ -789,7 +789,6 @@ class MachineProviderLeaseTest(test_case.EndpointsTestCase):
         request_id='abc',
         pubsub_topic='topic',
     ))
-    auth_testing.mock_get_current_identity(self)
 
     lease_response = jsonish_dict_to_rpc(
         self.call_api('lease', lease_request).json,
@@ -798,6 +797,7 @@ class MachineProviderLeaseTest(test_case.EndpointsTestCase):
     self.assertFalse(lease_response.error)
 
   def test_lease_duration_zero(self):
+    self.mock(acl.auth, 'is_group_member', lambda *args, **kwargs: True)
     lease_request = rpc_to_json(rpc_messages.LeaseRequest(
         dimensions=rpc_messages.Dimensions(
             os_family=rpc_messages.OSFamily.LINUX,
@@ -805,7 +805,6 @@ class MachineProviderLeaseTest(test_case.EndpointsTestCase):
         duration=0,
         request_id='abc',
     ))
-    auth_testing.mock_get_current_identity(self)
 
     lease_response = jsonish_dict_to_rpc(
         self.call_api('lease', lease_request).json,
@@ -817,6 +816,7 @@ class MachineProviderLeaseTest(test_case.EndpointsTestCase):
     )
 
   def test_lease_duration_negative(self):
+    self.mock(acl.auth, 'is_group_member', lambda *args, **kwargs: True)
     lease_request = rpc_to_json(rpc_messages.LeaseRequest(
         dimensions=rpc_messages.Dimensions(
             os_family=rpc_messages.OSFamily.LINUX,
@@ -824,26 +824,6 @@ class MachineProviderLeaseTest(test_case.EndpointsTestCase):
         duration=-1,
         request_id='abc',
     ))
-    auth_testing.mock_get_current_identity(self)
-
-    lease_response = jsonish_dict_to_rpc(
-        self.call_api('lease', lease_request).json,
-        rpc_messages.LeaseResponse,
-    )
-    self.assertEqual(
-        lease_response.error,
-        rpc_messages.LeaseRequestError.NONPOSITIVE_DEADLINE,
-    )
-
-  def test_lease_duration_negative(self):
-    lease_request = rpc_to_json(rpc_messages.LeaseRequest(
-        dimensions=rpc_messages.Dimensions(
-            os_family=rpc_messages.OSFamily.LINUX,
-        ),
-        duration=-1,
-        request_id='abc',
-    ))
-    auth_testing.mock_get_current_identity(self)
 
     lease_response = jsonish_dict_to_rpc(
         self.call_api('lease', lease_request).json,
@@ -855,6 +835,7 @@ class MachineProviderLeaseTest(test_case.EndpointsTestCase):
     )
 
   def test_lease_duration_and_lease_expiration_ts(self):
+    self.mock(acl.auth, 'is_group_member', lambda *args, **kwargs: True)
     lease_request = rpc_to_json(rpc_messages.LeaseRequest(
         dimensions=rpc_messages.Dimensions(
             os_family=rpc_messages.OSFamily.LINUX,
@@ -863,7 +844,6 @@ class MachineProviderLeaseTest(test_case.EndpointsTestCase):
         lease_expiration_ts=9999999999,
         request_id='abc',
     ))
-    auth_testing.mock_get_current_identity(self)
 
     lease_response = jsonish_dict_to_rpc(
         self.call_api('lease', lease_request).json,
@@ -875,6 +855,7 @@ class MachineProviderLeaseTest(test_case.EndpointsTestCase):
     )
 
   def test_lease_timestamp(self):
+    self.mock(acl.auth, 'is_group_member', lambda *args, **kwargs: True)
     lease_request = rpc_to_json(rpc_messages.LeaseRequest(
         dimensions=rpc_messages.Dimensions(
             os_family=rpc_messages.OSFamily.LINUX,
@@ -882,7 +863,6 @@ class MachineProviderLeaseTest(test_case.EndpointsTestCase):
         lease_expiration_ts=9999999999,
         request_id='abc',
     ))
-    auth_testing.mock_get_current_identity(self)
 
     lease_response = jsonish_dict_to_rpc(
         self.call_api('lease', lease_request).json,
@@ -891,6 +871,7 @@ class MachineProviderLeaseTest(test_case.EndpointsTestCase):
     self.assertFalse(lease_response.error)
 
   def test_lease_timestamp_passed(self):
+    self.mock(acl.auth, 'is_group_member', lambda *args, **kwargs: True)
     lease_request = rpc_to_json(rpc_messages.LeaseRequest(
         dimensions=rpc_messages.Dimensions(
             os_family=rpc_messages.OSFamily.LINUX,
@@ -898,7 +879,6 @@ class MachineProviderLeaseTest(test_case.EndpointsTestCase):
         lease_expiration_ts=1,
         request_id='abc',
     ))
-    auth_testing.mock_get_current_identity(self)
 
     lease_response = jsonish_dict_to_rpc(
         self.call_api('lease', lease_request).json,
@@ -910,6 +890,7 @@ class MachineProviderLeaseTest(test_case.EndpointsTestCase):
     )
 
   def test_duplicate(self):
+    self.mock(acl.auth, 'is_group_member', lambda *args, **kwargs: True)
     lease_request = rpc_to_json(rpc_messages.LeaseRequest(
         dimensions=rpc_messages.Dimensions(
             os_family=rpc_messages.OSFamily.OSX,
@@ -917,7 +898,6 @@ class MachineProviderLeaseTest(test_case.EndpointsTestCase):
         duration=3,
         request_id='asdf',
     ))
-    auth_testing.mock_get_current_identity(self)
 
     lease_response_1 = jsonish_dict_to_rpc(
         self.call_api('lease', lease_request).json,
@@ -935,6 +915,7 @@ class MachineProviderLeaseTest(test_case.EndpointsTestCase):
     )
 
   def test_request_id_reuse(self):
+    self.mock(acl.auth, 'is_group_member', lambda *args, **kwargs: True)
     lease_request_1 = rpc_to_json(rpc_messages.LeaseRequest(
         dimensions=rpc_messages.Dimensions(
             os_family=rpc_messages.OSFamily.WINDOWS,
@@ -949,7 +930,6 @@ class MachineProviderLeaseTest(test_case.EndpointsTestCase):
         duration=189,
         request_id='qwerty',
     ))
-    auth_testing.mock_get_current_identity(self)
 
     lease_response_1 = jsonish_dict_to_rpc(
         self.call_api('lease', lease_request_1).json,
@@ -970,6 +950,7 @@ class MachineProviderLeaseTest(test_case.EndpointsTestCase):
     )
 
   def test_invalid_topic(self):
+    self.mock(acl.auth, 'is_group_member', lambda *args, **kwargs: True)
     lease_request = rpc_to_json(rpc_messages.LeaseRequest(
         dimensions=rpc_messages.Dimensions(
             os_family=rpc_messages.OSFamily.WINDOWS,
@@ -978,7 +959,6 @@ class MachineProviderLeaseTest(test_case.EndpointsTestCase):
         pubsub_topic='../../a-different-project/topics/my-topic',
         request_id='123',
     ))
-    auth_testing.mock_get_current_identity(self)
 
     lease_response = jsonish_dict_to_rpc(
         self.call_api('lease', lease_request).json,
@@ -990,6 +970,7 @@ class MachineProviderLeaseTest(test_case.EndpointsTestCase):
     )
 
   def test_invalid_project(self):
+    self.mock(acl.auth, 'is_group_member', lambda *args, **kwargs: True)
     lease_request = rpc_to_json(rpc_messages.LeaseRequest(
         dimensions=rpc_messages.Dimensions(
             os_family=rpc_messages.OSFamily.WINDOWS,
@@ -999,7 +980,6 @@ class MachineProviderLeaseTest(test_case.EndpointsTestCase):
         pubsub_project='../../a-different-project/topics/my-other-topic',
         request_id='123',
     ))
-    auth_testing.mock_get_current_identity(self)
 
     lease_response = jsonish_dict_to_rpc(
         self.call_api('lease', lease_request).json,
@@ -1011,6 +991,7 @@ class MachineProviderLeaseTest(test_case.EndpointsTestCase):
     )
 
   def test_project_without_topic(self):
+    self.mock(acl.auth, 'is_group_member', lambda *args, **kwargs: True)
     lease_request = rpc_to_json(rpc_messages.LeaseRequest(
         dimensions=rpc_messages.Dimensions(
             os_family=rpc_messages.OSFamily.WINDOWS,
@@ -1019,7 +1000,6 @@ class MachineProviderLeaseTest(test_case.EndpointsTestCase):
         pubsub_project='my-project',
         request_id='123',
     ))
-    auth_testing.mock_get_current_identity(self)
 
     lease_response = jsonish_dict_to_rpc(
         self.call_api('lease', lease_request).json,