47 lines
1.8 KiB
Go
47 lines
1.8 KiB
Go
package sresponse
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
|
|
"git.sendico.io/tech/sxchnge/bff/edge/shared/auth/browser"
|
|
"git.sendico.io/tech/sxchnge/bff/pkg/model"
|
|
"github.com/stretchr/testify/require"
|
|
"go.uber.org/zap"
|
|
)
|
|
|
|
func TestBrowserLoginMovesRefreshCredentialToHttpOnlyCookie(t *testing.T) {
|
|
refresh := &TokenData{Token: "refresh-secret", Expiration: time.Now().Add(time.Hour)}
|
|
access := &TokenData{Token: "access-secret", Expiration: time.Now().Add(time.Minute)}
|
|
req := httptest.NewRequest(http.MethodPost, "http://app.sendico.io/api/v1/accounts/login", nil)
|
|
req.Header.Set(browser.TransportHeader, browser.TransportCookie)
|
|
req.Header.Set("X-Forwarded-Proto", "https")
|
|
recorder := httptest.NewRecorder()
|
|
|
|
Login(zap.NewNop(), &model.Account{}, access, refresh).ServeHTTP(recorder, req)
|
|
|
|
require.Equal(t, http.StatusOK, recorder.Code)
|
|
require.NotContains(t, recorder.Body.String(), refresh.Token)
|
|
require.Contains(t, recorder.Body.String(), access.Token)
|
|
setCookie := recorder.Header().Get("Set-Cookie")
|
|
require.True(t, strings.HasPrefix(setCookie, browser.RefreshCookie+"="))
|
|
require.Contains(t, setCookie, "HttpOnly")
|
|
require.Contains(t, setCookie, "Secure")
|
|
require.Contains(t, setCookie, "SameSite=Strict")
|
|
}
|
|
|
|
func TestNativeLoginKeepsRefreshCredentialInResponse(t *testing.T) {
|
|
refresh := &TokenData{Token: "native-refresh", Expiration: time.Now().Add(time.Hour)}
|
|
access := &TokenData{Token: "native-access", Expiration: time.Now().Add(time.Minute)}
|
|
req := httptest.NewRequest(http.MethodPost, "http://native.test/api/v1/accounts/login", nil)
|
|
recorder := httptest.NewRecorder()
|
|
|
|
Login(zap.NewNop(), &model.Account{}, access, refresh).ServeHTTP(recorder, req)
|
|
|
|
require.Contains(t, recorder.Body.String(), refresh.Token)
|
|
require.Empty(t, recorder.Header().Get("Set-Cookie"))
|
|
}
|