112 lines
3.6 KiB
Go
112 lines
3.6 KiB
Go
package clientpolicy
|
|
|
|
import (
|
|
"errors"
|
|
"slices"
|
|
"testing"
|
|
)
|
|
|
|
func TestValidate(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
tests := []struct {
|
|
name string
|
|
policy Policy
|
|
wantErr bool
|
|
}{
|
|
{name: "empty policy", policy: Policy{}},
|
|
{name: "bounded policy", policy: Policy{
|
|
MaxExtractCount: 10,
|
|
RequestsPerMinute: 600,
|
|
AllowedUpstreams: []string{"provider-a", "provider-b"},
|
|
AllowedRegions: []string{"shanghai", "beijing"},
|
|
AllowedRoutings: []string{"checkout", "catalog"},
|
|
}},
|
|
{name: "negative max count", policy: Policy{MaxExtractCount: -1}, wantErr: true},
|
|
{name: "negative request rate", policy: Policy{RequestsPerMinute: -1}, wantErr: true},
|
|
{name: "empty upstream", policy: Policy{AllowedUpstreams: []string{""}}, wantErr: true},
|
|
{name: "whitespace upstream", policy: Policy{AllowedUpstreams: []string{" provider-a"}}, wantErr: true},
|
|
{name: "duplicate upstream", policy: Policy{AllowedUpstreams: []string{"provider-a", "provider-a"}}, wantErr: true},
|
|
{name: "empty region", policy: Policy{AllowedRegions: []string{""}}, wantErr: true},
|
|
{name: "duplicate region", policy: Policy{AllowedRegions: []string{"shanghai", "shanghai"}}, wantErr: true},
|
|
{name: "duplicate routing", policy: Policy{AllowedRoutings: []string{"checkout", "checkout"}}, wantErr: true},
|
|
}
|
|
|
|
for _, test := range tests {
|
|
test := test
|
|
t.Run(test.name, func(t *testing.T) {
|
|
t.Parallel()
|
|
err := test.policy.Validate()
|
|
if test.wantErr && !errors.Is(err, ErrInvalidPolicy) {
|
|
t.Fatalf("Validate() error = %v, want ErrInvalidPolicy", err)
|
|
}
|
|
if !test.wantErr && err != nil {
|
|
t.Fatalf("Validate() error = %v", err)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestPolicyRestrictsExtractInputs(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
policy := Policy{
|
|
MaxExtractCount: 5,
|
|
AllowedUpstreams: []string{"provider-a", "provider-b"},
|
|
AllowedRegions: []string{"shanghai"},
|
|
}
|
|
if !policy.AllowsExtractCount(5) || policy.AllowsExtractCount(6) {
|
|
t.Fatal("max extract count restriction was not applied")
|
|
}
|
|
|
|
upstreams, ok := policy.RestrictUpstreams(nil)
|
|
if !ok || !slices.Equal(upstreams, []string{"provider-a", "provider-b"}) {
|
|
t.Fatalf("RestrictUpstreams(nil) = (%v, %v)", upstreams, ok)
|
|
}
|
|
upstreams, ok = policy.RestrictUpstreams([]string{"provider-b"})
|
|
if !ok || !slices.Equal(upstreams, []string{"provider-b"}) {
|
|
t.Fatalf("RestrictUpstreams(subset) = (%v, %v)", upstreams, ok)
|
|
}
|
|
if _, ok = policy.RestrictUpstreams([]string{"provider-c"}); ok {
|
|
t.Fatal("RestrictUpstreams() allowed an unauthorized upstream")
|
|
}
|
|
|
|
regions, ok := policy.RestrictRegions(nil)
|
|
if !ok || !slices.Equal(regions, []string{"shanghai"}) {
|
|
t.Fatalf("RestrictRegions(nil) = (%v, %v)", regions, ok)
|
|
}
|
|
if _, ok = policy.RestrictRegions([]string{"beijing"}); ok {
|
|
t.Fatal("RestrictRegions() allowed an unauthorized region")
|
|
}
|
|
}
|
|
|
|
func TestPolicyWithoutRestrictionsPreservesRequestAndClones(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
policy := Policy{}
|
|
requested := []string{"provider-a"}
|
|
effective, ok := policy.RestrictUpstreams(requested)
|
|
if !ok || !slices.Equal(effective, requested) {
|
|
t.Fatalf("RestrictUpstreams() = (%v, %v)", effective, ok)
|
|
}
|
|
effective[0] = "changed"
|
|
if requested[0] != "provider-a" {
|
|
t.Fatal("RestrictUpstreams() aliases caller input")
|
|
}
|
|
}
|
|
|
|
func TestPolicyRestrictsGatewayRoutings(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
policy := Policy{AllowedRoutings: []string{"checkout"}}
|
|
if !policy.AllowsRouting("checkout") {
|
|
t.Fatal("AllowsRouting() rejected the configured routing")
|
|
}
|
|
if policy.AllowsRouting("catalog") {
|
|
t.Fatal("AllowsRouting() accepted a routing outside the credential policy")
|
|
}
|
|
if !(Policy{}).AllowsRouting("catalog") {
|
|
t.Fatal("empty policy must preserve legacy gateway access")
|
|
}
|
|
}
|