Files
probo/pkg/accessreview/drivers/testdata/upcloud.yaml
Aurélien Sibiril 099543dfa9 Fix UpCloud admin detection and add name resolver
account/list marks the contract's primary account "main" on the live
API, not "mymain" as the published docs example shows, so matching the
documented spelling reported every account as a non-admin, including
the contract owner. Roles cannot stand in: a main account carries the
same technical/billing values a sub-account can hold. Classify off
"sub" instead, the one value the docs and the API agree on.

The fixture copied the docs example, so the test passed on the same
wrong assumption. Its bodies now mirror a live capture, anonymized: the
main account carries no main_account or allow_gui, sub-accounts add
them plus the access lists, and the primary account's type is "main".
A table test pins both spellings.

A review keys accounts on email plus external ID. Email came only from
account/details, and any failure blanked it while still emitting the
record, so a transient 5xx moved an account to a different key and
surfaced it as one account removed and another added. Only the stable
answers now degrade: UpCloud returns 403 ACCOUNT_FORBIDDEN, not 404,
for an account outside the token's reach, and both keep the list-only
fields. Anything else aborts the run.

A blank username no longer discards every account already collected,
matching the sibling drivers.

Resolve the source name from GET /1.3/account so sources read
"UpCloud <username>" rather than staying generic, and link the
connector to its documentation page.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>
2026-07-27 11:08:24 +02:00

140 lines
5.9 KiB
YAML

---
# Fixture for the UpCloud account-listing flow: GET /1.3/account/list returns
# the main account plus its sub-accounts in one call, then GET
# /1.3/account/details/{username} enriches each with name and email.
# my_temp_account's details call returns 403 ACCOUNT_FORBIDDEN, the status the
# live API gives for an account the token cannot read, exercising the driver's
# fallback to list-only fields.
#
# Response shapes mirror a live capture (the main account carries no
# main_account or allow_gui; sub-accounts add them plus the access lists) and
# the primary account's type is "main", as the API returns it, not the
# "mymain" of the published docs example. All values are synthetic.
version: 2
interactions:
- id: 0
request:
proto: HTTP/1.1
proto_major: 1
proto_minor: 1
content_length: 0
host: api.upcloud.com
headers:
Accept:
- application/json
url: https://api.upcloud.com/1.3/account/list
method: GET
response:
proto: HTTP/2.0
proto_major: 2
proto_minor: 0
content_length: -1
uncompressed: true
body: '{"accounts":{"account":[{"labels":[],"roles":{"role":["technical"]},"type":"main","username":"test"},{"labels":[],"roles":{"role":["technical"]},"type":"sub","username":"my_sub_account"},{"labels":[{"key":"to_be_removed","value":"after 2022-31-12"}],"roles":{"role":[]},"type":"sub","username":"my_temp_account"},{"labels":[],"roles":{"role":["billing"]},"type":"sub","username":"my_billing_account"}]}}'
headers:
Content-Type:
- application/json
status: 200 OK
code: 200
duration: 110ms
- id: 1
request:
proto: HTTP/1.1
proto_major: 1
proto_minor: 1
content_length: 0
host: api.upcloud.com
headers:
Accept:
- application/json
url: https://api.upcloud.com/1.3/account/details/test
method: GET
response:
proto: HTTP/2.0
proto_major: 2
proto_minor: 0
content_length: -1
uncompressed: true
body: '{"account":{"abuse_email":"","address":"","allow_api":"no","campaigns":{"campaign":[]},"city":"","company":"","country":"FIN","currency":"EUR","email":"main@example.com","enable_3rd_party_services":"yes","first_name":"Main","ip_filters":{"ip_filter":[]},"labels":[],"language":"en","last_name":"Account","phone":"+358.31245434","postal_code":"","roles":{"role":["technical"]},"simple_backup":"no","state":"","timezone":"UTC","type":"main","username":"test","vat_number":""}}'
headers:
Content-Type:
- application/json
status: 200 OK
code: 200
duration: 90ms
- id: 2
request:
proto: HTTP/1.1
proto_major: 1
proto_minor: 1
content_length: 0
host: api.upcloud.com
headers:
Accept:
- application/json
url: https://api.upcloud.com/1.3/account/details/my_sub_account
method: GET
response:
proto: HTTP/2.0
proto_major: 2
proto_minor: 0
content_length: -1
uncompressed: true
body: '{"account":{"address":"","allow_api":"yes","allow_gui":"no","campaigns":{"campaign":[]},"city":"","company":"","country":"FIN","currency":"EUR","email":"sub@example.com","enable_3rd_party_services":"yes","first_name":"Sub","ip_filters":{"ip_filter":[]},"labels":[],"language":"en","last_name":"Account","main_account":"test","network_access":{"network":[]},"phone":"+358.31245434","postal_code":"","roles":{"role":["technical"]},"server_access":{"server":[{"storage":"no","uuid":"*"}]},"state":"","storage_access":{"storage":["*"]},"tag_access":{"tag":[]},"timezone":"UTC","type":"sub","username":"my_sub_account","vat_number":""}}'
headers:
Content-Type:
- application/json
status: 200 OK
code: 200
duration: 90ms
- id: 3
request:
proto: HTTP/1.1
proto_major: 1
proto_minor: 1
content_length: 0
host: api.upcloud.com
headers:
Accept:
- application/json
url: https://api.upcloud.com/1.3/account/details/my_temp_account
method: GET
response:
proto: HTTP/2.0
proto_major: 2
proto_minor: 0
content_length: -1
uncompressed: true
body: '{"error":{"error_code":"ACCOUNT_FORBIDDEN","error_message":"You have no permission to access the account my_temp_account."}}'
headers:
Content-Type:
- application/json
status: 403 Forbidden
code: 403
duration: 90ms
- id: 4
request:
proto: HTTP/1.1
proto_major: 1
proto_minor: 1
content_length: 0
host: api.upcloud.com
headers:
Accept:
- application/json
url: https://api.upcloud.com/1.3/account/details/my_billing_account
method: GET
response:
proto: HTTP/2.0
proto_major: 2
proto_minor: 0
content_length: -1
uncompressed: true
body: '{"account":{"address":"","allow_api":"yes","allow_gui":"no","campaigns":{"campaign":[]},"city":"","company":"","country":"FIN","currency":"EUR","email":"billing@example.com","enable_3rd_party_services":"yes","first_name":"Billing","ip_filters":{"ip_filter":[]},"labels":[],"language":"en","last_name":"Account","main_account":"test","network_access":{"network":[]},"phone":"+358.31245434","postal_code":"","roles":{"role":["billing"]},"server_access":{"server":[{"storage":"no","uuid":"*"}]},"state":"","storage_access":{"storage":["*"]},"tag_access":{"tag":[]},"timezone":"UTC","type":"sub","username":"my_billing_account","vat_number":""}}'
headers:
Content-Type:
- application/json
status: 200 OK
code: 200
duration: 90ms