From bf39f4421b8cccd6db312da6e062cdcd81182f17 Mon Sep 17 00:00:00 2001 From: MrMelon54 Date: Sun, 8 Oct 2023 15:24:59 +0100 Subject: [PATCH] Add loads of test cases --- cmd/lavender/conf.go | 15 ------ cmd/lavender/serve.go | 12 ++--- issuer/manager_test.go | 2 +- issuer/sso_test.go | 1 + server/conf.go | 15 ++++++ server/flow.go | 18 ++----- server/flow_test.go | 1 + server/{ => pages}/flow-callback.go.html | 0 server/{ => pages}/flow-popup.go.html | 0 server/pages/pages.go | 20 ++++++++ server/server.go | 45 +++++++++-------- server/verify.go | 2 +- server/verify_test.go | 61 ++++++++++++++++++++++++ 13 files changed, 131 insertions(+), 61 deletions(-) delete mode 100644 cmd/lavender/conf.go create mode 100644 issuer/sso_test.go create mode 100644 server/conf.go create mode 100644 server/flow_test.go rename server/{ => pages}/flow-callback.go.html (100%) rename server/{ => pages}/flow-popup.go.html (100%) create mode 100644 server/pages/pages.go create mode 100644 server/verify_test.go diff --git a/cmd/lavender/conf.go b/cmd/lavender/conf.go deleted file mode 100644 index c9b465f..0000000 --- a/cmd/lavender/conf.go +++ /dev/null @@ -1,15 +0,0 @@ -package main - -import ( - loginServiceManager "github.com/1f349/lavender/issuer" - "github.com/1f349/lavender/utils" -) - -type startUpConfig struct { - Listen string `json:"listen"` - BaseUrl string `json:"base_url"` - ServiceName string `json:"service_name"` - Issuer string `json:"issuer"` - SsoServices []loginServiceManager.SsoConfig `json:"sso_services"` - AllowedClients []utils.JsonUrl `json:"allowed_clients"` -} diff --git a/cmd/lavender/serve.go b/cmd/lavender/serve.go index 4f94ca7..881d222 100644 --- a/cmd/lavender/serve.go +++ b/cmd/lavender/serve.go @@ -5,7 +5,6 @@ import ( "crypto/rand" "encoding/json" "flag" - "github.com/1f349/lavender/issuer" "github.com/1f349/lavender/server" "github.com/1f349/violet/utils" exit_reload "github.com/MrMelon54/exit-reload" @@ -50,7 +49,7 @@ func (s *serveCmd) Execute(_ context.Context, _ *flag.FlagSet, _ ...interface{}) return subcommands.ExitFailure } - var config startUpConfig + var config server.Conf err = json.NewDecoder(openConf).Decode(&config) if err != nil { log.Println("[Lavender] Error: invalid config file: ", err) @@ -66,18 +65,13 @@ func (s *serveCmd) Execute(_ context.Context, _ *flag.FlagSet, _ ...interface{}) return subcommands.ExitSuccess } -func normalLoad(startUp startUpConfig, wd string) { +func normalLoad(startUp server.Conf, wd string) { mSign, err := mjwt.NewMJwtSignerFromFileOrCreate(startUp.Issuer, filepath.Join(wd, "lavender.private.key"), rand.Reader, 4096) if err != nil { log.Fatal("[Lavender] Failed to load or create MJWT signer:", err) } - manager, err := issuer.NewManager(startUp.SsoServices) - if err != nil { - log.Fatal("[Lavender] Failed to create SSO service manager: ", err) - } - - srv := server.NewHttpServer(startUp.Listen, startUp.BaseUrl, startUp.ServiceName, startUp.AllowedClients, manager, mSign) + srv := server.NewHttpServer(startUp, mSign) log.Printf("[Lavender] Starting HTTP server on '%s'\n", srv.Addr) go utils.RunBackgroundHttp("HTTP", srv) diff --git a/issuer/manager_test.go b/issuer/manager_test.go index bf829d0..143014e 100644 --- a/issuer/manager_test.go +++ b/issuer/manager_test.go @@ -22,7 +22,7 @@ func testBody() io.ReadCloser { return io.NopCloser(strings.NewReader("{}")) } -func TestManager_CheckIssuer(t *testing.T) { +func TestManager_CheckNamespace(t *testing.T) { httpGet = func(url string) (resp *http.Response, err error) { return &http.Response{StatusCode: http.StatusOK, Body: testBody()}, nil } diff --git a/issuer/sso_test.go b/issuer/sso_test.go new file mode 100644 index 0000000..de84991 --- /dev/null +++ b/issuer/sso_test.go @@ -0,0 +1 @@ +package issuer diff --git a/server/conf.go b/server/conf.go new file mode 100644 index 0000000..bb7ddbb --- /dev/null +++ b/server/conf.go @@ -0,0 +1,15 @@ +package server + +import ( + "github.com/1f349/lavender/issuer" + "github.com/1f349/lavender/utils" +) + +type Conf struct { + Listen string `json:"listen"` + BaseUrl string `json:"base_url"` + ServiceName string `json:"service_name"` + Issuer string `json:"issuer"` + SsoServices []issuer.SsoConfig `json:"sso_services"` + AllowedClients []utils.JsonUrl `json:"allowed_clients"` +} diff --git a/server/flow.go b/server/flow.go index 852100e..69ad3a5 100644 --- a/server/flow.go +++ b/server/flow.go @@ -18,16 +18,6 @@ import ( "time" ) -var ( - //go:embed flow-popup.go.html - flowPopupHtml string - flowPopupTemplate *template.Template - - //go:embed flow-callback.go.html - flowCallbackHtml string - flowCallbackTemplate *template.Template -) - func init() { pageParse, err := template.New("pages").Parse(flowPopupHtml) if err != nil { @@ -44,7 +34,7 @@ func init() { func (h *HttpServer) flowPopup(rw http.ResponseWriter, req *http.Request, _ httprouter.Params) { err := flowPopupTemplate.Execute(rw, map[string]any{ - "ServiceName": h.serviceName, + "ServiceName": h.conf.ServiceName, "Origin": req.URL.Query().Get("origin"), }) if err != nil { @@ -75,7 +65,7 @@ func (h *HttpServer) flowPopupPost(rw http.ResponseWriter, req *http.Request, _ // generate oauth2 config and redirect to authorize URL oa2conf := login.OAuth2Config - oa2conf.RedirectURL = h.baseUrl + "/callback" + oa2conf.RedirectURL = h.conf.BaseUrl + "/callback" nextUrl := oa2conf.AuthCodeURL(state, oauth2.SetAuthURLParam("login_name", loginName)) http.Redirect(rw, req, nextUrl, http.StatusFound) } @@ -101,7 +91,7 @@ func (h *HttpServer) flowCallback(rw http.ResponseWriter, req *http.Request, _ h } oa2conf := v.sso.OAuth2Config - oa2conf.RedirectURL = h.baseUrl + "/callback" + oa2conf.RedirectURL = h.conf.BaseUrl + "/callback" exchange, err := oa2conf.Exchange(context.Background(), q.Get("code")) if err != nil { fmt.Println("Failed exchange:", err) @@ -157,7 +147,7 @@ func (h *HttpServer) flowCallback(rw http.ResponseWriter, req *http.Request, _ h } _ = flowCallbackTemplate.Execute(rw, map[string]any{ - "ServiceName": h.serviceName, + "ServiceName": h.conf.ServiceName, "TargetOrigin": v.targetOrigin, "TargetMessage": v3, "AccessToken": accessToken, diff --git a/server/flow_test.go b/server/flow_test.go new file mode 100644 index 0000000..abb4e43 --- /dev/null +++ b/server/flow_test.go @@ -0,0 +1 @@ +package server diff --git a/server/flow-callback.go.html b/server/pages/flow-callback.go.html similarity index 100% rename from server/flow-callback.go.html rename to server/pages/flow-callback.go.html diff --git a/server/flow-popup.go.html b/server/pages/flow-popup.go.html similarity index 100% rename from server/flow-popup.go.html rename to server/pages/flow-popup.go.html diff --git a/server/pages/pages.go b/server/pages/pages.go new file mode 100644 index 0000000..e3f8618 --- /dev/null +++ b/server/pages/pages.go @@ -0,0 +1,20 @@ +package pages + +import ( + "embed" + _ "embed" + "html/template" + "os" +) + +var ( + //go:embed pages/* + flowPages embed.FS + flowTemplates *template.Template +) + +func LoadPages(wd string) { + wdFs := os.DirFS(wd) + + flowPages.Open() +} diff --git a/server/server.go b/server/server.go index f0447ad..7b0474b 100644 --- a/server/server.go +++ b/server/server.go @@ -4,21 +4,20 @@ import ( "fmt" "github.com/1f349/cache" "github.com/1f349/lavender/issuer" - "github.com/1f349/lavender/utils" "github.com/MrMelon54/mjwt" "github.com/julienschmidt/httprouter" + "log" "net/http" "time" ) type HttpServer struct { - r *httprouter.Router - baseUrl string - serviceName string - manager *issuer.Manager - signer mjwt.Signer - flowState *cache.Cache[string, flowStateData] - services map[string]struct{} + r *httprouter.Router + conf Conf + manager *issuer.Manager + signer mjwt.Signer + flowState *cache.Cache[string, flowStateData] + services map[string]struct{} } type flowStateData struct { @@ -26,30 +25,34 @@ type flowStateData struct { targetOrigin string } -func NewHttpServer(listen, baseUrl, serviceName string, clients []utils.JsonUrl, manager *issuer.Manager, signer mjwt.Signer) *http.Server { +func NewHttpServer(conf Conf, signer mjwt.Signer) *http.Server { r := httprouter.New() // remove last slash from baseUrl { - l := len(baseUrl) - if baseUrl[l-1] == '/' { - baseUrl = baseUrl[:l-1] + l := len(conf.BaseUrl) + if conf.BaseUrl[l-1] == '/' { + conf.BaseUrl = conf.BaseUrl[:l-1] } } + manager, err := issuer.NewManager(conf.SsoServices) + if err != nil { + log.Fatal("[Lavender] Failed to create SSO service manager: ", err) + } + services := make(map[string]struct{}) - for _, i := range clients { + for _, i := range conf.AllowedClients { services[i.String()] = struct{}{} } hs := &HttpServer{ - r: r, - baseUrl: baseUrl, - serviceName: serviceName, - manager: manager, - signer: signer, - flowState: cache.New[string, flowStateData](), - services: services, + r: r, + conf: conf, + manager: manager, + signer: signer, + flowState: cache.New[string, flowStateData](), + services: services, } r.GET("/", func(rw http.ResponseWriter, req *http.Request, _ httprouter.Params) { @@ -62,7 +65,7 @@ func NewHttpServer(listen, baseUrl, serviceName string, clients []utils.JsonUrl, r.GET("/callback", hs.flowCallback) return &http.Server{ - Addr: listen, + Addr: conf.Listen, Handler: r, ReadTimeout: time.Minute, ReadHeaderTimeout: time.Minute, diff --git a/server/verify.go b/server/verify.go index 67831c3..a813977 100644 --- a/server/verify.go +++ b/server/verify.go @@ -24,7 +24,7 @@ func (h *HttpServer) verifyHandler(rw http.ResponseWriter, req *http.Request, _ } // check issuer against config - if b.Issuer != h.baseUrl { + if b.Issuer != h.conf.Issuer { http.Error(rw, "Invalid issuer", http.StatusBadRequest) return } diff --git a/server/verify_test.go b/server/verify_test.go new file mode 100644 index 0000000..42862bd --- /dev/null +++ b/server/verify_test.go @@ -0,0 +1,61 @@ +package server + +import ( + "crypto/rand" + "crypto/rsa" + "github.com/MrMelon54/mjwt" + "github.com/MrMelon54/mjwt/auth" + "github.com/MrMelon54/mjwt/claims" + "github.com/julienschmidt/httprouter" + "github.com/stretchr/testify/assert" + "net/http" + "net/http/httptest" + "testing" + "time" +) + +func TestVerifyHandler(t *testing.T) { + privKey, err := rsa.GenerateKey(rand.Reader, 2048) + assert.NoError(t, err) + + invalidSigner := mjwt.NewMJwtSigner("Invalid Issuer", privKey) + h := HttpServer{ + conf: Conf{Issuer: "Test Issuer"}, + signer: mjwt.NewMJwtSigner("Test Issuer", privKey), + } + + // test for missing bearer response + rec := httptest.NewRecorder() + req := httptest.NewRequest(http.MethodPost, "https://example.localhost", nil) + h.verifyHandler(rec, req, httprouter.Params{}) + assert.Equal(t, http.StatusForbidden, rec.Code) + assert.Equal(t, "Missing bearer\n", rec.Body.String()) + + // test for invalid token response + rec = httptest.NewRecorder() + req.Header.Set("Authorization", "Bearer abcd") + h.verifyHandler(rec, req, httprouter.Params{}) + assert.Equal(t, http.StatusForbidden, rec.Code) + assert.Equal(t, "Invalid token\n", rec.Body.String()) + + // test for invalid issuer response + rec = httptest.NewRecorder() + accessToken, err := invalidSigner.GenerateJwt("a", "a", nil, 15*time.Minute, auth.AccessTokenClaims{ + Perms: claims.NewPermStorage(), + }) + assert.NoError(t, err) + req.Header.Set("Authorization", "Bearer "+accessToken) + h.verifyHandler(rec, req, httprouter.Params{}) + assert.Equal(t, http.StatusBadRequest, rec.Code) + assert.Equal(t, "Invalid issuer\n", rec.Body.String()) + + // test for invalid issuer response + rec = httptest.NewRecorder() + accessToken, err = h.signer.GenerateJwt("a", "a", nil, 15*time.Minute, auth.AccessTokenClaims{ + Perms: claims.NewPermStorage(), + }) + assert.NoError(t, err) + req.Header.Set("Authorization", "Bearer "+accessToken) + h.verifyHandler(rec, req, httprouter.Params{}) + assert.Equal(t, http.StatusOK, rec.Code) +}