fix(apiserver): Check that app is bound on API routes

src/acceptance/api/api_test.go

@@ -79,7 +79,7 @@ var _ = Describe("AutoScaler Public API", func() {
  Expect(appGUID).NotTo(BeEmpty())
  })
 
- Context("when no policy defined", func() {
+ When("no scaling policy is set", func() {
 
  BeforeEach(func() {
  _, status := deletePolicy()
@@ -114,7 +114,7 @@ var _ = Describe("AutoScaler Public API", func() {
 
  })
 
- Context("When policy is defined", func() {
+ When("a scaling policy is set", func() {
  memThreshold := int64(10)
  var policy string
 
@@ -161,7 +161,7 @@ var _ = Describe("AutoScaler Public API", func() {
 
  })
 
- Context("for an unrelated user", func() {
+ When("an unrelated user tries to access the API", func() {
  BeforeEach(func() {
  workflowhelpers.AsUser(setup.AdminUserContext(), cfg.DefaultTimeoutDuration(), func() {
  // Make "other user" a space auditor in the space along with a space developer in the other space
@@ -179,7 +179,7 @@ var _ = Describe("AutoScaler Public API", func() {
  })
  })
 
- Context("When scale out is triggered ", func() {
+ When("a scale out is triggered ", func() {
  BeforeEach(func() {
  totalTime := time.Duration(cfg.AggregateInterval*2)*time.Second + 3*time.Minute
  WaitForNInstancesRunning(appGUID, 2, totalTime)
@@ -199,6 +199,27 @@ var _ = Describe("AutoScaler Public API", func() {
  }
  })
  })
+
+ When("trying to get info for an app not bound to the service", func() {
+ BeforeEach(func() {
+ UnbindServiceFromApp(cfg, appName, instanceName)
+ })
+
+ It("should not be possible to get information from the API", func() {
+ By("getting the policy")
+ _, status := getPolicy()
+ Expect(status).To(Equal(http.StatusForbidden))
+
+ By("getting the history")
+ _, status = get(historyURL)
+ Expect(status).To(Equal(http.StatusForbidden))
+
+ By("getting the aggregated metrics")
+ _, status = get(aggregatedMetricURL)
+ Expect(status).To(Equal(http.StatusForbidden))
+ })
+ })
+
  })
 })
 

src/acceptance/helpers/helpers.go

@@ -501,6 +501,11 @@ func BindServiceToAppWithPolicy(cfg *config.Config, appName string, instanceName
  return err
 }
 
+func UnbindServiceFromApp(cfg *config.Config, appName string, instanceName string) {
+ unbindService := cf.Cf("unbind-service", appName, instanceName).Wait(cfg.DefaultTimeoutDuration())
+ Expect(unbindService).To(Exit(0), fmt.Sprintf("Failed to unbind service %s from app %s \n CLI Output:\n %s %s", instanceName, appName, unbindService.Buffer().Contents(), unbindService.Err.Contents()))
+}
+
 func CreateService(cfg *config.Config) string {
  instanceName := generator.PrefixedRandomName(cfg.Prefix, cfg.InstancePrefix)
  FailOnError(CreateServiceWithPlan(cfg, cfg.ServicePlan, instanceName))

src/autoscaler/api/publicapiserver/public_api_server.go

@@ -52,6 +52,7 @@ func NewPublicApiServer(logger lager.Logger, conf *config.Config, policydb db.Po
  rp.Use(rateLimiterMiddleware.CheckRateLimit)
  rp.Use(mw.HasClientToken)
  rp.Use(mw.Oauth)
+ rp.Use(mw.CheckServiceBinding)
  rp.Use(httpStatusCollectMiddleware.Collect)
 
  rp.Get(routes.PublicApiScalingHistoryRouteName).Handler(scalingHistoryHandler)
@@ -68,13 +69,6 @@ func NewPublicApiServer(logger lager.Logger, conf *config.Config, policydb db.Po
  rpolicy.Get(routes.PublicApiAttachPolicyRouteName).Handler(VarsFunc(pah.AttachScalingPolicy))
  rpolicy.Get(routes.PublicApiDetachPolicyRouteName).Handler(VarsFunc(pah.DetachScalingPolicy))
 
- rcredential := routes.ApiCredentialRoutes()
- rcredential.Use(rateLimiterMiddleware.CheckRateLimit)
-
- rcredential.Use(httpStatusCollectMiddleware.Collect)
- rcredential.Use(mw.HasClientToken)
- rcredential.Use(mw.Oauth)
-
  return helpers.NewHTTPServer(logger, conf.PublicApiServer, r)
 }