mirror of
https://github.com/hanzoai/commerce.git
synced 2026-10-30 15:08:42 +00:00
89a7c70a89
A card subscription took any in-org userId, so a member could open a plan for another member and pay with that member's credits or balance. A caller who is not an org admin, SuperAdmin or service now subscribes their own account whatever userId names; the org's own account stays its admins'. EdgeAuth's strip list is authz.Headers plus authz.Retired, so X-User-IsOrgAdmin and X-Billing-Account-Id can no longer be set by a client; X-User-IsOrgAdmin is minted only from a verified token whose own org the request acts in. Every site the ecosystem rule decides has a test that fails under the old prefix rule, including red's repro tests. Co-authored-by: Hanzo Dev <[email protected]>
22 lines
706 B
Go
22 lines
706 B
Go
package middleware
|
|
|
|
import (
|
|
"net/http/httptest"
|
|
"testing"
|
|
)
|
|
|
|
// X-User-IsOrgAdmin is an authority header: iammiddleware.ActsAsOrgAdmin and
|
|
// isOrgAdmin both read it. The edge's strip set must remove every authority header
|
|
// the downstream trusts, so none survives from the client side.
|
|
func TestRed_EdgeAuth_StripsOrgAdminHeader(t *testing.T) {
|
|
t.Setenv("COMMERCE_EDGE_AUTH", "true")
|
|
|
|
req := httptest.NewRequest("POST", "/v1/billing/subscribe/card", nil)
|
|
req.Header.Set("X-User-IsOrgAdmin", "true")
|
|
|
|
_, headers := runEdgeAuth(t, req, "X-User-IsOrgAdmin")
|
|
if got := headers["X-User-IsOrgAdmin"]; got != "" {
|
|
t.Fatalf("EdgeAuth(enabled) left client-sent X-User-IsOrgAdmin=%q in place", got)
|
|
}
|
|
}
|