mirror of
https://github.com/pomerium/pomerium.git
synced 2025-07-29 06:29:19 +02:00
9471527a35
## Summary Some test improvements: - disable the race detector on macos, which currently results in a ton of linking errors, and I think doing race detection on linux is sufficient to find stuff - add build tags to the `integration` folder so it's not included by default when running `go test ./...` - remove some unused stuff in the Makefile - change the file `testenv` searches for from `.git` to `go.mod` which allows test caching to work more reliably - remove the test for orphaned connections in postgres. It doesn't actually make sense because we have listener connections in the background. I think it was racy. - fix yarn caching ## Checklist - [ ] reference any related issues - [x] updated unit tests - [x] add appropriate label (`enhancement`, `bug`, `breaking`, `dependencies`, `ci`) - [x] ready for review
76 lines
2.3 KiB
Go
76 lines
2.3 KiB
Go
//go:build integration
|
|
|
|
package main
|
|
|
|
import (
|
|
"context"
|
|
"net/http"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
|
|
"github.com/pomerium/pomerium/integration/flows"
|
|
)
|
|
|
|
func TestAuthorization(t *testing.T) {
|
|
ctx, clearTimeout := context.WithTimeout(t.Context(), time.Second*30)
|
|
defer clearTimeout()
|
|
|
|
withBrowserAcceptHeader := flows.WithRequestHeader("Accept",
|
|
"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7")
|
|
|
|
accessType := []string{"direct", "api"}
|
|
for _, at := range accessType {
|
|
t.Run(at, func(t *testing.T) {
|
|
var withAPI flows.AuthenticateOption
|
|
|
|
if at == "api" {
|
|
withAPI = flows.WithAPI()
|
|
}
|
|
|
|
t.Run("public", func(t *testing.T) {
|
|
client := getClient(t, false)
|
|
|
|
req, err := http.NewRequestWithContext(ctx, http.MethodGet, "https://httpdetails.localhost.pomerium.io", nil)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
res, err := client.Do(req)
|
|
if !assert.NoError(t, err, "unexpected http error") {
|
|
return
|
|
}
|
|
defer res.Body.Close()
|
|
|
|
assert.Equal(t, http.StatusOK, res.StatusCode, "unexpected status code, headers=%v", res.Header)
|
|
})
|
|
|
|
t.Run("domains", func(t *testing.T) {
|
|
t.Run("allowed", func(t *testing.T) {
|
|
client := getClient(t, false)
|
|
res, err := flows.Authenticate(ctx, client, mustParseURL("https://httpdetails.localhost.pomerium.io/by-domain"),
|
|
withAPI, flows.WithEmail("user1@dogs.test"), withBrowserAcceptHeader)
|
|
if assert.NoError(t, err) {
|
|
assert.Equal(t, http.StatusOK, res.StatusCode, "expected OK for dogs.test")
|
|
}
|
|
})
|
|
t.Run("not allowed", func(t *testing.T) {
|
|
client := getClient(t, false)
|
|
res, err := flows.Authenticate(ctx, client, mustParseURL("https://httpdetails.localhost.pomerium.io/by-domain"),
|
|
withAPI, flows.WithEmail("user1@cats.test"), withBrowserAcceptHeader)
|
|
if assert.NoError(t, err) {
|
|
assertDeniedAccess(t, res, "expected Forbidden for cats.test, but got: %d", res.StatusCode)
|
|
assert.Contains(t, res.Header.Get("Content-Type"), "text/html")
|
|
}
|
|
})
|
|
})
|
|
})
|
|
}
|
|
}
|
|
|
|
func assertDeniedAccess(t *testing.T, res *http.Response, msgAndArgs ...any) bool {
|
|
return assert.Condition(t, func() bool {
|
|
return res.StatusCode == http.StatusForbidden || res.StatusCode == http.StatusUnauthorized
|
|
}, msgAndArgs...)
|
|
}
|