65 lines
1.6 KiB
Go
65 lines
1.6 KiB
Go
package httpapi
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
)
|
|
|
|
func TestLoopbackAdminOnlyAllowsLoopbackAddresses(t *testing.T) {
|
|
for _, remoteAddress := range []string{
|
|
"127.0.0.1:12345",
|
|
"[::1]:12345",
|
|
} {
|
|
t.Run(remoteAddress, func(t *testing.T) {
|
|
router := gin.New()
|
|
router.Use(requestIDMiddleware(), loopbackAdminOnly())
|
|
router.GET("/tasks", func(ctx *gin.Context) {
|
|
ctx.Status(http.StatusNoContent)
|
|
})
|
|
request := httptest.NewRequest(http.MethodGet, "/tasks", nil)
|
|
request.RemoteAddr = remoteAddress
|
|
response := httptest.NewRecorder()
|
|
|
|
router.ServeHTTP(response, request)
|
|
|
|
if response.Code != http.StatusNoContent {
|
|
t.Fatalf("status = %d", response.Code)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestLoopbackAdminOnlyRejectsRemoteOrMalformedAddresses(t *testing.T) {
|
|
for _, remoteAddress := range []string{
|
|
"192.0.2.1:12345",
|
|
"not-an-address",
|
|
} {
|
|
t.Run(remoteAddress, func(t *testing.T) {
|
|
router := gin.New()
|
|
router.Use(requestIDMiddleware(), loopbackAdminOnly())
|
|
router.GET("/tasks", func(ctx *gin.Context) {
|
|
ctx.Status(http.StatusNoContent)
|
|
})
|
|
request := httptest.NewRequest(http.MethodGet, "/tasks", nil)
|
|
request.RemoteAddr = remoteAddress
|
|
response := httptest.NewRecorder()
|
|
|
|
router.ServeHTTP(response, request)
|
|
|
|
if response.Code != http.StatusForbidden {
|
|
t.Fatalf("status = %d", response.Code)
|
|
}
|
|
assertErrorCode(t, response, "ADMIN_SESSION_REQUIRED")
|
|
if response.Header().Get("Cache-Control") != "no-store" {
|
|
t.Fatalf(
|
|
"Cache-Control = %q",
|
|
response.Header().Get("Cache-Control"),
|
|
)
|
|
}
|
|
})
|
|
}
|
|
}
|