63 lines
2.3 KiB
Go
63 lines
2.3 KiB
Go
package api
|
|
|
|
import (
|
|
"io"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
|
|
"github.com/ponzischeme89/memby/server/internal/config"
|
|
)
|
|
|
|
func TestAdminReleaseBuilderRelaysWithoutExposingToken(t *testing.T) {
|
|
var receivedAuth string
|
|
builder := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
receivedAuth = r.Header.Get("Authorization")
|
|
if r.Method != http.MethodPost || r.URL.Path != "/v1/releases" {
|
|
t.Fatalf("builder request = %s %s", r.Method, r.URL.Path)
|
|
}
|
|
body, _ := io.ReadAll(r.Body)
|
|
if !strings.Contains(string(body), `"tag":"v0.2.64"`) || !strings.Contains(string(body), `"mandatory":true`) {
|
|
t.Fatalf("builder body = %s", body)
|
|
}
|
|
w.Header().Set("Content-Type", "application/json")
|
|
w.WriteHeader(http.StatusAccepted)
|
|
_, _ = io.WriteString(w, `{"state":"running","logs":[]}`)
|
|
}))
|
|
defer builder.Close()
|
|
|
|
s := &Server{cfg: config.Config{ReleaseBuilderURL: builder.URL, ReleasePublishToken: "release-secret"}}
|
|
recorder := httptest.NewRecorder()
|
|
request := httptest.NewRequest(http.MethodPost, "/admin/api/release-builder",
|
|
strings.NewReader(`{"tag":"v0.2.64","notes":"Living room polish","mandatory":true}`))
|
|
s.handleAdminReleaseBuilderStart(recorder, request)
|
|
|
|
if recorder.Code != http.StatusAccepted || receivedAuth != "Bearer release-secret" {
|
|
t.Fatalf("response/auth = %d/%q", recorder.Code, receivedAuth)
|
|
}
|
|
if strings.Contains(recorder.Body.String(), "release-secret") {
|
|
t.Fatal("release token was exposed to the browser")
|
|
}
|
|
}
|
|
|
|
func TestAdminReleaseBuilderValidatesTagBeforeRelay(t *testing.T) {
|
|
s := &Server{cfg: config.Config{ReleaseBuilderURL: "http://builder", ReleasePublishToken: "secret"}}
|
|
recorder := httptest.NewRecorder()
|
|
request := httptest.NewRequest(http.MethodPost, "/admin/api/release-builder",
|
|
strings.NewReader(`{"tag":"latest; rm -rf /"}`))
|
|
s.handleAdminReleaseBuilderStart(recorder, request)
|
|
if recorder.Code != http.StatusBadRequest {
|
|
t.Fatalf("invalid tag status = %d, want 400", recorder.Code)
|
|
}
|
|
}
|
|
|
|
func TestAdminReleaseBuilderIsUnavailableWhenUnconfigured(t *testing.T) {
|
|
s := &Server{}
|
|
recorder := httptest.NewRecorder()
|
|
s.handleAdminReleaseBuilderStatus(recorder, httptest.NewRequest(http.MethodGet, "/admin/api/release-builder", nil))
|
|
if recorder.Code != http.StatusServiceUnavailable {
|
|
t.Fatalf("unconfigured builder status = %d, want 503", recorder.Code)
|
|
}
|
|
}
|