e424563794
Introduce BearerChallengeMiddleware on MCP, Console and Connect GraphQL, Files, and OAuth2 userinfo. Call sites record challenge intent in context via NoteUnauthenticated, NoteInvalidToken, and NoteInsufficientScope; the middleware applies resource_metadata, invalid_token, and insufficient_scope on WriteHeader. OAuth2 access token middleware flags rejected Bearer tokens for invalid_token challenges. Add Authorizer.ScopesForAction for the scope auth-param. Signed-off-by: Ludovic Vielle <ludovic@probo.com>
132 lines
3.8 KiB
Go
132 lines
3.8 KiB
Go
// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
|
|
//
|
|
// Permission to use, copy, modify, and/or distribute this software for any
|
|
// purpose with or without fee is hereby granted, provided that the above
|
|
// copyright notice and this permission notice appear in all copies.
|
|
//
|
|
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
|
|
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
|
|
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
|
|
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
|
|
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
|
|
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
|
// PERFORMANCE OF THIS SOFTWARE.
|
|
|
|
package files_v1
|
|
|
|
import (
|
|
"context"
|
|
"io"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
|
|
"github.com/go-chi/chi/v5"
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
"go.gearno.de/kit/log"
|
|
"go.probo.inc/probo/pkg/baseurl"
|
|
"go.probo.inc/probo/pkg/securecookie"
|
|
)
|
|
|
|
func testHandler() *Handler {
|
|
return &Handler{
|
|
logger: log.NewLogger(log.WithOutput(io.Discard)),
|
|
}
|
|
}
|
|
|
|
func TestHandleGetPublicFile_InvalidGID(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
h := testHandler()
|
|
|
|
rec := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodGet, "/public/not-a-valid-gid", nil)
|
|
|
|
rctx := chi.NewRouteContext()
|
|
rctx.URLParams.Add("fileID", "not-a-valid-gid")
|
|
req = req.WithContext(context.WithValue(req.Context(), chi.RouteCtxKey, rctx))
|
|
|
|
h.handleGetPublicFile(rec, req)
|
|
|
|
assert.Equal(t, http.StatusNotFound, rec.Code)
|
|
}
|
|
|
|
func TestHandleGetFile_InvalidGID(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
h := testHandler()
|
|
|
|
rec := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodGet, "/not-a-valid-gid", nil)
|
|
|
|
rctx := chi.NewRouteContext()
|
|
rctx.URLParams.Add("fileID", "not-a-valid-gid")
|
|
req = req.WithContext(context.WithValue(req.Context(), chi.RouteCtxKey, rctx))
|
|
|
|
h.handleGetFile(rec, req)
|
|
|
|
assert.Equal(t, http.StatusNotFound, rec.Code)
|
|
}
|
|
|
|
func TestHandleGetStaticFile(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
mux := NewMux(
|
|
log.NewLogger(log.WithOutput(io.Discard)),
|
|
nil,
|
|
nil,
|
|
nil,
|
|
securecookie.Config{},
|
|
"test-secret",
|
|
baseurl.MustParse("https://example.com"),
|
|
)
|
|
|
|
rec := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodGet, "/static/probo.png", nil)
|
|
mux.ServeHTTP(rec, req)
|
|
|
|
require.Equal(t, http.StatusOK, rec.Code)
|
|
require.Contains(t, rec.Header().Get("Cache-Control"), "max-age=3600")
|
|
|
|
etag := rec.Header().Get("ETag")
|
|
require.NotEmpty(t, etag)
|
|
require.True(t, strings.HasPrefix(etag, `"`) && strings.HasSuffix(etag, `"`))
|
|
|
|
recNotModified := httptest.NewRecorder()
|
|
reqNotModified := httptest.NewRequest(http.MethodGet, "/static/probo.png", nil)
|
|
reqNotModified.Header.Set("If-None-Match", etag)
|
|
mux.ServeHTTP(recNotModified, reqNotModified)
|
|
|
|
require.Equal(t, http.StatusNotModified, recNotModified.Code)
|
|
|
|
recMissing := httptest.NewRecorder()
|
|
reqMissing := httptest.NewRequest(http.MethodGet, "/static/does-not-exist.png", nil)
|
|
mux.ServeHTTP(recMissing, reqMissing)
|
|
|
|
require.Equal(t, http.StatusNotFound, recMissing.Code)
|
|
}
|
|
|
|
func TestHandleGetFile_UnauthenticatedReturns401(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
// NewMux with nil services — safe because auth middleware returns 401
|
|
// before any service is called when no credentials are present.
|
|
mux := NewMux(
|
|
log.NewLogger(log.WithOutput(io.Discard)),
|
|
nil, // fileSvc — not reached
|
|
nil, // proboSvc — not reached
|
|
nil, // iamSvc — not reached when no token/cookie present
|
|
securecookie.Config{},
|
|
"test-secret",
|
|
baseurl.MustParse("https://example.com"),
|
|
)
|
|
|
|
rec := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodGet, "/some-valid-looking-id", nil)
|
|
mux.ServeHTTP(rec, req)
|
|
|
|
assert.Equal(t, http.StatusUnauthorized, rec.Code)
|
|
}
|