951dd8d26b
Some checks failed
ci / go (push) Has been cancelled
ci / admin-ui (push) Has been cancelled
ci / runtime-sdk (push) Has been cancelled
ci / helm (push) Has been cancelled
ci / openapi (push) Has been cancelled
ci / container (push) Has been cancelled
ci / release-config (push) Has been cancelled
ci / shared styling (push) Has been cancelled
ci / security (push) Has been cancelled
ci / all green (push) Has been cancelled
60 lines
2 KiB
Go
60 lines
2 KiB
Go
package auth
|
|
|
|
import (
|
|
"context"
|
|
"encoding/base64"
|
|
"net/http"
|
|
"strconv"
|
|
"testing"
|
|
|
|
"github.com/urpi/go-bananas/internal/config"
|
|
)
|
|
|
|
// base64RawURL encodes without padding, matching how cookies are written.
|
|
func base64RawURL(s string) string {
|
|
return base64.RawURLEncoding.EncodeToString([]byte(s))
|
|
}
|
|
|
|
// base64RawURLBytes encodes raw bytes without padding.
|
|
func base64RawURLBytes(b []byte) string {
|
|
return base64.RawURLEncoding.EncodeToString(b)
|
|
}
|
|
|
|
// itoa renders an int64 for embedding in a JSON test fixture.
|
|
func itoa(v int64) string { return strconv.FormatInt(v, 10) }
|
|
|
|
// stubResolver is a Resolver that authenticates nobody. It exists so that tests
|
|
// can construct an Authenticator in OIDC mode without a live provider, which
|
|
// also documents that New refuses to start in OIDC mode without one.
|
|
type stubResolver struct{}
|
|
|
|
func (stubResolver) Begin(context.Context, *http.Request, http.ResponseWriter, string) error {
|
|
return nil
|
|
}
|
|
func (stubResolver) Complete(context.Context, *http.Request) (*Login, error) {
|
|
return nil, ErrNoSession
|
|
}
|
|
func (stubResolver) End(context.Context, string) string { return "" }
|
|
func (stubResolver) Enabled() bool { return true }
|
|
func (stubResolver) ClearState(http.ResponseWriter) {}
|
|
func (stubResolver) LogoutURL(string) string { return "https://idp.example/logout" }
|
|
|
|
// newTestAuthenticator builds an Authenticator for a configuration.
|
|
//
|
|
// The key store is optional and is passed straight through: with machine
|
|
// credentials removed it only carries the user table, which most of these tests do
|
|
// not exercise.
|
|
func newTestAuthenticator(t *testing.T, cfg config.Config, keys KeyStore) *Authenticator {
|
|
t.Helper()
|
|
if cfg.SessionSecret == "" {
|
|
cfg.SessionSecret = testSecret
|
|
}
|
|
// A stub resolver rather than nil: New refuses to construct in OIDC mode
|
|
// without one, and the point of some of these tests is exactly that an
|
|
// unauthenticated request is rejected even when a provider is wired up.
|
|
a, err := New(cfg, stubResolver{}, keys)
|
|
if err != nil {
|
|
t.Fatalf("New: %v", err)
|
|
}
|
|
return a
|
|
}
|