82 lines
2.7 KiB
Go
82 lines
2.7 KiB
Go
package middleware
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"kra/internal/biz/system"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
)
|
|
|
|
type tokenAuthenticatorStub struct {
|
|
claims *system.AuthClaims
|
|
err error
|
|
got string
|
|
}
|
|
|
|
func (s *tokenAuthenticatorStub) AuthenticateToken(_ context.Context, token string) (*system.TokenAuthentication, error) {
|
|
s.got = token
|
|
if s.err != nil {
|
|
return nil, s.err
|
|
}
|
|
return &system.TokenAuthentication{Claims: s.claims}, nil
|
|
}
|
|
|
|
func TestAuthenticateWebSocketAcceptsQueryToken(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
stub := &tokenAuthenticatorStub{claims: &system.AuthClaims{ID: 7}}
|
|
recorder := httptest.NewRecorder()
|
|
context, _ := gin.CreateTestContext(recorder)
|
|
context.Request = httptest.NewRequest(http.MethodGet, "/ws?token=query-token", nil)
|
|
|
|
if !AuthenticateWebSocket(context, stub) {
|
|
t.Fatalf("AuthenticateWebSocket() = false, body=%s", recorder.Body.String())
|
|
}
|
|
if stub.got != "query-token" {
|
|
t.Fatalf("authenticated token = %q, want query-token", stub.got)
|
|
}
|
|
if Claims(context) == nil || Claims(context).ID != 7 {
|
|
t.Fatalf("claims were not stored: %#v", Claims(context))
|
|
}
|
|
}
|
|
|
|
func TestHTTPAuthDoesNotAcceptQueryToken(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
stub := &tokenAuthenticatorStub{claims: &system.AuthClaims{ID: 7}}
|
|
engine := gin.New()
|
|
called := false
|
|
engine.GET("/protected", Auth(stub), func(c *gin.Context) { called = true })
|
|
|
|
response := httptest.NewRecorder()
|
|
engine.ServeHTTP(response, httptest.NewRequest(http.MethodGet, "/protected?token=query-token", nil))
|
|
if response.Code != http.StatusUnauthorized || called {
|
|
t.Fatalf("status=%d called=%v body=%s", response.Code, called, response.Body.String())
|
|
}
|
|
}
|
|
|
|
func TestAuthenticateWebSocketSupportsBearerHeaderAndReportsInvalidToken(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
stub := &tokenAuthenticatorStub{claims: &system.AuthClaims{ID: 7}}
|
|
context, _ := gin.CreateTestContext(httptest.NewRecorder())
|
|
context.Request = httptest.NewRequest(http.MethodGet, "/ws", nil)
|
|
context.Request.Header.Set("Authorization", "Bearer header-token")
|
|
|
|
if !AuthenticateWebSocket(context, stub) || stub.got != "header-token" {
|
|
t.Fatalf("Bearer token was not accepted: ok=%v token=%q", Claims(context) != nil, stub.got)
|
|
}
|
|
|
|
invalid := &tokenAuthenticatorStub{err: errors.New("invalid token")}
|
|
invalidRecorder := httptest.NewRecorder()
|
|
invalidContext, _ := gin.CreateTestContext(invalidRecorder)
|
|
invalidContext.Request = httptest.NewRequest(http.MethodGet, "/ws?token=bad-token", nil)
|
|
if AuthenticateWebSocket(invalidContext, invalid) {
|
|
t.Fatal("invalid token was accepted")
|
|
}
|
|
if invalidRecorder.Code != http.StatusUnauthorized {
|
|
t.Fatalf("invalid token status=%d, want %d", invalidRecorder.Code, http.StatusUnauthorized)
|
|
}
|
|
}
|