mirror of
https://github.com/hanzoai/tasks.git
synced 2026-10-04 02:04:03 +00:00
stuart-wellsandGitHub
28fb98c825
## What changed? Adds JWT to server-to-server connections. Frontend already had support for reading auth so this focuses on getting a token and injecting it. ## Why? s2s is currently a gap in the auth abilities. This provides more flexibility for users based on their auth requirements. ## How did you test it? - [x] built - [x] run locally and tested manually - [x] covered by existing tests - [x] added new unit test(s) - [x] added new functional test(s) ## Potential risks Need to get auth right. Main risk is a user believing they are secure when they are not.
70 lines
1.9 KiB
Go
70 lines
1.9 KiB
Go
package auth
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"sync/atomic"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestTokenCredentials_AttachesBearerHeader(t *testing.T) {
|
|
t.Parallel()
|
|
callCount := atomic.Int32{}
|
|
creds := NewTokenCredentials("authorization", func(context.Context) (string, error) {
|
|
callCount.Add(1)
|
|
return "the-token", nil
|
|
})
|
|
|
|
md, err := creds.GetRequestMetadata(context.Background())
|
|
require.NoError(t, err)
|
|
require.Equal(t, "Bearer the-token", md["authorization"])
|
|
require.Equal(t, int32(1), callCount.Load())
|
|
}
|
|
|
|
func TestTokenCredentials_CallsFetchEveryTime(t *testing.T) {
|
|
t.Parallel()
|
|
// TokenCredentials does no caching — the provider owns the lifecycle.
|
|
callCount := atomic.Int32{}
|
|
creds := NewTokenCredentials("authorization", func(context.Context) (string, error) {
|
|
callCount.Add(1)
|
|
return "the-token", nil
|
|
})
|
|
|
|
for range 5 {
|
|
_, err := creds.GetRequestMetadata(context.Background())
|
|
require.NoError(t, err)
|
|
}
|
|
require.Equal(t, int32(5), callCount.Load())
|
|
}
|
|
|
|
func TestTokenCredentials_PropagatesFetchError(t *testing.T) {
|
|
t.Parallel()
|
|
creds := NewTokenCredentials("authorization", func(context.Context) (string, error) {
|
|
return "", errors.New("token server unavailable")
|
|
})
|
|
|
|
_, err := creds.GetRequestMetadata(context.Background())
|
|
require.ErrorContains(t, err, "token server unavailable")
|
|
}
|
|
|
|
func TestTokenCredentials_EmptyTokenReturnsNilMetadata(t *testing.T) {
|
|
t.Parallel()
|
|
creds := NewTokenCredentials("authorization", func(context.Context) (string, error) {
|
|
return "", nil
|
|
})
|
|
|
|
md, err := creds.GetRequestMetadata(context.Background())
|
|
require.NoError(t, err)
|
|
require.Nil(t, md)
|
|
}
|
|
|
|
func TestTokenCredentials_RequireTransportSecurity(t *testing.T) {
|
|
t.Parallel()
|
|
creds := NewTokenCredentials("authorization", func(context.Context) (string, error) {
|
|
return "token", nil
|
|
})
|
|
require.True(t, creds.RequireTransportSecurity(), "production credentials must require TLS")
|
|
}
|