chore(security): update user login test

pingcap · Sep 8, 2023 · fa5e241 · fa5e241
1 parent c0916bd
commit fa5e241
Show file tree

Hide file tree

Showing 4 changed files with 30 additions and 11 deletions.
diff --git a/pkg/apiserver/user/auth.go b/pkg/apiserver/user/auth.go
@@ -37,7 +37,7 @@ type AuthService struct {
 	middleware     *jwt.GinJWTMiddleware
 	authenticators map[utils.AuthType]Authenticator
 
-	rsaPublicKey  *rsa.PublicKey
+	RsaPublicKey  *rsa.PublicKey
 	RsaPrivateKey *rsa.PrivateKey
 }
 
@@ -104,7 +104,7 @@ func NewAuthService(featureFlags *featureflag.Registry) *AuthService {
 		middleware:              nil,
 		authenticators:          map[utils.AuthType]Authenticator{},
 		RsaPrivateKey:           privateKey,
-		rsaPublicKey:            publicKey,
+		RsaPublicKey:            publicKey,
 	}
 
 	middleware, err := jwt.New(&jwt.GinJWTMiddleware{
@@ -128,7 +128,7 @@ func NewAuthService(featureFlags *featureflag.Registry) *AuthService {
 				// if generate successfully, replace the old key pair
 				if err == nil {
 					service.RsaPrivateKey = privateKey
-					service.rsaPublicKey = publicKey
+					service.RsaPublicKey = publicKey
 				}
 			}
 			return u, nil
@@ -321,7 +321,7 @@ func (s *AuthService) GetLoginInfoHandler(c *gin.Context) {
 	sort.Ints(supportedAuth)
 	// both work
 	// publicKeyStr, err := ExportPublicKeyAsString(s.rsaPublicKey)
-	publicKeyStr, err := DumpPublicKeyBase64(s.rsaPublicKey)
+	publicKeyStr, err := DumpPublicKeyBase64(s.RsaPublicKey)
 	if err != nil {
 		rest.Error(c, err)
 		return

diff --git a/pkg/apiserver/user/rsa_utils.go b/pkg/apiserver/user/rsa_utils.go
@@ -79,6 +79,18 @@ func DumpPrivateKeyBase64(privatekey *rsa.PrivateKey) (string, error) {
 	return keyBase64, nil
 }
 
+// Encrypt by public key.
+func Encrypt(plainText string, publicKey *rsa.PublicKey) (string, error) {
+	encryptedText, err := rsa.EncryptPKCS1v15(rand.Reader, publicKey, []byte(plainText))
+	if err != nil {
+		return "", err
+	}
+
+	// the encryptedText is encoded by base64 in the frontend by jsEncrypt
+	encodedText := base64.StdEncoding.EncodeToString(encryptedText)
+	return encodedText, nil
+}
+
 // Decrypt by private key.
 func Decrypt(cipherText string, privateKey *rsa.PrivateKey) (string, error) {
 	// the cipherText is encoded by base64 in the frontend by jsEncrypt

diff --git a/tests/integration/info/info_test.go b/tests/integration/info/info_test.go
@@ -96,7 +96,8 @@ func (s *testInfoSuite) getTokenBySQLRoot() string {
 	param := make(map[string]interface{})
 	param["type"] = 0
 	param["username"] = "root"
-	param["password"] = ""
+	pwd, _ := user.Encrypt("", s.authService.RsaPublicKey)
+	param["password"] = pwd
 
 	jsonByte, _ := json.Marshal(param)
 	req, _ := http.NewRequest(http.MethodPost, "/user/login", bytes.NewReader(jsonByte))

diff --git a/tests/integration/user/user_test.go b/tests/integration/user/user_test.go
@@ -93,7 +93,8 @@ func (s *testUserSuite) TestLoginWithNotExistUser() {
 	param := make(map[string]interface{})
 	param["type"] = 0
 	param["username"] = "not_exist"
-	param["password"] = "aaa"
+	pwd, _ := user.Encrypt("aaa", s.authService.RsaPublicKey)
+	param["password"] = pwd
 
 	jsonByte, _ := json.Marshal(param)
 	req, _ := http.NewRequest(http.MethodPost, "/user/login", bytes.NewReader(jsonByte))
@@ -109,7 +110,8 @@ func (s *testUserSuite) TestLoginWithWrongPassword() {
 	param := make(map[string]interface{})
 	param["type"] = 0
 	param["username"] = "dashboardAdmin"
-	param["password"] = "123456789"
+	pwd, _ := user.Encrypt("123456789", s.authService.RsaPublicKey)
+	param["password"] = pwd
 
 	jsonByte, _ := json.Marshal(param)
 	req, _ := http.NewRequest(http.MethodPost, "/user/login", bytes.NewReader(jsonByte))
@@ -125,7 +127,8 @@ func (s *testUserSuite) TestLoginWithInsufficientPrivs() {
 	param := make(map[string]interface{})
 	param["type"] = 0
 	param["username"] = "dashboardAdmin-2"
-	param["password"] = "12345678"
+	pwd, _ := user.Encrypt("12345678", s.authService.RsaPublicKey)
+	param["password"] = pwd
 
 	jsonByte, _ := json.Marshal(param)
 	req, _ := http.NewRequest(http.MethodPost, "/user/login", bytes.NewReader(jsonByte))
@@ -142,7 +145,8 @@ func (s *testUserSuite) TestLoginWithSufficientPrivs() {
 		param := make(map[string]interface{})
 		param["type"] = 0
 		param["username"] = "dashboardAdmin"
-		param["password"] = "12345678"
+		pwd, _ := user.Encrypt("12345678", s.authService.RsaPublicKey)
+		param["password"] = pwd
 
 		jsonByte, _ := json.Marshal(param)
 		req, _ := http.NewRequest(http.MethodPost, "/user/login", bytes.NewReader(jsonByte))
@@ -177,7 +181,8 @@ func (s *testUserSuite) TestLoginWithWrongPasswordForRoot() {
 	param := make(map[string]interface{})
 	param["type"] = 0
 	param["username"] = "root"
-	param["password"] = "aaa"
+	pwd, _ := user.Encrypt("aaa", s.authService.RsaPublicKey)
+	param["password"] = pwd
 
 	jsonByte, _ := json.Marshal(param)
 	req, _ := http.NewRequest(http.MethodPost, "/user/login", bytes.NewReader(jsonByte))
@@ -193,7 +198,8 @@ func (s *testUserSuite) TestLoginWithCorrectPasswordForRoot() {
 	param := make(map[string]interface{})
 	param["type"] = 0
 	param["username"] = "root"
-	param["password"] = ""
+	pwd, _ := user.Encrypt("", s.authService.RsaPublicKey)
+	param["password"] = pwd
 
 	jsonByte, _ := json.Marshal(param)
 	req, _ := http.NewRequest(http.MethodPost, "/user/login", bytes.NewReader(jsonByte))