feat: prevent anonymous call for observatory

.github/workflows/tests.yml

@@ -6,6 +6,7 @@ on:
       - 'src/satellite/**'
       - 'src/orbiter/**'
       - 'src/console/**'
+      - 'src/observatory/**'
       - 'src/mission_control/**'
       - 'src/libs/**'
       - 'src/tests/**'
@@ -39,6 +40,10 @@ jobs:
             wasm: console.wasm.gz
             target: scratch_console
 
+          - name: observatory
+            wasm: observatory.wasm.gz
+            target: scratch_observatory
+
           - name: mission_control
             wasm: mission_control.wasm.gz
             target: scratch_mission_control
@@ -96,6 +101,12 @@ jobs:
           name: console.wasm.gz
           path: .
 
+      - name: Download observatory.wasm.gz
+        uses: actions/download-artifact@v4
+        with:
+          name: observatory.wasm.gz
+          path: .
+
       - name: Download mission_control.wasm.gz
         uses: actions/download-artifact@v4
         with:

src/observatory/src/guards.rs

@@ -5,6 +5,7 @@ use junobuild_shared::controllers::{
     is_controller as is_controller_impl,
 };
 use junobuild_shared::types::state::Controllers;
+use junobuild_shared::utils::principal_not_anonymous;
 
 pub fn caller_is_admin_controller() -> Result<(), String> {
     if is_admin_controller() {
@@ -24,6 +25,16 @@ pub fn caller_can_execute_cron_jobs() -> Result<(), String> {
     }
 }
 
+pub fn caller_is_not_anonymous() -> Result<(), String> {
+    let caller = caller();
+
+    if principal_not_anonymous(caller) {
+        Ok(())
+    } else {
+        Err("Anonymous caller is not allowed.".to_string())
+    }
+}
+
 fn caller_is_controller() -> bool {
     let caller = caller();
     let controllers: Controllers = STATE.with(|state| state.borrow().stable.controllers.clone());

src/observatory/src/lib.rs

@@ -9,7 +9,7 @@ mod types;
 use crate::console::assert_mission_control_center;
 use crate::constants::CRON_INTERVAL_NS;
 use crate::cron_jobs::cron_jobs;
-use crate::guards::{caller_can_execute_cron_jobs, caller_is_admin_controller};
+use crate::guards::{caller_can_execute_cron_jobs, caller_is_not_anonymous, caller_is_admin_controller};
 use crate::reports::collect_statuses as collect_statuses_report;
 use crate::store::{
     delete_controllers, get_cron_tab as get_cron_tab_store, get_statuses as get_statuses_store,
@@ -83,7 +83,7 @@ fn del_controllers(DeleteControllersArgs { controllers }: DeleteControllersArgs)
 
 /// Crontabs
 
-#[update]
+#[update(guard = "caller_is_not_anonymous")]
 async fn set_cron_tab(cron_tab: SetCronTab) -> CronTab {
     let user = caller();
 
@@ -94,15 +94,15 @@ async fn set_cron_tab(cron_tab: SetCronTab) -> CronTab {
     set_cron_tab_store(&user, &cron_tab).unwrap_or_else(|e| trap(&e))
 }
 
-#[query]
+#[query(guard = "caller_is_not_anonymous")]
 fn get_cron_tab() -> Option<CronTab> {
     let user = caller();
     get_cron_tab_store(&user)
 }
 
 /// Statuses
 
-#[query]
+#[query(guard = "caller_is_not_anonymous")]
 fn get_statuses() -> Option<ArchiveStatuses> {
     let user = caller();
     get_statuses_store(&user)

src/tests/constants/observatory-tests.constants.ts

@@ -0,0 +1 @@
+export const ANONYMOUS_ERROR_MSG = 'Anonymous caller is not allowed.';

src/tests/observatory.spec.ts

@@ -0,0 +1,91 @@
+import type { _SERVICE as ObservatoryActor } from '$declarations/observatory/observatory.did';
+import { idlFactory as idlFactorObservatory } from '$declarations/observatory/observatory.factory.did';
+import { AnonymousIdentity } from '@dfinity/agent';
+import { Ed25519KeyIdentity } from '@dfinity/identity';
+import { PocketIc, type Actor } from '@hadronous/pic';
+import { afterAll, beforeAll, describe, expect, inject } from 'vitest';
+import { ANONYMOUS_ERROR_MSG } from './constants/observatory-tests.constants';
+import { OBSERVATORY_WASM_PATH } from './utils/setup-tests.utils';
+
+describe('Observatory', () => {
+	let pic: PocketIc;
+	let actor: Actor<ObservatoryActor>;
+
+	const controller = Ed25519KeyIdentity.generate();
+
+	beforeAll(async () => {
+		pic = await PocketIc.create(inject('PIC_URL'));
+
+		const { actor: c } = await pic.setupCanister<ObservatoryActor>({
+			idlFactory: idlFactorObservatory,
+			wasm: OBSERVATORY_WASM_PATH,
+			sender: controller.getPrincipal()
+		});
+
+		actor = c;
+		actor.setIdentity(controller);
+	});
+
+	afterAll(async () => {
+		await pic?.tearDown();
+	});
+
+	describe('anonymous', () => {
+		beforeAll(() => {
+			actor.setIdentity(new AnonymousIdentity());
+		});
+
+		it('should throw errors on set crontab', async () => {
+			const { set_cron_tab } = actor;
+
+			await expect(
+				set_cron_tab({
+					cron_jobs: {
+						metadata: [],
+						statuses: {
+							mission_control_cycles_threshold: [],
+							orbiters: [],
+							satellites: [],
+							enabled: false,
+							cycles_threshold: []
+						}
+					},
+					mission_control_id: Ed25519KeyIdentity.generate().getPrincipal(),
+					version: []
+				})
+			).rejects.toThrow(ANONYMOUS_ERROR_MSG);
+		});
+
+		it('should throw errors on get crontab', async () => {
+			const { get_cron_tab } = actor;
+
+			await expect(get_cron_tab()).rejects.toThrow(ANONYMOUS_ERROR_MSG);
+		});
+
+		it('should throw errors on get statuses', async () => {
+			const { get_statuses } = actor;
+
+			await expect(get_statuses()).rejects.toThrow(ANONYMOUS_ERROR_MSG);
+		});
+	});
+
+	describe('owner', () => {
+		const owner = Ed25519KeyIdentity.generate();
+
+		beforeAll(() => {
+			actor.setIdentity(owner);
+		});
+
+		it('should not throw errors on get crontab', async () => {
+			const { get_cron_tab } = actor;
+
+			await expect(get_cron_tab()).resolves.not.toThrow(ANONYMOUS_ERROR_MSG);
+		});
+
+		it('should not throw errors on get statuses', async () => {
+			const { get_statuses } = actor;
+
+			await expect(get_statuses()).resolves.not.toThrow(ANONYMOUS_ERROR_MSG);
+		});
+	});
+});

src/tests/utils/setup-tests.utils.ts

@@ -34,6 +34,12 @@ export const MISSION_CONTROL_WASM_PATH = existsSync(MISSION_CONTROL_WASM_PATH_CI
 	? MISSION_CONTROL_WASM_PATH_CI
 	: MISSION_CONTROL_WASM_PATH_LOCAL;
 
+const OBSERVATORY_WASM_PATH_LOCAL = join(WASM_PATH_LOCAL, 'observatory.wasm.gz');
+const OBSERVATORY_WASM_PATH_CI = join(process.cwd(), 'observatory.wasm.gz');
+export const OBSERVATORY_WASM_PATH = existsSync(OBSERVATORY_WASM_PATH_CI)
+	? OBSERVATORY_WASM_PATH_CI
+	: OBSERVATORY_WASM_PATH_LOCAL;
+
 export const controllersInitArgs = (controllers: Identity | Principal[]): ArrayBuffer =>
 	IDL.encode(
 		[