70 lines
1.9 KiB
Go
70 lines
1.9 KiB
Go
package middleware
|
|
|
|
import "context"
|
|
import "net/http"
|
|
import "net/http/httptest"
|
|
import "testing"
|
|
|
|
import "codit/internal/models"
|
|
|
|
func TestAPIKeyFromRequest(t *testing.T) {
|
|
var req *http.Request
|
|
var token string
|
|
req = httptest.NewRequest(http.MethodGet, "/", nil)
|
|
req.Header.Set("X-API-Key", "abc")
|
|
token = apiKeyFromRequest(req)
|
|
if token != "abc" {
|
|
t.Fatalf("expected header token, got %q", token)
|
|
}
|
|
req = httptest.NewRequest(http.MethodGet, "/", nil)
|
|
req.Header.Set("Authorization", "Bearer xyz")
|
|
token = apiKeyFromRequest(req)
|
|
if token != "xyz" {
|
|
t.Fatalf("expected bearer token, got %q", token)
|
|
}
|
|
}
|
|
|
|
func TestRequireAuth(t *testing.T) {
|
|
var called bool
|
|
var handler http.Handler
|
|
var recorder *httptest.ResponseRecorder
|
|
var req *http.Request
|
|
handler = RequireAuth(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
|
|
called = true
|
|
w.WriteHeader(http.StatusNoContent)
|
|
}))
|
|
recorder = httptest.NewRecorder()
|
|
req = httptest.NewRequest(http.MethodGet, "/", nil)
|
|
handler.ServeHTTP(recorder, req)
|
|
if recorder.Code != http.StatusUnauthorized {
|
|
t.Fatalf("expected 401, got %d", recorder.Code)
|
|
}
|
|
if called {
|
|
t.Fatalf("protected handler should not be called")
|
|
}
|
|
}
|
|
|
|
func TestRequireAdmin(t *testing.T) {
|
|
var called bool
|
|
var handler http.Handler
|
|
var recorder *httptest.ResponseRecorder
|
|
var req *http.Request
|
|
var user models.User
|
|
var ctx context.Context
|
|
handler = RequireAdmin(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
|
|
called = true
|
|
w.WriteHeader(http.StatusNoContent)
|
|
}))
|
|
user = models.User{ID: "u1", Username: "admin", IsAdmin: true}
|
|
ctx = context.WithValue(context.Background(), userKey, user)
|
|
recorder = httptest.NewRecorder()
|
|
req = httptest.NewRequest(http.MethodGet, "/", nil).WithContext(ctx)
|
|
handler.ServeHTTP(recorder, req)
|
|
if recorder.Code != http.StatusNoContent {
|
|
t.Fatalf("expected 204, got %d", recorder.Code)
|
|
}
|
|
if !called {
|
|
t.Fatalf("admin handler should be called")
|
|
}
|
|
}
|