mirror of
https://github.com/hanzoai/base.git
synced 2026-10-21 03:41:50 +00:00
zeekay
054d65663a
Base's own registry was already org-native in every method — OrgDB(orgID), HasOrg(orgID), orgDir(orgID) — and only the type names said tenant. So this is the vocabulary catching up with the code, not a change of behaviour. TenantRegistry -> Bases app.Bases().OrgDB(org) TenantConfig -> BasesConfig MultiTenant -> PerOrg it enables per-org databases; say that MULTI_TENANT -> MULTI_BASE core/tenant.go -> core/bases.go Tenant was the wrong noun twice over: it is the multi-tenancy word, and this product's unit is the thing a customer creates per org — a Base. Identity here is org, user, project, and nothing else. The UI never said it; this was Go-side only. 64 packages green. One test was collateral and is fixed rather than renamed: TestToHTTPHeader asserts a pure snake_case-to-Header-Case transform, so rewriting its EXPECTED value while its input stayed "tenant_id" made it assert something false. The case is dropped — org_id already covers that transform.
36 lines
1.1 KiB
Go
36 lines
1.1 KiB
Go
package claims
|
|
|
|
import (
|
|
"net/http"
|
|
"testing"
|
|
)
|
|
|
|
// Every header the gateway strips must also be stripped here. This list is
|
|
// duplicated from gateway/iamauth.StripIdentityHeaderNames because the two
|
|
// modules do not import each other — which is exactly why it needs a test:
|
|
// the copies drifted, and the ones that went missing were the payer
|
|
// (X-Billing-Account-Id, X-User-Owner) and the permission set. A service
|
|
// behind this middleware and not behind the gateway trusted whatever the
|
|
// client sent.
|
|
func TestStripsEveryGatewayIdentityHeader(t *testing.T) {
|
|
mustStrip := []string{
|
|
"X-User-Id", "X-Org-Id", "X-User-Owner", "X-Roles",
|
|
"X-User-Permissions", "X-User-Email", "X-Phone-Number",
|
|
"X-User-IsAdmin", "X-User-IsGlobalAdmin", "X-Project-Id",
|
|
"X-Billing-Account-Id", "X-User-Role", "X-User-Roles",
|
|
"X-User-Name", "X-Base-Id", "X-Base-ID", "X-Org",
|
|
}
|
|
|
|
h := http.Header{}
|
|
for _, name := range mustStrip {
|
|
h.Set(name, "forged-by-the-client")
|
|
}
|
|
StripIdentityHeaders(h)
|
|
|
|
for _, name := range mustStrip {
|
|
if got := h.Get(name); got != "" {
|
|
t.Errorf("%s survived as %q — a client can forge it", name, got)
|
|
}
|
|
}
|
|
}
|