inspec/lib/plugins/inspec-compliance/test/unit/api_test.rb

require 'minitest/autorun'
require 'webmock/minitest'
require 'mocha/setup'
require_relative '../../lib/inspec-compliance/api.rb'

describe InspecPlugins::Compliance::API do
  let(:profiles_response) do
    [{ 'name'=>'apache-baseline',
      'title'=>'DevSec Apache Baseline',
      'maintainer'=>'DevSec Hardening Framework Team',
      'copyright'=>'DevSec Hardening Framework Team',
      'copyright_email'=>'hello@dev-sec.io',
      'license'=>'Apache 2 license',
      'summary'=>'Test-suite for best-practice apache hardening',
      'version'=>'2.0.2',
      'supports'=>[{ 'os-family'=>'unix' }],
      'depends'=>nil,
      'owner_id'=>'admin' },
     { 'name'=>'apache-baseline',
      'title'=>'DevSec Apache Baseline',
      'maintainer'=>'Hardening Framework Team',
      'copyright'=>'Hardening Framework Team',
      'copyright_email'=>'hello@dev-sec.io',
      'license'=>'Apache 2 license',
      'summary'=>'Test-suite for best-practice apache hardening',
      'version'=>'2.0.1',
      'supports'=>[{ 'os-family'=>'unix' }],
      'depends'=>nil,
      'latest_version'=>'2.0.2',
      'owner_id'=>'admin' },
     { 'name'=>'cis-aix-5.3-6.1-level1',
      'title'=>'CIS AIX 5.3 and AIX 6.1 Benchmark Level 1',
      'maintainer'=>'Chef Software, Inc.',
      'copyright'=>'Chef Software, Inc.',
      'copyright_email'=>'support@chef.io',
      'license'=>'Proprietary, All rights reserved',
      'summary'=>'CIS AIX 5.3 and AIX 6.1 Benchmark Level 1 translated from SCAP',
      'version'=>'1.1.0',
      'supports'=>nil,
      'depends'=>nil,
      'latest_version'=>'1.1.0-3',
      'owner_id'=>'admin' }]
  end

  describe '.version' do
    let(:headers) { 'test-headers' }
    let(:config) do
      {
        'server' => 'myserver',
        'insecure' => true,
      }
    end

    before do
      InspecPlugins::Compliance::API.expects(:get_headers).returns(headers)
    end

    describe 'when a 404 is received' do
      it 'should return an empty hash' do
        response = mock
        response.stubs(:code).returns('404')
        InspecPlugins::Compliance::HTTP.expects(:get).with('myserver/version', 'test-headers', true).returns(response)
        InspecPlugins::Compliance::API.version(config).must_equal({})
      end
    end

    describe 'when the returned body is nil' do
      it 'should return an empty hash' do
        response = mock
        response.stubs(:code).returns('200')
        response.stubs(:body).returns(nil)
        InspecPlugins::Compliance::HTTP.expects(:get).with('myserver/version', 'test-headers', true).returns(response)
        InspecPlugins::Compliance::API.version(config).must_equal({})
      end
    end

    describe 'when the returned body is an empty string' do
      it 'should return an empty hash' do
        response = mock
        response.stubs(:code).returns('200')
        response.stubs(:body).returns('')
        InspecPlugins::Compliance::HTTP.expects(:get).with('myserver/version', 'test-headers', true).returns(response)
        InspecPlugins::Compliance::API.version(config).must_equal({})
      end
    end

    describe 'when the returned body has no version key' do
      it 'should return an empty hash' do
        response = mock
        response.stubs(:code).returns('200')
        response.stubs(:body).returns('{"api":"compliance"}')
        InspecPlugins::Compliance::HTTP.expects(:get).with('myserver/version', 'test-headers', true).returns(response)
        InspecPlugins::Compliance::API.version(config).must_equal({})
      end
    end

    describe 'when the returned body has an empty version key' do
      it 'should return an empty hash' do
        response = mock
        response.stubs(:code).returns('200')
        response.stubs(:body).returns('{"api":"compliance","version":""}')
        InspecPlugins::Compliance::HTTP.expects(:get).with('myserver/version', 'test-headers', true).returns(response)
        InspecPlugins::Compliance::API.version(config).must_equal({})
      end
    end

    describe 'when the returned body has a proper version' do
      it 'should return an empty hash' do
        response = mock
        response.stubs(:code).returns('200')
        response.stubs(:body).returns('{"api":"compliance","version":"1.2.3"}')
        InspecPlugins::Compliance::HTTP.expects(:get).with('myserver/version', 'test-headers', true).returns(response)
        InspecPlugins::Compliance::API.version(config).must_equal({ 'version' => '1.2.3', 'api' => 'compliance' })
      end
    end
  end

  describe 'automate/compliance is? checks' do
    describe 'when the config has a compliance server_type' do
      it 'automate/compliance server is? methods return correctly' do
        config = InspecPlugins::Compliance::Configuration.new
        config.clean
        config['server_type'] = 'compliance'
        InspecPlugins::Compliance::API.is_compliance_server?(config).must_equal true
        InspecPlugins::Compliance::API.is_automate_server?(config).must_equal false
        InspecPlugins::Compliance::API.is_automate_server_pre_080?(config).must_equal false
        InspecPlugins::Compliance::API.is_automate_server_080_and_later?(config).must_equal false
        InspecPlugins::Compliance::API.is_automate2_server?(config).must_equal false
      end
    end

    describe 'when the config has a automate2 server_type' do
      it 'automate/compliance server is? methods return correctly' do
        config = InspecPlugins::Compliance::Configuration.new
        config.clean
        config['server_type'] = 'automate2'
        InspecPlugins::Compliance::API.is_compliance_server?(config).must_equal false
        InspecPlugins::Compliance::API.is_automate_server?(config).must_equal false
        InspecPlugins::Compliance::API.is_automate_server_pre_080?(config).must_equal false
        InspecPlugins::Compliance::API.is_automate_server_080_and_later?(config).must_equal false
        InspecPlugins::Compliance::API.is_automate2_server?(config).must_equal true
      end
    end

    describe 'when the config has an automate server_type and no version key' do
      it 'automate/compliance server is? methods return correctly' do
        config = InspecPlugins::Compliance::Configuration.new
        config.clean
        config['server_type'] = 'automate'
        InspecPlugins::Compliance::API.is_compliance_server?(config).must_equal false
        InspecPlugins::Compliance::API.is_automate_server?(config).must_equal true
        InspecPlugins::Compliance::API.is_automate_server_pre_080?(config).must_equal true
        InspecPlugins::Compliance::API.is_automate_server_080_and_later?(config).must_equal false
        InspecPlugins::Compliance::API.is_automate2_server?(config).must_equal false
      end
    end

    describe 'when the config has an automate server_type and a version key that is not a hash' do
      it 'automate/compliance server is? methods return correctly' do
        config = InspecPlugins::Compliance::Configuration.new
        config.clean
        config['server_type'] = 'automate'
        config['version'] = '1.2.3'
        InspecPlugins::Compliance::API.is_compliance_server?(config).must_equal false
        InspecPlugins::Compliance::API.is_automate_server?(config).must_equal true
        InspecPlugins::Compliance::API.is_automate_server_pre_080?(config).must_equal true
        InspecPlugins::Compliance::API.is_automate_server_080_and_later?(config).must_equal false
        InspecPlugins::Compliance::API.is_automate2_server?(config).must_equal false
      end
    end

    describe 'when the config has an automate server_type and a version hash with no version' do
      it 'automate/compliance server is? methods return correctly' do
        config = InspecPlugins::Compliance::Configuration.new
        config.clean
        config['server_type'] = 'automate'
        config['version'] = {}
        InspecPlugins::Compliance::API.is_compliance_server?(config).must_equal false
        InspecPlugins::Compliance::API.is_automate_server?(config).must_equal true
        InspecPlugins::Compliance::API.is_automate_server_pre_080?(config).must_equal true
        InspecPlugins::Compliance::API.is_automate_server_080_and_later?(config).must_equal false
      end
    end

    describe 'when the config has an automate server_type and a version hash with a version' do
      it 'automate/compliance server is? methods return correctly' do
        config = InspecPlugins::Compliance::Configuration.new
        config.clean
        config['server_type'] = 'automate'
        config['version'] = { 'version' => '0.8.1' }
        InspecPlugins::Compliance::API.is_compliance_server?(config).must_equal false
        InspecPlugins::Compliance::API.is_automate_server?(config).must_equal true
        InspecPlugins::Compliance::API.is_automate_server_pre_080?(config).must_equal false
        InspecPlugins::Compliance::API.is_automate_server_080_and_later?(config).must_equal true
      end
    end
  end

  describe '.server_version_from_config' do
    it 'returns nil when the config has no version key' do
      config = {}
      InspecPlugins::Compliance::API.server_version_from_config(config).must_be_nil
    end

    it 'returns nil when the version value is not a hash' do
      config = { 'version' => '123' }
      InspecPlugins::Compliance::API.server_version_from_config(config).must_be_nil
    end

    it 'returns nil when the version value is a hash but has no version key inside' do
      config = { 'version' => {} }
      InspecPlugins::Compliance::API.server_version_from_config(config).must_be_nil
    end

    it 'returns the version if the version value is a hash containing a version' do
      config = { 'version' => { 'version' => '1.2.3' } }
      InspecPlugins::Compliance::API.server_version_from_config(config).must_equal '1.2.3'
    end
  end

  describe 'profile_split' do
    it 'handles a profile without version' do
      InspecPlugins::Compliance::API.profile_split('admin/apache-baseline').must_equal ['admin', 'apache-baseline', nil]
    end

    it 'handles a profile with a version' do
      InspecPlugins::Compliance::API.profile_split('admin/apache-baseline#2.0.1').must_equal ['admin', 'apache-baseline', '2.0.1']
    end
  end

  describe 'target_url' do
    it 'handles a automate profile with and without version' do
      config = InspecPlugins::Compliance::Configuration.new
      config.clean
      config['server_type'] = 'automate'
      config['server'] = 'https://myautomate'
      config['version'] = '1.6.99'
      InspecPlugins::Compliance::API.target_url(config, 'admin/apache-baseline').must_equal       'https://myautomate/profiles/admin/apache-baseline/tar'
      InspecPlugins::Compliance::API.target_url(config, 'admin/apache-baseline#2.0.2').must_equal 'https://myautomate/profiles/admin/apache-baseline/version/2.0.2/tar'
    end

    it 'handles a chef-compliance profile with and without version' do
      config = InspecPlugins::Compliance::Configuration.new
      config.clean
      config['server_type'] = 'compliance'
      config['server'] = 'https://mychefcompliance'
      config['version'] = '1.1.2'
      InspecPlugins::Compliance::API.target_url(config, 'admin/apache-baseline').must_equal       'https://mychefcompliance/owners/admin/compliance/apache-baseline/tar'
      InspecPlugins::Compliance::API.target_url(config, 'admin/apache-baseline#2.0.2').must_equal 'https://mychefcompliance/owners/admin/compliance/apache-baseline/tar'
    end
  end

  describe 'exist?' do
    it 'works with profiles returned by Automate' do
      # ruby 2.3.3 has issues running stub_requests properly
      # skipping for that specific version
      return if RUBY_VERSION == '2.3.3'

      config = InspecPlugins::Compliance::Configuration.new
      config.clean
      config['owner'] = 'admin'
      config['server_type'] = 'automate'
      config['server'] = 'https://myautomate'
      config['version'] = '1.6.99'
      config['automate'] = { 'ent'=>'automate', 'token_type'=>'dctoken' }
      config['version'] = { 'api'=> 'compliance', 'version'=>'0.8.24' }
      
      stub_request(:get, 'https://myautomate/profiles/admin')
        .with(headers: { 'Accept'=>'*/*', 'Accept-Encoding'=>'gzip;q=1.0,deflate;q=0.6,identity;q=0.3', 'Chef-Delivery-Enterprise'=>'automate', 'User-Agent'=>'Ruby', 'X-Data-Collector-Token'=>'' })
        .to_return(status: 200, body: profiles_response.to_json, headers: {})

      InspecPlugins::Compliance::API.exist?(config, 'admin/apache-baseline').must_equal true
      InspecPlugins::Compliance::API.exist?(config, 'admin/apache-baseline#2.0.1').must_equal true
      InspecPlugins::Compliance::API.exist?(config, 'admin/apache-baseline#2.0.999').must_equal false
      InspecPlugins::Compliance::API.exist?(config, 'admin/missing-in-action').must_equal false
    end
  end

  describe '.determine_server_type' do
    let(:url) { 'https://someserver.onthe.net/' }

    let(:compliance_endpoint) { '/api/version' }
    let(:automate_endpoint) { '/compliance/version' }
    let(:automate2_endpoint) { '/dex/auth' }
    let(:headers) { nil }
    let(:insecure) { true }

    let(:good_response) { mock }
    let(:bad_response) { mock }

    it 'returns `:automate2` when a 400 is received from `https://URL/dex/auth`' do
      good_response.stubs(:code).returns('400')

      InspecPlugins::Compliance::HTTP.expects(:get)
                      .with(url + automate2_endpoint, headers, insecure)
                      .returns(good_response)

      InspecPlugins::Compliance::API.determine_server_type(url, insecure).must_equal(:automate2)
    end

    it 'returns `:automate` when a 401 is received from `https://URL/compliance/version`' do
      good_response.stubs(:code).returns('401')
      bad_response.stubs(:code).returns('404')

      InspecPlugins::Compliance::HTTP.expects(:get)
                      .with(url + automate2_endpoint, headers, insecure)
                      .returns(bad_response)
      InspecPlugins::Compliance::HTTP.expects(:get)
                      .with(url + automate_endpoint, headers, insecure)
                      .returns(good_response)

      InspecPlugins::Compliance::API.determine_server_type(url, insecure).must_equal(:automate)
    end

    # Chef Automate currently returns 401 for `/compliance/version` but some
    # versions of OpsWorks Chef Automate return 200 and a Chef Manage page when
    # unauthenticated requests are received.
    it 'returns `:automate` when a 200 is received from `https://URL/compliance/version`' do
      bad_response.stubs(:code).returns('404')
      good_response.stubs(:code).returns('200')
      good_response.stubs(:body).returns('Are You Looking For the Chef Server?')

      InspecPlugins::Compliance::HTTP.expects(:get)
                      .with(url + automate2_endpoint, headers, insecure)
                      .returns(bad_response)
      InspecPlugins::Compliance::HTTP.expects(:get)
                      .with(url + automate_endpoint, headers, insecure)
                      .returns(good_response)

      InspecPlugins::Compliance::API.determine_server_type(url, insecure).must_equal(:automate)
    end

    it 'returns `nil` if a 200 is received from `https://URL/compliance/version` but not redirected to Chef Manage' do
      bad_response.stubs(:code).returns('200')
      bad_response.stubs(:body).returns('No Chef Manage here')

      InspecPlugins::Compliance::HTTP.expects(:get)
                      .with(url + automate_endpoint, headers, insecure)
                      .returns(bad_response)
      InspecPlugins::Compliance::HTTP.expects(:get)
                      .with(url + automate2_endpoint, headers, insecure)
                      .returns(bad_response)

      mock_compliance_response = mock
      mock_compliance_response.stubs(:code).returns('404')
      InspecPlugins::Compliance::HTTP.expects(:get)
                      .with(url + compliance_endpoint, headers, insecure)
                      .returns(mock_compliance_response)

      InspecPlugins::Compliance::API.determine_server_type(url, insecure).must_be_nil
    end

    it 'returns `:compliance` when a 200 is received from `https://URL/api/version`' do
      good_response.stubs(:code).returns('200')
      bad_response.stubs(:code).returns('404')

      InspecPlugins::Compliance::HTTP.expects(:get)
                      .with(url + automate_endpoint, headers, insecure)
                      .returns(bad_response)
      InspecPlugins::Compliance::HTTP.expects(:get)
                      .with(url + automate2_endpoint, headers, insecure)
                      .returns(bad_response)
      InspecPlugins::Compliance::HTTP.expects(:get)
                      .with(url + compliance_endpoint, headers, insecure)
                      .returns(good_response)

      InspecPlugins::Compliance::API.determine_server_type(url, insecure).must_equal(:compliance)
    end

    it 'returns `nil` if it cannot determine the server type' do
      bad_response.stubs(:code).returns('404')

      InspecPlugins::Compliance::HTTP.expects(:get)
                      .with(url + automate2_endpoint, headers, insecure)
                      .returns(bad_response)
      InspecPlugins::Compliance::HTTP.expects(:get)
                      .with(url + automate_endpoint, headers, insecure)
                      .returns(bad_response)
      InspecPlugins::Compliance::HTTP.expects(:get)
                      .with(url + compliance_endpoint, headers, insecure)
                      .returns(bad_response)

      InspecPlugins::Compliance::API.determine_server_type(url, insecure).must_be_nil
    end
  end
end