feat: complete API-driven projects with infrastructure and business acceptance

examples/userService/internal/middleware/auth_test.go

@@ -0,0 +1,35 @@
+package middleware
+
+import (
+	apierrors "git.yuntuo.hk/k2safe/go-omni/errors"
+	"git.yuntuo.hk/k2safe/go-omni/httpx"
+	"net/http/httptest"
+	"testing"
+)
+
+func TestAuthFailsClosedAndDoesNotLeakKey(t *testing.T) {
+	t.Setenv("USER_SERVICE_API_TOKEN", "")
+	if _, err := NewAuthFromEnv(); err == nil {
+		t.Fatal("missing credential accepted")
+	}
+	token := "test-key-012345678901234567890123456789"
+	t.Setenv("USER_SERVICE_API_TOKEN", token)
+	middleware, err := NewAuthFromEnv()
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, header := range []string{"", "Basic " + token, "Bearer wrong", "Bearer " + token} {
+		called := false
+		r := httptest.NewRequest("GET", "/", nil)
+		r.Header.Set("Authorization", header)
+		c := httpx.NewContext(r, httptest.NewRecorder(), nil)
+		err = middleware(func(*httpx.Context) error { called = true; return nil })(c)
+		if header == "Bearer "+token {
+			if err != nil || !called {
+				t.Fatal("valid token rejected")
+			}
+		} else if err == nil || called || apierrors.From(err).Status != 401 {
+			t.Fatal("unauthenticated request reached service")
+		}
+	}
+}