@@ -0,0 +1,217 @@
|
||||
package api
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"mime/multipart"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"net/url"
|
||||
"strconv"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
"gorm.io/gorm"
|
||||
|
||||
"oci-portal/internal/crypto"
|
||||
"oci-portal/internal/model"
|
||||
"oci-portal/internal/oci"
|
||||
"oci-portal/internal/service"
|
||||
)
|
||||
|
||||
func newIconTestRouter(t *testing.T) (*gin.Engine, string, uint, *service.SystemLogService) {
|
||||
t.Helper()
|
||||
router, auth, logs, db := newTestRouterDB(t)
|
||||
id := seedIconConfig(t, db)
|
||||
token, _, err := auth.Login(context.Background(), "admin", "pass123", "127.0.0.1", "")
|
||||
if err != nil {
|
||||
t.Fatalf("login: %v", err)
|
||||
}
|
||||
return router, token, id, logs
|
||||
}
|
||||
|
||||
func seedIconConfig(t *testing.T, db *gorm.DB) uint {
|
||||
t.Helper()
|
||||
cipher, err := crypto.NewCipher("test-key")
|
||||
if err != nil {
|
||||
t.Fatalf("new cipher: %v", err)
|
||||
}
|
||||
key, err := cipher.EncryptString("-----BEGIN PRIVATE KEY-----\nfake\n-----END PRIVATE KEY-----")
|
||||
if err != nil {
|
||||
t.Fatalf("encrypt key: %v", err)
|
||||
}
|
||||
cfg := model.OciConfig{Alias: "icons", TenancyOCID: "ocid1.tenancy.oc1..t", UserOCID: "ocid1.user.oc1..u",
|
||||
Fingerprint: "aa:bb", Region: "us-ashburn-1", HomeRegionKey: "IAD", PrivateKeyEnc: key}
|
||||
if err := db.Create(&cfg).Error; err != nil {
|
||||
t.Fatalf("create config: %v", err)
|
||||
}
|
||||
return cfg.ID
|
||||
}
|
||||
|
||||
func iconSVG(t *testing.T, size int) []byte {
|
||||
t.Helper()
|
||||
data := []byte(`<svg xmlns="http://www.w3.org/2000/svg"/>`)
|
||||
if len(data) > size {
|
||||
t.Fatalf("svg size %d exceeds target %d", len(data), size)
|
||||
}
|
||||
return append(data, bytes.Repeat([]byte(" "), size-len(data))...)
|
||||
}
|
||||
|
||||
func sendIconUpload(t *testing.T, router *gin.Engine, token, path, fileName string, data []byte) *httptest.ResponseRecorder {
|
||||
t.Helper()
|
||||
var body bytes.Buffer
|
||||
writer := multipart.NewWriter(&body)
|
||||
part, err := writer.CreateFormFile("file", fileName)
|
||||
if err != nil {
|
||||
t.Fatalf("create form file: %v", err)
|
||||
}
|
||||
_, _ = part.Write(data)
|
||||
_ = writer.Close()
|
||||
req := httptest.NewRequest(http.MethodPost, path, &body)
|
||||
req.Header.Set("Content-Type", writer.FormDataContentType())
|
||||
req.Header.Set("Authorization", "Bearer "+token)
|
||||
rec := httptest.NewRecorder()
|
||||
router.ServeHTTP(rec, req)
|
||||
return rec
|
||||
}
|
||||
|
||||
func TestIdpIconMultipartSizeBoundary(t *testing.T) {
|
||||
router, token, id, logs := newIconTestRouter(t)
|
||||
t.Cleanup(logs.Wait)
|
||||
path := "/api/v1/oci-configs/" + strconv.FormatUint(uint64(id), 10) + "/idp-icons"
|
||||
cases := []struct {
|
||||
name, fileName string
|
||||
data []byte
|
||||
want int
|
||||
}{
|
||||
{"exactly 1MiB", "icon.svg", iconSVG(t, 1<<20), http.StatusOK},
|
||||
{"one byte over", "icon.svg", iconSVG(t, 1<<20+1), http.StatusRequestEntityTooLarge},
|
||||
{"empty", "icon.png", nil, http.StatusBadRequest},
|
||||
{"spoofed png", "icon.png", []byte("not an image"), http.StatusUnsupportedMediaType},
|
||||
}
|
||||
for _, tc := range cases {
|
||||
rec := sendIconUpload(t, router, token, path, tc.fileName, tc.data)
|
||||
if rec.Code != tc.want {
|
||||
t.Errorf("%s status = %d, want %d, body %s", tc.name, rec.Code, tc.want, rec.Body.String())
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestDeleteIdpIconRoute(t *testing.T) {
|
||||
router, token, id, logs := newIconTestRouter(t)
|
||||
t.Cleanup(logs.Wait)
|
||||
base := "/api/v1/oci-configs/" + strconv.FormatUint(uint64(id), 10) + "/idp-icons"
|
||||
fileName := "images/idp-icon-" + strings.Repeat("ab", 16) + ".png"
|
||||
query := url.Values{"fileName": {fileName}}
|
||||
rec := doRequest(t, router, http.MethodDelete, base+"?"+query.Encode(), token, "")
|
||||
if rec.Code != http.StatusNoContent {
|
||||
t.Errorf("delete status = %d, want 204, body %s", rec.Code, rec.Body.String())
|
||||
}
|
||||
rec = doRequest(t, router, http.MethodDelete, base+"?fileName=images/company-brand.png", token, "")
|
||||
if rec.Code != http.StatusBadRequest {
|
||||
t.Errorf("invalid delete status = %d, want 400", rec.Code)
|
||||
}
|
||||
}
|
||||
|
||||
func assertResponderStatus(t *testing.T, name string, err error, want int, responder func(*gin.Context, error)) {
|
||||
t.Helper()
|
||||
rec := httptest.NewRecorder()
|
||||
ctx, _ := gin.CreateTestContext(rec)
|
||||
ctx.Request = httptest.NewRequest(http.MethodPost, "/", nil)
|
||||
responder(ctx, err)
|
||||
if rec.Code != want {
|
||||
t.Errorf("%s status = %d, want %d", name, rec.Code, want)
|
||||
}
|
||||
}
|
||||
|
||||
func TestIdpIconErrorResponder(t *testing.T) {
|
||||
cases := []struct {
|
||||
name string
|
||||
err error
|
||||
want int
|
||||
}{
|
||||
{"empty icon", service.ErrIdpIconEmpty, 400},
|
||||
{"bad icon name", service.ErrIdpIconBadName, 400},
|
||||
{"large icon", service.ErrIdpIconTooLarge, 413},
|
||||
{"bad icon type", service.ErrIdpIconBadType, 415},
|
||||
}
|
||||
for _, tc := range cases {
|
||||
assertResponderStatus(t, tc.name, tc.err, tc.want, respondIdpIconErr)
|
||||
}
|
||||
}
|
||||
|
||||
func TestCreateIdpOrdinaryErrorHasNoPartialSemantics(t *testing.T) {
|
||||
rec, body := callCreateIdpResponder(t, oci.IdentityProviderInfo{}, errors.New("create failed"))
|
||||
if rec.Code != http.StatusInternalServerError {
|
||||
t.Fatalf("status = %d, want 500; body %s", rec.Code, rec.Body.String())
|
||||
}
|
||||
if _, ok := body["setupWarning"]; ok || bytes.Contains(rec.Body.Bytes(), []byte("resourceCreated")) {
|
||||
t.Errorf("ordinary error unexpectedly carries partial semantics: %s", rec.Body.String())
|
||||
}
|
||||
}
|
||||
|
||||
func TestCreateIdpPartialErrorReturnsStableWarning(t *testing.T) {
|
||||
partial := &oci.PartialIdentityProviderCreateError{
|
||||
IdentityProvider: oci.IdentityProviderInfo{ID: "idp-1", Name: "test-idp"},
|
||||
}
|
||||
rec, body := callCreateIdpResponder(t, oci.IdentityProviderInfo{}, errors.Join(errors.New("raw secret"), partial))
|
||||
warning, ok := body["setupWarning"].(map[string]interface{})
|
||||
if rec.Code != http.StatusCreated || !ok {
|
||||
t.Fatalf("status = %d, warning = %#v; body %s", rec.Code, body["setupWarning"], rec.Body.String())
|
||||
}
|
||||
requestID, _ := warning["requestId"].(string)
|
||||
if warning["code"] != oci.IdpSetupWarningCode || warning["resourceCreated"] != true || requestID == "" {
|
||||
t.Errorf("warning = %#v, want stable partial-create contract", warning)
|
||||
}
|
||||
if bytes.Contains(rec.Body.Bytes(), []byte("secret")) {
|
||||
t.Errorf("partial response leaks internal cause: %s", rec.Body.String())
|
||||
}
|
||||
}
|
||||
|
||||
func callCreateIdpResponder(t *testing.T, idp oci.IdentityProviderInfo, err error) (*httptest.ResponseRecorder, map[string]interface{}) {
|
||||
t.Helper()
|
||||
rec := httptest.NewRecorder()
|
||||
ctx, _ := gin.CreateTestContext(rec)
|
||||
ctx.Request = httptest.NewRequest(http.MethodPost, "/identity-providers", nil)
|
||||
respondCreateIdpResult(ctx, idp, err)
|
||||
body := map[string]interface{}{}
|
||||
if decodeErr := json.Unmarshal(rec.Body.Bytes(), &body); decodeErr != nil {
|
||||
t.Fatalf("decode response: %v", decodeErr)
|
||||
}
|
||||
return rec, body
|
||||
}
|
||||
|
||||
func TestPARErrorResponder(t *testing.T) {
|
||||
cases := []struct {
|
||||
name string
|
||||
err error
|
||||
}{
|
||||
{"bad PAR type", service.ErrPARInvalidAccessType},
|
||||
{"bad PAR expiry", service.ErrPARInvalidExpiration},
|
||||
}
|
||||
for _, tc := range cases {
|
||||
assertResponderStatus(t, tc.name, tc.err, http.StatusBadRequest, respondPARError)
|
||||
}
|
||||
}
|
||||
|
||||
func TestCreatePARValidationReturns400(t *testing.T) {
|
||||
router, token, id, logs := newIconTestRouter(t)
|
||||
t.Cleanup(logs.Wait)
|
||||
path := "/api/v1/oci-configs/" + strconv.FormatUint(uint64(id), 10) + "/buckets/b/pars"
|
||||
cases := []struct {
|
||||
name, body string
|
||||
}{
|
||||
{"bad access type", `{"accessType":"BucketRead","expiresHours":24}`},
|
||||
{"zero expiration", `{"accessType":"ObjectRead","expiresHours":0}`},
|
||||
{"excessive expiration", `{"accessType":"ObjectRead","expiresHours":876001}`},
|
||||
}
|
||||
for _, tc := range cases {
|
||||
rec := doRequest(t, router, http.MethodPost, path, token, tc.body)
|
||||
if rec.Code != http.StatusBadRequest {
|
||||
t.Errorf("%s status = %d, want 400, body %s", tc.name, rec.Code, rec.Body.String())
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user