mirror of
https://github.com/pomerium/pomerium.git
synced 2025-04-30 19:06:33 +02:00
8d1732582e
authenticate: unmarshal and verify state from jwt, instead of middleware
authorize: embed opa policy using statik
authorize: have IsAuthorized handle authorization for all routes
authorize: if no signing key is provided, one is generated
authorize: remove IsAdmin grpc endpoint
authorize/client: return authorize decision struct
cmd/pomerium: main logger no longer contains email and group
cryptutil: add ECDSA signing methods
dashboard: have impersonate form show up for all users, but have api gated by authz
docs: fix typo in signed jwt header
encoding/jws: remove unused es256 signer
frontend: namespace static web assets
internal/sessions: remove leeway to match authz policy
proxy: move signing functionality to authz
proxy: remove jwt attestation from proxy (authZ does now)
proxy: remove non-signed headers from headers
proxy: remove special handling of x-forwarded-host
sessions: do not verify state in middleware
sessions: remove leeway from state to match authz
sessions/{all}: store jwt directly instead of state
Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
103 lines
2.7 KiB
Go
103 lines
2.7 KiB
Go
package sessions_test
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"fmt"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/google/go-cmp/cmp"
|
|
"gopkg.in/square/go-jose.v2/jwt"
|
|
|
|
"github.com/pomerium/pomerium/internal/cryptutil"
|
|
"github.com/pomerium/pomerium/internal/encoding/jws"
|
|
"github.com/pomerium/pomerium/internal/sessions"
|
|
"github.com/pomerium/pomerium/internal/sessions/mock"
|
|
)
|
|
|
|
func TestNewContext(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
ctx context.Context
|
|
t *sessions.State
|
|
err error
|
|
want context.Context
|
|
}{
|
|
{"simple", context.Background(), &sessions.State{Email: "bdd@pomerium.io"}, nil, nil},
|
|
}
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
signer, err := jws.NewHS256Signer(cryptutil.NewKey(), "issuer")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
jwt, err := signer.Marshal(tt.t)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
ctxOut := sessions.NewContext(tt.ctx, string(jwt), tt.err)
|
|
out, errOut := sessions.FromContext(ctxOut)
|
|
var stateOut sessions.State
|
|
err = signer.Unmarshal([]byte(out), &stateOut)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if diff := cmp.Diff(tt.t.Email, stateOut.Email); diff != "" {
|
|
t.Errorf("NewContext() = %s", diff)
|
|
}
|
|
if diff := cmp.Diff(tt.err, errOut); diff != "" {
|
|
t.Errorf("NewContext() = %s", diff)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func testAuthorizer(next http.Handler) http.Handler {
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
_, err := sessions.FromContext(r.Context())
|
|
if err != nil {
|
|
http.Error(w, err.Error(), http.StatusUnauthorized)
|
|
return
|
|
}
|
|
next.ServeHTTP(w, r)
|
|
})
|
|
}
|
|
|
|
func TestVerifier(t *testing.T) {
|
|
fnh := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
w.Header().Set("Content-Type", "text/plain; charset=utf-8")
|
|
fmt.Fprint(w, http.StatusText(http.StatusOK))
|
|
w.WriteHeader(http.StatusOK)
|
|
})
|
|
|
|
tests := []struct {
|
|
name string
|
|
store mock.Store
|
|
state sessions.State
|
|
wantStatus int
|
|
}{
|
|
{"empty session", mock.Store{LoadError: sessions.ErrNoSessionFound}, sessions.State{}, 401},
|
|
{"simple good load", mock.Store{Session: &sessions.State{Subject: "hi", Expiry: jwt.NewNumericDate(time.Now().Add(time.Second))}}, sessions.State{}, 200},
|
|
{"session error", mock.Store{LoadError: errors.New("err")}, sessions.State{}, 401},
|
|
}
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
|
|
r := httptest.NewRequest(http.MethodGet, "/", nil)
|
|
r.Header.Set("Accept", "application/json")
|
|
w := httptest.NewRecorder()
|
|
|
|
got := sessions.RetrieveSession(tt.store)(testAuthorizer((fnh)))
|
|
got.ServeHTTP(w, r)
|
|
|
|
gotStatus := w.Result().StatusCode
|
|
|
|
if diff := cmp.Diff(gotStatus, tt.wantStatus); diff != "" {
|
|
t.Errorf("RetrieveSession() = %v", diff)
|
|
}
|
|
})
|
|
}
|
|
}
|