61 lines
2 KiB
Go
61 lines
2 KiB
Go
|
package auth
|
||
|
|
|
||
|
|
import (
|
||
|
|
"context"
|
||
|
|
"encoding/base64"
|
||
|
|
"net/http"
|
||
|
|
"strconv"
|
||
|
|
"testing"
|
||
|
|
|
||
|
|
"github.com/urpi/go-bananas/internal/config"
|
||
|
|
)
|
||
|
|
|
||
|
|
// base64RawURL encodes without padding, matching how cookies are written.
|
||
|
|
func base64RawURL(s string) string {
|
||
|
|
return base64.RawURLEncoding.EncodeToString([]byte(s))
|
||
|
|
}
|
||
|
|
|
||
|
|
// base64RawURLBytes encodes raw bytes without padding.
|
||
|
|
func base64RawURLBytes(b []byte) string {
|
||
|
|
return base64.RawURLEncoding.EncodeToString(b)
|
||
|
|
}
|
||
|
|
|
||
|
|
// itoa renders an int64 for embedding in a JSON test fixture.
|
||
|
|
func itoa(v int64) string { return strconv.FormatInt(v, 10) }
|
||
|
|
|
||
|
|
// stubResolver is a Resolver that authenticates nobody. It exists so that tests
|
||
|
|
// can construct an Authenticator in OIDC mode without a live provider, which
|
||
|
|
// also documents that New refuses to start in OIDC mode without one.
|
||
|
|
type stubResolver struct{}
|
||
|
|
|
||
|
|
func (stubResolver) Begin(context.Context, *http.Request, http.ResponseWriter, string) error {
|
||
|
|
return nil
|
||
|
|
}
|
||
|
|
func (stubResolver) Complete(context.Context, *http.Request) (*Login, error) {
|
||
|
|
return nil, ErrNoSession
|
||
|
|
}
|
||
|
|
func (stubResolver) End(context.Context, string) string { return "" }
|
||
|
|
func (stubResolver) Enabled() bool { return true }
|
||
|
|
func (stubResolver) ClearState(http.ResponseWriter) {}
|
||
|
|
func (stubResolver) LogoutURL(string) string { return "https://idp.example/logout" }
|
||
|
|
|
||
|
|
// newTestAuthenticator builds an Authenticator for a configuration.
|
||
|
|
//
|
||
|
|
// The key store is optional and is passed straight through: with machine
|
||
|
|
// credentials removed it only carries the user table, which most of these tests do
|
||
|
|
// not exercise.
|
||
|
|
func newTestAuthenticator(t *testing.T, cfg config.Config, keys KeyStore) *Authenticator {
|
||
|
|
t.Helper()
|
||
|
|
if cfg.SessionSecret == "" {
|
||
|
|
cfg.SessionSecret = testSecret
|
||
|
|
}
|
||
|
|
// A stub resolver rather than nil: New refuses to construct in OIDC mode
|
||
|
|
// without one, and the point of some of these tests is exactly that an
|
||
|
|
// unauthenticated request is rejected even when a provider is wired up.
|
||
|
|
a, err := New(cfg, stubResolver{}, keys)
|
||
|
|
if err != nil {
|
||
|
|
t.Fatalf("New: %v", err)
|
||
|
|
}
|
||
|
|
return a
|
||
|
|
}
|