59 lines
2.5 KiB
Go
59 lines
2.5 KiB
Go
package sresponse
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
|
|
"git.sendico.io/tech/sxchnge/bff/edge/shared/auth/browser"
|
|
"git.sendico.io/tech/sxchnge/bff/pkg/model"
|
|
"github.com/stretchr/testify/require"
|
|
"go.uber.org/zap"
|
|
)
|
|
|
|
func TestBrowserLoginMovesRefreshCredentialToHttpOnlyCookie(t *testing.T) {
|
|
refresh := &TokenData{Token: "refresh-secret", Expiration: time.Now().Add(time.Hour)}
|
|
access := &TokenData{Token: "access-secret", Expiration: time.Now().Add(time.Minute)}
|
|
req := httptest.NewRequest(http.MethodPost, "http://app.sendico.io/api/v1/accounts/login", nil)
|
|
req.Header.Set(browser.TransportHeader, browser.TransportCookie)
|
|
req.Header.Set("X-Forwarded-Proto", "https")
|
|
recorder := httptest.NewRecorder()
|
|
|
|
Login(zap.NewNop(), &model.Account{}, access, refresh).ServeHTTP(recorder, req)
|
|
|
|
require.Equal(t, http.StatusOK, recorder.Code)
|
|
require.NotContains(t, recorder.Body.String(), refresh.Token)
|
|
require.Contains(t, recorder.Body.String(), access.Token)
|
|
setCookie := recorder.Header().Get("Set-Cookie")
|
|
require.True(t, strings.HasPrefix(setCookie, browser.RefreshCookie+"="))
|
|
require.Contains(t, setCookie, "HttpOnly")
|
|
require.Contains(t, setCookie, "Secure")
|
|
require.Contains(t, setCookie, "SameSite=Strict")
|
|
}
|
|
|
|
func TestNativeLoginKeepsRefreshCredentialInResponse(t *testing.T) {
|
|
refresh := &TokenData{Token: "native-refresh", Expiration: time.Now().Add(time.Hour)}
|
|
access := &TokenData{Token: "native-access", Expiration: time.Now().Add(time.Minute)}
|
|
req := httptest.NewRequest(http.MethodPost, "http://native.test/api/v1/accounts/login", nil)
|
|
recorder := httptest.NewRecorder()
|
|
|
|
Login(zap.NewNop(), &model.Account{}, access, refresh).ServeHTTP(recorder, req)
|
|
|
|
require.Contains(t, recorder.Body.String(), refresh.Token)
|
|
require.Empty(t, recorder.Header().Get("Set-Cookie"))
|
|
}
|
|
|
|
func TestCustomerResponseExcludesStorageAndPlatformFields(t *testing.T) {
|
|
account := &model.Account{Password: "private-password-hash", Status: model.AccountActive}
|
|
account.Login = "customer@example.test"
|
|
account.Name = "Customer"
|
|
recorder := httptest.NewRecorder()
|
|
Account(zap.NewNop(), account, &TokenData{}).ServeHTTP(recorder, httptest.NewRequest(http.MethodGet, "/accounts/me", nil))
|
|
require.Contains(t, recorder.Body.String(), "customer@example.test")
|
|
for _, field := range []string{"private-password-hash", "password", "status\":\"active", "organization", "role", "policy", "isAnonymous", "createdAt", "isArchived"} {
|
|
require.NotContains(t, recorder.Body.String(), field)
|
|
}
|
|
}
|