80 lines
1.8 KiB
Go
80 lines
1.8 KiB
Go
package middleware
|
|
|
|
import (
|
|
"context"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
|
|
"mal/internal/database"
|
|
)
|
|
|
|
func TestAccessPolicy_IsPublicPath(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
policy := NewAccessPolicy()
|
|
|
|
if !policy.IsPublicPath("/") {
|
|
t.Fatal("expected / to be public")
|
|
}
|
|
|
|
if !policy.IsPublicPath("/api/search") {
|
|
t.Fatal("expected /api/search to be public")
|
|
}
|
|
|
|
if !policy.IsPublicPath("/static/app.css") {
|
|
t.Fatal("expected /static/app.css to be public")
|
|
}
|
|
|
|
if policy.IsPublicPath("/watchlist") {
|
|
t.Fatal("expected /watchlist to be private")
|
|
}
|
|
}
|
|
|
|
func TestRequireGlobalAuthWithPolicy_ProtectedPath(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
policy := AccessPolicy{
|
|
PublicPaths: map[string]struct{}{"/public": {}},
|
|
}
|
|
|
|
h := RequireGlobalAuthWithPolicy(policy)(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
w.WriteHeader(http.StatusNoContent)
|
|
}))
|
|
|
|
req := httptest.NewRequest(http.MethodGet, "/private", nil)
|
|
rec := httptest.NewRecorder()
|
|
|
|
h.ServeHTTP(rec, req)
|
|
|
|
if rec.Code != http.StatusFound {
|
|
t.Fatalf("expected redirect status, got %d", rec.Code)
|
|
}
|
|
|
|
if location := rec.Header().Get("Location"); location != "/login" {
|
|
t.Fatalf("expected redirect to /login, got %q", location)
|
|
}
|
|
}
|
|
|
|
func TestRequireGlobalAuthWithPolicy_AllowsAuthenticatedUser(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
policy := AccessPolicy{
|
|
PublicPaths: map[string]struct{}{},
|
|
}
|
|
|
|
h := RequireGlobalAuthWithPolicy(policy)(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
w.WriteHeader(http.StatusNoContent)
|
|
}))
|
|
|
|
req := httptest.NewRequest(http.MethodGet, "/private", nil)
|
|
ctx := context.WithValue(req.Context(), UserContextKey, &database.User{ID: "user-1"})
|
|
rec := httptest.NewRecorder()
|
|
|
|
h.ServeHTTP(rec, req.WithContext(ctx))
|
|
|
|
if rec.Code != http.StatusNoContent {
|
|
t.Fatalf("expected status %d, got %d", http.StatusNoContent, rec.Code)
|
|
}
|
|
}
|