initial commit

internal/auth/helpers_test.go

@@ -0,0 +1,60 @@
+package auth
+
+import (
+	"context"
+	"encoding/base64"
+	"net/http"
+	"strconv"
+	"testing"
+
+	"github.com/urpi/go-bananas/internal/config"
+)
+
+// base64RawURL encodes without padding, matching how cookies are written.
+func base64RawURL(s string) string {
+	return base64.RawURLEncoding.EncodeToString([]byte(s))
+}
+
+// base64RawURLBytes encodes raw bytes without padding.
+func base64RawURLBytes(b []byte) string {
+	return base64.RawURLEncoding.EncodeToString(b)
+}
+
+// itoa renders an int64 for embedding in a JSON test fixture.
+func itoa(v int64) string { return strconv.FormatInt(v, 10) }
+
+// stubResolver is a Resolver that authenticates nobody. It exists so that tests
+// can construct an Authenticator in OIDC mode without a live provider, which
+// also documents that New refuses to start in OIDC mode without one.
+type stubResolver struct{}
+
+func (stubResolver) Begin(context.Context, *http.Request, http.ResponseWriter, string) error {
+	return nil
+}
+func (stubResolver) Complete(context.Context, *http.Request) (*Login, error) {
+	return nil, ErrNoSession
+}
+func (stubResolver) End(context.Context, string) string { return "" }
+func (stubResolver) Enabled() bool                      { return true }
+func (stubResolver) ClearState(http.ResponseWriter)     {}
+func (stubResolver) LogoutURL(string) string            { return "https://idp.example/logout" }
+
+// newTestAuthenticator builds an Authenticator for a configuration.
+//
+// The key store is optional and is passed straight through: with machine
+// credentials removed it only carries the user table, which most of these tests do
+// not exercise.
+func newTestAuthenticator(t *testing.T, cfg config.Config, keys KeyStore) *Authenticator {
+	t.Helper()
+	if cfg.SessionSecret == "" {
+		cfg.SessionSecret = testSecret
+	}
+	// A stub resolver rather than nil: New refuses to construct in OIDC mode
+	// without one, and the point of some of these tests is exactly that an
+	// unauthenticated request is rejected even when a provider is wired up.
+	a, err := New(cfg, stubResolver{}, keys)
+	if err != nil {
+		t.Fatalf("New: %v", err)
+	}
+	return a
+}