Archived
96 lines
2.8 KiB
Go
96 lines
2.8 KiB
Go
package httpapi
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
|
|
sdktrace "go.opentelemetry.io/otel/sdk/trace"
|
|
"go.opentelemetry.io/otel/sdk/trace/tracetest"
|
|
)
|
|
|
|
func TestRouterExposesOnlySpecifiedMethods(t *testing.T) {
|
|
endpoint := http.HandlerFunc(func(response http.ResponseWriter, _ *http.Request) {
|
|
response.WriteHeader(http.StatusNoContent)
|
|
})
|
|
router, err := NewRouter(Endpoints{
|
|
Metadata: endpoint,
|
|
Token: endpoint,
|
|
JWKS: endpoint,
|
|
Health: endpoint,
|
|
Ready: endpoint,
|
|
}, Telemetry{})
|
|
if err != nil {
|
|
t.Fatalf("NewRouter() error = %v", err)
|
|
}
|
|
|
|
tests := []struct {
|
|
method string
|
|
path string
|
|
status int
|
|
}{
|
|
{http.MethodGet, "/.well-known/oauth-authorization-server", http.StatusNoContent},
|
|
{http.MethodPost, "/oauth2/token", http.StatusNoContent},
|
|
{http.MethodGet, "/oauth2/jwks", http.StatusNoContent},
|
|
{http.MethodGet, "/healthz", http.StatusNoContent},
|
|
{http.MethodGet, "/readyz", http.StatusNoContent},
|
|
{http.MethodGet, "/oauth2/token", http.StatusMethodNotAllowed},
|
|
{http.MethodPost, "/oauth2/jwks", http.StatusMethodNotAllowed},
|
|
{http.MethodGet, "/unknown", http.StatusNotFound},
|
|
}
|
|
|
|
for _, test := range tests {
|
|
t.Run(test.method+" "+test.path, func(t *testing.T) {
|
|
request := httptest.NewRequest(test.method, test.path, nil)
|
|
response := httptest.NewRecorder()
|
|
router.ServeHTTP(response, request)
|
|
if response.Code != test.status {
|
|
t.Fatalf("status = %d, want %d", response.Code, test.status)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestRouterRequiresEveryEndpoint(t *testing.T) {
|
|
if _, err := NewRouter(Endpoints{}, Telemetry{}); err == nil {
|
|
t.Fatal("NewRouter() error = nil, want missing endpoint error")
|
|
}
|
|
}
|
|
|
|
func TestRouterTelemetryDoesNotCaptureCredentialValues(t *testing.T) {
|
|
const canary = "canary-secret-token"
|
|
recorder := tracetest.NewSpanRecorder()
|
|
tracerProvider := sdktrace.NewTracerProvider(sdktrace.WithSpanProcessor(recorder))
|
|
t.Cleanup(func() { _ = tracerProvider.Shutdown(t.Context()) })
|
|
|
|
endpoint := http.HandlerFunc(func(response http.ResponseWriter, _ *http.Request) {
|
|
response.WriteHeader(http.StatusNoContent)
|
|
})
|
|
router, err := NewRouter(Endpoints{
|
|
Metadata: endpoint,
|
|
Token: endpoint,
|
|
JWKS: endpoint,
|
|
Health: endpoint,
|
|
Ready: endpoint,
|
|
}, Telemetry{TracerProvider: tracerProvider})
|
|
if err != nil {
|
|
t.Fatalf("NewRouter() error = %v", err)
|
|
}
|
|
|
|
request := httptest.NewRequest(http.MethodGet, "/oauth2/jwks?subject_token="+canary, nil)
|
|
request.Header.Set("Authorization", "Bearer "+canary)
|
|
response := httptest.NewRecorder()
|
|
router.ServeHTTP(response, request)
|
|
|
|
spans := recorder.Ended()
|
|
if len(spans) != 1 {
|
|
t.Fatalf("ended spans = %d, want 1", len(spans))
|
|
}
|
|
for _, attribute := range spans[0].Attributes() {
|
|
if strings.Contains(attribute.Value.Emit(), canary) {
|
|
t.Fatalf("span attribute %q captured credential canary", attribute.Key)
|
|
}
|
|
}
|
|
}
|