mirror of
https://github.com/featurebasedb/featurebase.git
synced 2026-08-28 10:54:59 +00:00
773 lines
22 KiB
Go
773 lines
22 KiB
Go
// Copyright 2021 Molecula Corp. All rights reserved.
|
|
package pilosa
|
|
|
|
import (
|
|
"bytes"
|
|
"encoding/hex"
|
|
"encoding/json"
|
|
"io/ioutil"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"net/url"
|
|
"os"
|
|
"reflect"
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/golang-jwt/jwt"
|
|
"github.com/molecula/featurebase/v3/authn"
|
|
"golang.org/x/oauth2"
|
|
|
|
"github.com/molecula/featurebase/v3/authz"
|
|
"github.com/molecula/featurebase/v3/logger"
|
|
"github.com/molecula/featurebase/v3/pql"
|
|
)
|
|
|
|
// Test custom UnmarshalJSON for postIndexRequest object
|
|
func TestPostIndexRequestUnmarshalJSON(t *testing.T) {
|
|
tests := []struct {
|
|
json string
|
|
expected postIndexRequest
|
|
err string
|
|
}{
|
|
{json: `{"options": {}}`, expected: postIndexRequest{Options: IndexOptions{TrackExistence: true}}},
|
|
{json: `{"options": {"trackExistence": false}}`, expected: postIndexRequest{Options: IndexOptions{TrackExistence: false}}},
|
|
{json: `{"options": {"keys": true}}`, expected: postIndexRequest{Options: IndexOptions{Keys: true, TrackExistence: true}}},
|
|
{json: `{"options": 4}`, err: "options is not map[string]interface{}"},
|
|
{json: `{"option": {}}`, err: "unknown key: option:map[]"},
|
|
{json: `{"options": {"badKey": "test"}}`, err: "unknown key: badKey:test"},
|
|
}
|
|
for _, test := range tests {
|
|
actual := &postIndexRequest{}
|
|
err := json.Unmarshal([]byte(test.json), actual)
|
|
|
|
if err != nil {
|
|
if test.err == "" || test.err != err.Error() {
|
|
t.Errorf("expected error: %v, but got result: %v", test.err, err)
|
|
}
|
|
} else {
|
|
if test.err != "" {
|
|
t.Errorf("expected error: %v, but got no error", test.err)
|
|
}
|
|
}
|
|
|
|
if test.err == "" {
|
|
if !reflect.DeepEqual(*actual, test.expected) {
|
|
t.Errorf("expected: %v, but got: %v for JSON: %s", test.expected, *actual, test.json)
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
// Test custom UnmarshalJSON for postFieldRequest object
|
|
func TestPostFieldRequestUnmarshalJSON(t *testing.T) {
|
|
foo := "foo"
|
|
tests := []struct {
|
|
json string
|
|
expected postFieldRequest
|
|
err string
|
|
}{
|
|
{json: `{"options": {}}`, expected: postFieldRequest{}},
|
|
{json: `{"options": 4}`, err: "json: cannot unmarshal number"},
|
|
{json: `{"option": {}}`, err: `json: unknown field "option"`},
|
|
{json: `{"options": {"badKey": "test"}}`, err: `json: unknown field "badKey"`},
|
|
{json: `{"options": {"inverseEnabled": true}}`, err: `json: unknown field "inverseEnabled"`},
|
|
{json: `{"options": {"cacheType": "foo"}}`, expected: postFieldRequest{Options: fieldOptions{CacheType: &foo}}},
|
|
{json: `{"options": {"inverse": true, "cacheType": "foo"}}`, err: `json: unknown field "inverse"`},
|
|
}
|
|
for i, test := range tests {
|
|
actual := &postFieldRequest{}
|
|
dec := json.NewDecoder(bytes.NewReader([]byte(test.json)))
|
|
dec.DisallowUnknownFields()
|
|
err := dec.Decode(actual)
|
|
if err != nil {
|
|
if test.err == "" || !strings.HasPrefix(err.Error(), test.err) {
|
|
t.Errorf("test %d: expected error: %v, but got result: %v", i, test.err, err)
|
|
}
|
|
}
|
|
|
|
if test.err == "" {
|
|
if !reflect.DeepEqual(*actual, test.expected) {
|
|
t.Errorf("test %d: expected: %v, but got: %v", i, test.expected, *actual)
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
func stringPtr(s string) *string {
|
|
return &s
|
|
}
|
|
|
|
func decimalPtr(d pql.Decimal) *pql.Decimal {
|
|
return &d
|
|
}
|
|
|
|
// Test fieldOption validation.
|
|
func TestFieldOptionValidation(t *testing.T) {
|
|
timeQuantum := TimeQuantum("YMD")
|
|
defaultCacheSize := uint32(DefaultCacheSize)
|
|
tests := []struct {
|
|
json string
|
|
expected postFieldRequest
|
|
err string
|
|
}{
|
|
// FieldType: Set
|
|
{json: `{"options": {}}`, expected: postFieldRequest{Options: fieldOptions{
|
|
Type: FieldTypeSet,
|
|
CacheType: stringPtr(DefaultCacheType),
|
|
CacheSize: &defaultCacheSize,
|
|
}}},
|
|
{json: `{"options": {"type": "set"}}`, expected: postFieldRequest{Options: fieldOptions{
|
|
Type: FieldTypeSet,
|
|
CacheType: stringPtr(DefaultCacheType),
|
|
CacheSize: &defaultCacheSize,
|
|
}}},
|
|
{json: `{"options": {"type": "set", "cacheType": "lru"}}`, expected: postFieldRequest{Options: fieldOptions{
|
|
Type: FieldTypeSet,
|
|
CacheType: stringPtr("lru"),
|
|
CacheSize: &defaultCacheSize,
|
|
}}},
|
|
{json: `{"options": {"type": "set", "min": 0}}`, err: "min does not apply to field type set"},
|
|
{json: `{"options": {"type": "set", "max": 100}}`, err: "max does not apply to field type set"},
|
|
{json: `{"options": {"type": "set", "timeQuantum": "YMD"}}`, err: "timeQuantum does not apply to field type set"},
|
|
|
|
// FieldType: Int
|
|
{json: `{"options": {"type": "int"}}`, err: "min is required for field type int"},
|
|
{json: `{"options": {"type": "int", "min": 0}}`, err: "max is required for field type int"},
|
|
{json: `{"options": {"type": "int", "min": 0, "max": 1001}}`, expected: postFieldRequest{Options: fieldOptions{
|
|
Type: FieldTypeInt,
|
|
Min: decimalPtr(pql.NewDecimal(0, 0)),
|
|
Max: decimalPtr(pql.NewDecimal(1001, 0)),
|
|
}}},
|
|
{json: `{"options": {"type": "int", "min": 0, "max": 1000, "cacheType": "ranked"}}`, err: "cacheType does not apply to field type int"},
|
|
{json: `{"options": {"type": "int", "min": 0, "max": 1000, "cacheSize": 1000}}`, err: "cacheSize does not apply to field type int"},
|
|
{json: `{"options": {"type": "int", "min": 0, "max": 1000, "timeQuantum": "YMD"}}`, err: "timeQuantum does not apply to field type int"},
|
|
|
|
// FieldType: Time
|
|
{json: `{"options": {"type": "time"}}`, err: "timeQuantum is required for field type time"},
|
|
{json: `{"options": {"type": "time", "timeQuantum": "YMD"}}`, expected: postFieldRequest{Options: fieldOptions{
|
|
Type: FieldTypeTime,
|
|
TimeQuantum: &timeQuantum,
|
|
}}},
|
|
{json: `{"options": {"type": "time", "timeQuantum": "YMD", "min": 0}}`, err: "min does not apply to field type time"},
|
|
{json: `{"options": {"type": "time", "timeQuantum": "YMD", "max": 1000}}`, err: "max does not apply to field type time"},
|
|
{json: `{"options": {"type": "time", "timeQuantum": "YMD", "cacheType": "ranked"}}`, err: "cacheType does not apply to field type time"},
|
|
{json: `{"options": {"type": "time", "timeQuantum": "YMD", "cacheSize": 1000}}`, err: "cacheSize does not apply to field type time"},
|
|
}
|
|
for i, test := range tests {
|
|
actual := &postFieldRequest{}
|
|
dec := json.NewDecoder(bytes.NewReader([]byte(test.json)))
|
|
dec.DisallowUnknownFields()
|
|
err := dec.Decode(actual)
|
|
if err != nil {
|
|
t.Errorf("test %d: %v", i, err)
|
|
}
|
|
|
|
// Validate field options.
|
|
if err := actual.Options.validate(); err != nil {
|
|
if test.err == "" || test.err != err.Error() {
|
|
t.Errorf("test %d: expected error: %v, but got result: %v", i, test.err, err)
|
|
}
|
|
}
|
|
|
|
if test.err == "" {
|
|
if !reflect.DeepEqual(*actual, test.expected) {
|
|
t.Errorf("test %d: expected: %v, but got: %v", i, test.expected, *actual)
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
func readResponse(w *httptest.ResponseRecorder) ([]byte, error) {
|
|
res := w.Result()
|
|
defer res.Body.Close()
|
|
return ioutil.ReadAll(res.Body)
|
|
}
|
|
|
|
func TestAuthentication(t *testing.T) {
|
|
type evaluate func(w *httptest.ResponseRecorder, data []byte)
|
|
type endpoint func(w http.ResponseWriter, r *http.Request)
|
|
var (
|
|
ClientId = "e9088663-eb08-41d7-8f65-efb5f54bbb71"
|
|
ClientSecret = "DEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEF"
|
|
AuthorizeURL = "https://login.microsoftonline.com/4a137d66-d161-4ae4-b1e6-07e9920874b8/oauth2/v2.0/authorize"
|
|
TokenURL = "https://login.microsoftonline.com/4a137d66-d161-4ae4-b1e6-07e9920874b8/oauth2/v2.0/token"
|
|
GroupEndpointURL = "https://graph.microsoft.com/v1.0/me/transitiveMemberOf/microsoft.graph.group?$count=true"
|
|
LogoutURL = "https://login.microsoftonline.com/common/oauth2/v2.0/logout"
|
|
Scopes = []string{"https://graph.microsoft.com/.default", "offline_access"}
|
|
SecretKey = "DEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEF"
|
|
)
|
|
|
|
secretKey, _ := hex.DecodeString("DEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEF")
|
|
|
|
a, err := authn.NewAuth(
|
|
logger.NewStandardLogger(os.Stdout),
|
|
"http://localhost:10101/",
|
|
Scopes,
|
|
AuthorizeURL,
|
|
TokenURL,
|
|
GroupEndpointURL,
|
|
LogoutURL,
|
|
ClientId,
|
|
ClientSecret,
|
|
SecretKey,
|
|
)
|
|
if err != nil {
|
|
t.Errorf("building auth object%s", err)
|
|
}
|
|
|
|
h := Handler{
|
|
logger: logger.NewStandardLogger(os.Stdout),
|
|
queryLogger: logger.NewStandardLogger(os.Stdout),
|
|
auth: a,
|
|
}
|
|
|
|
hOff := Handler{}
|
|
|
|
// make a valid token
|
|
tkn := jwt.New(jwt.SigningMethodHS256)
|
|
claims := tkn.Claims.(jwt.MapClaims)
|
|
claims["oid"] = "42"
|
|
claims["name"] = "todd"
|
|
validToken, err := tkn.SignedString([]byte(secretKey))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
validToken = "Bearer " + validToken
|
|
|
|
token := oauth2.Token{
|
|
TokenType: "Bearer",
|
|
AccessToken: "asdf",
|
|
RefreshToken: "abcdef",
|
|
Expiry: time.Now().Add(time.Hour),
|
|
}
|
|
|
|
// make an expired token
|
|
claims["exp"] = "1"
|
|
expiredToken, err := tkn.SignedString([]byte(secretKey))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
expiredToken = "Bearer " + expiredToken
|
|
|
|
validCookie := &http.Cookie{
|
|
Name: "molecula-chip",
|
|
Value: token.AccessToken,
|
|
Path: "/",
|
|
Secure: true,
|
|
HttpOnly: true,
|
|
Expires: token.Expiry,
|
|
}
|
|
|
|
permissions1 := `"user-groups":
|
|
"dca35310-ecda-4f23-86cd-876aee559900":
|
|
"test": "write"
|
|
admin: "ac97c9e2-346b-42a2-b6da-18bcb61a32fe"`
|
|
|
|
tests := []struct {
|
|
name string
|
|
path string
|
|
kind string
|
|
method string
|
|
yamlData string
|
|
token string
|
|
cookie *http.Cookie
|
|
handler endpoint
|
|
fn evaluate
|
|
}{
|
|
{
|
|
name: "Login",
|
|
path: "/login",
|
|
kind: "type1",
|
|
cookie: validCookie,
|
|
handler: h.handleLogin,
|
|
fn: func(w *httptest.ResponseRecorder, data []byte) {
|
|
if strings.Index(string(data), AuthorizeURL) != 9 {
|
|
t.Errorf("incorrect redirect url: expected: %s, got: %s", AuthorizeURL, string(data))
|
|
}
|
|
},
|
|
},
|
|
{
|
|
name: "Logout",
|
|
path: "/logout",
|
|
kind: "type1",
|
|
cookie: validCookie,
|
|
handler: h.handleLogout,
|
|
fn: func(w *httptest.ResponseRecorder, data []byte) {
|
|
if w.Result().Cookies()[0].Value != "" {
|
|
t.Errorf("expected cookie to be cleared, got: %+v", w.Result().Cookies()[0].Value)
|
|
}
|
|
},
|
|
},
|
|
{
|
|
name: "Authenticate-ValidToken",
|
|
path: "/auth",
|
|
kind: "bearer",
|
|
token: validToken,
|
|
handler: h.handleCheckAuthentication,
|
|
fn: func(w *httptest.ResponseRecorder, data []byte) {
|
|
if w.Result().StatusCode != 200 {
|
|
body, _ := readResponse(w)
|
|
t.Errorf("expected http code 200, got: %+v with body: %+v", w.Result().StatusCode, body)
|
|
}
|
|
},
|
|
},
|
|
{
|
|
name: "Authenticate-NoToken",
|
|
path: "/auth",
|
|
kind: "type1",
|
|
handler: h.handleCheckAuthentication,
|
|
fn: func(w *httptest.ResponseRecorder, data []byte) {
|
|
// not token at all == status forbidden
|
|
if w.Result().StatusCode != 401 {
|
|
t.Errorf("expected http code 401, got: %+v", w.Result().StatusCode)
|
|
}
|
|
},
|
|
},
|
|
{
|
|
name: "Authenticate-InvalidToken",
|
|
path: "/auth",
|
|
kind: "type1",
|
|
token: "this isn't a real token",
|
|
handler: h.handleCheckAuthentication,
|
|
fn: func(w *httptest.ResponseRecorder, data []byte) {
|
|
// no valid token in header == Unauthorized
|
|
if w.Result().StatusCode != http.StatusUnauthorized {
|
|
t.Errorf("expected http code 401, got: %+v", w.Result().StatusCode)
|
|
}
|
|
},
|
|
},
|
|
{
|
|
name: "Authenticate-ExpiredToken",
|
|
path: "/auth",
|
|
kind: "type1",
|
|
token: expiredToken,
|
|
handler: h.handleCheckAuthentication,
|
|
fn: func(w *httptest.ResponseRecorder, data []byte) {
|
|
// expired token == unauthorized
|
|
if w.Result().StatusCode != 401 {
|
|
t.Errorf("expected http code 403, got: %+v", w.Result().StatusCode)
|
|
}
|
|
},
|
|
},
|
|
{
|
|
name: "UserInfo",
|
|
path: "/userinfo",
|
|
kind: "bearer",
|
|
token: validToken,
|
|
handler: h.handleUserInfo,
|
|
fn: func(w *httptest.ResponseRecorder, data []byte) {
|
|
uinfo := authn.UserInfo{}
|
|
err = json.Unmarshal(data, &uinfo)
|
|
if err != nil {
|
|
t.Errorf("unmarshalling userinfo")
|
|
}
|
|
if uinfo.UserID != "42" && uinfo.UserName != "todd" {
|
|
t.Errorf("expected http code 400, got: %+v", uinfo)
|
|
}
|
|
},
|
|
},
|
|
{
|
|
name: "UserInfo-NoCookie",
|
|
path: "/userinfo",
|
|
kind: "bearer",
|
|
token: "",
|
|
handler: h.handleUserInfo,
|
|
fn: func(w *httptest.ResponseRecorder, data []byte) {
|
|
if got := w.Result().StatusCode; got != http.StatusForbidden {
|
|
t.Errorf("expected 403, got %v", got)
|
|
}
|
|
},
|
|
},
|
|
{
|
|
name: "Redirect-NoAuthCode",
|
|
path: "/redirect",
|
|
kind: "type1",
|
|
cookie: validCookie,
|
|
handler: h.handleRedirect,
|
|
fn: func(w *httptest.ResponseRecorder, data []byte) {
|
|
if strings.Index(string(data), AuthorizeURL) != 9 {
|
|
if w.Result().StatusCode != 400 {
|
|
t.Errorf("expected http code 400, got: %+v", w.Result().StatusCode)
|
|
}
|
|
}
|
|
},
|
|
},
|
|
{
|
|
name: "Redirect-SomeAuthCode",
|
|
path: "/redirect",
|
|
kind: "type2",
|
|
cookie: validCookie,
|
|
handler: h.handleRedirect,
|
|
fn: func(w *httptest.ResponseRecorder, data []byte) {
|
|
if strings.Index(string(data), AuthorizeURL) != 9 {
|
|
if w.Result().StatusCode != 400 {
|
|
t.Errorf("expected http code 400, got: %+v", w.Result().StatusCode)
|
|
}
|
|
}
|
|
},
|
|
},
|
|
{
|
|
name: "Login-AuthOff",
|
|
path: "/login",
|
|
kind: "type1",
|
|
cookie: validCookie,
|
|
handler: hOff.handleLogin,
|
|
fn: func(w *httptest.ResponseRecorder, data []byte) {
|
|
if strings.Index(string(data), AuthorizeURL) != 9 {
|
|
if w.Result().StatusCode != 204 {
|
|
t.Errorf("expected http code 204, got: %+v", w.Result().StatusCode)
|
|
}
|
|
}
|
|
},
|
|
},
|
|
{
|
|
name: "Logout-AuthOff",
|
|
path: "/logout",
|
|
kind: "type1",
|
|
cookie: validCookie,
|
|
handler: hOff.handleLogout,
|
|
fn: func(w *httptest.ResponseRecorder, data []byte) {
|
|
if strings.Index(string(data), AuthorizeURL) != 9 {
|
|
if w.Result().StatusCode != 204 {
|
|
t.Errorf("expected http code 204, got: %+v", w.Result().StatusCode)
|
|
}
|
|
}
|
|
},
|
|
},
|
|
{
|
|
name: "UserInfo-AuthOff",
|
|
path: "/userinfo",
|
|
kind: "type1",
|
|
cookie: validCookie,
|
|
handler: hOff.handleUserInfo,
|
|
fn: func(w *httptest.ResponseRecorder, data []byte) {
|
|
if strings.Index(string(data), AuthorizeURL) != 9 {
|
|
if w.Result().StatusCode != 204 {
|
|
t.Errorf("expected http code 204, got: %+v", w.Result().StatusCode)
|
|
}
|
|
}
|
|
},
|
|
},
|
|
{
|
|
name: "Authenticate-AuthOff",
|
|
path: "/auth",
|
|
kind: "type1",
|
|
cookie: validCookie,
|
|
handler: hOff.handleCheckAuthentication,
|
|
fn: func(w *httptest.ResponseRecorder, data []byte) {
|
|
if strings.Index(string(data), AuthorizeURL) != 9 {
|
|
if w.Result().StatusCode != 204 {
|
|
t.Errorf("expected http code 204, got: %+v", w.Result().StatusCode)
|
|
}
|
|
}
|
|
},
|
|
},
|
|
{
|
|
name: "Redirect-AuthOff",
|
|
path: "/redirect",
|
|
kind: "type1",
|
|
cookie: validCookie,
|
|
handler: hOff.handleRedirect,
|
|
fn: func(w *httptest.ResponseRecorder, data []byte) {
|
|
if strings.Index(string(data), AuthorizeURL) != 9 {
|
|
if w.Result().StatusCode != 204 {
|
|
t.Errorf("expected http code 204, got: %+v", w.Result().StatusCode)
|
|
}
|
|
}
|
|
},
|
|
},
|
|
{
|
|
name: "MW-AuthOff",
|
|
path: "/index/{index}/query",
|
|
kind: "middleware",
|
|
cookie: validCookie,
|
|
handler: func(w http.ResponseWriter, r *http.Request) {
|
|
f := hOff.chkAuthZ(hOff.handlePostQuery, authz.Admin)
|
|
f(w, r)
|
|
},
|
|
fn: func(w *httptest.ResponseRecorder, data []byte) {
|
|
if w.Result().StatusCode != 400 {
|
|
t.Errorf("expected http code 400, got: %+v", w.Result().StatusCode)
|
|
}
|
|
},
|
|
},
|
|
{
|
|
name: "MW-CreateIndexInsufficientPerms",
|
|
path: "/index/abcd",
|
|
kind: "bearer",
|
|
method: http.MethodPost,
|
|
token: validToken,
|
|
handler: func(w http.ResponseWriter, r *http.Request) {
|
|
h := h
|
|
var p authz.GroupPermissions
|
|
if err := p.ReadPermissionsFile(strings.NewReader(permissions1)); err != nil {
|
|
t.Errorf("Error: %s", err)
|
|
}
|
|
h.permissions = &p
|
|
|
|
f := h.chkAuthZ(h.handlePostIndex, authz.Admin)
|
|
f(w, r)
|
|
},
|
|
fn: func(w *httptest.ResponseRecorder, data []byte) {
|
|
if got, want := w.Result().StatusCode, http.StatusForbidden; got != want {
|
|
t.Errorf("expected %v, got %v", want, got)
|
|
}
|
|
},
|
|
},
|
|
{
|
|
// this tests that there are no permissions read in even though
|
|
// auth is turned on, so we get a 500
|
|
name: "MW-NoPermissions",
|
|
path: "/index/{index}/query",
|
|
kind: "bearer",
|
|
token: validToken,
|
|
handler: func(w http.ResponseWriter, r *http.Request) {
|
|
h := h
|
|
f := h.chkAuthZ(h.handlePostQuery, authz.Write)
|
|
f(w, r)
|
|
},
|
|
fn: func(w *httptest.ResponseRecorder, data []byte) {
|
|
if got, want := w.Result().StatusCode, http.StatusInternalServerError; got != want {
|
|
t.Errorf("expected %v, got %v", want, got)
|
|
}
|
|
},
|
|
},
|
|
{
|
|
name: "MW-NoQuery",
|
|
path: "/index/{index}/query",
|
|
kind: "bearer",
|
|
token: validToken,
|
|
handler: func(w http.ResponseWriter, r *http.Request) {
|
|
h := h
|
|
var p authz.GroupPermissions
|
|
if err := p.ReadPermissionsFile(strings.NewReader(permissions1)); err != nil {
|
|
t.Errorf("Error: %s", err)
|
|
}
|
|
h.permissions = &p
|
|
f := h.chkAuthZ(h.handlePostQuery, authz.Write)
|
|
f(w, r)
|
|
},
|
|
fn: func(w *httptest.ResponseRecorder, data []byte) {
|
|
if got, want := w.Result().StatusCode, http.StatusBadRequest; got != want {
|
|
t.Errorf("expected %v, got: %+v", want, got)
|
|
}
|
|
},
|
|
},
|
|
}
|
|
|
|
for _, test := range tests {
|
|
switch test.kind {
|
|
case "type1", "middleware":
|
|
t.Run(test.name, func(t *testing.T) {
|
|
r := httptest.NewRequest(http.MethodGet, test.path, nil)
|
|
w := httptest.NewRecorder()
|
|
if test.cookie != nil {
|
|
r.AddCookie(test.cookie)
|
|
}
|
|
test.handler(w, r)
|
|
data, err := readResponse(w)
|
|
if err != nil {
|
|
t.Errorf("expected no errors reading response, got: %+v", err)
|
|
}
|
|
test.fn(w, data)
|
|
})
|
|
case "type2":
|
|
t.Run(test.name, func(t *testing.T) {
|
|
r := httptest.NewRequest(http.MethodGet, test.path, nil)
|
|
w := httptest.NewRecorder()
|
|
r.Form = url.Values{}
|
|
r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
|
r.Form.Add("code", "junk")
|
|
|
|
test.handler(w, r)
|
|
data, err := readResponse(w)
|
|
if err != nil {
|
|
t.Errorf("expected no errors reading response, got: %+v", err)
|
|
}
|
|
|
|
test.fn(w, data)
|
|
|
|
})
|
|
case "bearer":
|
|
t.Run(test.name, func(t *testing.T) {
|
|
if test.method == "" {
|
|
test.method = http.MethodGet
|
|
}
|
|
r := httptest.NewRequest(test.method, test.path, nil)
|
|
w := httptest.NewRecorder()
|
|
if test.token != "" {
|
|
r.Header.Add("Authorization", test.token)
|
|
}
|
|
test.handler(w, r)
|
|
data, err := readResponse(w)
|
|
if err != nil {
|
|
t.Errorf("expected no errors reading response, got: %+v", err)
|
|
}
|
|
test.fn(w, data)
|
|
})
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
func TestChkAuthN(t *testing.T) {
|
|
a := NewTestAuth(t)
|
|
h := Handler{
|
|
logger: logger.NewStandardLogger(os.Stdout),
|
|
queryLogger: logger.NewStandardLogger(os.Stdout),
|
|
auth: a,
|
|
}
|
|
|
|
// make a valid token
|
|
tkn := jwt.New(jwt.SigningMethodHS256)
|
|
claims := tkn.Claims.(jwt.MapClaims)
|
|
claims["oid"] = "42"
|
|
claims["name"] = "A. Token"
|
|
validToken, err := tkn.SignedString(a.SecretKey())
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
validToken = "Bearer " + validToken
|
|
|
|
// make an invalid token
|
|
invalidToken := "Bearer " + "thisis.a.bad.token"
|
|
|
|
// make an expired token
|
|
claims["exp"] = "1"
|
|
expiredToken, err := tkn.SignedString(a.SecretKey())
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
expiredToken = "Bearer " + expiredToken
|
|
|
|
testingHandler := func(w http.ResponseWriter, r *http.Request) {
|
|
w.Write([]byte("good"))
|
|
}
|
|
|
|
cases := []struct {
|
|
name string
|
|
endpoint string
|
|
token string
|
|
handler http.HandlerFunc
|
|
statusCode int
|
|
}{
|
|
{
|
|
name: "Valid",
|
|
token: validToken,
|
|
handler: h.chkAuthN(testingHandler),
|
|
statusCode: http.StatusOK,
|
|
},
|
|
{
|
|
name: "Invalid",
|
|
token: invalidToken,
|
|
handler: h.chkAuthN(testingHandler),
|
|
statusCode: http.StatusUnauthorized,
|
|
},
|
|
{
|
|
name: "Expired",
|
|
token: expiredToken,
|
|
handler: h.chkAuthN(testingHandler),
|
|
statusCode: http.StatusUnauthorized,
|
|
},
|
|
}
|
|
for _, test := range cases {
|
|
t.Run(test.name, func(t *testing.T) {
|
|
w := httptest.NewRecorder()
|
|
r := httptest.NewRequest("GET", "/whatever", nil)
|
|
r.Header.Add("Authorization", test.token)
|
|
test.handler(w, r)
|
|
resp := w.Result()
|
|
if resp.StatusCode != test.statusCode {
|
|
t.Fatalf("expected %v, got %v", test.statusCode, resp.StatusCode)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestChkInternal(t *testing.T) {
|
|
a := NewTestAuth(t)
|
|
authKey := "DEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEF"
|
|
h := Handler{
|
|
logger: logger.NewStandardLogger(os.Stdout),
|
|
queryLogger: logger.NewStandardLogger(os.Stdout),
|
|
auth: a,
|
|
}
|
|
|
|
testingHandler := func(w http.ResponseWriter, r *http.Request) {
|
|
w.Write([]byte("good"))
|
|
}
|
|
|
|
cases := []struct {
|
|
name string
|
|
statusCode int
|
|
handler http.HandlerFunc
|
|
key string
|
|
}{
|
|
{
|
|
name: "happyPath",
|
|
statusCode: http.StatusOK,
|
|
handler: h.chkInternal(testingHandler),
|
|
key: authKey,
|
|
},
|
|
{
|
|
name: "unhappyPath-empty",
|
|
statusCode: http.StatusUnauthorized,
|
|
handler: h.chkInternal(testingHandler),
|
|
key: "",
|
|
},
|
|
{
|
|
name: "unhappyPath-wrong",
|
|
statusCode: http.StatusUnauthorized,
|
|
handler: h.chkInternal(testingHandler),
|
|
key: "BEABBEEFBEABBEEFBEABBEEFBEABBEEFBEABBEEFBEABBEEFBEABBEEFBEABBEEF",
|
|
},
|
|
}
|
|
for _, test := range cases {
|
|
t.Run(test.name, func(t *testing.T) {
|
|
w := httptest.NewRecorder()
|
|
r := httptest.NewRequest("GET", "/whatever", nil)
|
|
if test.key != "" {
|
|
r.Header.Add("X-Feature-Key", test.key)
|
|
}
|
|
test.handler(w, r)
|
|
resp := w.Result()
|
|
if resp.StatusCode != test.statusCode {
|
|
t.Fatalf("expected %v, got %v", test.statusCode, resp.StatusCode)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func NewTestAuth(t *testing.T) *authn.Auth {
|
|
t.Helper()
|
|
var (
|
|
ClientID = "e9088663-eb08-41d7-8f65-efb5f54bbb71"
|
|
ClientSecret = "DEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEF"
|
|
AuthorizeURL = "https://login.microsoftonline.com/4a137d66-d161-4ae4-b1e6-07e9920874b8/oauth2/v2.0/authorize"
|
|
TokenURL = "https://login.microsoftonline.com/4a137d66-d161-4ae4-b1e6-07e9920874b8/oauth2/v2.0/token"
|
|
GroupEndpointURL = "https://graph.microsoft.com/v1.0/me/transitiveMemberOf/microsoft.graph.group?$count=true"
|
|
LogoutURL = "https://login.microsoftonline.com/common/oauth2/v2.0/logout"
|
|
Scopes = []string{"https://graph.microsoft.com/.default", "offline_access"}
|
|
Key = "DEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEF"
|
|
)
|
|
|
|
a, err := authn.NewAuth(
|
|
logger.NewStandardLogger(os.Stdout),
|
|
"http://localhost:10101/",
|
|
Scopes,
|
|
AuthorizeURL,
|
|
TokenURL,
|
|
GroupEndpointURL,
|
|
LogoutURL,
|
|
ClientID,
|
|
ClientSecret,
|
|
Key,
|
|
)
|
|
if err != nil {
|
|
t.Fatalf("building auth object%s", err)
|
|
}
|
|
return a
|
|
}
|