66 lines
2.1 KiB
Go
66 lines
2.1 KiB
Go
package httpsecurity
|
|
|
|
import (
|
|
"errors"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
|
|
"proxy-pool/internal/config"
|
|
"proxy-pool/internal/domain/authorization"
|
|
)
|
|
|
|
func TestNewFromListenerMapsResolvedConfiguration(t *testing.T) {
|
|
t.Parallel()
|
|
listener := config.Listener{
|
|
Access: config.Access{
|
|
AllowCIDRs: []string{"198.51.100.0/24"},
|
|
TrustedProxies: []string{"10.0.0.0/8"},
|
|
},
|
|
Auth: config.Auth{Mode: ModeAny, Methods: []config.AuthMethod{
|
|
{Mode: ModeBearer, Value: "bearer-secret", Permissions: []string{authorization.AdminRead}},
|
|
{Mode: ModeAPIKey, Header: "X-API-Key", Value: "api-secret", Permissions: []string{authorization.AdminWrite}},
|
|
}},
|
|
}
|
|
protection, err := NewFromListener(listener, ClientAuthenticated, APIAuthSemantics, nil)
|
|
if err != nil {
|
|
t.Fatalf("NewFromListener() error = %v", err)
|
|
}
|
|
request := newRequest()
|
|
request.Header.Set("Authorization", "Bearer bearer-secret")
|
|
|
|
identity, err := protection.Resolve(request)
|
|
if err != nil {
|
|
t.Fatalf("Resolve() error = %v", err)
|
|
}
|
|
if identity.ClientID != credentialSubject("bearer", "bearer-secret") {
|
|
t.Fatalf("identity = %+v", identity)
|
|
}
|
|
if !identity.Allows(authorization.AdminRead) || identity.Allows(authorization.AdminWrite) {
|
|
t.Fatalf("identity permissions = %v", identity.Permissions)
|
|
}
|
|
if _, err := protection.Resolve(httptest.NewRequest(http.MethodGet, "/", nil)); err == nil {
|
|
t.Fatal("Resolve(request without remote address) error = nil")
|
|
}
|
|
}
|
|
|
|
func TestBuildFromListenerAppliesConfiguredAdmissionLimits(t *testing.T) {
|
|
t.Parallel()
|
|
listener := config.Listener{
|
|
Auth: config.Auth{Mode: ModeNone},
|
|
Limits: config.Limits{RequestsPerMinute: 1, RequestsPerMinutePerClient: 1},
|
|
}
|
|
protection, err := BuildFromListener(listener, ClientSourceIP, APIAuthSemantics)
|
|
if err != nil {
|
|
t.Fatalf("BuildFromListener() error = %v", err)
|
|
}
|
|
if _, err := protection.Resolve(newRequest()); err != nil {
|
|
t.Fatalf("Resolve(first) error = %v", err)
|
|
}
|
|
_, err = protection.Resolve(newRequest())
|
|
var httpError *HTTPError
|
|
if !errors.As(err, &httpError) || httpError.StatusCode != http.StatusTooManyRequests {
|
|
t.Fatalf("Resolve(second) error = %T %v", err, err)
|
|
}
|
|
}
|