84 lines
3.6 KiB
Go
84 lines
3.6 KiB
Go
package handler
|
|
|
|
import (
|
|
"context"
|
|
"go.uber.org/zap"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
|
|
"git.sundynix.cn/Blizzard/Veyra/internal/service"
|
|
)
|
|
|
|
func TestAuthenticationAndCSRFBoundaries(t *testing.T) {
|
|
auth, err := service.NewAuthService(nil)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
probe := func(context.Context) error { return nil }
|
|
router := NewRouter(service.NewHealthService(probe, probe), zap.NewNop(), IdentityOptions{Auth: auth, DevelopmentLogin: true})
|
|
for _, tc := range []struct {
|
|
method, path, body, origin string
|
|
status int
|
|
}{
|
|
{http.MethodGet, "/api/admin/v1/users", "", "", 401},
|
|
{http.MethodGet, "/api/v1/accounts", "", "", 401},
|
|
{http.MethodPost, "/api/admin/v1/auth/login", `{"login_name":"admin","password":"test-password"}`, "http://evil.example", 403},
|
|
{http.MethodPost, "/api/admin/v1/auth/login", `{"login_name":"admin","password":"test-password"}`, "", 403},
|
|
{http.MethodPost, "/api/admin/v1/auth/login", `{"login_name":"admin","password":"test-password","role":"ADMIN"}`, "http://example.com", 422},
|
|
{http.MethodPost, "/api/v1/auth/login", `{} {}`, "", 422},
|
|
} {
|
|
req := httptest.NewRequest(tc.method, "http://example.com"+tc.path, strings.NewReader(tc.body))
|
|
req.Header.Set("Content-Type", "application/json")
|
|
req.Header.Set("Origin", tc.origin)
|
|
rec := httptest.NewRecorder()
|
|
router.ServeHTTP(rec, req)
|
|
if rec.Code != tc.status {
|
|
t.Fatalf("%s %s got %d want %d", tc.method, tc.path, rec.Code, tc.status)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestDevelopmentLoginDisabledByDefault(t *testing.T) {
|
|
probe := func(context.Context) error { return nil }
|
|
router := NewRouter(service.NewHealthService(probe, probe), zap.NewNop(), IdentityOptions{})
|
|
rec := httptest.NewRecorder()
|
|
router.ServeHTTP(rec, httptest.NewRequest(http.MethodPost, "/api/v1/auth/login", strings.NewReader(`{}`)))
|
|
if rec.Code != http.StatusServiceUnavailable {
|
|
t.Fatal("development login open outside explicitly enabled environment")
|
|
}
|
|
}
|
|
|
|
func TestHTTPSPublicOriginBehindProxy(t *testing.T) {
|
|
auth, err := service.NewAuthService(nil)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
probe := func(context.Context) error { return nil }
|
|
for _, tc := range []struct {
|
|
name, publicOrigin, host, origin, forwardedProto string
|
|
status int
|
|
}{
|
|
{"configured HTTPS", "https://veyra.sundynix.cn", "veyra.sundynix.cn", "https://veyra.sundynix.cn", "https", 503},
|
|
{"no reliance on proxy header", "https://veyra.sundynix.cn", "veyra.sundynix.cn", "https://veyra.sundynix.cn", "", 503},
|
|
{"foreign origin", "https://veyra.sundynix.cn", "veyra.sundynix.cn", "https://evil.example", "https", 403},
|
|
{"HTTP origin rejected", "https://veyra.sundynix.cn", "veyra.sundynix.cn", "http://veyra.sundynix.cn", "https", 403},
|
|
{"wrong host", "https://veyra.sundynix.cn", "evil.example", "https://veyra.sundynix.cn", "https", 403},
|
|
{"spoofed proxy header", "", "veyra.sundynix.cn", "https://veyra.sundynix.cn", "https", 403},
|
|
} {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
router := NewRouter(service.NewHealthService(probe, probe), zap.NewNop(), IdentityOptions{Auth: auth, DevelopmentLogin: true, PublicOrigin: tc.publicOrigin})
|
|
req := httptest.NewRequest(http.MethodPost, "http://"+tc.host+"/api/admin/v1/auth/login", strings.NewReader(`{"login_name":"admin","password":"test-password"}`))
|
|
req.Header.Set("Content-Type", "application/json")
|
|
req.Header.Set("Origin", tc.origin)
|
|
req.Header.Set("X-Forwarded-Proto", tc.forwardedProto)
|
|
rec := httptest.NewRecorder()
|
|
router.ServeHTTP(rec, req)
|
|
if rec.Code != tc.status {
|
|
t.Fatalf("got %d want %d", rec.Code, tc.status)
|
|
}
|
|
})
|
|
}
|
|
}
|