Luciano Milani
118 lines
3.3 KiB
Go
118 lines
3.3 KiB
Go
package auth_test
|
|
|
|
import (
|
|
"net/http/httptest"
|
|
"testing"
|
|
|
|
"github.com/gofiber/fiber/v2"
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
|
|
"github.com/techxcar/backend/internal/auth"
|
|
)
|
|
|
|
func TestRequireAuth_missingHeader(t *testing.T) {
|
|
app := fiber.New()
|
|
app.Get("/protected", auth.RequireAuth(testSecret), func(c *fiber.Ctx) error {
|
|
return c.SendString("ok")
|
|
})
|
|
|
|
req := httptest.NewRequest("GET", "/protected", nil)
|
|
resp, err := app.Test(req)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, 401, resp.StatusCode)
|
|
}
|
|
|
|
func TestRequireAuth_validToken(t *testing.T) {
|
|
token, _ := auth.GenerateAccessToken("user-1", "tenant-1", "manager", testSecret)
|
|
|
|
app := fiber.New()
|
|
app.Get("/protected", auth.RequireAuth(testSecret), func(c *fiber.Ctx) error {
|
|
claims := c.Locals("claims").(*auth.Claims)
|
|
return c.SendString(claims.UserID)
|
|
})
|
|
|
|
req := httptest.NewRequest("GET", "/protected", nil)
|
|
req.Header.Set("Authorization", "Bearer "+token)
|
|
resp, err := app.Test(req)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, 200, resp.StatusCode)
|
|
}
|
|
|
|
func TestRequireAuth_invalidToken(t *testing.T) {
|
|
app := fiber.New()
|
|
app.Get("/protected", auth.RequireAuth(testSecret), func(c *fiber.Ctx) error {
|
|
return c.SendString("ok")
|
|
})
|
|
|
|
req := httptest.NewRequest("GET", "/protected", nil)
|
|
req.Header.Set("Authorization", "Bearer invalid.token.here")
|
|
resp, err := app.Test(req)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, 401, resp.StatusCode)
|
|
}
|
|
|
|
func TestRequireRole_allowed(t *testing.T) {
|
|
token, _ := auth.GenerateAccessToken("user-1", "", "super_admin", testSecret)
|
|
|
|
app := fiber.New()
|
|
app.Get("/admin",
|
|
auth.RequireAuth(testSecret),
|
|
auth.RequireRole("super_admin"),
|
|
func(c *fiber.Ctx) error { return c.SendString("ok") },
|
|
)
|
|
|
|
req := httptest.NewRequest("GET", "/admin", nil)
|
|
req.Header.Set("Authorization", "Bearer "+token)
|
|
resp, err := app.Test(req)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, 200, resp.StatusCode)
|
|
}
|
|
|
|
func TestRequireRole_forbidden(t *testing.T) {
|
|
token, _ := auth.GenerateAccessToken("user-1", "t-1", "technician", testSecret)
|
|
|
|
app := fiber.New()
|
|
app.Get("/admin",
|
|
auth.RequireAuth(testSecret),
|
|
auth.RequireRole("super_admin", "tenant_admin"),
|
|
func(c *fiber.Ctx) error { return c.SendString("ok") },
|
|
)
|
|
|
|
req := httptest.NewRequest("GET", "/admin", nil)
|
|
req.Header.Set("Authorization", "Bearer "+token)
|
|
resp, err := app.Test(req)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, 403, resp.StatusCode)
|
|
}
|
|
|
|
func TestRequireRole_allowsMatchingRole(t *testing.T) {
|
|
app := fiber.New()
|
|
app.Use(func(c *fiber.Ctx) error {
|
|
c.Locals("claims", &auth.Claims{Role: "tenant_admin"})
|
|
return c.Next()
|
|
})
|
|
app.Get("/test", auth.RequireRole("tenant_admin"), func(c *fiber.Ctx) error {
|
|
return c.SendStatus(200)
|
|
})
|
|
req := httptest.NewRequest("GET", "/test", nil)
|
|
resp, err := app.Test(req)
|
|
assert.NoError(t, err)
|
|
assert.Equal(t, 200, resp.StatusCode)
|
|
}
|
|
|
|
func TestRequireRole_rejectsMismatch(t *testing.T) {
|
|
app := fiber.New()
|
|
app.Use(func(c *fiber.Ctx) error {
|
|
c.Locals("claims", &auth.Claims{Role: "technician"})
|
|
return c.Next()
|
|
})
|
|
app.Get("/test", auth.RequireRole("super_admin"), func(c *fiber.Ctx) error {
|
|
return c.SendStatus(200)
|
|
})
|
|
req := httptest.NewRequest("GET", "/test", nil)
|
|
resp, err := app.Test(req)
|
|
assert.NoError(t, err)
|
|
assert.Equal(t, 403, resp.StatusCode)
|
|
}
|