2022-03-29 11:53:19 +02:00
|
|
|
package middleware
|
|
|
|
|
|
|
|
import (
|
|
|
|
"context"
|
|
|
|
"fmt"
|
|
|
|
"net/http"
|
|
|
|
"net/http/httptest"
|
|
|
|
"reflect"
|
|
|
|
"testing"
|
|
|
|
|
|
|
|
"github.com/stretchr/testify/assert"
|
2022-04-25 11:16:36 +02:00
|
|
|
"golang.org/x/text/language"
|
2022-03-29 11:53:19 +02:00
|
|
|
|
2022-04-27 01:01:45 +02:00
|
|
|
"github.com/zitadel/zitadel/internal/api/authz"
|
2023-11-29 11:57:47 +01:00
|
|
|
zitadel_http "github.com/zitadel/zitadel/internal/api/http"
|
2022-03-29 11:53:19 +02:00
|
|
|
)
|
|
|
|
|
|
|
|
func Test_instanceInterceptor_Handler(t *testing.T) {
|
|
|
|
type fields struct {
|
|
|
|
verifier authz.InstanceVerifier
|
|
|
|
headerName string
|
|
|
|
}
|
|
|
|
type args struct {
|
|
|
|
request *http.Request
|
|
|
|
}
|
|
|
|
type res struct {
|
|
|
|
statusCode int
|
|
|
|
context context.Context
|
|
|
|
}
|
|
|
|
tests := []struct {
|
|
|
|
name string
|
|
|
|
fields fields
|
|
|
|
args args
|
|
|
|
res res
|
|
|
|
}{
|
|
|
|
{
|
|
|
|
"setInstance error",
|
|
|
|
fields{
|
|
|
|
verifier: &mockInstanceVerifier{},
|
|
|
|
headerName: "header",
|
|
|
|
},
|
|
|
|
args{
|
|
|
|
request: httptest.NewRequest("", "/url", nil),
|
|
|
|
},
|
|
|
|
res{
|
2022-08-17 08:07:41 +02:00
|
|
|
statusCode: 404,
|
2022-03-29 11:53:19 +02:00
|
|
|
context: nil,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
"setInstance ok",
|
|
|
|
fields{
|
|
|
|
verifier: &mockInstanceVerifier{"host"},
|
|
|
|
headerName: "header",
|
|
|
|
},
|
|
|
|
args{
|
|
|
|
request: func() *http.Request {
|
|
|
|
r := httptest.NewRequest("", "/url", nil)
|
|
|
|
r.Header.Set("header", "host")
|
|
|
|
return r
|
|
|
|
}(),
|
|
|
|
},
|
|
|
|
res{
|
|
|
|
statusCode: 200,
|
|
|
|
context: authz.WithInstance(context.Background(), &mockInstance{}),
|
|
|
|
},
|
|
|
|
},
|
|
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
|
|
a := &instanceInterceptor{
|
|
|
|
verifier: tt.fields.verifier,
|
|
|
|
headerName: tt.fields.headerName,
|
2023-11-29 11:57:47 +01:00
|
|
|
translator: newZitadelTranslator(),
|
2022-03-29 11:53:19 +02:00
|
|
|
}
|
|
|
|
next := &testHandler{}
|
|
|
|
got := a.HandlerFunc(next.ServeHTTP)
|
|
|
|
rr := httptest.NewRecorder()
|
|
|
|
got.ServeHTTP(rr, tt.args.request)
|
|
|
|
assert.Equal(t, tt.res.statusCode, rr.Code)
|
|
|
|
assert.Equal(t, tt.res.context, next.context)
|
|
|
|
})
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func Test_instanceInterceptor_HandlerFunc(t *testing.T) {
|
|
|
|
type fields struct {
|
|
|
|
verifier authz.InstanceVerifier
|
|
|
|
headerName string
|
|
|
|
}
|
|
|
|
type args struct {
|
|
|
|
request *http.Request
|
|
|
|
}
|
|
|
|
type res struct {
|
|
|
|
statusCode int
|
|
|
|
context context.Context
|
|
|
|
}
|
|
|
|
tests := []struct {
|
|
|
|
name string
|
|
|
|
fields fields
|
|
|
|
args args
|
|
|
|
res res
|
|
|
|
}{
|
|
|
|
{
|
|
|
|
"setInstance error",
|
|
|
|
fields{
|
|
|
|
verifier: &mockInstanceVerifier{},
|
|
|
|
headerName: "header",
|
|
|
|
},
|
|
|
|
args{
|
|
|
|
request: httptest.NewRequest("", "/url", nil),
|
|
|
|
},
|
|
|
|
res{
|
2022-08-17 08:07:41 +02:00
|
|
|
statusCode: 404,
|
2022-03-29 11:53:19 +02:00
|
|
|
context: nil,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
"setInstance ok",
|
|
|
|
fields{
|
|
|
|
verifier: &mockInstanceVerifier{"host"},
|
|
|
|
headerName: "header",
|
|
|
|
},
|
|
|
|
args{
|
|
|
|
request: func() *http.Request {
|
|
|
|
r := httptest.NewRequest("", "/url", nil)
|
|
|
|
r.Header.Set("header", "host")
|
|
|
|
return r
|
|
|
|
}(),
|
|
|
|
},
|
|
|
|
res{
|
|
|
|
statusCode: 200,
|
|
|
|
context: authz.WithInstance(context.Background(), &mockInstance{}),
|
|
|
|
},
|
|
|
|
},
|
|
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
|
|
a := &instanceInterceptor{
|
|
|
|
verifier: tt.fields.verifier,
|
|
|
|
headerName: tt.fields.headerName,
|
2023-11-29 11:57:47 +01:00
|
|
|
translator: newZitadelTranslator(),
|
2022-03-29 11:53:19 +02:00
|
|
|
}
|
|
|
|
next := &testHandler{}
|
|
|
|
got := a.HandlerFunc(next.ServeHTTP)
|
|
|
|
rr := httptest.NewRecorder()
|
|
|
|
got.ServeHTTP(rr, tt.args.request)
|
|
|
|
assert.Equal(t, tt.res.statusCode, rr.Code)
|
|
|
|
assert.Equal(t, tt.res.context, next.context)
|
|
|
|
})
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func Test_setInstance(t *testing.T) {
|
|
|
|
type args struct {
|
|
|
|
r *http.Request
|
|
|
|
verifier authz.InstanceVerifier
|
|
|
|
headerName string
|
|
|
|
}
|
|
|
|
type res struct {
|
|
|
|
want context.Context
|
|
|
|
err bool
|
|
|
|
}
|
|
|
|
tests := []struct {
|
|
|
|
name string
|
|
|
|
args args
|
|
|
|
res res
|
|
|
|
}{
|
|
|
|
{
|
2023-11-29 11:57:47 +01:00
|
|
|
"special host header not found, error",
|
2022-03-29 11:53:19 +02:00
|
|
|
args{
|
|
|
|
r: func() *http.Request {
|
|
|
|
r := httptest.NewRequest("", "/url", nil)
|
|
|
|
return r
|
|
|
|
}(),
|
|
|
|
verifier: &mockInstanceVerifier{},
|
|
|
|
headerName: "",
|
|
|
|
},
|
|
|
|
res{
|
|
|
|
want: nil,
|
|
|
|
err: true,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
2023-11-29 11:57:47 +01:00
|
|
|
"special host header invalid, error",
|
2022-03-29 11:53:19 +02:00
|
|
|
args{
|
|
|
|
r: func() *http.Request {
|
|
|
|
r := httptest.NewRequest("", "/url", nil)
|
|
|
|
r.Header.Set("header", "host2")
|
|
|
|
return r
|
|
|
|
}(),
|
|
|
|
verifier: &mockInstanceVerifier{"host"},
|
|
|
|
headerName: "header",
|
|
|
|
},
|
|
|
|
res{
|
|
|
|
want: nil,
|
|
|
|
err: true,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
2023-11-29 11:57:47 +01:00
|
|
|
"special host header valid, ok",
|
2022-03-29 11:53:19 +02:00
|
|
|
args{
|
|
|
|
r: func() *http.Request {
|
|
|
|
r := httptest.NewRequest("", "/url", nil)
|
|
|
|
r.Header.Set("header", "host")
|
|
|
|
return r
|
|
|
|
}(),
|
|
|
|
verifier: &mockInstanceVerifier{"host"},
|
|
|
|
headerName: "header",
|
|
|
|
},
|
|
|
|
res{
|
|
|
|
want: authz.WithInstance(context.Background(), &mockInstance{}),
|
|
|
|
err: false,
|
|
|
|
},
|
|
|
|
},
|
2023-11-29 11:57:47 +01:00
|
|
|
{
|
|
|
|
"host from origin if header is not special, ok",
|
|
|
|
args{
|
|
|
|
r: func() *http.Request {
|
|
|
|
r := httptest.NewRequest("", "/url", nil)
|
|
|
|
r.Header.Set("host", "fromrequest")
|
|
|
|
return r.WithContext(zitadel_http.WithComposedOrigin(r.Context(), "https://fromorigin:9999"))
|
|
|
|
}(),
|
2023-12-06 18:53:41 +02:00
|
|
|
verifier: &mockInstanceVerifier{"fromorigin:9999"},
|
2023-11-29 11:57:47 +01:00
|
|
|
headerName: "host",
|
|
|
|
},
|
|
|
|
res{
|
|
|
|
want: authz.WithInstance(zitadel_http.WithComposedOrigin(context.Background(), "https://fromorigin:9999"), &mockInstance{}),
|
|
|
|
err: false,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
"host from origin, instance not found",
|
|
|
|
args{
|
|
|
|
r: func() *http.Request {
|
|
|
|
r := httptest.NewRequest("", "/url", nil)
|
|
|
|
return r.WithContext(zitadel_http.WithComposedOrigin(r.Context(), "https://fromorigin:9999"))
|
|
|
|
}(),
|
|
|
|
verifier: &mockInstanceVerifier{"unknowndomain"},
|
|
|
|
headerName: "host",
|
|
|
|
},
|
|
|
|
res{
|
|
|
|
want: nil,
|
|
|
|
err: true,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
{
|
|
|
|
"host from origin invalid, err",
|
|
|
|
args{
|
|
|
|
r: func() *http.Request {
|
|
|
|
r := httptest.NewRequest("", "/url", nil)
|
|
|
|
return r.WithContext(zitadel_http.WithComposedOrigin(r.Context(), "https://from origin:9999"))
|
|
|
|
}(),
|
|
|
|
verifier: &mockInstanceVerifier{"from origin"},
|
|
|
|
headerName: "host",
|
|
|
|
},
|
|
|
|
res{
|
|
|
|
want: nil,
|
|
|
|
err: true,
|
|
|
|
},
|
|
|
|
},
|
2022-03-29 11:53:19 +02:00
|
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
|
|
got, err := setInstance(tt.args.r, tt.args.verifier, tt.args.headerName)
|
|
|
|
if (err != nil) != tt.res.err {
|
|
|
|
t.Errorf("setInstance() error = %v, wantErr %v", err, tt.res.err)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
if !reflect.DeepEqual(got, tt.res.want) {
|
|
|
|
t.Errorf("setInstance() got = %v, want %v", got, tt.res.want)
|
|
|
|
}
|
|
|
|
})
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
type testHandler struct {
|
|
|
|
context context.Context
|
|
|
|
}
|
|
|
|
|
2022-08-17 08:07:41 +02:00
|
|
|
func (t *testHandler) ServeHTTP(_ http.ResponseWriter, r *http.Request) {
|
2022-03-29 11:53:19 +02:00
|
|
|
t.context = r.Context()
|
|
|
|
}
|
|
|
|
|
|
|
|
type mockInstanceVerifier struct {
|
|
|
|
host string
|
|
|
|
}
|
|
|
|
|
2022-08-17 08:07:41 +02:00
|
|
|
func (m *mockInstanceVerifier) InstanceByHost(_ context.Context, host string) (authz.Instance, error) {
|
2022-03-29 11:53:19 +02:00
|
|
|
if host != m.host {
|
|
|
|
return nil, fmt.Errorf("invalid host")
|
|
|
|
}
|
|
|
|
return &mockInstance{}, nil
|
|
|
|
}
|
|
|
|
|
2023-02-15 02:52:11 +01:00
|
|
|
func (m *mockInstanceVerifier) InstanceByID(context.Context) (authz.Instance, error) {
|
|
|
|
return nil, nil
|
|
|
|
}
|
|
|
|
|
2022-03-29 11:53:19 +02:00
|
|
|
type mockInstance struct{}
|
|
|
|
|
|
|
|
func (m *mockInstance) InstanceID() string {
|
|
|
|
return "instanceID"
|
|
|
|
}
|
|
|
|
|
|
|
|
func (m *mockInstance) ProjectID() string {
|
|
|
|
return "projectID"
|
|
|
|
}
|
|
|
|
|
|
|
|
func (m *mockInstance) ConsoleClientID() string {
|
|
|
|
return "consoleClientID"
|
|
|
|
}
|
2022-04-12 16:20:17 +02:00
|
|
|
|
2022-04-14 14:19:18 +02:00
|
|
|
func (m *mockInstance) ConsoleApplicationID() string {
|
|
|
|
return "consoleApplicationID"
|
|
|
|
}
|
|
|
|
|
2022-04-25 11:16:36 +02:00
|
|
|
func (m *mockInstance) DefaultLanguage() language.Tag {
|
|
|
|
return language.English
|
|
|
|
}
|
|
|
|
|
2022-06-03 14:30:39 +02:00
|
|
|
func (m *mockInstance) DefaultOrganisationID() string {
|
|
|
|
return "orgID"
|
|
|
|
}
|
|
|
|
|
2022-04-12 16:20:17 +02:00
|
|
|
func (m *mockInstance) RequestedDomain() string {
|
|
|
|
return "zitadel.cloud"
|
|
|
|
}
|
2022-04-25 11:16:36 +02:00
|
|
|
|
|
|
|
func (m *mockInstance) RequestedHost() string {
|
|
|
|
return "zitadel.cloud:443"
|
|
|
|
}
|
2022-12-14 07:17:36 +01:00
|
|
|
|
|
|
|
func (m *mockInstance) SecurityPolicyAllowedOrigins() []string {
|
|
|
|
return nil
|
|
|
|
}
|