85 lines
2.8 KiB
Go
85 lines
2.8 KiB
Go
package authproxy
|
|
|
|
import (
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
)
|
|
|
|
func validConfig() Config {
|
|
return Config{
|
|
ClientID: "cid",
|
|
ClientSecret: "sec",
|
|
CookieSecret: strings.Repeat("x", 32),
|
|
AuthHost: "auth.example.com",
|
|
AllowedDomains: []string{"signal.org"},
|
|
CookieName: "_google_auth",
|
|
SessionTTL: time.Hour,
|
|
}
|
|
}
|
|
|
|
func TestConfigValidate(t *testing.T) {
|
|
if err := validConfig().validate(); err != nil {
|
|
t.Fatalf("valid config rejected: %v", err)
|
|
}
|
|
|
|
mutations := map[string]func(*Config){
|
|
"missing client id": func(c *Config) { c.ClientID = "" },
|
|
"missing client secret": func(c *Config) { c.ClientSecret = "" },
|
|
"short cookie secret": func(c *Config) { c.CookieSecret = "short" },
|
|
"missing auth host": func(c *Config) { c.AuthHost = "" },
|
|
"auth host with scheme": func(c *Config) { c.AuthHost = "https://auth.example.com" },
|
|
"no allow rules": func(c *Config) { c.AllowedDomains = nil; c.AllowedEmails = nil },
|
|
}
|
|
for name, mutate := range mutations {
|
|
cfg := validConfig()
|
|
mutate(&cfg)
|
|
if err := cfg.validate(); err == nil {
|
|
t.Errorf("%s: expected validation error", name)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestConfigFromEnv(t *testing.T) {
|
|
t.Setenv("GOOGLE_AUTH_CLIENT_ID", "cid")
|
|
t.Setenv("GOOGLE_AUTH_CLIENT_SECRET", "sec")
|
|
t.Setenv("GOOGLE_AUTH_COOKIE_SECRET", strings.Repeat("x", 32))
|
|
t.Setenv("GOOGLE_AUTH_AUTH_HOST", "HTTPS://Auth.Example.com/")
|
|
t.Setenv("GOOGLE_AUTH_ALLOWED_DOMAINS", "Signal.org, @example.com")
|
|
t.Setenv("GOOGLE_AUTH_ALLOWED_EMAILS", "Guest@Partner.com")
|
|
t.Setenv("GOOGLE_AUTH_DENIED_EMAILS", "Former@Signal.org example@example.com")
|
|
t.Setenv("GOOGLE_AUTH_SESSION_TTL", "48h")
|
|
|
|
cfg, err := ConfigFromEnv()
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if cfg.AuthHost != "auth.example.com" {
|
|
t.Errorf("AuthHost = %q", cfg.AuthHost)
|
|
}
|
|
if len(cfg.AllowedDomains) != 2 || cfg.AllowedDomains[0] != "signal.org" || cfg.AllowedDomains[1] != "example.com" {
|
|
t.Errorf("AllowedDomains = %v", cfg.AllowedDomains)
|
|
}
|
|
if len(cfg.AllowedEmails) != 1 || cfg.AllowedEmails[0] != "guest@partner.com" {
|
|
t.Errorf("AllowedEmails = %v", cfg.AllowedEmails)
|
|
}
|
|
if len(cfg.DeniedEmails) != 2 || cfg.DeniedEmails[0] != "former@signal.org" || cfg.DeniedEmails[1] != "example@example.com" {
|
|
t.Errorf("DeniedEmails = %v", cfg.DeniedEmails)
|
|
}
|
|
if cfg.SessionTTL != 48*time.Hour {
|
|
t.Errorf("SessionTTL = %v", cfg.SessionTTL)
|
|
}
|
|
}
|
|
|
|
func TestConfigFromEnvRejectsBadTTL(t *testing.T) {
|
|
t.Setenv("GOOGLE_AUTH_CLIENT_ID", "cid")
|
|
t.Setenv("GOOGLE_AUTH_CLIENT_SECRET", "sec")
|
|
t.Setenv("GOOGLE_AUTH_COOKIE_SECRET", strings.Repeat("x", 32))
|
|
t.Setenv("GOOGLE_AUTH_AUTH_HOST", "auth.example.com")
|
|
t.Setenv("GOOGLE_AUTH_ALLOWED_DOMAINS", "signal.org")
|
|
t.Setenv("GOOGLE_AUTH_SESSION_TTL", "2 fortnights")
|
|
if _, err := ConfigFromEnv(); err == nil {
|
|
t.Fatal("expected error for bad TTL")
|
|
}
|
|
}
|