实现首轮协议与 Transit 签名 PoC

internal/httpapi/router_test.go

@@ -0,0 +1,95 @@
+package httpapi
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	sdktrace "go.opentelemetry.io/otel/sdk/trace"
+	"go.opentelemetry.io/otel/sdk/trace/tracetest"
+)
+
+func TestRouterExposesOnlySpecifiedMethods(t *testing.T) {
+	endpoint := http.HandlerFunc(func(response http.ResponseWriter, _ *http.Request) {
+		response.WriteHeader(http.StatusNoContent)
+	})
+	router, err := NewRouter(Endpoints{
+		Metadata: endpoint,
+		Token:    endpoint,
+		JWKS:     endpoint,
+		Health:   endpoint,
+		Ready:    endpoint,
+	}, Telemetry{})
+	if err != nil {
+		t.Fatalf("NewRouter() error = %v", err)
+	}
+
+	tests := []struct {
+		method string
+		path   string
+		status int
+	}{
+		{http.MethodGet, "/.well-known/oauth-authorization-server", http.StatusNoContent},
+		{http.MethodPost, "/oauth2/token", http.StatusNoContent},
+		{http.MethodGet, "/oauth2/jwks", http.StatusNoContent},
+		{http.MethodGet, "/healthz", http.StatusNoContent},
+		{http.MethodGet, "/readyz", http.StatusNoContent},
+		{http.MethodGet, "/oauth2/token", http.StatusMethodNotAllowed},
+		{http.MethodPost, "/oauth2/jwks", http.StatusMethodNotAllowed},
+		{http.MethodGet, "/unknown", http.StatusNotFound},
+	}
+
+	for _, test := range tests {
+		t.Run(test.method+" "+test.path, func(t *testing.T) {
+			request := httptest.NewRequest(test.method, test.path, nil)
+			response := httptest.NewRecorder()
+			router.ServeHTTP(response, request)
+			if response.Code != test.status {
+				t.Fatalf("status = %d, want %d", response.Code, test.status)
+			}
+		})
+	}
+}
+
+func TestRouterRequiresEveryEndpoint(t *testing.T) {
+	if _, err := NewRouter(Endpoints{}, Telemetry{}); err == nil {
+		t.Fatal("NewRouter() error = nil, want missing endpoint error")
+	}
+}
+
+func TestRouterTelemetryDoesNotCaptureCredentialValues(t *testing.T) {
+	const canary = "canary-secret-token"
+	recorder := tracetest.NewSpanRecorder()
+	tracerProvider := sdktrace.NewTracerProvider(sdktrace.WithSpanProcessor(recorder))
+	t.Cleanup(func() { _ = tracerProvider.Shutdown(t.Context()) })
+
+	endpoint := http.HandlerFunc(func(response http.ResponseWriter, _ *http.Request) {
+		response.WriteHeader(http.StatusNoContent)
+	})
+	router, err := NewRouter(Endpoints{
+		Metadata: endpoint,
+		Token:    endpoint,
+		JWKS:     endpoint,
+		Health:   endpoint,
+		Ready:    endpoint,
+	}, Telemetry{TracerProvider: tracerProvider})
+	if err != nil {
+		t.Fatalf("NewRouter() error = %v", err)
+	}
+
+	request := httptest.NewRequest(http.MethodGet, "/oauth2/jwks?subject_token="+canary, nil)
+	request.Header.Set("Authorization", "Bearer "+canary)
+	response := httptest.NewRecorder()
+	router.ServeHTTP(response, request)
+
+	spans := recorder.Ended()
+	if len(spans) != 1 {
+		t.Fatalf("ended spans = %d, want 1", len(spans))
+	}
+	for _, attribute := range spans[0].Attributes() {
+		if strings.Contains(attribute.Value.Emit(), canary) {
+			t.Fatalf("span attribute %q captured credential canary", attribute.Key)
+		}
+	}
+}