164 lines
8.0 KiB
Go
164 lines
8.0 KiB
Go
package app
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
|
|
"lingniu/vehicle-data-platform/apps/api/internal/config"
|
|
"lingniu/vehicle-data-platform/apps/api/internal/platform"
|
|
)
|
|
|
|
const (
|
|
viewerToken = "viewer-token-at-least-16"
|
|
operatorToken = "operator-token-at-least-16"
|
|
adminToken = "admin-token-at-least-16"
|
|
)
|
|
|
|
func testAuthConfig() config.Config {
|
|
return config.Config{
|
|
AuthMode: "enforce",
|
|
AuthTokensJSON: `[
|
|
{"token":"` + viewerToken + `","name":"viewer-a","role":"viewer"},
|
|
{"token":"` + operatorToken + `","name":"operator-a","role":"operator"},
|
|
{"token":"` + adminToken + `","name":"admin-a","role":"admin"}
|
|
]`,
|
|
}
|
|
}
|
|
|
|
func authRequest(t *testing.T, cfg config.Config, method, path, token string) *httptest.ResponseRecorder {
|
|
t.Helper()
|
|
next := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
principal, ok := platform.PrincipalFromContext(r.Context())
|
|
if !ok {
|
|
t.Fatal("authenticated request reached handler without principal")
|
|
}
|
|
w.Header().Set("X-Principal", principal.Name+":"+principal.Role)
|
|
w.WriteHeader(http.StatusNoContent)
|
|
})
|
|
req := httptest.NewRequest(method, path, nil)
|
|
if token != "" {
|
|
req.Header.Set("Authorization", "Bearer "+token)
|
|
}
|
|
rec := httptest.NewRecorder()
|
|
withAPIAuth(next, cfg).ServeHTTP(rec, req)
|
|
return rec
|
|
}
|
|
|
|
func TestAPIAuthEnforcesTokensAndRoleBoundaries(t *testing.T) {
|
|
cfg := testAuthConfig()
|
|
|
|
missing := authRequest(t, cfg, http.MethodGet, "/api/v2/alerts/rules", "")
|
|
if missing.Code != http.StatusUnauthorized || !strings.HasPrefix(missing.Header().Get("WWW-Authenticate"), "Bearer") {
|
|
t.Fatalf("missing token status=%d headers=%v body=%s", missing.Code, missing.Header(), missing.Body.String())
|
|
}
|
|
invalid := authRequest(t, cfg, http.MethodGet, "/api/v2/alerts/rules", "wrong-token-at-least-16")
|
|
if invalid.Code != http.StatusUnauthorized {
|
|
t.Fatalf("invalid token status=%d body=%s", invalid.Code, invalid.Body.String())
|
|
}
|
|
|
|
viewerQuery := authRequest(t, cfg, http.MethodPost, "/api/v2/alerts/events", viewerToken)
|
|
if viewerQuery.Code != http.StatusNoContent || viewerQuery.Header().Get("X-Principal") != "viewer-a:viewer" {
|
|
t.Fatalf("viewer query status=%d principal=%s", viewerQuery.Code, viewerQuery.Header().Get("X-Principal"))
|
|
}
|
|
viewerAction := authRequest(t, cfg, http.MethodPost, "/api/v2/alerts/events/a/actions", viewerToken)
|
|
if viewerAction.Code != http.StatusForbidden {
|
|
t.Fatalf("viewer mutation should be forbidden, status=%d", viewerAction.Code)
|
|
}
|
|
viewerExports := authRequest(t, cfg, http.MethodGet, "/api/v2/exports", viewerToken)
|
|
if viewerExports.Code != http.StatusNoContent {
|
|
t.Fatalf("viewer export listing should reach owner/scope enforcement, status=%d", viewerExports.Code)
|
|
}
|
|
viewerExportCreate := authRequest(t, cfg, http.MethodPost, "/api/v2/exports", viewerToken)
|
|
if viewerExportCreate.Code != http.StatusNoContent {
|
|
t.Fatalf("viewer export creation should reach owner/scope enforcement, status=%d", viewerExportCreate.Code)
|
|
}
|
|
operatorExports := authRequest(t, cfg, http.MethodGet, "/api/v2/exports/exp_1/download", operatorToken)
|
|
if operatorExports.Code != http.StatusNoContent {
|
|
t.Fatalf("operator export download status=%d", operatorExports.Code)
|
|
}
|
|
operatorAction := authRequest(t, cfg, http.MethodPost, "/api/v2/alerts/events/a/actions", operatorToken)
|
|
if operatorAction.Code != http.StatusNoContent {
|
|
t.Fatalf("operator action status=%d body=%s", operatorAction.Code, operatorAction.Body.String())
|
|
}
|
|
operatorRule := authRequest(t, cfg, http.MethodPost, "/api/v2/alerts/rules", operatorToken)
|
|
if operatorRule.Code != http.StatusForbidden {
|
|
t.Fatalf("operator rule mutation should be forbidden, status=%d", operatorRule.Code)
|
|
}
|
|
operatorProfile := authRequest(t, cfg, http.MethodPut, "/api/v2/vehicles/VIN001/profile", operatorToken)
|
|
if operatorProfile.Code != http.StatusForbidden {
|
|
t.Fatalf("operator profile mutation should be forbidden, status=%d", operatorProfile.Code)
|
|
}
|
|
operatorProfileSync := authRequest(t, cfg, http.MethodPost, "/api/v2/vehicle-profiles/sync", operatorToken)
|
|
if operatorProfileSync.Code != http.StatusForbidden {
|
|
t.Fatalf("operator profile sync should be forbidden, status=%d", operatorProfileSync.Code)
|
|
}
|
|
viewerSourceDiagnostic := authRequest(t, cfg, http.MethodGet, "/api/v2/operations/vehicles/VIN001/sources", viewerToken)
|
|
if viewerSourceDiagnostic.Code != http.StatusForbidden {
|
|
t.Fatalf("viewer source diagnostic should be forbidden, status=%d", viewerSourceDiagnostic.Code)
|
|
}
|
|
operatorSourceDiagnostic := authRequest(t, cfg, http.MethodGet, "/api/v2/operations/vehicles/VIN001/sources", operatorToken)
|
|
if operatorSourceDiagnostic.Code != http.StatusNoContent {
|
|
t.Fatalf("operator source diagnostic status=%d", operatorSourceDiagnostic.Code)
|
|
}
|
|
operatorSourcePolicy := authRequest(t, cfg, http.MethodPut, "/api/v2/operations/vehicles/VIN001/sources/ref", operatorToken)
|
|
if operatorSourcePolicy.Code != http.StatusForbidden {
|
|
t.Fatalf("operator source policy mutation should be forbidden, status=%d", operatorSourcePolicy.Code)
|
|
}
|
|
viewerReconciliation := authRequest(t, cfg, http.MethodGet, "/api/v2/reconciliation/summary", viewerToken)
|
|
if viewerReconciliation.Code != http.StatusForbidden {
|
|
t.Fatalf("viewer reconciliation summary should be forbidden, status=%d", viewerReconciliation.Code)
|
|
}
|
|
operatorReconciliation := authRequest(t, cfg, http.MethodPost, "/api/v2/reconciliation/issues/reconciliation-1/actions", operatorToken)
|
|
if operatorReconciliation.Code != http.StatusNoContent {
|
|
t.Fatalf("operator reconciliation action status=%d body=%s", operatorReconciliation.Code, operatorReconciliation.Body.String())
|
|
}
|
|
adminProfile := authRequest(t, cfg, http.MethodPut, "/api/v2/vehicles/VIN001/profile", adminToken)
|
|
if adminProfile.Code != http.StatusNoContent || adminProfile.Header().Get("X-Principal") != "admin-a:admin" {
|
|
t.Fatalf("admin profile mutation status=%d principal=%s", adminProfile.Code, adminProfile.Header().Get("X-Principal"))
|
|
}
|
|
adminProfileSync := authRequest(t, cfg, http.MethodPost, "/api/v2/vehicle-profiles/sync", adminToken)
|
|
if adminProfileSync.Code != http.StatusNoContent || adminProfileSync.Header().Get("X-Principal") != "admin-a:admin" {
|
|
t.Fatalf("admin profile sync status=%d principal=%s", adminProfileSync.Code, adminProfileSync.Header().Get("X-Principal"))
|
|
}
|
|
adminThreshold := authRequest(t, cfg, http.MethodPut, "/api/v2/access/thresholds", adminToken)
|
|
if adminThreshold.Code != http.StatusNoContent {
|
|
t.Fatalf("admin threshold status=%d body=%s", adminThreshold.Code, adminThreshold.Body.String())
|
|
}
|
|
adminSourcePolicy := authRequest(t, cfg, http.MethodPut, "/api/v2/operations/vehicles/VIN001/sources/ref", adminToken)
|
|
if adminSourcePolicy.Code != http.StatusNoContent {
|
|
t.Fatalf("admin source policy status=%d body=%s", adminSourcePolicy.Code, adminSourcePolicy.Body.String())
|
|
}
|
|
}
|
|
|
|
func TestAPIAuthSessionAndDisabledMode(t *testing.T) {
|
|
rec := authRequest(t, config.Config{AuthMode: "disabled"}, http.MethodGet, "/api/v2/alerts/rules", "")
|
|
if rec.Code != http.StatusNoContent || rec.Header().Get("X-Principal") != "local-developer:admin" {
|
|
t.Fatalf("disabled mode status=%d principal=%s", rec.Code, rec.Header().Get("X-Principal"))
|
|
}
|
|
|
|
req := httptest.NewRequest(http.MethodGet, "/api/v2/session", nil)
|
|
req.Header.Set("Authorization", "Bearer "+operatorToken)
|
|
session := httptest.NewRecorder()
|
|
withAPIAuth(http.NotFoundHandler(), testAuthConfig()).ServeHTTP(session, req)
|
|
if session.Code != http.StatusOK || !strings.Contains(session.Body.String(), `"name":"operator-a"`) || !strings.Contains(session.Body.String(), `"role":"operator"`) {
|
|
t.Fatalf("session status=%d body=%s", session.Code, session.Body.String())
|
|
}
|
|
}
|
|
|
|
func TestAPIAuthMisconfigurationFailsClosed(t *testing.T) {
|
|
cases := []config.Config{
|
|
{AuthMode: "enforce"},
|
|
{AuthMode: "unknown"},
|
|
{AuthMode: "enforce", AuthTokensJSON: `not-json`},
|
|
{AuthMode: "enforce", AuthToken: "short"},
|
|
}
|
|
for _, cfg := range cases {
|
|
rec := authRequest(t, cfg, http.MethodGet, "/api/v2/alerts/rules", "")
|
|
if rec.Code != http.StatusServiceUnavailable {
|
|
t.Fatalf("misconfigured auth should fail closed: cfg=%+v status=%d", cfg, rec.Code)
|
|
}
|
|
}
|
|
}
|