Initial commit.

internal/authproxy/config_test.go

@@ -0,0 +1,80 @@
+package authproxy
+
+import (
+	"strings"
+	"testing"
+	"time"
+)
+
+func validConfig() Config {
+	return Config{
+		ClientID:       "cid",
+		ClientSecret:   "sec",
+		CookieSecret:   strings.Repeat("x", 32),
+		AuthHost:       "auth.example.com",
+		AllowedDomains: []string{"signal.org"},
+		CookieName:     "_google_auth",
+		SessionTTL:     time.Hour,
+	}
+}
+
+func TestConfigValidate(t *testing.T) {
+	if err := validConfig().validate(); err != nil {
+		t.Fatalf("valid config rejected: %v", err)
+	}
+
+	mutations := map[string]func(*Config){
+		"missing client id":     func(c *Config) { c.ClientID = "" },
+		"missing client secret": func(c *Config) { c.ClientSecret = "" },
+		"short cookie secret":   func(c *Config) { c.CookieSecret = "short" },
+		"missing auth host":     func(c *Config) { c.AuthHost = "" },
+		"auth host with scheme": func(c *Config) { c.AuthHost = "https://auth.example.com" },
+		"no allow rules":        func(c *Config) { c.AllowedDomains = nil; c.AllowedEmails = nil },
+	}
+	for name, mutate := range mutations {
+		cfg := validConfig()
+		mutate(&cfg)
+		if err := cfg.validate(); err == nil {
+			t.Errorf("%s: expected validation error", name)
+		}
+	}
+}
+
+func TestConfigFromEnv(t *testing.T) {
+	t.Setenv("GOOGLE_AUTH_CLIENT_ID", "cid")
+	t.Setenv("GOOGLE_AUTH_CLIENT_SECRET", "sec")
+	t.Setenv("GOOGLE_AUTH_COOKIE_SECRET", strings.Repeat("x", 32))
+	t.Setenv("GOOGLE_AUTH_AUTH_HOST", "HTTPS://Auth.Example.com/")
+	t.Setenv("GOOGLE_AUTH_ALLOWED_DOMAINS", "Signal.org, @example.com")
+	t.Setenv("GOOGLE_AUTH_ALLOWED_EMAILS", "Guest@Partner.com")
+	t.Setenv("GOOGLE_AUTH_SESSION_TTL", "48h")
+
+	cfg, err := ConfigFromEnv()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if cfg.AuthHost != "auth.example.com" {
+		t.Errorf("AuthHost = %q", cfg.AuthHost)
+	}
+	if len(cfg.AllowedDomains) != 2 || cfg.AllowedDomains[0] != "signal.org" || cfg.AllowedDomains[1] != "example.com" {
+		t.Errorf("AllowedDomains = %v", cfg.AllowedDomains)
+	}
+	if len(cfg.AllowedEmails) != 1 || cfg.AllowedEmails[0] != "guest@partner.com" {
+		t.Errorf("AllowedEmails = %v", cfg.AllowedEmails)
+	}
+	if cfg.SessionTTL != 48*time.Hour {
+		t.Errorf("SessionTTL = %v", cfg.SessionTTL)
+	}
+}
+
+func TestConfigFromEnvRejectsBadTTL(t *testing.T) {
+	t.Setenv("GOOGLE_AUTH_CLIENT_ID", "cid")
+	t.Setenv("GOOGLE_AUTH_CLIENT_SECRET", "sec")
+	t.Setenv("GOOGLE_AUTH_COOKIE_SECRET", strings.Repeat("x", 32))
+	t.Setenv("GOOGLE_AUTH_AUTH_HOST", "auth.example.com")
+	t.Setenv("GOOGLE_AUTH_ALLOWED_DOMAINS", "signal.org")
+	t.Setenv("GOOGLE_AUTH_SESSION_TTL", "2 fortnights")
+	if _, err := ConfigFromEnv(); err == nil {
+		t.Fatal("expected error for bad TTL")
+	}
+}