49 lines
2.1 KiB
Go
49 lines
2.1 KiB
Go
package main
|
|
|
|
import (
|
|
"crypto/hmac"
|
|
"crypto/sha256"
|
|
"encoding/hex"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strconv"
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
)
|
|
|
|
func TestInternalCultivateRequiresSignedServiceRequest(t *testing.T) {
|
|
previous := internalAPI
|
|
defer func() { internalAPI = previous }()
|
|
internalAPI = internalAPIRuntime{config: internalAPIConfig{Enabled: true, Services: map[string]internalAPIServiceConfig{"hotgo-admin": {Secret: "secret"}}}}
|
|
req := httptest.NewRequest(http.MethodPost, "/internal/cultivate/tenants/default/users/batch", strings.NewReader(`{"user_ids":[1]}`))
|
|
rec := httptest.NewRecorder()
|
|
serveInternalCultivate(rec, req, "/internal/cultivate/")
|
|
if rec.Code != http.StatusUnauthorized {
|
|
t.Fatalf("status=%d body=%s", rec.Code, rec.Body.String())
|
|
}
|
|
}
|
|
|
|
func TestInternalCultivateUsesSharedInternalCredential(t *testing.T) {
|
|
previous := internalAPI
|
|
defer func() { internalAPI = previous }()
|
|
internalAPI = internalAPIRuntime{config: internalAPIConfig{Enabled: true, TimeWindowSeconds: 300, Services: map[string]internalAPIServiceConfig{
|
|
"hotgo-admin": {Secret: "shared-secret", Allow: []string{"admin_query"}},
|
|
"cultivate-server": {Secret: "ignored-separate-secret", Allow: []string{"cultivate"}},
|
|
}}}
|
|
req := httptest.NewRequest(http.MethodPost, "/internal/cultivate/tenants/default/users/batch", strings.NewReader(`{"user_ids":[1]}`))
|
|
req.Header.Set(internalHeaderService, "cultivate-server")
|
|
timestamp := strconv.FormatInt(time.Now().Unix(), 10)
|
|
req.Header.Set(internalHeaderTimestamp, timestamp)
|
|
req.Header.Set(internalHeaderNonce, "nonce")
|
|
bodyHash := sha256.Sum256([]byte(`{"user_ids":[1]}`))
|
|
signingText := strings.Join([]string{req.Method, req.URL.RequestURI(), hex.EncodeToString(bodyHash[:]), timestamp, "nonce"}, "\n")
|
|
mac := hmac.New(sha256.New, []byte("shared-secret"))
|
|
_, _ = mac.Write([]byte(signingText))
|
|
req.Header.Set(internalHeaderSignature, hex.EncodeToString(mac.Sum(nil)))
|
|
rec := httptest.NewRecorder()
|
|
if !authorizeInternalAPI(rec, req) {
|
|
t.Fatalf("shared internal credential was rejected: status=%d body=%s", rec.Code, rec.Body.String())
|
|
}
|
|
}
|