deploy configuration

internal/web/handlers_test.go

@@ -8,8 +8,10 @@ import (
 	"testing"
 	"testing/fstest"
 
-	"github.com/danyel/go-cms/internal/security"
-	"github.com/danyel/go-cms/internal/service"
+	"github.com/danyel/go-tell/internal/config"
+	"github.com/danyel/go-tell/internal/golooseauth"
+	"github.com/danyel/go-tell/internal/security"
+	"github.com/danyel/go-tell/internal/service"
 )
 
 type fakeContent struct{ updated bool }
@@ -31,12 +33,16 @@ func (f *fakeContent) Update(_ context.Context, c service.Content) (service.Cont
 	return c, nil
 }
 
-func newTestRoutes(content *fakeContent) http.Handler {
+func newTestRoutes(content *fakeContent, browser ...*golooseauth.Auth) http.Handler {
 	assets := fstest.MapFS{
 		"index.html":      &fstest.MapFile{Data: []byte("<!doctype html><div id=\"root\"></div>")},
-		"assets/index.js": &fstest.MapFile{Data: []byte("console.log('cms')")},
+		"assets/index.js": &fstest.MapFile{Data: []byte("console.log('go-tell')")},
 	}
-	return NewHandler(content, assets, security.NewSSOTokenVerifier("X-SSO-Token", "", "")).Routes("http://localhost:5173")
+	var auth *golooseauth.Auth
+	if len(browser) > 0 {
+		auth = browser[0]
+	}
+	return NewHandler(content, assets, security.NewSSOTokenVerifier("X-SSO-Token", "", ""), auth).Routes("http://localhost:5173")
 }
 
 func TestAnonymousCanReadButNotEdit(t *testing.T) {
@@ -89,6 +95,68 @@ func TestProxyIdentityCanEdit(t *testing.T) {
 	}
 }
 
+func TestGoLooseLoginRedirectsToTheIdentityProvider(t *testing.T) {
+	routes := newTestRoutes(&fakeContent{}, testGoLooseAuth(t))
+
+	response := httptest.NewRecorder()
+	routes.ServeHTTP(response, httptest.NewRequest(http.MethodGet, golooseauth.LoginPath, nil))
+	if response.Code != http.StatusFound {
+		t.Fatalf("login status = %d, body = %s", response.Code, response.Body.String())
+	}
+	location := response.Header().Get("Location")
+	if !strings.HasPrefix(location, "https://tell.auth.dev/connect/authorize?") ||
+		!strings.Contains(location, "redirect_uri=https%3A%2F%2Ftell.dev%2Fapi%2Fauth%2Fcallback") {
+		t.Fatalf("unexpected login redirect: %s", location)
+	}
+}
+
+func TestSessionAdvertisesGoLooseEndpoints(t *testing.T) {
+	routes := newTestRoutes(&fakeContent{}, testGoLooseAuth(t))
+
+	response := httptest.NewRecorder()
+	routes.ServeHTTP(response, httptest.NewRequest(http.MethodGet, "/api/auth/session", nil))
+	if response.Code != http.StatusOK {
+		t.Fatalf("session status = %d", response.Code)
+	}
+	body := response.Body.String()
+	for _, want := range []string{`"authenticated":false`, `"loginUrl":"/api/auth/login"`, `"logoutUrl":"/api/auth/logout"`} {
+		if !strings.Contains(body, want) {
+			t.Fatalf("session = %s, want %s", body, want)
+		}
+	}
+}
+
+func TestSessionWithoutGoLooseHasNoLoginURL(t *testing.T) {
+	response := httptest.NewRecorder()
+	newTestRoutes(&fakeContent{}).ServeHTTP(response, httptest.NewRequest(http.MethodGet, "/api/auth/session", nil))
+	if strings.Contains(response.Body.String(), "loginUrl") {
+		t.Fatalf("session = %s, want no login endpoint", response.Body.String())
+	}
+}
+
+func TestGoLooseRoutesAreNotFoundWhenUnconfigured(t *testing.T) {
+	routes := newTestRoutes(&fakeContent{})
+	for _, path := range []string{golooseauth.LoginPath, golooseauth.CallbackPath, golooseauth.LogoutPath} {
+		response := httptest.NewRecorder()
+		routes.ServeHTTP(response, httptest.NewRequest(http.MethodGet, path, nil))
+		if response.Code != http.StatusNotFound || !strings.Contains(response.Body.String(), "GO_LOOSE_CLIENT_ID") {
+			t.Fatalf("%s without Go Loose = %d %s", path, response.Code, response.Body.String())
+		}
+	}
+}
+
+func testGoLooseAuth(t *testing.T) *golooseauth.Auth {
+	t.Helper()
+	auth, err := golooseauth.New(config.GoLooseConfig{
+		Tenant: "tell", AuthDomain: "auth.dev", AppDomain: "tell.dev",
+		ClientID: "glc_tell", ClientSecret: "secret",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return auth
+}
+
 func TestServesEmbeddedAppForClientRoutes(t *testing.T) {
 	routes := newTestRoutes(&fakeContent{})