Disallow colons (#291)

Disallow colons in UI and API for flag and segment keys

.github/actions/integration-test/Dockerfile

@@ -0,0 +1,21 @@
+FROM debian:stable-slim
+
+RUN apt-get update && \
+    apt-get install -y bats curl jq gnupg \
+    # chromium dependencies
+    libgbm1 chromium chromium-l10n \
+    # webkit dependencies
+    libwoff1 libopus0 libwebp6 libwebpdemux2 libenchant1c2a \
+    libgudev-1.0-0 libsecret-1-0 libhyphen0 libgdk-pixbuf2.0-0 libegl1 libgles2 \
+    libevent-2.1-6 libnotify4 libvpx5 libxslt1.1 \
+    # ffmpeg
+    ffmpeg
+
+RUN curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | apt-key add - && \
+    echo "deb https://dl.yarnpkg.com/debian/ stable main" | tee /etc/apt/sources.list.d/yarn.list
+
+RUN apt-get update && \
+    apt-get install -y yarn npm && \
+    apt-get clean -y
+
+EXPOSE 8080

.github/actions/integration-test/action.yml

@@ -0,0 +1,12 @@
+# action.yml
+name: 'Flipt IT Tests'
+description: 'Container for running Flipt ITs'
+inputs:
+  args:  # id of input
+    description: args to pass to container'
+    required: true
+runs:
+  using: 'docker'
+  image: 'Dockerfile'
+  args:
+    - ${{ inputs.args }}

.github/workflows/benchmark.yml

@@ -28,7 +28,7 @@ jobs:
 
     steps:
     - name: Setup Go
-      uses: actions/setup-go@v1
+      uses: actions/setup-go@v2
       with:
         go-version: 1.14.1
       id: go

.github/workflows/database-test.yml

@@ -26,7 +26,7 @@ jobs:
 
     steps:
     - name: Setup Go
-      uses: actions/setup-go@v1
+      uses: actions/setup-go@v2
       with:
         go-version: 1.14.1
       id: go

.github/workflows/integration-test.yml

@@ -17,32 +17,60 @@ jobs:
     name: Test
     runs-on: ubuntu-latest
 
+    timeout-minutes: 20
+
     steps:
-    - name: Setup Go
-      uses: actions/setup-go@v1
+    - uses: actions/checkout@v2
+
+    - uses: actions/setup-go@v2
       with:
         go-version: 1.14.1
-      id: go
 
-    - name: Checkout
-      uses: actions/checkout@v2
+    - uses: actions/setup-node@v1
+      with:
+        node-version: '12'
 
-    - name: Restore Cache
-      uses: actions/cache@v1
-      id: cache
+    - uses: actions/cache@v1
+      id: go-cache
       with:
         path: ~/go/pkg/mod
         key: ${{ runner.os }}-${{ hashFiles('**/go.sum') }}
 
-    - name: Build binary
-      run: go build -o ./bin/flipt ./cmd/flipt/.
+    - name: Get yarn cache directory path
+      id: yarn-cache-dir-path
+      run: echo "::set-output name=dir::$(yarn cache dir)"
+
+    - uses: actions/cache@v1
+      id: yarn-cache
+      with:
+        path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
+        key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
+
+    - name: Build the binary
+      run: |
+        make setup
+        make build
 
     - name: Test API
-      uses: ./.github/actions/api-test
+      uses: ./.github/actions/integration-test
       with:
         args: ./script/test/api
 
     - name: Test CLI
-      uses: ./.github/actions/api-test
+      uses: ./.github/actions/integration-test
       with:
         args: ./script/test/cli
+
+    - name: Test UI
+      uses: ./.github/actions/integration-test
+      env:
+        FFMPEG_PATH: /usr/bin/ffmpeg # for recording video
+        QAW_ARTIFACT_PATH: ${{ github.workspace }}/artifacts
+      with:
+        args: ./script/test/qawolf
+
+    - name: Upload Artifacts
+      if: always()
+      uses: actions/upload-artifact@master
+      with:
+        path: ${{ github.workspace }}/artifacts

.github/workflows/test.yml

@@ -14,7 +14,7 @@ jobs:
 
     steps:
     - name: Setup Go
-      uses: actions/setup-go@v1
+      uses: actions/setup-go@v2
       with:
         go-version: 1.14.1
       id: go
@@ -42,7 +42,7 @@ jobs:
 
     steps:
     - name: Setup Go
-      uses: actions/setup-go@v1
+      uses: actions/setup-go@v2
       with:
         go-version: 1.14.1
       id: go

Dockerfile

@@ -1,4 +1,4 @@
-ARG GO_VERSION=1.13.7
+ARG GO_VERSION=1.14
 
 FROM golang:$GO_VERSION-alpine AS build
 

go.sum

@@ -168,8 +168,6 @@ github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrU
 github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
 github.com/golang/protobuf v1.4.0 h1:oOuy+ugB+P/kBdUnG5QaMXSIyJ1q38wWSojYCb3z5VQ=
 github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
-github.com/golang/protobuf v1.4.1 h1:ZFgWrT+bLgsYPirOnRfKLYJLvssAegOj/hgyMFdJZe0=
-github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
 github.com/golang/protobuf v1.4.2 h1:+Z5KGCizgyZCbGh1KZqA0fcLLkwbsjIzS4aV2v7wJX0=
 github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/golangci/check v0.0.0-20180506172741-cfe4005ccda2 h1:23T5iq8rbUYlhpt5DB4XJkc6BU31uODLD1o1gKvZmD0=
@@ -234,8 +232,6 @@ github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 h1:Ovs26xHkKqVztRpIrF/92Bcuy
 github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgfV/d3M/q6VIi02HzZEHgUlZvzk=
 github.com/grpc-ecosystem/grpc-gateway v1.9.0/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
 github.com/grpc-ecosystem/grpc-gateway v1.12.1/go.mod h1:8XEsbTttt/W+VvjtQhLACqCisSPWTxCZ7sBRjU6iH9c=
-github.com/grpc-ecosystem/grpc-gateway v1.14.5 h1:aiLxiiVzAXb7wb3lAmubA69IokWOoUNe+E7TdGKh8yw=
-github.com/grpc-ecosystem/grpc-gateway v1.14.5/go.mod h1:UJ0EZAp832vCd54Wev9N1BMKEyvcZ5+IM0AwDrnlkEc=
 github.com/grpc-ecosystem/grpc-gateway v1.14.6 h1:8ERzHx8aj1Sc47mu9n/AksaKCSWrMchFtkdrS4BIj5o=
 github.com/grpc-ecosystem/grpc-gateway v1.14.6/go.mod h1:zdiPV4Yse/1gnckTHtghG4GkDEdKCRJduHpTxT3/jcw=
 github.com/hashicorp/consul/api v1.1.0/go.mod h1:VmuI/Lkw1nC05EYQWNKwWGbkg+FbDBtguAZLlVdkD9Q=
@@ -553,6 +549,7 @@ golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAG
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45 h1:SVwTIAaPC2U/AvvLNZ2a7OVsmBpC8L5BlwK1whH3hm0=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
+golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d h1:TzXSXBo42m9gQenoE3b9BGiEpg5IG2JkU5FkPIawgtw=
 golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -651,8 +648,7 @@ google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98
 google.golang.org/genproto v0.0.0-20190911173649-1774047e7e51/go.mod h1:IbNlFCBrqXvoKpeg0TB2l7cyZUmoaFKYIwrEpbDKLA8=
 google.golang.org/genproto v0.0.0-20190927181202-20e1ac93f88c/go.mod h1:IbNlFCBrqXvoKpeg0TB2l7cyZUmoaFKYIwrEpbDKLA8=
 google.golang.org/genproto v0.0.0-20191108220845-16a3f7862a1a/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20191115221424-83cc0476cb11 h1:51D++eCgOHufw5VfDE9Uzqyyc+OyQIjb9hkYy9LN5Fk=
-google.golang.org/genproto v0.0.0-20191115221424-83cc0476cb11/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
+google.golang.org/genproto v0.0.0-20200513103714-09dca8ec2884 h1:fiNLklpBwWK1mth30Hlwk+fcdBmIALlgF5iy77O37Ig=
 google.golang.org/genproto v0.0.0-20200513103714-09dca8ec2884/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
@@ -670,8 +666,7 @@ google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQ
 google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
 google.golang.org/protobuf v1.21.0 h1:qdOKuR/EIArgaWNjetjgTzgVTAZ+S/WXVrq9HW9zimw=
 google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
-google.golang.org/protobuf v1.22.0 h1:cJv5/xdbk1NnMPR1VP9+HU6gupuG9MLBoH1r6RHZ2MY=
-google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
+google.golang.org/protobuf v1.23.0 h1:4MY060fB1DLGMB/7MBTLnwQUY6+F09GEiz6SsrNqyzM=
 google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

rpc/validation.go

@@ -1,6 +1,7 @@
 package flipt
 
 import (
+	"regexp"
 	"strings"
 
 	"github.com/markphelps/flipt/errors"
@@ -25,6 +26,8 @@ func (req *EvaluationRequest) Validate() error {
 	return nil
 }
 
+var keyRegex = regexp.MustCompile(`^[-_,A-Za-z0-9]+$`)
+
 // Flags
 
 func (req *GetFlagRequest) Validate() error {
@@ -40,6 +43,10 @@ func (req *CreateFlagRequest) Validate() error {
 		return errors.EmptyFieldError("key")
 	}
 
+	if !keyRegex.MatchString(req.Key) {
+		return errors.InvalidFieldError("key", "contains invalid characters")
+	}
+
 	if req.Name == "" {
 		return errors.EmptyFieldError("name")
 	}
@@ -272,6 +279,10 @@ func (req *CreateSegmentRequest) Validate() error {
 		return errors.EmptyFieldError("key")
 	}
 
+	if !keyRegex.MatchString(req.Key) {
+		return errors.InvalidFieldError("key", "contains invalid characters")
+	}
+
 	if req.Name == "" {
 		return errors.EmptyFieldError("name")
 	}

rpc/validation_test.go

@@ -88,6 +88,16 @@ func TestValidate_CreateFlagRequest(t *testing.T) {
 			},
 			wantErr: errors.EmptyFieldError("key"),
 		},
+		{
+			name: "invalidKey",
+			req: &CreateFlagRequest{
+				Key:         "foo:bar",
+				Name:        "name",
+				Description: "desc",
+				Enabled:     true,
+			},
+			wantErr: errors.InvalidFieldError("key", "contains invalid characters"),
+		},
 		{
 			name: "emptyName",
 			req: &CreateFlagRequest{
@@ -815,6 +825,15 @@ func TestValidate_CreateSegmentRequest(t *testing.T) {
 			},
 			wantErr: errors.EmptyFieldError("key"),
 		},
+		{
+			name: "invalidKey",
+			req: &CreateSegmentRequest{
+				Key:         "foo:bar",
+				Name:        "name",
+				Description: "desc",
+			},
+			wantErr: errors.InvalidFieldError("key", "contains invalid characters"),
+		},
 		{
 			name: "emptyName",
 			req: &CreateSegmentRequest{

script/test/qawolf

@@ -0,0 +1,26 @@
+#!/bin/bash
+
+cd "$(dirname "$0")/../.." || exit
+
+run()
+{
+    # run any pending db migrations
+    ./bin/flipt migrate --config ./config/local.yml &> /dev/null
+
+    ./bin/flipt --config ./config/local.yml &> /dev/null &
+
+    sleep 5
+
+    flipt_host="0.0.0.0:8080"
+
+    echo -e "\e[32m                \e[0m"
+    echo -e "\e[32m===========================================\e[0m"
+    echo -e "\e[32mStart UI testing $flipt_host\e[0m"
+    echo -e "\e[32m===========================================\e[0m"
+
+    ./script/test/helpers/wait-for-it/wait-for-it.sh "$flipt_host" -t 30
+
+    cd "ui" && yarn && yarn qawolf test --headless
+}
+
+run