Archived
70 lines
2.5 KiB
Go
70 lines
2.5 KiB
Go
package protocol
|
|
|
|
import (
|
|
"errors"
|
|
"net/url"
|
|
"reflect"
|
|
"testing"
|
|
)
|
|
|
|
func TestParseExchangeRequest(t *testing.T) {
|
|
request, err := ParseExchangeRequest(validForm())
|
|
if err != nil {
|
|
t.Fatalf("ParseExchangeRequest() error = %v", err)
|
|
}
|
|
|
|
if request.ClientID != "homelab-infra-ci" {
|
|
t.Fatalf("ClientID = %q", request.ClientID)
|
|
}
|
|
if !reflect.DeepEqual(request.Scopes, []string{"bao.login", "ssh.certificate"}) {
|
|
t.Fatalf("Scopes = %#v", request.Scopes)
|
|
}
|
|
}
|
|
|
|
func TestParseExchangeRequestRejectsInvalidInput(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
mutate func(url.Values)
|
|
code string
|
|
}{
|
|
{name: "missing client id", mutate: func(v url.Values) { v.Del("client_id") }, code: "invalid_request"},
|
|
{name: "short client id", mutate: func(v url.Values) { v.Set("client_id", "ci") }, code: "invalid_request"},
|
|
{name: "uppercase client id", mutate: func(v url.Values) { v.Set("client_id", "CI-worker") }, code: "invalid_request"},
|
|
{name: "leading hyphen", mutate: func(v url.Values) { v.Set("client_id", "-ci-worker") }, code: "invalid_request"},
|
|
{name: "missing token", mutate: func(v url.Values) { v.Del("subject_token") }, code: "invalid_request"},
|
|
{name: "wrong grant", mutate: func(v url.Values) { v.Set("grant_type", "client_credentials") }, code: "unsupported_grant_type"},
|
|
{name: "missing audience", mutate: func(v url.Values) { v.Del("audience") }, code: "invalid_target"},
|
|
{name: "multiple audiences", mutate: func(v url.Values) { v.Add("audience", "second") }, code: "invalid_target"},
|
|
{name: "missing scope", mutate: func(v url.Values) { v.Del("scope") }, code: "invalid_scope"},
|
|
{name: "actor token", mutate: func(v url.Values) { v.Set("actor_token", "not-supported") }, code: "invalid_request"},
|
|
}
|
|
|
|
for _, test := range tests {
|
|
t.Run(test.name, func(t *testing.T) {
|
|
form := validForm()
|
|
test.mutate(form)
|
|
|
|
_, err := ParseExchangeRequest(form)
|
|
var requestErr *RequestError
|
|
if !errors.As(err, &requestErr) {
|
|
t.Fatalf("error = %v, want RequestError", err)
|
|
}
|
|
if requestErr.Code != test.code {
|
|
t.Fatalf("error code = %q, want %q", requestErr.Code, test.code)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func validForm() url.Values {
|
|
return url.Values{
|
|
"grant_type": {TokenExchangeGrantType},
|
|
"client_id": {"homelab-infra-ci"},
|
|
"subject_token": {"test-subject-token"},
|
|
"subject_token_type": {JWTTokenType},
|
|
"requested_token_type": {AccessTokenType},
|
|
"audience": {"https://bao.ad.ddupan.top:8200"},
|
|
"scope": {"bao.login ssh.certificate"},
|
|
}
|
|
}
|