46 lines
1.8 KiB
Go
46 lines
1.8 KiB
Go
package factorhttp
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
|
|
sresponse "git.sendico.io/tech/sxchnge/product/auth/response"
|
|
customer "git.sendico.io/tech/sxchnge/product/customers/model"
|
|
api "git.sendico.io/tech/sxchnge/shared/http"
|
|
mservice "git.sendico.io/tech/sxchnge/shared/service"
|
|
"github.com/stretchr/testify/require"
|
|
"go.uber.org/zap"
|
|
)
|
|
|
|
type accountRoutes map[string]sresponse.AccountHandlerFunc
|
|
|
|
func (r accountRoutes) AccountHandler(_ mservice.Type, path string, _ api.HTTPMethod, h sresponse.AccountHandlerFunc) {
|
|
r[path] = h
|
|
}
|
|
|
|
func TestSettingsTransportRejectsCallerOwnedScopeAndDestinationOverrides(t *testing.T) {
|
|
routes := accountRoutes{}
|
|
Install(routes, nil, zap.NewNop())
|
|
// Every route is registered through the authenticated-account contract.
|
|
require.Len(t, routes, 6)
|
|
for _, tc := range []struct{ path, body string }{
|
|
{"/two-factor/enroll", `{"channel":"email","address":"a@example.com","subject":"other-account"}`},
|
|
{"/two-factor/enroll/verify", `{"challengeId":"id","code":"123456","purpose":"login"}`},
|
|
{"/two-factor/preference", `{"factorId":"id","address":"arbitrary@example.com"}`},
|
|
{"/two-factor/preference/verify", `{"factorId":"id","code":"123456","verified":true}`},
|
|
{"/two-factor/resend", `{"challengeId":"id","target":"arbitrary@example.com"}`},
|
|
{"/two-factor/enroll", `{"channel":"email"} {"channel":"sms"}`},
|
|
} {
|
|
t.Run(tc.path+tc.body, func(t *testing.T) {
|
|
req := httptest.NewRequest(http.MethodPost, tc.path, strings.NewReader(tc.body))
|
|
w := httptest.NewRecorder()
|
|
routes[tc.path](req, &customer.Account{}, nil).ServeHTTP(w, req)
|
|
require.Equal(t, http.StatusBadRequest, w.Code, w.Body.String())
|
|
require.Equal(t, "no-store", w.Header().Get("Cache-Control"))
|
|
require.NotContains(t, w.Body.String(), "arbitrary@example.com")
|
|
})
|
|
}
|
|
}
|