71 lines
2.4 KiB
Go
71 lines
2.4 KiB
Go
package main
|
|
|
|
import (
|
|
"io"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestGatewayForwardsOnlyCreatorAllowlist(t *testing.T) {
|
|
upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
if r.URL.Path != "/v1/creator/tasks/task-1" || r.URL.RawQuery != "session_id=session-1&workspace_id=workspace-1" {
|
|
t.Fatalf("unexpected upstream target %s?%s", r.URL.Path, r.URL.RawQuery)
|
|
}
|
|
if r.Header.Get("Authorization") != "Bearer bounded-session" {
|
|
t.Fatal("authorization header was not forwarded")
|
|
}
|
|
w.Header().Set("Content-Type", "application/json")
|
|
_, _ = io.WriteString(w, `{"TaskID":"task-1"}`)
|
|
}))
|
|
defer upstream.Close()
|
|
handler, err := newHandler(upstream.URL, upstream.Client())
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
request := httptest.NewRequest(http.MethodGet, "/api/tasks/task-1?session_id=session-1&workspace_id=workspace-1", nil)
|
|
request.Header.Set("Authorization", "Bearer bounded-session")
|
|
response := httptest.NewRecorder()
|
|
handler.ServeHTTP(response, request)
|
|
if response.Code != http.StatusOK || !strings.Contains(response.Body.String(), "task-1") {
|
|
t.Fatalf("response = %d %s", response.Code, response.Body.String())
|
|
}
|
|
}
|
|
|
|
func TestGatewayDeniesInternalAndMutationRoutes(t *testing.T) {
|
|
handler, err := newHandler("http://core-runtime:8080", http.DefaultClient)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
for _, test := range []struct{ method, path string }{
|
|
{http.MethodPost, "/api/tasks/task-1"},
|
|
{http.MethodGet, "/api/principal-bindings/actor/principal"},
|
|
{http.MethodPost, "/api/focus-task-commits"},
|
|
{http.MethodGet, "/api/tasks/../../healthz"},
|
|
} {
|
|
request := httptest.NewRequest(test.method, test.path, nil)
|
|
response := httptest.NewRecorder()
|
|
handler.ServeHTTP(response, request)
|
|
if response.Code != http.StatusNotFound {
|
|
t.Fatalf("%s %s returned %d", test.method, test.path, response.Code)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestConsoleAndSecurityHeaders(t *testing.T) {
|
|
handler, err := newHandler("http://core-runtime:8080", http.DefaultClient)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
request := httptest.NewRequest(http.MethodGet, "/", nil)
|
|
response := httptest.NewRecorder()
|
|
handler.ServeHTTP(response, request)
|
|
if response.Code != http.StatusOK || !strings.Contains(response.Body.String(), "Домовой") {
|
|
t.Fatalf("console response = %d", response.Code)
|
|
}
|
|
if response.Header().Get("Content-Security-Policy") == "" {
|
|
t.Fatal("content security policy is missing")
|
|
}
|
|
}
|