mirror of
https://github.com/pomerium/pomerium.git
synced 2025-05-02 11:56:02 +02:00
c13459bb88
* authorize: authorization module adds support for per-route access policy. In this release we support the most common forms of identity based access policy: `allowed_users`, `allowed_groups`, and `allowed_domains`. In future versions, the authorization module will also support context and device based authorization policy and decisions. See website documentation for more details. * docs: updated `env.example` to include a `POLICY` setting example. * docs: added `IDP_SERVICE_ACCOUNT` to `env.example` . * docs: removed `PROXY_ROOT_DOMAIN` settings which has been replaced by `POLICY`. * all: removed `ALLOWED_DOMAINS` settings which has been replaced by `POLICY`. Authorization is now handled by the authorization service and is defined in the policy configuration files. * proxy: `ROUTES` settings which has been replaced by `POLICY`. * internal/log: `http.Server` and `httputil.NewSingleHostReverseProxy` now uses pomerium's logging package instead of the standard library's built in one. Closes #54 Closes #41 Closes #61 Closes #58
44 lines
984 B
Go
44 lines
984 B
Go
package cryptutil
|
|
|
|
import (
|
|
"testing"
|
|
)
|
|
|
|
func TestES256Signer(t *testing.T) {
|
|
signer, err := NewES256Signer([]byte(pemECPrivateKeyP256), "destination-url")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if signer == nil {
|
|
t.Fatal("signer should not be nil")
|
|
}
|
|
rawJwt, err := signer.SignJWT("joe-user", "joe-user@example.com", "group1,group2")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if rawJwt == "" {
|
|
t.Fatal("jwt should not be nil")
|
|
}
|
|
}
|
|
|
|
func TestNewES256Signer(t *testing.T) {
|
|
t.Parallel()
|
|
tests := []struct {
|
|
name string
|
|
privKey []byte
|
|
audience string
|
|
wantErr bool
|
|
}{
|
|
{"working example", []byte(pemECPrivateKeyP256), "some-domain.com", false},
|
|
{"bad private key", []byte(garbagePEM), "some-domain.com", true},
|
|
}
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
_, err := NewES256Signer(tt.privKey, tt.audience)
|
|
if (err != nil) != tt.wantErr {
|
|
t.Errorf("NewES256Signer() error = %v, wantErr %v", err, tt.wantErr)
|
|
return
|
|
}
|
|
})
|
|
}
|
|
}
|