0.2.64 update

server/internal/api/release_builder_test.go

@@ -0,0 +1,62 @@
+package api
+
+import (
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/ponzischeme89/memby/server/internal/config"
+)
+
+func TestAdminReleaseBuilderRelaysWithoutExposingToken(t *testing.T) {
+	var receivedAuth string
+	builder := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		receivedAuth = r.Header.Get("Authorization")
+		if r.Method != http.MethodPost || r.URL.Path != "/v1/releases" {
+			t.Fatalf("builder request = %s %s", r.Method, r.URL.Path)
+		}
+		body, _ := io.ReadAll(r.Body)
+		if !strings.Contains(string(body), `"tag":"v0.2.64"`) || !strings.Contains(string(body), `"mandatory":true`) {
+			t.Fatalf("builder body = %s", body)
+		}
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusAccepted)
+		_, _ = io.WriteString(w, `{"state":"running","logs":[]}`)
+	}))
+	defer builder.Close()
+
+	s := &Server{cfg: config.Config{ReleaseBuilderURL: builder.URL, ReleasePublishToken: "release-secret"}}
+	recorder := httptest.NewRecorder()
+	request := httptest.NewRequest(http.MethodPost, "/admin/api/release-builder",
+		strings.NewReader(`{"tag":"v0.2.64","notes":"Living room polish","mandatory":true}`))
+	s.handleAdminReleaseBuilderStart(recorder, request)
+
+	if recorder.Code != http.StatusAccepted || receivedAuth != "Bearer release-secret" {
+		t.Fatalf("response/auth = %d/%q", recorder.Code, receivedAuth)
+	}
+	if strings.Contains(recorder.Body.String(), "release-secret") {
+		t.Fatal("release token was exposed to the browser")
+	}
+}
+
+func TestAdminReleaseBuilderValidatesTagBeforeRelay(t *testing.T) {
+	s := &Server{cfg: config.Config{ReleaseBuilderURL: "http://builder", ReleasePublishToken: "secret"}}
+	recorder := httptest.NewRecorder()
+	request := httptest.NewRequest(http.MethodPost, "/admin/api/release-builder",
+		strings.NewReader(`{"tag":"latest; rm -rf /"}`))
+	s.handleAdminReleaseBuilderStart(recorder, request)
+	if recorder.Code != http.StatusBadRequest {
+		t.Fatalf("invalid tag status = %d, want 400", recorder.Code)
+	}
+}
+
+func TestAdminReleaseBuilderIsUnavailableWhenUnconfigured(t *testing.T) {
+	s := &Server{}
+	recorder := httptest.NewRecorder()
+	s.handleAdminReleaseBuilderStatus(recorder, httptest.NewRequest(http.MethodGet, "/admin/api/release-builder", nil))
+	if recorder.Code != http.StatusServiceUnavailable {
+		t.Fatalf("unconfigured builder status = %d, want 503", recorder.Code)
+	}
+}