GroupPolicy.cs (12808B)
1 // ----------------------------------------------------------------------------- 2 // <copyright file="GroupPolicy.cs" company="Microsoft Corporation"> 3 // Copyright (c) Microsoft Corporation. Licensed under the MIT License. 4 // </copyright> 5 // ----------------------------------------------------------------------------- 6 7 namespace AppInstallerCLIE2ETests 8 { 9 using AppInstallerCLIE2ETests.Helpers; 10 using NUnit.Framework; 11 12 /// <summary> 13 /// Tests for enforcement of Group Policy. 14 /// Behavior is better tested in the unit tests; these tests mostly ensure match between the code and the definition. 15 /// </summary> 16 public class GroupPolicy : BaseCommand 17 { 18 /// <summary> 19 /// Set up. 20 /// </summary> 21 [SetUp] 22 public void Setup() 23 { 24 WinGetSettingsHelper.InitializeAllFeatures(false); 25 GroupPolicyHelper.DeleteExistingPolicies(); 26 } 27 28 /// <summary> 29 /// Tear down. 30 /// </summary> 31 [TearDown] 32 public void TearDown() 33 { 34 WinGetSettingsHelper.InitializeAllFeatures(false); 35 GroupPolicyHelper.DeleteExistingPolicies(); 36 } 37 38 /// <summary> 39 /// Test winget search is disabled by policy. 40 /// </summary> 41 [Test] 42 public void PolicyEnableWinget() 43 { 44 GroupPolicyHelper.EnableWinget.Disable(); 45 var result = TestCommon.RunAICLICommand("search", "foo"); 46 Assert.AreEqual(Constants.ErrorCode.ERROR_BLOCKED_BY_POLICY, result.ExitCode); 47 48 // Scenario if Policy WinGet is disabled but Policy EnableWindowsPackageManagerCommandLineInterfaces is Enabled. 49 GroupPolicyHelper.EnableWinGetCommandLineInterfaces.Enable(); 50 result = TestCommon.RunAICLICommand("search", "foo"); 51 Assert.AreEqual(Constants.ErrorCode.ERROR_BLOCKED_BY_POLICY, result.ExitCode); 52 53 // Scenario if Policy WinGet is disabled but Policy EnableWindowsPackageManagerCommandLineInterfaces is Not-Configured. 54 GroupPolicyHelper.EnableWinGetCommandLineInterfaces.SetNotConfigured(); 55 result = TestCommon.RunAICLICommand("search", "foo"); 56 Assert.AreEqual(Constants.ErrorCode.ERROR_BLOCKED_BY_POLICY, result.ExitCode); 57 58 // Scenario if Policy WinGet is enabled but Policy EnableWindowsPackageManagerCommandLineInterfaces is disabled. 59 GroupPolicyHelper.EnableWinget.Enable(); 60 GroupPolicyHelper.EnableWinGetCommandLineInterfaces.Disable(); 61 result = TestCommon.RunAICLICommand("search", "foo"); 62 Assert.AreEqual(Constants.ErrorCode.ERROR_BLOCKED_BY_POLICY, result.ExitCode); 63 64 // Scenario if Policy WinGet is Not-Configured but Policy EnableWindowsPackageManagerCommandLineInterfaces is disabled. 65 GroupPolicyHelper.EnableWinget.SetNotConfigured(); 66 GroupPolicyHelper.EnableWinGetCommandLineInterfaces.Disable(); 67 result = TestCommon.RunAICLICommand("search", "foo"); 68 Assert.AreEqual(Constants.ErrorCode.ERROR_BLOCKED_BY_POLICY, result.ExitCode); 69 } 70 71 /// <summary> 72 /// Test winget settings is disable by policy. 73 /// </summary> 74 [Test] 75 public void EnableSettings() 76 { 77 GroupPolicyHelper.EnableSettings.Disable(); 78 var result = TestCommon.RunAICLICommand("settings", string.Empty); 79 Assert.AreEqual(Constants.ErrorCode.ERROR_BLOCKED_BY_POLICY, result.ExitCode); 80 } 81 82 /// <summary> 83 /// Test experimental features policy. 84 /// </summary> 85 [Test] 86 public void EnableExperimentalFeatures() 87 { 88 WinGetSettingsHelper.ConfigureFeature("experimentalCmd", true); 89 var result = TestCommon.RunAICLICommand("experimental", string.Empty); 90 Assert.AreEqual(Constants.ErrorCode.S_OK, result.ExitCode); 91 92 // An experimental feature disabled by Group Policy behaves the same as one that is not enabled. 93 // The expected result is a command line error as the argument validation rejects this. 94 GroupPolicyHelper.EnableExperimentalFeatures.Disable(); 95 result = TestCommon.RunAICLICommand("experimental", string.Empty); 96 Assert.AreEqual(Constants.ErrorCode.ERROR_INVALID_CL_ARGUMENTS, result.ExitCode); 97 } 98 99 /// <summary> 100 /// Test install via manifest is disabled by policy. 101 /// </summary> 102 [Test] 103 public void EnableLocalManifests() 104 { 105 GroupPolicyHelper.EnableLocalManifests.Disable(); 106 var result = TestCommon.RunAICLICommand("install", $"-m {TestCommon.GetTestDataFile(@"Manifests\TestExeInstaller.yaml")}"); 107 Assert.AreEqual(Constants.ErrorCode.ERROR_BLOCKED_BY_POLICY, result.ExitCode); 108 } 109 110 /// <summary> 111 /// Test install without checking the hash is disabled by policy. 112 /// </summary> 113 [Test] 114 public void EnableHashOverride() 115 { 116 GroupPolicyHelper.EnableHashOverride.Disable(); 117 var result = TestCommon.RunAICLICommand("install", "AnyPackage --ignore-security-hash"); 118 Assert.AreEqual(Constants.ErrorCode.ERROR_BLOCKED_BY_POLICY, result.ExitCode); 119 } 120 121 /// <summary> 122 /// Test install ignoring the malware scan is disabled by policy. 123 /// </summary> 124 [Test] 125 public void EnableIgnoreLocalArchiveMalwareScanOverride() 126 { 127 GroupPolicyHelper.EnableLocalArchiveMalwareScanOverride.Disable(); 128 var result = TestCommon.RunAICLICommand("install", "AnyPackage --ignore-local-archive-malware-scan"); 129 130 Assert.AreEqual(Constants.ErrorCode.ERROR_BLOCKED_BY_POLICY, result.ExitCode); 131 } 132 133 /// <summary> 134 /// Test winget source is enabled by policy. 135 /// </summary> 136 [Test] 137 public void EnableDefaultSource() 138 { 139 // Default sources are disabled during setup so they are missing. 140 var result = TestCommon.RunAICLICommand("source list", "winget"); 141 Assert.AreEqual(Constants.ErrorCode.ERROR_SOURCE_NAME_DOES_NOT_EXIST, result.ExitCode); 142 143 GroupPolicyHelper.EnableDefaultSource.Enable(); 144 result = TestCommon.RunAICLICommand("source list", "winget"); 145 Assert.AreEqual(Constants.ErrorCode.S_OK, result.ExitCode); 146 } 147 148 /// <summary> 149 /// Test store source is enabled by policy. 150 /// </summary> 151 [Test] 152 public void EnableMicrosoftStoreSource() 153 { 154 // Default sources are disabled during setup so they are missing. 155 var result = TestCommon.RunAICLICommand("source list", "msstore"); 156 Assert.AreEqual(Constants.ErrorCode.ERROR_SOURCE_NAME_DOES_NOT_EXIST, result.ExitCode); 157 158 GroupPolicyHelper.EnableMicrosoftStoreSource.Enable(); 159 result = TestCommon.RunAICLICommand("source list", "msstore"); 160 Assert.AreEqual(Constants.ErrorCode.S_OK, result.ExitCode); 161 } 162 163 /// <summary> 164 /// Test additional sources are enabled by policy. 165 /// </summary> 166 [Test] 167 public void EnableAdditionalSources() 168 { 169 // Remove the test source, then add it with policy. 170 TestCommon.RunAICLICommand("source remove", "TestSource"); 171 var result = TestCommon.RunAICLICommand("source list", "TestSource"); 172 Assert.AreEqual(Constants.ErrorCode.ERROR_SOURCE_NAME_DOES_NOT_EXIST, result.ExitCode); 173 174 GroupPolicyHelper.EnableAdditionalSources.SetEnabledList(new string[] 175 { 176 "{\"Arg\":\"https://localhost:5001/TestKit\",\"Data\":\"WingetE2E.Tests_8wekyb3d8bbwe\",\"Identifier\":\"WingetE2E.Tests_8wekyb3d8bbwe\",\"Name\":\"TestSource\",\"Type\":\"Microsoft.PreIndexed.Package\"}", 177 }); 178 179 result = TestCommon.RunAICLICommand("source list", "TestSource"); 180 Assert.AreEqual(Constants.ErrorCode.S_OK, result.ExitCode); 181 } 182 183 /// <summary> 184 /// Test additional sources with trust levels and explicit are enabled by policy. 185 /// </summary> 186 [Test] 187 public void EnableAdditionalSources_TrustLevel_Explicit() 188 { 189 // Remove the test source, then add it with policy. 190 TestCommon.RunAICLICommand("source remove", "TestSource"); 191 var result = TestCommon.RunAICLICommand("source list", "TestSource"); 192 Assert.AreEqual(Constants.ErrorCode.ERROR_SOURCE_NAME_DOES_NOT_EXIST, result.ExitCode); 193 194 GroupPolicyHelper.EnableAdditionalSources.SetEnabledList(new string[] 195 { 196 "{\"Arg\":\"https://localhost:5001/TestKit\",\"Data\":\"WingetE2E.Tests_8wekyb3d8bbwe\",\"Identifier\":\"WingetE2E.Tests_8wekyb3d8bbwe\",\"Name\":\"TestSource\",\"Type\":\"Microsoft.PreIndexed.Package\",\"TrustLevel\":[\"Trusted\"],\"Explicit\":true}", 197 }); 198 199 result = TestCommon.RunAICLICommand("source list", "TestSource"); 200 Assert.AreEqual(Constants.ErrorCode.S_OK, result.ExitCode); 201 Assert.True(result.StdOut.Contains("Trust Level")); 202 Assert.True(result.StdOut.Contains("Trusted")); 203 204 var searchResult = TestCommon.RunAICLICommand("search", "TestExampleInstaller"); 205 Assert.AreEqual(Constants.ErrorCode.ERROR_NO_SOURCES_DEFINED, searchResult.ExitCode); 206 Assert.True(searchResult.StdOut.Contains("No sources defined; add one with 'source add' or reset to defaults with 'source reset'")); 207 } 208 209 /// <summary> 210 /// Test enable allowed sources. 211 /// </summary> 212 [Test] 213 public void EnableAllowedSources() 214 { 215 // Try listing the test source. We should only see it if it is allowed. 216 // With allowed sources disabled: 217 GroupPolicyHelper.EnableAllowedSources.Disable(); 218 var result = TestCommon.RunAICLICommand("source list", "TestSource"); 219 Assert.AreEqual(Constants.ErrorCode.ERROR_SOURCE_NAME_DOES_NOT_EXIST, result.ExitCode); 220 221 // With allowed sources enabled, but not listing the test source: 222 GroupPolicyHelper.EnableAdditionalSources.SetEnabledList(new string[] 223 { 224 "{\"Arg\":\"An argument\",\"Data\":\"Some data\",\"Identifier\":\"Test id\",\"Name\":\"NotTestSource\",\"Type\":\"Microsoft.PreIndexed.Package\"}", 225 }); 226 227 result = TestCommon.RunAICLICommand("source list", "TestSource"); 228 Assert.AreEqual(Constants.ErrorCode.ERROR_SOURCE_NAME_DOES_NOT_EXIST, result.ExitCode); 229 230 // With the test source allowed: 231 GroupPolicyHelper.EnableAdditionalSources.SetEnabledList(new string[] 232 { 233 "{\"Arg\":\"https://localhost:5001/TestKit\",\"Data\":\"WingetE2E.Tests_8wekyb3d8bbwe\",\"Identifier\":\"WingetE2E.Tests_8wekyb3d8bbwe\",\"Name\":\"TestSource\",\"Type\":\"Microsoft.PreIndexed.Package\"}", 234 }); 235 236 result = TestCommon.RunAICLICommand("source list", "TestSource"); 237 Assert.AreEqual(Constants.ErrorCode.S_OK, result.ExitCode); 238 } 239 240 /// <summary> 241 /// Tests source auto update policy. 242 /// </summary> 243 [Test] 244 public void SourceAutoUpdateInterval() 245 { 246 // Test this policy by inspecting the result of --info 247 GroupPolicyHelper.SourceAutoUpdateInterval.SetEnabledValue(123); 248 var result = TestCommon.RunAICLICommand(string.Empty, "--info"); 249 Assert.AreEqual(Constants.ErrorCode.S_OK, result.ExitCode); 250 Assert.IsTrue(result.StdOut.Contains("Source Auto Update Interval In Minutes 123")); 251 } 252 253 /// <summary> 254 /// Test configuration is disabled by policy. 255 /// </summary> 256 [Test] 257 public void EnableConfiguration() 258 { 259 GroupPolicyHelper.EnableConfiguration.Disable(); 260 var result = TestCommon.RunAICLICommand("configure", TestCommon.GetTestDataFile("Configuration\\ShowDetails_TestRepo.yml")); 261 Assert.AreEqual(Constants.ErrorCode.ERROR_BLOCKED_BY_POLICY, result.ExitCode); 262 263 result = TestCommon.RunAICLICommand("configure show", TestCommon.GetTestDataFile("Configuration\\ShowDetails_TestRepo.yml")); 264 Assert.AreEqual(Constants.ErrorCode.ERROR_BLOCKED_BY_POLICY, result.ExitCode); 265 } 266 } 267 }