98dd09847a
- Registry neither-interface, nil-registry, and authenticate default - MemoryStore sweep actually drops expired entries - RegisterHouseMiddlewareFactory duplicate-name failure - pathScopedCORS unmatched path plus empty-raw-group introspection - Time UnmarshalJSON +00:00/Z and PublicOnlyMode host/IP cases
93 lines
3.1 KiB
Go
93 lines
3.1 KiB
Go
package surf
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
)
|
|
|
|
// Gap (d): pathScopedCORS with a path matching NONE of the configured
|
|
// globs. TestCORSPathScopedHeaders already covers the two named fonoteka
|
|
// groups; this fixture is framework-only (/healthz vs api/*).
|
|
|
|
func TestCORSPathScopedNoMatchIndependentOfFonoteka(t *testing.T) {
|
|
cfg := CORSConfig{
|
|
Paths: []string{"api/*", "oauth/mcp/*"},
|
|
AllowedMethods: []string{"*"},
|
|
AllowedOrigins: []string{"*"},
|
|
AllowedHeaders: []string{"*"},
|
|
}
|
|
inner := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
w.WriteHeader(http.StatusNoContent)
|
|
})
|
|
h := pathScopedCORS(cfg, inner)
|
|
|
|
rec := httptest.NewRecorder()
|
|
h.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/healthz", nil))
|
|
if rec.Code != http.StatusNoContent {
|
|
t.Fatalf("status = %d", rec.Code)
|
|
}
|
|
if got := rec.Header().Get("Access-Control-Allow-Origin"); got != "" {
|
|
t.Fatalf("unmatched path must not set ACAO, got %q", got)
|
|
}
|
|
}
|
|
|
|
func TestCORSAllowOriginExactAndPattern(t *testing.T) {
|
|
cfg := CORSConfig{
|
|
Paths: []string{"api/*"},
|
|
AllowedMethods: []string{"GET", "POST"},
|
|
AllowedOrigins: []string{"https://app.example.test"},
|
|
AllowedOriginsPatterns: []string{`^https://.*\.example\.test$`},
|
|
AllowedHeaders: []string{"Authorization", "Content-Type"},
|
|
ExposedHeaders: []string{"X-RateLimit-Limit"},
|
|
MaxAge: 600,
|
|
SupportsCredentials: true,
|
|
}
|
|
inner := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
w.WriteHeader(http.StatusOK)
|
|
})
|
|
h := pathScopedCORS(cfg, inner)
|
|
|
|
t.Run("exact origin", func(t *testing.T) {
|
|
req := httptest.NewRequest(http.MethodGet, "/api/v1/items", nil)
|
|
req.Header.Set("Origin", "https://app.example.test")
|
|
rec := httptest.NewRecorder()
|
|
h.ServeHTTP(rec, req)
|
|
if rec.Header().Get("Access-Control-Allow-Origin") != "https://app.example.test" {
|
|
t.Fatalf("ACAO = %q", rec.Header().Get("Access-Control-Allow-Origin"))
|
|
}
|
|
if rec.Header().Get("Vary") != "Origin" {
|
|
t.Fatalf("Vary = %q", rec.Header().Get("Vary"))
|
|
}
|
|
if rec.Header().Get("Access-Control-Allow-Credentials") != "true" {
|
|
t.Fatal("missing credentials header")
|
|
}
|
|
if rec.Header().Get("Access-Control-Max-Age") != "600" {
|
|
t.Fatalf("Max-Age = %q", rec.Header().Get("Access-Control-Max-Age"))
|
|
}
|
|
})
|
|
|
|
t.Run("pattern origin", func(t *testing.T) {
|
|
req := httptest.NewRequest(http.MethodOptions, "/api/v1/items", nil)
|
|
req.Header.Set("Origin", "https://admin.example.test")
|
|
rec := httptest.NewRecorder()
|
|
h.ServeHTTP(rec, req)
|
|
if rec.Code != http.StatusNoContent {
|
|
t.Fatalf("preflight status = %d", rec.Code)
|
|
}
|
|
if rec.Header().Get("Access-Control-Allow-Origin") != "https://admin.example.test" {
|
|
t.Fatalf("ACAO = %q", rec.Header().Get("Access-Control-Allow-Origin"))
|
|
}
|
|
})
|
|
|
|
t.Run("disallowed origin", func(t *testing.T) {
|
|
req := httptest.NewRequest(http.MethodGet, "/api/v1/items", nil)
|
|
req.Header.Set("Origin", "https://evil.test")
|
|
rec := httptest.NewRecorder()
|
|
h.ServeHTTP(rec, req)
|
|
if got := rec.Header().Get("Access-Control-Allow-Origin"); got != "" {
|
|
t.Fatalf("disallowed origin ACAO = %q", got)
|
|
}
|
|
})
|
|
}
|