70 lines
2.5 KiB
Go
70 lines
2.5 KiB
Go
package main
|
|
|
|
import (
|
|
"encoding/json"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
)
|
|
|
|
func TestBearerTokenRequiresBearerScheme(t *testing.T) {
|
|
request := httptest.NewRequest("GET", "/", nil)
|
|
request.Header.Set("Authorization", "Basic value")
|
|
if token := bearerToken(request); token != "" {
|
|
t.Fatalf("unexpected token %q", token)
|
|
}
|
|
request.Header.Set("Authorization", "Bearer creator-session")
|
|
if token := bearerToken(request); token != "creator-session" {
|
|
t.Fatalf("token = %q", token)
|
|
}
|
|
}
|
|
|
|
func TestCreatorSessionHandlerAcceptsConfiguredCredentials(t *testing.T) {
|
|
handler := creatorSessionHandler("recovery", "m", "password", []byte("01234567890123456789012345678901"), func() time.Time { return time.Unix(1000, 0) })
|
|
request := httptest.NewRequest(http.MethodPost, "/v1/creator/sessions", strings.NewReader(`{"username":"m","password":"password"}`))
|
|
response := httptest.NewRecorder()
|
|
handler(response, request)
|
|
if response.Code != http.StatusOK {
|
|
t.Fatalf("status = %d body=%s", response.Code, response.Body.String())
|
|
}
|
|
var issued struct {
|
|
Token string
|
|
}
|
|
if err := json.NewDecoder(response.Body).Decode(&issued); err != nil || issued.Token == "" {
|
|
t.Fatalf("session response = %+v, err=%v", issued, err)
|
|
}
|
|
}
|
|
|
|
func TestCreatorSessionHandlerFailsClosed(t *testing.T) {
|
|
handler := creatorSessionHandler("recovery", "m", "password", []byte("01234567890123456789012345678901"), time.Now)
|
|
tests := []string{
|
|
`{"username":"wrong","password":"password"}`,
|
|
`{"username":"m","password":"wrong"}`,
|
|
`{"username":"","password":""}`,
|
|
`{"username":"m","password":"password","actor":"attacker"}`,
|
|
`{`,
|
|
`{"username":"m","password":"password"}{}`,
|
|
}
|
|
for _, body := range tests {
|
|
request := httptest.NewRequest(http.MethodPost, "/v1/creator/sessions", strings.NewReader(body))
|
|
response := httptest.NewRecorder()
|
|
handler(response, request)
|
|
if response.Code != http.StatusUnauthorized || strings.TrimSpace(response.Body.String()) != "creator authentication denied" {
|
|
t.Fatalf("body %q: status=%d response=%q", body, response.Code, response.Body.String())
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestCreatorSessionHandlerPreservesBootstrapRecovery(t *testing.T) {
|
|
handler := creatorSessionHandler("recovery", "", "", []byte("01234567890123456789012345678901"), time.Now)
|
|
request := httptest.NewRequest(http.MethodPost, "/v1/creator/sessions", nil)
|
|
request.Header.Set("Authorization", "Bearer recovery")
|
|
response := httptest.NewRecorder()
|
|
handler(response, request)
|
|
if response.Code != http.StatusOK {
|
|
t.Fatalf("bootstrap recovery status = %d", response.Code)
|
|
}
|
|
}
|