unkin-agent
f1bcb8cd3a
repospawner turns JSON new-repo requests into terraform-git pull requests via kubernetes Jobs, follows those PRs to merge and optionally activates the repository in Woodpecker.
72 lines
2.1 KiB
Go
72 lines
2.1 KiB
Go
package auth
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
)
|
|
|
|
func TestPermit(t *testing.T) {
|
|
m := New("X-Forwarded-Groups", []string{"akP-repospawner-user", "akR-platform"})
|
|
|
|
cases := []struct {
|
|
name string
|
|
values []string
|
|
want bool
|
|
}{
|
|
{name: "no header", want: false},
|
|
{name: "unrelated group", values: []string{"akP-mediamark-user"}, want: false},
|
|
{name: "exact group", values: []string{"akP-repospawner-user"}, want: true},
|
|
{name: "comma list", values: []string{"a,akR-platform,b"}, want: true},
|
|
{name: "repeated header", values: []string{"nope", "akR-platform"}, want: true},
|
|
{name: "empty value", values: []string{""}, want: false},
|
|
{name: "prefix only", values: []string{"akP-repospawner"}, want: false},
|
|
}
|
|
for _, tc := range cases {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
r := httptest.NewRequest(http.MethodGet, "/api/requests", nil)
|
|
for _, v := range tc.values {
|
|
r.Header.Add("X-Forwarded-Groups", v)
|
|
}
|
|
if got := m.Permit(r); got != tc.want {
|
|
t.Errorf("Permit = %v, want %v", got, tc.want)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestEmptyAllowListDeniesEverything(t *testing.T) {
|
|
m := New("X-Forwarded-Groups", nil)
|
|
r := httptest.NewRequest(http.MethodGet, "/", nil)
|
|
r.Header.Set("X-Forwarded-Groups", "anything")
|
|
if m.Permit(r) {
|
|
t.Error("an empty allow-list must deny")
|
|
}
|
|
}
|
|
|
|
func TestWrap(t *testing.T) {
|
|
m := New("X-Forwarded-Groups", []string{"ok"})
|
|
var reached bool
|
|
h := m.Wrap(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
|
|
reached = true
|
|
w.WriteHeader(http.StatusNoContent)
|
|
}))
|
|
|
|
denied := httptest.NewRecorder()
|
|
h.ServeHTTP(denied, httptest.NewRequest(http.MethodGet, "/", nil))
|
|
if denied.Code != http.StatusForbidden {
|
|
t.Errorf("status = %d, want 403", denied.Code)
|
|
}
|
|
if reached {
|
|
t.Error("the wrapped handler ran for a denied request")
|
|
}
|
|
|
|
req := httptest.NewRequest(http.MethodGet, "/", nil)
|
|
req.Header.Set("X-Forwarded-Groups", "ok")
|
|
allowed := httptest.NewRecorder()
|
|
h.ServeHTTP(allowed, req)
|
|
if allowed.Code != http.StatusNoContent || !reached {
|
|
t.Errorf("status = %d reached = %v", allowed.Code, reached)
|
|
}
|
|
}
|