How to use bless - 10 common examples

def test_invalid_request_with_mismatched_bastion_and_remote():
    '''
    Test default kmsauth behavior, that a bastion_user and remote_usernames must match
    :return: 
    '''
    output = lambda_handler(INVALID_TEST_KMSAUTH_REQUEST_USERNAME_DOESNT_MATCH_REMOTE, context=Context,
                            ca_private_key_password=RSA_CA_PRIVATE_KEY_PASSWORD,
                            entropy_check=False,
                            config_file=os.path.join(os.path.dirname(__file__),
                                                     'bless-test-kmsauth.cfg'))
    assert output['errorType'] == 'KMSAuthValidationError'

def test_invalid_uncompressed_with_bz2(monkeypatch):
    extra_environment_variables = {
        'bless_ca_default_password': '',
        'bless_ca_ca_private_key_file': 'tests/aws_lambda/only-use-for-unit-tests.pem',
        'bless_ca_ca_private_key_compression': 'bz2',
        'bless_options_username_validation': 'email',
        'bless_options_remote_usernames_validation': 'useradd',
    }

    for k, v in extra_environment_variables.items():
        monkeypatch.setenv(k, v)

    with pytest.raises(OSError):
        lambda_handler(VALID_TEST_REQUEST_USERNAME_VALIDATION_EMAIL_REMOTE_USERNAMES_USERADD, context=Context,
                       ca_private_key_password=RSA_CA_PRIVATE_KEY_PASSWORD,
                       entropy_check=False,
                       config_file=os.path.join(os.path.dirname(__file__), ''))

def test_basic_ca_private_key_env_zlib(monkeypatch):
    extra_environment_variables = {
        'bless_ca_default_password': '',
        'bless_ca_ca_private_key': 'eJxtl7XOxYqOhfs8xelzj8J0u3Cywwxddphhh59+/pl63FqyLOtby/a///4FJ8qq+Y/rsf/YrhqyvviPJib/m/gXsLc5/9d/lvK//+D/EU3eTWxfFABB1P5Vp2r+7z+s6P2LoPS/PMf/hycwHGEIikYlVBAonCNRhJYkCRcwiSIoEgB+w3h+RpVdTXl6Rhw5/VxZi8XKgvTzZUqocTd5QJq1dtz6rHKOyVGCuEhfo+4ocCYPwDOSZG3thKq8U6HaSLjU5NVSauoBcmQ3jTpC/8FO2RmKAeEch7WsJlei9GEjtZlbENCan0aJTWLo+aTubI5EkvU6DxNoThKlIWteqS74Q52Z6Jw0SO44el1pgcyNl5htZQfMsVRK9Rmm5cnn6vrjfrZ/i89HKVTeO54Sd09Umz1Fu/zuXUtCEkZYF5t9IUU3LfEZ8MZ2qPpRxb7Xt5nSRctxuBfkX+V/rStY2WipNZWUJ1/WaFk3kUA57o+/qdPupJAvfgGGuXDNrj/CStoJ+fREroqsBoaRAR3Gb4TiXMAxNNljqNK6SbK+wwc2YNa9eaixC7YG7FdSX0jc6s8MBp1mxiF5yaQAo1j0ewmxRUs6TjXcOX+cmVz2qa22gBP3x4J6LBafGUg7Lb8/HkkyZODpu2126ZU1zgFeRBiY807sfQKlp7mY/vW1X527ofDYCd/jen1Q3hIYxQkT5iPWnJeC0DbGfz2Yt7aXTtP8jduPOZhBVFnQp0FZf6kNFsxiRzLCEmTK0jElYIXTGY16cMZ/lPApZxLOQdJ+Te5ZwhnlZINmLf2noQxLoWx7Xl8VlQP6pXad29ZXYgCYNRMWBDVfoyuRtcmRtUtJid95BdcfAfqGJ3rfAQ6ZtCkPq3bX34SPVY+y6j4GdawAJ7+k9fwwLsRi76f4I+evF7HKiAlCJYfKsLl2Gc5dEzAbym5Un2CFKyHKG5sp+KnMAVeNOoUqpONI2k1sKS+S3WlvdnXn4rkLYTs6I5wcWsiTTgaj5P6gmbbAcBzp2nY4PQD1Q+WIu1pplyQR6Dn3DIgfBCXovA8kOdf0MvFwdg1oxDB8LMGNZxtq1p7UFp+05UOgZ3hOE+s7h1uw6+RqIiUSv64vKQfs9ML0OlDlXVXc5XWvPrt2eo92PKyHdQQ/BRFKYHd2NKwS6oO6xDqFacLnzm9SFAz1Vssnnl2Rz6+nxfTA8tOm2xndpY5KYA6ND+BSSAAsVL7s05qeUcPBtuL84nrT5mE7oh8MIXTjpWSQHRiKq+BVgPBn7fKlUfcOHjOKsXjAQNfCZXmlla/1l1LEvOV6HCEElvmWT5e7rBvpdFzYDhqpenS7UiypNz+O8VtIaVYmwBLQWyX6Jv/8zcWnLL4T9puvV8eHlRDnoQr69a+U0tt2fAcbQtdXScP6ia5VlhL8bIDc75USaZSAZ25E2qD7s4J7Y6xO3fPR5MV9oMnuJ98SS9xV/IK4Bt+rAmM9wwlQaEaBgRL+4N6Ue6+fzUZ8Dj4aZ/fHqhtkSilul9yOGGG5zwHr24KpdolUdDYSlPuZVMv3gHFeo1yaTnnOU2UL/LpOI3yyJoNJynBvbqHvfzqhwpriWStBGsmGtMd+yVpdMf0lWcBV+iO+Txr5Qr3GIkj7ID15YSbzo5iZV9jOmOvZ0Lvx5d/2AuU7nOS3J7nSetV9AAdAvnvUXOJD+XaqG3wb6BPj6dccFDS7rP7P5xv1DHK8qD2b5yUdaXaSoYMKp9OnA8XyAEyeaq1qEiWupJI43XJQ0ApUGGzG7kx1msyx0OuuNZ+8XOkTJCEn10/yUcOPd3teMgKyDXLDSCM3DBYvHXL6fm9OHCcsKi9B7taGmou/UE56s4mDGpKn1fSaU04LCI0qu3eAK6fMvkE30HEt388RXn9B3FaipmTRoNbzHYfBTtd6sPx6Q9lTH+tN3j5kYJp9muFPCxE4E9PHi5/uVuZ7E8W+9EXL01XaQkLuE83981dP19Mu2vusqm/7971SCMUllUfMIwPafBIXm+vNkXDyQxjdMCrM0xFQLThlWcHWIcngzJO24j3VfCTlaI0tjoa2jwZOYtMAYTcchyyBWnMF1fr98Zkt/7gedal2RLKI4X0Dbik5tB0NdQ93Ut8o6mz9Eous+3NQDDinP/FRahRsUvFIHQULS1sUmmV+UaZO6CC7qXRfKebM4DO6lG5/kONAEu9ukUuxRRFolwGLTFrO+jWOKDT35ojwzUtQppbUoq+fjq8GC5BBbp+CX/QsuApUjwyEqErkNWgR2AUU6UpcPXcY04kyJLhJ8n9r71rz36J0uyJbHXDII/dZGg16mg5yz05im2nz5DbIcIAlCZDppD0LSiNg6lbmUkEGp0Er2hbhAhBSuO0PZ1D9qK2oGXr8qVnNfQZkvcjRLW/g7VoSKUpHI4W2i1i5jzhly35BJvhL9qvynSvSu7v7+EuglcC0Q/vLz6p1MdGEU32hgIebMZFiaA1y3Yzr3H6JyOf1tE3BGGLCgqFGKZ23T0/Yq7W7RGhPOpJ40y1roMx5eaALpPQP9O82nKhTqWMsuyF8KUtBonjFwZyYvmrfEl1ycbYGDlnCNFxgelbJOoIpBzGwaZDHF23DJzmczAcrJBHkOcMcn+zBIq2tso3bP79h+oogslNx+0Deu3gpSiqs0yE6kEB5aBbjRLuH+r1q2+j3bTG0b+MP0pV2Rq/MVOnuW1tnSXR/8fsQMWoQ2bMgqUwedUBhS4IiQkGNC54OukzytOl+W1afsUF8zQsTmhyN1jllxEQpfxAeG7tGb2JJcx/nKHlgRIrjZ85rt49Z8YMIy6zo0b3KZWEbbvcnmiy/Ix6QLMO0tzp3ll4X4UKR1NByn4wTgGSECBknsSXoEpPBQOF+9NFwlqX/mWM1KUetir1HiCb2XXBKhMwgzZ9WGs6FCNwlxIGvMLf2bN7r0uCHS9TXQo9Q6zngNB4fUx40t2xjIVjbi9rfbtTu0T8iBmkrlPz5kLABJZXOUbR+wk3n9NuKEtf3ZBP5rXlAvTJvgY5u9yf+DT4tNSwPxw11wBoDbMfIXlPLBNiO5Hi7GX+jW2prRTid45m8vI3fi/jz7gNdg+jsB9sYP+fEovyeDWEsvs+8wPdLCCfghri6Mw9jKbeXu+j3T+3DIBBC5d5ncGXJb+K5lqm3kYiHpbfocDSX2rzt5v07aW3yC8BJT1B/LOPGTh4NyzPRuuQ7bDP8Wh8+FK09drVfH4Nb9FSEZqwHPccnuZSXdtjlQAGWQ8Ukl8y26ufjhs44mik8QvtyuW6qqC5ngvgN6f3PLESFsTE+pHAeLyS/TZuG/kIPAKcd1FpxwmOKFFmEHVr7OYr++x2wckg3Jim+fdIcyTKKuwuNxnxEiXD4Mtu7LsLGEPB/X4xoCv//d/M/z4BBFQ==',
        'bless_ca_ca_private_key_compression': 'zlib',
        'bless_options_username_validation': 'email',
        'bless_options_remote_usernames_validation': 'useradd',
    }

    for k, v in extra_environment_variables.items():
        monkeypatch.setenv(k, v)

    output = lambda_handler(VALID_TEST_REQUEST_USERNAME_VALIDATION_EMAIL_REMOTE_USERNAMES_USERADD, context=Context,
                            ca_private_key_password=RSA_CA_PRIVATE_KEY_PASSWORD,
                            entropy_check=False,
                            config_file=os.path.join(os.path.dirname(__file__), ''))
    assert output['certificate'].startswith('ssh-rsa-cert-v01@openssh.com ')

def test_local_request_with_multiple_principals():
    output = lambda_handler(VALID_TEST_REQUEST_MULTIPLE_PRINCIPALS, context=Context,
                            ca_private_key_password=RSA_CA_PRIVATE_KEY_PASSWORD,
                            entropy_check=False,
                            config_file=os.path.join(os.path.dirname(__file__),
                                                     'bless-test.cfg'))
    assert output['certificate'].startswith('ssh-rsa-cert-v01@openssh.com ')

def test_basic_local_unused_kmsauth_request():
    output = lambda_handler(VALID_TEST_REQUEST_KMSAUTH, context=Context,
                            ca_private_key_password=RSA_CA_PRIVATE_KEY_PASSWORD,
                            entropy_check=False,
                            config_file=os.path.join(os.path.dirname(__file__), 'bless-test.cfg'))
    assert output['certificate'].startswith('ssh-rsa-cert-v01@openssh.com ')

def test_invalid_request_with_unallowed_remote():
    output = lambda_handler(INVALID_TEST_KMSAUTH_REQUEST_DIFFERENT_REMOTE_USER, context=Context,
                            ca_private_key_password=RSA_CA_PRIVATE_KEY_PASSWORD,
                            entropy_check=False,
                            config_file=os.path.join(os.path.dirname(__file__),
                                                     'bless-test-kmsauth-different-remote.cfg'))
    assert output['errorType'] == 'KMSAuthValidationError'

def test_local_request_config_not_found():
    with pytest.raises(ValueError):
        lambda_handler(VALID_TEST_REQUEST, context=Context,
                       ca_private_key_password=RSA_CA_PRIVATE_KEY_PASSWORD,
                       entropy_check=False,
                       config_file=os.path.join(os.path.dirname(__file__), 'none'))

def test_basic_local_username_validation_disabled(monkeypatch):
    extra_environment_variables = {
        'bless_ca_default_password': '',
        'bless_ca_ca_private_key_file': 'tests/aws_lambda/only-use-for-unit-tests.pem',
        'bless_options_username_validation': 'disabled',
        'bless_options_remote_usernames_validation': 'disabled',
    }

    for k, v in extra_environment_variables.items():
        monkeypatch.setenv(k, v)

    output = lambda_handler(VALID_TEST_REQUEST_USERNAME_VALIDATION_DISABLED, context=Context,
                            ca_private_key_password=RSA_CA_PRIVATE_KEY_PASSWORD,
                            entropy_check=False,
                            config_file=os.path.join(os.path.dirname(__file__), ''))
    assert output['certificate'].startswith('ssh-rsa-cert-v01@openssh.com ')

def test_invalid_username_request():
    output = lambda_handler(INVALID_TEST_REQUEST_USERNAME_INVALID, context=Context,
                            ca_private_key_password=RSA_CA_PRIVATE_KEY_PASSWORD,
                            entropy_check=False,
                            config_file=os.path.join(os.path.dirname(__file__),
                                                     'bless-test.cfg'))
    assert output['errorType'] == 'InputValidationError'

def test_basic_ca_private_key_file_zlib(monkeypatch):
    extra_environment_variables = {
        'bless_ca_default_password': '',
        'bless_ca_ca_private_key_file': 'tests/aws_lambda/only-use-for-unit-tests.zlib',
        'bless_ca_ca_private_key_compression': 'zlib',
        'bless_options_username_validation': 'email',
        'bless_options_remote_usernames_validation': 'useradd',
    }

    for k, v in extra_environment_variables.items():
        monkeypatch.setenv(k, v)

    output = lambda_handler(VALID_TEST_REQUEST_USERNAME_VALIDATION_EMAIL_REMOTE_USERNAMES_USERADD, context=Context,
                            ca_private_key_password=RSA_CA_PRIVATE_KEY_PASSWORD,
                            entropy_check=False,
                            config_file=os.path.join(os.path.dirname(__file__), ''))
    assert output['certificate'].startswith('ssh-rsa-cert-v01@openssh.com ')