mirror of
https://github.com/hanzoai/base.git
synced 2026-10-21 03:41:50 +00:00
zeekay
3e7b0ce670
One path: /v1/*. We do not use /api/ — that's Casdoor's path. The
BASE_API_PREFIX env knob is gone; the prefix is hard-coded in
apis/base.go and apis/serve.go banner.
Server-side mounts:
- apis: bindHealthApi, bindCollectionApi, bindRecordCrudApi, etc. all
attach under r.Group("/v1") (was r.Group(BASE_API_PREFIX, default /api))
- platform plugin: /api/platform/* -> /v1/platform/* (including auth and
org sub-groups)
- kms plugin: /api/kms/* -> /v1/kms/*
- functions plugin: /api/functions/* -> /v1/functions/*
- cloudsql plugin: /api/cloud-sql/*, /api/meta/* -> /v1/*
- superuser OIDC: /_/api/oidc/config -> /_/v1/oidc/config
- core settings: default RateLimitRule labels /api/batch, /api/ ->
/v1/batch, /v1/
- apis/batch.go: ValidBatchActions regexes match /v1/collections/*;
internal rewrite targets /v1/collections/* (was /v1/base/collections/*,
a stale artifact)
Clients:
- sdk/base-js (BaseClient.collections, files, realtime, CRDT WS,
signIn/refresh/health) targets /v1/*
- sdk/base-react (use-crdt WS path) targets /v1/crdt
- ui-react admin (lib/api.ts, settings.application copy) targets /v1/*
- cmd/cli (NewClient.APIPrefix) defaults to /v1; client_test.go and
cmd/cli_test.go stubServer use /v1/*
- cmd/typegen calls /v1/collections
Upstream paths untouched: Casdoor IAM (/api/login, /api/userinfo,
/api/signup, /api/send-verification-code, /api/get-user), KMS Infisical
(/api/v1/auth/universal-auth/login, /api/v2/workspace/environments),
Kubernetes tasks (/api/v1/namespaces/...), IPFS (/api/v0/...), Gitea/
GitLab/Discord/Strava/Patreon/Box/Wakatime upstream APIs. Those are
their contracts, not ours.
Tests: all 437 prior /api/ test URLs across apis/*_test.go and
plugins/platform/auth_proxy_test.go updated to /v1/. Build + go vet
clean. ./apis ./core ./plugins/platform ./plugins/jsvm ./forms all
green. Pre-existing red probes (network/TestRedProbe_*,
migratecmd/TestAutomigrateCollection*) unchanged.
768 lines
29 KiB
Go
768 lines
29 KiB
Go
package apis_test
|
|
|
|
import (
|
|
"net/http"
|
|
"strings"
|
|
"testing"
|
|
|
|
"github.com/hanzoai/base/apis"
|
|
"github.com/hanzoai/base/core"
|
|
"github.com/hanzoai/base/tests"
|
|
)
|
|
|
|
func TestPanicRecover(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
scenarios := []tests.ApiScenario{
|
|
{
|
|
Name: "panic from route",
|
|
Method: http.MethodGet,
|
|
URL: "/my/test",
|
|
BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
|
|
e.Router.GET("/my/test", func(e *core.RequestEvent) error {
|
|
panic("123")
|
|
})
|
|
},
|
|
ExpectedStatus: 500,
|
|
ExpectedContent: []string{`"data":{}`},
|
|
ExpectedEvents: map[string]int{"*": 0},
|
|
},
|
|
{
|
|
Name: "panic from middleware",
|
|
Method: http.MethodGet,
|
|
URL: "/my/test",
|
|
BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
|
|
e.Router.GET("/my/test", func(e *core.RequestEvent) error {
|
|
return e.String(http.StatusOK, "test")
|
|
}).BindFunc(func(e *core.RequestEvent) error {
|
|
panic(123)
|
|
})
|
|
},
|
|
ExpectedStatus: 500,
|
|
ExpectedContent: []string{`"data":{}`},
|
|
ExpectedEvents: map[string]int{"*": 0},
|
|
},
|
|
}
|
|
|
|
for _, scenario := range scenarios {
|
|
scenario.Test(t)
|
|
}
|
|
}
|
|
|
|
func TestRequireGuestOnly(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
beforeTestFunc := func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
|
|
e.Router.GET("/my/test", func(e *core.RequestEvent) error {
|
|
return e.String(200, "test123")
|
|
}).Bind(apis.RequireGuestOnly())
|
|
}
|
|
|
|
scenarios := []tests.ApiScenario{
|
|
{
|
|
Name: "valid regular user token",
|
|
Method: http.MethodGet,
|
|
URL: "/my/test",
|
|
Headers: map[string]string{
|
|
"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjb2xsZWN0aW9uSWQiOiJfdXNlcnNfYXV0aF8iLCJleHAiOjI1MjQ2MDQ0NjEsImlkIjoiNHExeGxjbG1mbG9rdTMzIiwicmVmcmVzaGFibGUiOnRydWUsInR5cGUiOiJhdXRoIn0.AuFTIzCsdLEy-5adFzpjZzbqAdTP6Iu9B1wPBAxLBgo",
|
|
},
|
|
BeforeTestFunc: beforeTestFunc,
|
|
ExpectedStatus: 400,
|
|
ExpectedContent: []string{`"data":{}`},
|
|
ExpectedEvents: map[string]int{"*": 0},
|
|
},
|
|
{
|
|
Name: "valid superuser auth token",
|
|
Method: http.MethodGet,
|
|
URL: "/my/test",
|
|
Headers: map[string]string{
|
|
"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjb2xsZWN0aW9uSWQiOiJoYmNfMzE0MjYzNTgyMyIsImV4cCI6MjUyNDYwNDQ2MSwiaWQiOiJzeXdiaGVjbmg0NnJobTAiLCJyZWZyZXNoYWJsZSI6dHJ1ZSwidHlwZSI6ImF1dGgifQ.CXBf8BazmUeg2RnJW8OEs1UFYF41rbCMOa6YZa4wZio",
|
|
},
|
|
BeforeTestFunc: beforeTestFunc,
|
|
ExpectedStatus: 400,
|
|
ExpectedContent: []string{`"data":{}`},
|
|
ExpectedEvents: map[string]int{"*": 0},
|
|
},
|
|
{
|
|
Name: "expired/invalid token",
|
|
Method: http.MethodGet,
|
|
URL: "/my/test",
|
|
Headers: map[string]string{
|
|
"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjb2xsZWN0aW9uSWQiOiJfdXNlcnNfYXV0aF8iLCJleHAiOjE3Njg3MzA2NzIsImlkIjoiNHExeGxjbG1mbG9rdTMzIiwicmVmcmVzaGFibGUiOnRydWUsInR5cGUiOiJhdXRoIn0.9iYiBgJP1HRJzqY1WDZxtI9e2CUSkAKNlZmJGiPYQio",
|
|
},
|
|
BeforeTestFunc: beforeTestFunc,
|
|
ExpectedStatus: 200,
|
|
ExpectedContent: []string{"test123"},
|
|
ExpectedEvents: map[string]int{"*": 0},
|
|
},
|
|
{
|
|
Name: "guest",
|
|
Method: http.MethodGet,
|
|
URL: "/my/test",
|
|
BeforeTestFunc: beforeTestFunc,
|
|
ExpectedStatus: 200,
|
|
ExpectedContent: []string{"test123"},
|
|
ExpectedEvents: map[string]int{"*": 0},
|
|
},
|
|
}
|
|
|
|
for _, scenario := range scenarios {
|
|
scenario.Test(t)
|
|
}
|
|
}
|
|
|
|
func TestRequireAuth(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
scenarios := []tests.ApiScenario{
|
|
{
|
|
Name: "guest",
|
|
Method: http.MethodGet,
|
|
URL: "/my/test",
|
|
BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
|
|
e.Router.GET("/my/test", func(e *core.RequestEvent) error {
|
|
return e.String(200, "test123")
|
|
}).Bind(apis.RequireAuth())
|
|
},
|
|
ExpectedStatus: 401,
|
|
ExpectedContent: []string{`"data":{}`},
|
|
ExpectedEvents: map[string]int{"*": 0},
|
|
},
|
|
{
|
|
Name: "expired token",
|
|
Method: http.MethodGet,
|
|
URL: "/my/test",
|
|
Headers: map[string]string{
|
|
"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjb2xsZWN0aW9uSWQiOiJfdXNlcnNfYXV0aF8iLCJleHAiOjE3Njg3MzA2NzIsImlkIjoiNHExeGxjbG1mbG9rdTMzIiwicmVmcmVzaGFibGUiOnRydWUsInR5cGUiOiJhdXRoIn0.9iYiBgJP1HRJzqY1WDZxtI9e2CUSkAKNlZmJGiPYQio",
|
|
},
|
|
BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
|
|
e.Router.GET("/my/test", func(e *core.RequestEvent) error {
|
|
return e.String(200, "test123")
|
|
}).Bind(apis.RequireAuth())
|
|
},
|
|
ExpectedStatus: 401,
|
|
ExpectedContent: []string{`"data":{}`},
|
|
ExpectedEvents: map[string]int{"*": 0},
|
|
},
|
|
{
|
|
Name: "invalid token",
|
|
Method: http.MethodGet,
|
|
URL: "/my/test",
|
|
Headers: map[string]string{
|
|
"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjb2xsZWN0aW9uSWQiOiJoYmNfMzE0MjYzNTgyMyIsImV4cCI6NDkyMjQxNjYwNCwiaWQiOiJzeXdiaGVjbmg0NnJobTAiLCJ0eXBlIjoiZmlsZSJ9.OuICrgrFGLFWo3zuC0-_Lm3VO3N8U03mOYoDZB7vQp8",
|
|
},
|
|
BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
|
|
e.Router.GET("/my/test", func(e *core.RequestEvent) error {
|
|
return e.String(200, "test123")
|
|
}).Bind(apis.RequireAuth())
|
|
},
|
|
ExpectedStatus: 401,
|
|
ExpectedContent: []string{`"data":{}`},
|
|
ExpectedEvents: map[string]int{"*": 0},
|
|
},
|
|
{
|
|
Name: "valid record auth token with no collection restrictions",
|
|
Method: http.MethodGet,
|
|
URL: "/my/test",
|
|
Headers: map[string]string{
|
|
// regular user
|
|
"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjb2xsZWN0aW9uSWQiOiJfdXNlcnNfYXV0aF8iLCJleHAiOjI1MjQ2MDQ0NjEsImlkIjoiNHExeGxjbG1mbG9rdTMzIiwicmVmcmVzaGFibGUiOnRydWUsInR5cGUiOiJhdXRoIn0.AuFTIzCsdLEy-5adFzpjZzbqAdTP6Iu9B1wPBAxLBgo",
|
|
},
|
|
BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
|
|
e.Router.GET("/my/test", func(e *core.RequestEvent) error {
|
|
return e.String(200, "test123")
|
|
}).Bind(apis.RequireAuth())
|
|
},
|
|
ExpectedStatus: 200,
|
|
ExpectedContent: []string{"test123"},
|
|
},
|
|
{
|
|
Name: "valid record static auth token",
|
|
Method: http.MethodGet,
|
|
URL: "/my/test",
|
|
Headers: map[string]string{
|
|
// regular user
|
|
"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjb2xsZWN0aW9uSWQiOiJfdXNlcnNfYXV0aF8iLCJleHAiOjI1MjQ2MDQ0NjEsImlkIjoiNHExeGxjbG1mbG9rdTMzIiwicmVmcmVzaGFibGUiOmZhbHNlLCJ0eXBlIjoiYXV0aCJ9.8LJt8Jz66YTdn5bm_PalFa66lhgdZINXn5EDiVZNV7M",
|
|
},
|
|
BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
|
|
e.Router.GET("/my/test", func(e *core.RequestEvent) error {
|
|
return e.String(200, "test123")
|
|
}).Bind(apis.RequireAuth())
|
|
},
|
|
ExpectedStatus: 200,
|
|
ExpectedContent: []string{"test123"},
|
|
},
|
|
{
|
|
Name: "valid record auth token with collection not in the restricted list",
|
|
Method: http.MethodGet,
|
|
URL: "/my/test",
|
|
Headers: map[string]string{
|
|
// superuser
|
|
"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjb2xsZWN0aW9uSWQiOiJoYmNfMzE0MjYzNTgyMyIsImV4cCI6MjUyNDYwNDQ2MSwiaWQiOiJzeXdiaGVjbmg0NnJobTAiLCJyZWZyZXNoYWJsZSI6dHJ1ZSwidHlwZSI6ImF1dGgifQ.CXBf8BazmUeg2RnJW8OEs1UFYF41rbCMOa6YZa4wZio",
|
|
},
|
|
BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
|
|
e.Router.GET("/my/test", func(e *core.RequestEvent) error {
|
|
return e.String(200, "test123")
|
|
}).Bind(apis.RequireAuth("users", "demo1"))
|
|
},
|
|
ExpectedStatus: 403,
|
|
ExpectedContent: []string{`"data":{}`},
|
|
ExpectedEvents: map[string]int{"*": 0},
|
|
},
|
|
{
|
|
Name: "valid record auth token with collection in the restricted list",
|
|
Method: http.MethodGet,
|
|
URL: "/my/test",
|
|
Headers: map[string]string{
|
|
// superuser
|
|
"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjb2xsZWN0aW9uSWQiOiJoYmNfMzE0MjYzNTgyMyIsImV4cCI6MjUyNDYwNDQ2MSwiaWQiOiJzeXdiaGVjbmg0NnJobTAiLCJyZWZyZXNoYWJsZSI6dHJ1ZSwidHlwZSI6ImF1dGgifQ.CXBf8BazmUeg2RnJW8OEs1UFYF41rbCMOa6YZa4wZio",
|
|
},
|
|
BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
|
|
e.Router.GET("/my/test", func(e *core.RequestEvent) error {
|
|
return e.String(200, "test123")
|
|
}).Bind(apis.RequireAuth("users", core.CollectionNameSuperusers))
|
|
},
|
|
ExpectedStatus: 200,
|
|
ExpectedContent: []string{"test123"},
|
|
},
|
|
{
|
|
Name: "valid record auth token with Bearer case-insensitive prefix",
|
|
Method: http.MethodGet,
|
|
URL: "/my/test",
|
|
Headers: map[string]string{
|
|
// regular user
|
|
"Authorization": "BeArEr eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjb2xsZWN0aW9uSWQiOiJfdXNlcnNfYXV0aF8iLCJleHAiOjI1MjQ2MDQ0NjEsImlkIjoiNHExeGxjbG1mbG9rdTMzIiwicmVmcmVzaGFibGUiOnRydWUsInR5cGUiOiJhdXRoIn0.AuFTIzCsdLEy-5adFzpjZzbqAdTP6Iu9B1wPBAxLBgo",
|
|
},
|
|
BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
|
|
e.Router.GET("/my/test", func(e *core.RequestEvent) error {
|
|
return e.String(200, "test123")
|
|
}).Bind(apis.RequireAuth())
|
|
},
|
|
ExpectedStatus: 200,
|
|
ExpectedContent: []string{"test123"},
|
|
},
|
|
}
|
|
|
|
for _, scenario := range scenarios {
|
|
scenario.Test(t)
|
|
}
|
|
}
|
|
|
|
func TestRequireSuperuserAuth(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
scenarios := []tests.ApiScenario{
|
|
{
|
|
Name: "guest",
|
|
Method: http.MethodGet,
|
|
URL: "/my/test",
|
|
BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
|
|
e.Router.GET("/my/test", func(e *core.RequestEvent) error {
|
|
return e.String(200, "test123")
|
|
}).Bind(apis.RequireSuperuserAuth())
|
|
},
|
|
ExpectedStatus: 401,
|
|
ExpectedContent: []string{`"data":{}`},
|
|
ExpectedEvents: map[string]int{"*": 0},
|
|
},
|
|
{
|
|
Name: "expired/invalid token",
|
|
Method: http.MethodGet,
|
|
URL: "/my/test",
|
|
Headers: map[string]string{
|
|
"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjb2xsZWN0aW9uSWQiOiJoYmNfMzE0MjYzNTgyMyIsImV4cCI6MTc2ODczMDM5MywiaWQiOiJzeXdiaGVjbmg0NnJobTAiLCJyZWZyZXNoYWJsZSI6dHJ1ZSwidHlwZSI6ImF1dGgifQ.qP2DRKrbLsxafLNzO7ywT4GfykiwCLmDEf5_RmUF99o",
|
|
},
|
|
BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
|
|
e.Router.GET("/my/test", func(e *core.RequestEvent) error {
|
|
return e.String(200, "test123")
|
|
}).Bind(apis.RequireSuperuserAuth())
|
|
},
|
|
ExpectedStatus: 401,
|
|
ExpectedContent: []string{`"data":{}`},
|
|
ExpectedEvents: map[string]int{"*": 0},
|
|
},
|
|
{
|
|
Name: "valid regular user auth token",
|
|
Method: http.MethodGet,
|
|
URL: "/my/test",
|
|
Headers: map[string]string{
|
|
"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjb2xsZWN0aW9uSWQiOiJfdXNlcnNfYXV0aF8iLCJleHAiOjI1MjQ2MDQ0NjEsImlkIjoiNHExeGxjbG1mbG9rdTMzIiwicmVmcmVzaGFibGUiOnRydWUsInR5cGUiOiJhdXRoIn0.AuFTIzCsdLEy-5adFzpjZzbqAdTP6Iu9B1wPBAxLBgo",
|
|
},
|
|
BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
|
|
e.Router.GET("/my/test", func(e *core.RequestEvent) error {
|
|
return e.String(200, "test123")
|
|
}).Bind(apis.RequireSuperuserAuth())
|
|
},
|
|
ExpectedStatus: 403,
|
|
ExpectedContent: []string{`"data":{}`},
|
|
ExpectedEvents: map[string]int{"*": 0},
|
|
},
|
|
{
|
|
Name: "valid superuser auth token",
|
|
Method: http.MethodGet,
|
|
URL: "/my/test",
|
|
Headers: map[string]string{
|
|
"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjb2xsZWN0aW9uSWQiOiJoYmNfMzE0MjYzNTgyMyIsImV4cCI6MjUyNDYwNDQ2MSwiaWQiOiJzeXdiaGVjbmg0NnJobTAiLCJyZWZyZXNoYWJsZSI6dHJ1ZSwidHlwZSI6ImF1dGgifQ.CXBf8BazmUeg2RnJW8OEs1UFYF41rbCMOa6YZa4wZio",
|
|
},
|
|
BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
|
|
e.Router.GET("/my/test", func(e *core.RequestEvent) error {
|
|
return e.String(200, "test123")
|
|
}).Bind(apis.RequireSuperuserAuth())
|
|
},
|
|
ExpectedStatus: 200,
|
|
ExpectedContent: []string{"test123"},
|
|
},
|
|
}
|
|
|
|
for _, scenario := range scenarios {
|
|
scenario.Test(t)
|
|
}
|
|
}
|
|
|
|
func TestRequireSuperuserOrOwnerAuth(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
scenarios := []tests.ApiScenario{
|
|
{
|
|
Name: "guest",
|
|
Method: http.MethodGet,
|
|
URL: "/my/test/4q1xlclmfloku33",
|
|
BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
|
|
e.Router.GET("/my/test/{id}", func(e *core.RequestEvent) error {
|
|
return e.String(200, "test123")
|
|
}).Bind(apis.RequireSuperuserOrOwnerAuth(""))
|
|
},
|
|
ExpectedStatus: 401,
|
|
ExpectedContent: []string{`"data":{}`},
|
|
ExpectedEvents: map[string]int{"*": 0},
|
|
},
|
|
{
|
|
Name: "expired/invalid token",
|
|
Method: http.MethodGet,
|
|
URL: "/my/test/4q1xlclmfloku33",
|
|
Headers: map[string]string{
|
|
"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjb2xsZWN0aW9uSWQiOiJoYmNfMzE0MjYzNTgyMyIsImV4cCI6MTc2ODczMDM5MywiaWQiOiJzeXdiaGVjbmg0NnJobTAiLCJyZWZyZXNoYWJsZSI6dHJ1ZSwidHlwZSI6ImF1dGgifQ.qP2DRKrbLsxafLNzO7ywT4GfykiwCLmDEf5_RmUF99o",
|
|
},
|
|
BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
|
|
e.Router.GET("/my/test/{id}", func(e *core.RequestEvent) error {
|
|
return e.String(200, "test123")
|
|
}).Bind(apis.RequireSuperuserOrOwnerAuth(""))
|
|
},
|
|
ExpectedStatus: 401,
|
|
ExpectedContent: []string{`"data":{}`},
|
|
ExpectedEvents: map[string]int{"*": 0},
|
|
},
|
|
{
|
|
Name: "valid record auth token (different user)",
|
|
Method: http.MethodGet,
|
|
URL: "/my/test/oap640cot4yru2s",
|
|
Headers: map[string]string{
|
|
"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjb2xsZWN0aW9uSWQiOiJfdXNlcnNfYXV0aF8iLCJleHAiOjI1MjQ2MDQ0NjEsImlkIjoiNHExeGxjbG1mbG9rdTMzIiwicmVmcmVzaGFibGUiOnRydWUsInR5cGUiOiJhdXRoIn0.AuFTIzCsdLEy-5adFzpjZzbqAdTP6Iu9B1wPBAxLBgo",
|
|
},
|
|
BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
|
|
e.Router.GET("/my/test/{id}", func(e *core.RequestEvent) error {
|
|
return e.String(200, "test123")
|
|
}).Bind(apis.RequireSuperuserOrOwnerAuth(""))
|
|
},
|
|
ExpectedStatus: 403,
|
|
ExpectedContent: []string{`"data":{}`},
|
|
ExpectedEvents: map[string]int{"*": 0},
|
|
},
|
|
{
|
|
Name: "valid record auth token (owner)",
|
|
Method: http.MethodGet,
|
|
URL: "/my/test/4q1xlclmfloku33",
|
|
Headers: map[string]string{
|
|
"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjb2xsZWN0aW9uSWQiOiJfdXNlcnNfYXV0aF8iLCJleHAiOjI1MjQ2MDQ0NjEsImlkIjoiNHExeGxjbG1mbG9rdTMzIiwicmVmcmVzaGFibGUiOnRydWUsInR5cGUiOiJhdXRoIn0.AuFTIzCsdLEy-5adFzpjZzbqAdTP6Iu9B1wPBAxLBgo",
|
|
},
|
|
BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
|
|
e.Router.GET("/my/test/{id}", func(e *core.RequestEvent) error {
|
|
return e.String(200, "test123")
|
|
}).Bind(apis.RequireSuperuserOrOwnerAuth(""))
|
|
},
|
|
ExpectedStatus: 200,
|
|
ExpectedContent: []string{"test123"},
|
|
},
|
|
{
|
|
Name: "valid record auth token (owner + non-matching custom owner param)",
|
|
Method: http.MethodGet,
|
|
URL: "/my/test/4q1xlclmfloku33",
|
|
Headers: map[string]string{
|
|
"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjb2xsZWN0aW9uSWQiOiJfdXNlcnNfYXV0aF8iLCJleHAiOjI1MjQ2MDQ0NjEsImlkIjoiNHExeGxjbG1mbG9rdTMzIiwicmVmcmVzaGFibGUiOnRydWUsInR5cGUiOiJhdXRoIn0.AuFTIzCsdLEy-5adFzpjZzbqAdTP6Iu9B1wPBAxLBgo",
|
|
},
|
|
BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
|
|
e.Router.GET("/my/test/{id}", func(e *core.RequestEvent) error {
|
|
return e.String(200, "test123")
|
|
}).Bind(apis.RequireSuperuserOrOwnerAuth("test"))
|
|
},
|
|
ExpectedStatus: 403,
|
|
ExpectedContent: []string{`"data":{}`},
|
|
ExpectedEvents: map[string]int{"*": 0},
|
|
},
|
|
{
|
|
Name: "valid record auth token (owner + matching custom owner param)",
|
|
Method: http.MethodGet,
|
|
URL: "/my/test/4q1xlclmfloku33",
|
|
Headers: map[string]string{
|
|
"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjb2xsZWN0aW9uSWQiOiJfdXNlcnNfYXV0aF8iLCJleHAiOjI1MjQ2MDQ0NjEsImlkIjoiNHExeGxjbG1mbG9rdTMzIiwicmVmcmVzaGFibGUiOnRydWUsInR5cGUiOiJhdXRoIn0.AuFTIzCsdLEy-5adFzpjZzbqAdTP6Iu9B1wPBAxLBgo",
|
|
},
|
|
BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
|
|
e.Router.GET("/my/test/{test}", func(e *core.RequestEvent) error {
|
|
return e.String(200, "test123")
|
|
}).Bind(apis.RequireSuperuserOrOwnerAuth("test"))
|
|
},
|
|
ExpectedStatus: 200,
|
|
ExpectedContent: []string{"test123"},
|
|
},
|
|
{
|
|
Name: "valid superuser auth token",
|
|
Method: http.MethodGet,
|
|
URL: "/my/test/4q1xlclmfloku33",
|
|
Headers: map[string]string{
|
|
"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjb2xsZWN0aW9uSWQiOiJoYmNfMzE0MjYzNTgyMyIsImV4cCI6MjUyNDYwNDQ2MSwiaWQiOiJzeXdiaGVjbmg0NnJobTAiLCJyZWZyZXNoYWJsZSI6dHJ1ZSwidHlwZSI6ImF1dGgifQ.CXBf8BazmUeg2RnJW8OEs1UFYF41rbCMOa6YZa4wZio",
|
|
},
|
|
BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
|
|
e.Router.GET("/my/test/{id}", func(e *core.RequestEvent) error {
|
|
return e.String(200, "test123")
|
|
}).Bind(apis.RequireSuperuserOrOwnerAuth(""))
|
|
},
|
|
ExpectedStatus: 200,
|
|
ExpectedContent: []string{"test123"},
|
|
},
|
|
}
|
|
|
|
for _, scenario := range scenarios {
|
|
scenario.Test(t)
|
|
}
|
|
}
|
|
|
|
func TestRequireSameCollectionContextAuth(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
scenarios := []tests.ApiScenario{
|
|
{
|
|
Name: "guest",
|
|
Method: http.MethodGet,
|
|
URL: "/my/test/_users_auth_",
|
|
BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
|
|
e.Router.GET("/my/test/{collection}", func(e *core.RequestEvent) error {
|
|
return e.String(200, "test123")
|
|
}).Bind(apis.RequireSameCollectionContextAuth(""))
|
|
},
|
|
ExpectedStatus: 401,
|
|
ExpectedContent: []string{`"data":{}`},
|
|
ExpectedEvents: map[string]int{"*": 0},
|
|
},
|
|
{
|
|
Name: "expired/invalid token",
|
|
Method: http.MethodGet,
|
|
URL: "/my/test/_users_auth_",
|
|
Headers: map[string]string{
|
|
"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjb2xsZWN0aW9uSWQiOiJfdXNlcnNfYXV0aF8iLCJleHAiOjE3Njg3MzA2NzIsImlkIjoiNHExeGxjbG1mbG9rdTMzIiwicmVmcmVzaGFibGUiOnRydWUsInR5cGUiOiJhdXRoIn0.9iYiBgJP1HRJzqY1WDZxtI9e2CUSkAKNlZmJGiPYQio",
|
|
},
|
|
BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
|
|
e.Router.GET("/my/test/{collection}", func(e *core.RequestEvent) error {
|
|
return e.String(200, "test123")
|
|
}).Bind(apis.RequireSameCollectionContextAuth(""))
|
|
},
|
|
ExpectedStatus: 401,
|
|
ExpectedContent: []string{`"data":{}`},
|
|
ExpectedEvents: map[string]int{"*": 0},
|
|
},
|
|
{
|
|
Name: "valid record auth token (different collection)",
|
|
Method: http.MethodGet,
|
|
URL: "/my/test/clients",
|
|
Headers: map[string]string{
|
|
"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjb2xsZWN0aW9uSWQiOiJfdXNlcnNfYXV0aF8iLCJleHAiOjI1MjQ2MDQ0NjEsImlkIjoiNHExeGxjbG1mbG9rdTMzIiwicmVmcmVzaGFibGUiOnRydWUsInR5cGUiOiJhdXRoIn0.AuFTIzCsdLEy-5adFzpjZzbqAdTP6Iu9B1wPBAxLBgo",
|
|
},
|
|
BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
|
|
e.Router.GET("/my/test/{collection}", func(e *core.RequestEvent) error {
|
|
return e.String(200, "test123")
|
|
}).Bind(apis.RequireSameCollectionContextAuth(""))
|
|
},
|
|
ExpectedStatus: 403,
|
|
ExpectedContent: []string{`"data":{}`},
|
|
ExpectedEvents: map[string]int{"*": 0},
|
|
},
|
|
{
|
|
Name: "valid record auth token (same collection)",
|
|
Method: http.MethodGet,
|
|
URL: "/my/test/_users_auth_",
|
|
Headers: map[string]string{
|
|
"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjb2xsZWN0aW9uSWQiOiJfdXNlcnNfYXV0aF8iLCJleHAiOjI1MjQ2MDQ0NjEsImlkIjoiNHExeGxjbG1mbG9rdTMzIiwicmVmcmVzaGFibGUiOnRydWUsInR5cGUiOiJhdXRoIn0.AuFTIzCsdLEy-5adFzpjZzbqAdTP6Iu9B1wPBAxLBgo",
|
|
},
|
|
BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
|
|
e.Router.GET("/my/test/{collection}", func(e *core.RequestEvent) error {
|
|
return e.String(200, "test123")
|
|
}).Bind(apis.RequireSameCollectionContextAuth(""))
|
|
},
|
|
ExpectedStatus: 200,
|
|
ExpectedContent: []string{"test123"},
|
|
},
|
|
{
|
|
Name: "valid record auth token (non-matching/missing collection param)",
|
|
Method: http.MethodGet,
|
|
URL: "/my/test/_users_auth_",
|
|
Headers: map[string]string{
|
|
"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjb2xsZWN0aW9uSWQiOiJfdXNlcnNfYXV0aF8iLCJleHAiOjI1MjQ2MDQ0NjEsImlkIjoiNHExeGxjbG1mbG9rdTMzIiwicmVmcmVzaGFibGUiOnRydWUsInR5cGUiOiJhdXRoIn0.AuFTIzCsdLEy-5adFzpjZzbqAdTP6Iu9B1wPBAxLBgo",
|
|
},
|
|
BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
|
|
e.Router.GET("/my/test/{id}", func(e *core.RequestEvent) error {
|
|
return e.String(200, "test123")
|
|
}).Bind(apis.RequireSuperuserOrOwnerAuth(""))
|
|
},
|
|
ExpectedStatus: 403,
|
|
ExpectedContent: []string{`"data":{}`},
|
|
ExpectedEvents: map[string]int{"*": 0},
|
|
},
|
|
{
|
|
Name: "valid record auth token (matching custom collection param)",
|
|
Method: http.MethodGet,
|
|
URL: "/my/test/_users_auth_",
|
|
Headers: map[string]string{
|
|
"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjb2xsZWN0aW9uSWQiOiJfdXNlcnNfYXV0aF8iLCJleHAiOjI1MjQ2MDQ0NjEsImlkIjoiNHExeGxjbG1mbG9rdTMzIiwicmVmcmVzaGFibGUiOnRydWUsInR5cGUiOiJhdXRoIn0.AuFTIzCsdLEy-5adFzpjZzbqAdTP6Iu9B1wPBAxLBgo",
|
|
},
|
|
BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
|
|
e.Router.GET("/my/test/{test}", func(e *core.RequestEvent) error {
|
|
return e.String(200, "test123")
|
|
}).Bind(apis.RequireSuperuserOrOwnerAuth("test"))
|
|
},
|
|
ExpectedStatus: 403,
|
|
ExpectedContent: []string{`"data":{}`},
|
|
ExpectedEvents: map[string]int{"*": 0},
|
|
},
|
|
{
|
|
Name: "superuser no exception check",
|
|
Method: http.MethodGet,
|
|
URL: "/my/test/_users_auth_",
|
|
Headers: map[string]string{
|
|
"Authorization": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJjb2xsZWN0aW9uSWQiOiJoYmNfMzE0MjYzNTgyMyIsImV4cCI6MjUyNDYwNDQ2MSwiaWQiOiJzeXdiaGVjbmg0NnJobTAiLCJyZWZyZXNoYWJsZSI6dHJ1ZSwidHlwZSI6ImF1dGgifQ.CXBf8BazmUeg2RnJW8OEs1UFYF41rbCMOa6YZa4wZio",
|
|
},
|
|
BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
|
|
e.Router.GET("/my/test/{collection}", func(e *core.RequestEvent) error {
|
|
return e.String(200, "test123")
|
|
}).Bind(apis.RequireSameCollectionContextAuth(""))
|
|
},
|
|
ExpectedStatus: 403,
|
|
ExpectedContent: []string{`"data":{}`},
|
|
ExpectedEvents: map[string]int{"*": 0},
|
|
},
|
|
}
|
|
|
|
for _, scenario := range scenarios {
|
|
scenario.Test(t)
|
|
}
|
|
}
|
|
|
|
// TestExternalAuthGuard verifies that every retired Base auth surface is
|
|
// gone from the router (404) regardless of collection or external-only
|
|
// mode, and that auth-methods serves the generic IAM provider entry when
|
|
// external-only mode is active.
|
|
//
|
|
// The original handlers (auth-with-password, auth-with-oauth2,
|
|
// auth-with-otp, oauth2-redirect, all request/confirm flows, impersonate)
|
|
// were deleted in the IAM-native rip. The externalAuthGuard helper
|
|
// remains in apis for callers who want to attach the 410-Gone-with-
|
|
// Location behavior to their own routes, but nothing in core Base
|
|
// binds it any more.
|
|
func TestExternalAuthGuard(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
scenarios := []tests.ApiScenario{
|
|
{
|
|
Name: "auth-with-password is gone (router 404) for users",
|
|
Method: http.MethodPost,
|
|
URL: "/v1/collections/users/auth-with-password",
|
|
Body: strings.NewReader(`{"identity":"[email protected]","password":"1234567890"}`),
|
|
BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
|
|
app.Store().Set(apis.StoreKeyExternalAuthOnly, true)
|
|
},
|
|
ExpectedStatus: 404,
|
|
NotExpectedContent: []string{`This endpoint is retired`},
|
|
ExpectedEvents: map[string]int{"*": 0},
|
|
},
|
|
{
|
|
// _superusers used to be the last collection with a local-
|
|
// auth carve-out. It is no longer: the admin panel logs in
|
|
// via the IAM PKCE flow proxied at /v1/iam/oauth/authorize.
|
|
Name: "auth-with-password is gone (router 404) for _superusers",
|
|
Method: http.MethodPost,
|
|
URL: "/v1/collections/_superusers/auth-with-password",
|
|
Body: strings.NewReader(`{"identity":"[email protected]","password":"1234567890"}`),
|
|
BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
|
|
app.Store().Set(apis.StoreKeyExternalAuthOnly, true)
|
|
},
|
|
ExpectedStatus: 404,
|
|
NotExpectedContent: []string{`This endpoint is retired`},
|
|
ExpectedEvents: map[string]int{"*": 0},
|
|
},
|
|
{
|
|
Name: "auth-with-oauth2 is gone (router 404)",
|
|
Method: http.MethodPost,
|
|
URL: "/v1/collections/users/auth-with-oauth2",
|
|
Body: strings.NewReader(`{"provider":"google","code":"x","redirectURL":"http://localhost"}`),
|
|
BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
|
|
app.Store().Set(apis.StoreKeyExternalAuthOnly, true)
|
|
},
|
|
ExpectedStatus: 404,
|
|
NotExpectedContent: []string{`This endpoint is retired`},
|
|
ExpectedEvents: map[string]int{"*": 0},
|
|
},
|
|
{
|
|
Name: "auth-with-otp is gone (router 404)",
|
|
Method: http.MethodPost,
|
|
URL: "/v1/collections/users/auth-with-otp",
|
|
Body: strings.NewReader(`{"otpId":"x","password":"y"}`),
|
|
BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
|
|
app.Store().Set(apis.StoreKeyExternalAuthOnly, true)
|
|
},
|
|
ExpectedStatus: 404,
|
|
NotExpectedContent: []string{`This endpoint is retired`},
|
|
ExpectedEvents: map[string]int{"*": 0},
|
|
},
|
|
{
|
|
Name: "oauth2-redirect is gone (router 404)",
|
|
Method: http.MethodGet,
|
|
URL: "/v1/oauth2-redirect?state=x&code=y",
|
|
BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
|
|
app.Store().Set(apis.StoreKeyExternalAuthOnly, true)
|
|
},
|
|
ExpectedStatus: 404,
|
|
ExpectedContent: []string{`"status":404`},
|
|
ExpectedEvents: map[string]int{"*": 0},
|
|
},
|
|
{
|
|
Name: "request-otp is gone (router 404)",
|
|
Method: http.MethodPost,
|
|
URL: "/v1/collections/users/request-otp",
|
|
Body: strings.NewReader(`{"email":"[email protected]"}`),
|
|
BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
|
|
app.Store().Set(apis.StoreKeyExternalAuthOnly, true)
|
|
},
|
|
ExpectedStatus: 404,
|
|
NotExpectedContent: []string{`This endpoint is retired`},
|
|
ExpectedEvents: map[string]int{"*": 0},
|
|
},
|
|
{
|
|
Name: "request-password-reset is gone (router 404)",
|
|
Method: http.MethodPost,
|
|
URL: "/v1/collections/users/request-password-reset",
|
|
Body: strings.NewReader(`{"email":"[email protected]"}`),
|
|
BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
|
|
app.Store().Set(apis.StoreKeyExternalAuthOnly, true)
|
|
},
|
|
ExpectedStatus: 404,
|
|
NotExpectedContent: []string{`This endpoint is retired`},
|
|
ExpectedEvents: map[string]int{"*": 0},
|
|
},
|
|
{
|
|
Name: "auth-methods returns a single generic 'iam' oauth2 entry when external auth is on",
|
|
Method: http.MethodGet,
|
|
URL: "/v1/collections/users/auth-methods",
|
|
BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
|
|
app.Store().Set(apis.StoreKeyExternalAuthOnly, true)
|
|
app.Store().Set(apis.StoreKeyJWKSURL, "https://iam.example.com/.well-known/jwks")
|
|
},
|
|
ExpectedStatus: 200,
|
|
ExpectedContent: []string{
|
|
`"name":"iam"`,
|
|
`"oauth2":{"providers":[{"name":"iam"`,
|
|
`https://iam.example.com/oauth/authorize?response_type=code`,
|
|
},
|
|
// Base must not bake any specific brand name into the protocol layer.
|
|
NotExpectedContent: []string{`"hanzo"`, `"google"`, `"github"`},
|
|
},
|
|
}
|
|
|
|
for _, scenario := range scenarios {
|
|
scenario.Test(t)
|
|
}
|
|
}
|
|
|
|
func TestExternalAuthOnlySuperuserFallback(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
// superuser local token accepted in external-only mode
|
|
t.Run("superuser token accepted", func(t *testing.T) {
|
|
app, err := tests.NewTestApp()
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
defer app.Cleanup()
|
|
|
|
app.Store().Set(apis.StoreKeyExternalAuthOnly, true)
|
|
|
|
token, err := tests.GetSuperuserAuthToken(app, tests.TestSuperuserID1)
|
|
if err != nil {
|
|
t.Fatalf("failed to get superuser token: %v", err)
|
|
}
|
|
|
|
scenario := tests.ApiScenario{
|
|
Name: "superuser token in external mode",
|
|
Method: http.MethodGet,
|
|
URL: "/my/test",
|
|
Headers: map[string]string{
|
|
"Authorization": token,
|
|
},
|
|
TestAppFactory: func(t testing.TB) *tests.TestApp {
|
|
return app
|
|
},
|
|
DisableTestAppCleanup: true,
|
|
BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
|
|
e.Router.GET("/my/test", func(e *core.RequestEvent) error {
|
|
if e.Auth == nil {
|
|
return e.String(401, "no auth")
|
|
}
|
|
return e.String(200, "auth:"+e.Auth.Collection().Name+":"+e.Auth.Id)
|
|
})
|
|
},
|
|
ExpectedStatus: 200,
|
|
ExpectedContent: []string{"auth:_superusers:" + tests.TestSuperuserID1},
|
|
}
|
|
|
|
scenario.Test(t)
|
|
})
|
|
|
|
// regular user token rejected in external-only mode
|
|
t.Run("regular user token rejected", func(t *testing.T) {
|
|
app, err := tests.NewTestApp()
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
defer app.Cleanup()
|
|
|
|
app.Store().Set(apis.StoreKeyExternalAuthOnly, true)
|
|
|
|
token, err := tests.GetUserAuthToken(app, "users", tests.TestUserID1)
|
|
if err != nil {
|
|
t.Fatalf("failed to get user token: %v", err)
|
|
}
|
|
|
|
scenario := tests.ApiScenario{
|
|
Name: "regular user token in external mode",
|
|
Method: http.MethodGet,
|
|
URL: "/my/test",
|
|
Headers: map[string]string{
|
|
"Authorization": token,
|
|
},
|
|
TestAppFactory: func(t testing.TB) *tests.TestApp {
|
|
return app
|
|
},
|
|
DisableTestAppCleanup: true,
|
|
BeforeTestFunc: func(t testing.TB, app *tests.TestApp, e *core.ServeEvent) {
|
|
e.Router.GET("/my/test", func(e *core.RequestEvent) error {
|
|
if e.Auth == nil {
|
|
return e.String(401, "no auth")
|
|
}
|
|
return e.String(200, "auth:"+e.Auth.Collection().Name+":"+e.Auth.Id)
|
|
})
|
|
},
|
|
ExpectedStatus: 401,
|
|
ExpectedContent: []string{"no auth"},
|
|
}
|
|
|
|
scenario.Test(t)
|
|
})
|
|
}
|