beyond/token_test.go at main · presbrey/beyond · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
package beyond

import (
	"encoding/json"
	"io"
	"net/http"
	"net/http/httptest"
	"os"
	"strings"
	"testing"

	"github.com/presbrey/beyond/internal/authn"
	"github.com/presbrey/beyond/internal/authz"
	"github.com/stretchr/testify/assert"
)

func init() {
	// Setup file transport for ACL
	t := &http.Transport{}
	t.RegisterProtocol("file", http.NewFileTransport(http.Dir("/")))
	client := &http.Client{Transport: t}
	authz.SetHTTPClient(client)

	// Load the fence and sites configuration for testing
	cwd, _ := os.Getwd()
	*authz.FenceURL = "file://" + cwd + "/example/fence.json"
	*authz.SitesURL = "file://" + cwd + "/example/sites.json"
	authz.RefreshFence()
	authz.RefreshSites()

	// Setup token authentication
	*authn.TokenBase = tokenServer.URL + "/?access_token="
}

var (
	tokenTestTokenUsers = map[string]string{
		"932928c0a4edf9878ee0257a1d8f4d06adaaffee": "user1",
		"257a1d8f4d06adaaffee932928c0a4edf9878ee0": "[email protected]",
	}
	tokenTestUserTokens = map[string]string{
		"user1":            "932928c0a4edf9878ee0257a1d8f4d06adaaffee",
		"[email protected]": "257a1d8f4d06adaaffee932928c0a4edf9878ee0",
	}

	tokenServer = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		if r.URL.Query().Get("access_token") == "invalid" {
			_, err := io.WriteString(w, "{")
			if err != nil {
				errorHandler(w, 500, err.Error())
			}
			return
		}
		authorization := r.Header.Get("Authorization")
		user := tokenTestTokenUsers[r.URL.Query().Get("access_token")]
		if user == "" && strings.Contains(authorization, " ") {
			user = tokenTestTokenUsers[strings.Split(authorization, " ")[1]]
		}
		err := json.NewEncoder(w).Encode(authn.TokenUser{Login: user})
		if err != nil {
			errorHandler(w, 500, err.Error())
		}
	}))
)

func TestTokenError(t *testing.T) {
	*authn.TokenBase = "https://foo.bar?"

	r, err := http.NewRequest("GET", "/", nil)
	assert.NoError(t, err)

	assert.Equal(t, "", authn.TokenAuth(r))
	r.Header.Set("Authorization", "token test")
	assert.Equal(t, "", authn.TokenAuth(r))

	*authn.TokenBase = tokenServer.URL + "/?access_token="
	r.Header.Set("Authorization", "token invalid")
	assert.Equal(t, "", authn.TokenAuth(r))
}

func TestTokenBasic(t *testing.T) {
	r, err := http.NewRequest("GET", "/", nil)
	assert.NoError(t, err)

	r.SetBasicAuth(tokenTestUserTokens["user1"], "x-oauth-basic")
	login1 := authn.TokenAuth(r)
	r.SetBasicAuth("", tokenTestUserTokens["user1"])
	login2 := authn.TokenAuth(r)
	assert.Equal(t, "user1", login1)
	assert.Equal(t, "user1", login2)

	r.SetBasicAuth(tokenTestUserTokens["user1"], "foobar")
	assert.Equal(t, "", authn.TokenAuth(r))
}

func TestTokenFederation(t *testing.T) {
	r, err := http.NewRequest("GET", "/", nil)
	assert.NoError(t, err)

	r.Header.Set("Authorization", "token test")
	assert.Equal(t, "", authn.TokenAuth(r))

	r.Header.Set("Authorization", "token "+tokenTestUserTokens["user1"])
	login1 := authn.TokenAuth(r)
	login2 := authn.TokenAuth(r)
	assert.Equal(t, "user1", login1)
	assert.Equal(t, "user1", login2)
}

func TestTokenSuccess(t *testing.T) {
	// Test token authentication with Authorization header
	request := httptest.NewRequest("GET", "/", nil)
	request.Header.Set("Authorization", "Token "+tokenTestUserTokens["user1"])
	request.Host = "checkip.amazonaws.com"
	w := httptest.NewRecorder()
	testMux.ServeHTTP(w, request)

	resp := w.Result()
	body, _ := io.ReadAll(resp.Body)
	assert.Equal(t, 200, resp.StatusCode)
	// AWS checkip returns an IP address followed by newline
	assert.Regexp(t, `^\d+\.\d+\.\d+\.\d+\n$`, string(body))

	// Test token authentication with Basic Auth
	request = httptest.NewRequest("GET", "/", nil)
	request.SetBasicAuth("user1", tokenTestUserTokens["user1"])
	request.Host = "checkip.amazonaws.com"
	w = httptest.NewRecorder()
	testMux.ServeHTTP(w, request)

	resp = w.Result()
	body, _ = io.ReadAll(resp.Body)
	assert.Equal(t, 200, resp.StatusCode)
	// AWS checkip returns an IP address followed by newline
	assert.Regexp(t, `^\d+\.\d+\.\d+\.\d+\n$`, string(body))

	// Test ACL 403 - [email protected] should be blocked by ACL
	request = httptest.NewRequest("GET", "/", nil)
	request.Header.Set("Authorization", "Token "+tokenTestUserTokens["[email protected]"])
	request.Host = "example.com"
	w = httptest.NewRecorder()
	testMux.ServeHTTP(w, request)

	resp = w.Result()
	body, _ = io.ReadAll(resp.Body)
	assert.Equal(t, 403, resp.StatusCode)
	assert.Contains(t, string(body), "Access Denied")
}