70 lines
2.2 KiB
Go
70 lines
2.2 KiB
Go
package httpserver
|
|
|
|
import (
|
|
"context"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
|
|
"git.yuntuo.hk/k2safe/orbit/internal/retention"
|
|
core "git.yuntuo.hk/k2safe/orbit/model"
|
|
"git.yuntuo.hk/k2safe/orbit/platform/auth"
|
|
)
|
|
|
|
type fakeArchiveManager struct {
|
|
retention.SchedulerStore
|
|
calls int
|
|
}
|
|
|
|
func (f *fakeArchiveManager) ListArchivePlans(context.Context, auth.Token) ([]retention.ArchivePlan, error) {
|
|
f.calls++
|
|
return []retention.ArchivePlan{}, nil
|
|
}
|
|
func TestArchiveRoutesRequireCookieAndRejectCrossOrigin(t *testing.T) {
|
|
ns, _ := core.NewID()
|
|
cred, _ := core.NewID()
|
|
raw, _, _ := auth.Issue(ns, cred)
|
|
volume, _ := core.NewID()
|
|
authStore := &fakeConsoleAuth{valid: true}
|
|
store := &fakeArchiveManager{}
|
|
server := NewWithConsoleAuth("127.0.0.1:0", nil, authStore)
|
|
RegisterConsoleArchiveJobs(server, authStore, store, volume)
|
|
WrapConsoleAuth(server, authStore)
|
|
tests := []struct {
|
|
name, method, path, origin string
|
|
cookie, bearer bool
|
|
status int
|
|
}{
|
|
{"no session", "GET", "/console/archive/plans", "", false, false, 401},
|
|
{"bearer alone", "GET", "/console/archive/plans", "", false, true, 401},
|
|
{"cookie read", "GET", "/console/archive/plans", "", true, false, 200},
|
|
{"missing key", "PUT", "/console/archive/plans/tasks", "", true, false, 400},
|
|
{"cross origin", "PUT", "/console/archive/plans/tasks", "https://foreign.invalid", true, false, 403},
|
|
{"cross origin retry", "POST", "/console/archive/jobs/11111111111111111111111111111111/actions", "https://foreign.invalid", true, false, 403},
|
|
}
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
r := httptest.NewRequest(tt.method, tt.path, strings.NewReader(`{}`))
|
|
r.Header.Set("Content-Type", "application/json")
|
|
if tt.cookie {
|
|
r.AddCookie(&http.Cookie{Name: consoleSessionCookie, Value: raw})
|
|
}
|
|
if tt.bearer {
|
|
r.Header.Set("Authorization", "Bearer "+raw)
|
|
}
|
|
if tt.origin != "" {
|
|
r.Header.Set("Origin", tt.origin)
|
|
}
|
|
w := httptest.NewRecorder()
|
|
server.Handler.ServeHTTP(w, r)
|
|
if w.Code != tt.status {
|
|
t.Fatalf("status=%d body=%s", w.Code, w.Body.String())
|
|
}
|
|
})
|
|
}
|
|
if store.calls != 1 {
|
|
t.Fatal("unexpected store access", store.calls)
|
|
}
|
|
}
|