67 lines
1.8 KiB
Go
67 lines
1.8 KiB
Go
package authorization
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
|
|
"proxui/backend/internal/membership"
|
|
"proxui/backend/internal/rbac"
|
|
)
|
|
|
|
func TestRequireAllowsRoleWithPermission(t *testing.T) {
|
|
middleware := NewMiddleware()
|
|
handler := middleware.Require(rbac.ActionProjectManage, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
w.WriteHeader(http.StatusNoContent)
|
|
}))
|
|
|
|
req := requestWithMembership(rbac.RoleAdmin)
|
|
rec := httptest.NewRecorder()
|
|
|
|
handler.ServeHTTP(rec, req)
|
|
|
|
if rec.Code != http.StatusNoContent {
|
|
t.Fatalf("status = %d, want %d", rec.Code, http.StatusNoContent)
|
|
}
|
|
}
|
|
|
|
func TestRequireRejectsRoleWithoutPermission(t *testing.T) {
|
|
middleware := NewMiddleware()
|
|
handler := middleware.Require(rbac.ActionProjectManage, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
w.WriteHeader(http.StatusNoContent)
|
|
}))
|
|
|
|
req := requestWithMembership(rbac.RoleViewer)
|
|
rec := httptest.NewRecorder()
|
|
|
|
handler.ServeHTTP(rec, req)
|
|
|
|
if rec.Code != http.StatusForbidden {
|
|
t.Fatalf("status = %d, want %d", rec.Code, http.StatusForbidden)
|
|
}
|
|
}
|
|
|
|
func TestRequireRejectsMissingMembership(t *testing.T) {
|
|
middleware := NewMiddleware()
|
|
handler := middleware.Require(rbac.ActionProjectRead, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
w.WriteHeader(http.StatusNoContent)
|
|
}))
|
|
|
|
req := httptest.NewRequest(http.MethodGet, "/tenants/tenant-1/projects", nil)
|
|
rec := httptest.NewRecorder()
|
|
|
|
handler.ServeHTTP(rec, req)
|
|
|
|
if rec.Code != http.StatusForbidden {
|
|
t.Fatalf("status = %d, want %d", rec.Code, http.StatusForbidden)
|
|
}
|
|
}
|
|
|
|
func requestWithMembership(role rbac.Role) *http.Request {
|
|
req := httptest.NewRequest(http.MethodGet, "/tenants/tenant-1/projects", nil)
|
|
return req.WithContext(membership.ContextWithMembership(req.Context(), membership.Membership{
|
|
TenantID: "tenant-1",
|
|
Role: role,
|
|
}))
|
|
}
|