sec: enforce admin authorization across all management endpoints and randomize session secret

2026-09-25 23:39:37 +02:00
parent 344d57ff49
commit ad022cc447
3 changed files with 45 additions and 19 deletions
@@ -109,7 +109,9 @@ def run_tests():
    print(f"[OK] Client enrolled successfully. Certificates stored in {cert_dir}")

    # 2c. Verify client shows in /api/clients
-    clients_req = urllib.request.Request(f"http://{HERMES_HOST}:{HERMES_PORT}/api/clients")
+    auth_tok = server_conf.get("auth_token") or client_conf.get("auth_token")
+    client_headers = {"Authorization": f"Bearer {auth_tok}"} if auth_tok else {}
+    clients_req = urllib.request.Request(f"http://{HERMES_HOST}:{HERMES_PORT}/api/clients", headers=client_headers)
    with urllib.request.urlopen(clients_req, timeout=5) as resp:
        clients_data = json.loads(resp.read().decode("utf-8"))
        assert clients_data["active_seats"] >= 1