git.iko.soy/typeable/oauth2-proxy
on ea261ca help sign in
typeable/oauth2-proxy/validator_test.go
387 lines 11 kB history raw
1package main
3import (
4 "io/ioutil"
5 "os"
6 "strings"
7 "testing"
9 . "github.com/onsi/gomega"
12type ValidatorTest struct {
13 authEmailFileName string
14 done chan bool
15 updateSeen bool
18func NewValidatorTest(t *testing.T) *ValidatorTest {
19 vt := &ValidatorTest{}
20 var err error
21 f, err := ioutil.TempFile("", "test_auth_emails_")
22 if err != nil {
23 t.Fatalf("failed to create temp file: %v", err)
24 }
25 if err := f.Close(); err != nil {
26 t.Fatalf("failed to close temp file: %v", err)
27 }
28 vt.authEmailFileName = f.Name()
29 vt.done = make(chan bool, 1)
30 return vt
33func (vt *ValidatorTest) TearDown() {
34 vt.done <- true
35 os.Remove(vt.authEmailFileName)
38func (vt *ValidatorTest) NewValidator(domains []string,
39 updated chan<- bool) func(string) bool {
40 return newValidatorImpl(domains, vt.authEmailFileName,
41 vt.done, func() {
42 if vt.updateSeen == false {
43 updated <- true
44 vt.updateSeen = true
45 }
46 })
49func (vt *ValidatorTest) WriteEmails(t *testing.T, emails []string) {
50 f, err := os.OpenFile(vt.authEmailFileName, os.O_WRONLY, 0600)
51 if err != nil {
52 t.Fatalf("failed to open auth email file: %v", err)
53 }
55 if _, err := f.WriteString(strings.Join(emails, "\n")); err != nil {
56 t.Fatalf("failed to write emails to auth email file: %v", err)
57 }
59 if err := f.Close(); err != nil {
60 t.Fatalf("failed to close auth email file: %v", err)
61 }
64func TestValidatorOverwriteEmailListDirectly(t *testing.T) {
65 testCasesPreUpdate := []struct {
66 name string
67 email string
68 expectedAuthZ bool
69 }{
70 {
71 name: "FirstEmailInList",
72 email: "xyzzy@example.com",
73 expectedAuthZ: true,
74 },
75 {
76 name: "SecondEmailInList",
77 email: "plugh@example.com",
78 expectedAuthZ: true,
79 },
80 {
81 name: "EmailNotInListThatMatchesNoDomains",
82 email: "xyzzy.plugh@example.com",
83 expectedAuthZ: false,
84 },
85 }
86 testCasesPostUpdate := []struct {
87 name string
88 email string
89 expectedAuthZ bool
90 }{
91 {
92 name: "email removed from list",
93 email: "xyzzy@example.com",
94 expectedAuthZ: false,
95 },
96 {
97 name: "email retained in list",
98 email: "plugh@example.com",
99 expectedAuthZ: true,
100 },
101 {
102 name: "email added to list",
103 email: "xyzzy.plugh@example.com",
104 expectedAuthZ: true,
105 },
106 }
108 vt := NewValidatorTest(t)
109 defer vt.TearDown()
111 vt.WriteEmails(t, []string{
112 "xyzzy@example.com",
113 "plugh@example.com",
114 })
115 updated := make(chan bool)
116 validator := vt.NewValidator([]string(nil), updated)
118 for _, tc := range testCasesPreUpdate {
119 t.Run(tc.name, func(t *testing.T) {
120 g := NewWithT(t)
121 authorized := validator(tc.email)
122 g.Expect(authorized).To(Equal(tc.expectedAuthZ))
123 })
124 }
126 vt.WriteEmails(t, []string{
127 "xyzzy.plugh@example.com",
128 "plugh@example.com",
129 })
130 <-updated
132 for _, tc := range testCasesPostUpdate {
133 t.Run(tc.name, func(t *testing.T) {
134 g := NewWithT(t)
135 authorized := validator(tc.email)
136 g.Expect(authorized).To(Equal(tc.expectedAuthZ))
137 })
138 }
141func TestValidatorCases(t *testing.T) {
142 testCases := []struct {
143 name string
144 allowedEmails []string
145 allowedDomains []string
146 email string
147 expectedAuthZ bool
148 }{
149 {
150 name: "EmailNotInCorrect1stSubDomainsNotInEmails",
151 allowedEmails: []string{"xyzzy@example.com", "plugh@example.com"},
152 allowedDomains: []string{".example0.com", ".example1.com"},
153 email: "foo.bar@example0.com",
154 expectedAuthZ: false,
155 },
156 {
157 name: "EmailInFirstDomain",
158 allowedEmails: []string{"xyzzy@example.com", "plugh@example.com"},
159 allowedDomains: []string{".example0.com", ".example1.com"},
160 email: "foo@bar.example0.com",
161 expectedAuthZ: true,
162 },
163 {
164 name: "EmailNotInCorrect2ndSubDomainsNotInEmails",
165 allowedEmails: []string{"xyzzy@example.com", "plugh@example.com"},
166 allowedDomains: []string{".example0.com", ".example1.com"},
167 email: "baz.quux@example1.com",
168 expectedAuthZ: false,
169 },
170 {
171 name: "EmailInSecondDomain",
172 allowedEmails: []string{"xyzzy@example.com", "plugh@example.com"},
173 allowedDomains: []string{".example0.com", ".example1.com"},
174 email: "baz@quux.example1.com",
175 expectedAuthZ: true,
176 },
177 {
178 name: "EmailInFirstEmailList",
179 allowedEmails: []string{"xyzzy@example.com", "plugh@example.com"},
180 allowedDomains: []string{".example0.com", ".example1.com"},
181 email: "xyzzy@example.com",
182 expectedAuthZ: true,
183 },
184 {
185 name: "EmailNotInDomainsNotInEmails",
186 allowedEmails: []string{"xyzzy@example.com", "plugh@example.com"},
187 allowedDomains: []string{".example0.com", ".example1.com"},
188 email: "xyzzy.plugh@example.com",
189 expectedAuthZ: false,
190 },
191 {
192 name: "EmailInLastEmailList",
193 allowedEmails: []string{"xyzzy@example.com", "plugh@example.com"},
194 allowedDomains: []string{".example0.com", ".example1.com"},
195 email: "plugh@example.com",
196 expectedAuthZ: true,
197 },
198 {
199 name: "EmailIn1stSubdomain",
200 allowedEmails: nil,
201 allowedDomains: []string{"us.example.com", "de.example.com", "example.com"},
202 email: "xyzzy@us.example.com",
203 expectedAuthZ: true,
204 },
205 {
206 name: "EmailIn2ndSubdomain",
207 allowedEmails: nil,
208 allowedDomains: []string{"us.example.com", "de.example.com", "example.com"},
209 email: "xyzzy@de.example.com",
210 expectedAuthZ: true,
211 },
212 {
213 name: "EmailNotInAnySubdomain",
214 allowedEmails: nil,
215 allowedDomains: []string{"us.example.com", "de.example.com", "example.com"},
216 email: "global@au.example.com",
217 expectedAuthZ: false,
218 },
219 {
220 name: "EmailInLastSubdomain",
221 allowedEmails: nil,
222 allowedDomains: []string{"us.example.com", "de.example.com", "example.com"},
223 email: "xyzzy@example.com",
224 expectedAuthZ: true,
225 },
226 {
227 name: "EmailDomainNotCompletelyMatch",
228 allowedEmails: nil,
229 allowedDomains: []string{".example.com", ".example1.com"},
230 email: "something@fooexample.com",
231 expectedAuthZ: false,
232 },
233 {
234 name: "HackerExtraDomainPrefix1",
235 allowedEmails: nil,
236 allowedDomains: []string{".mycompany.com"},
237 email: "something@evilhackmycompany.com",
238 expectedAuthZ: false,
239 },
240 {
241 name: "HackerExtraDomainPrefix2",
242 allowedEmails: nil,
243 allowedDomains: []string{".mycompany.com"},
244 email: "something@ext.evilhackmycompany.com",
245 expectedAuthZ: false,
246 },
247 {
248 name: "EmptyDomainAndEmailList",
249 allowedEmails: []string(nil),
250 allowedDomains: []string(nil),
251 email: "foo.bar@example.com",
252 expectedAuthZ: false,
253 },
254 {
255 name: "EmailMatchWithAllowedEmails",
256 email: "foo.bar@example.com",
257 allowedEmails: []string{"foo.bar@example.com"},
258 allowedDomains: []string{"example.com"},
259 expectedAuthZ: true,
260 },
261 {
262 name: "EmailFromSameDomainButNotInList",
263 email: "baz.quux@example.com",
264 allowedEmails: []string{"foo.bar@example.com"},
265 allowedDomains: []string(nil),
266 expectedAuthZ: false,
267 },
268 {
269 name: "EmailMatchOnDomain",
270 email: "foo.bar@example.com",
271 allowedEmails: []string(nil),
272 allowedDomains: []string{"example.com"},
273 expectedAuthZ: true,
274 },
275 {
276 name: "EmailMatchOnDomain2",
277 email: "baz.quux@example.com",
278 allowedEmails: []string(nil),
279 allowedDomains: []string{"example.com"},
280 expectedAuthZ: true,
281 },
282 {
283 name: "EmailFromFirstDomainShouldValidate",
284 email: "foo.bar@example0.com",
285 allowedEmails: []string{"Foo.Bar@Example.Com"},
286 allowedDomains: []string{"example0.com", "example1.com"},
287 expectedAuthZ: true,
288 },
289 {
290 name: "EmailFromSecondDomainShouldValidate",
291 email: "baz.quux@example1.com",
292 allowedEmails: []string{"Foo.Bar@Example.Com"},
293 allowedDomains: []string{"example0.com", "example1.com"},
294 expectedAuthZ: true,
295 },
296 {
297 name: "FirstEmailInListShouldValidate",
298 email: "xyzzy@example.com",
299 allowedEmails: []string{"xyzzy@example.com", "plugh@example.com"},
300 allowedDomains: []string{"example0.com", "example1.com"},
301 expectedAuthZ: true,
302 },
303 {
304 name: "SecondEmailInListShouldValidate",
305 email: "plugh@example.com",
306 allowedEmails: []string{"xyzzy@example.com", "plugh@example.com"},
307 allowedDomains: []string{"example0.com", "example1.com"},
308 expectedAuthZ: true,
309 },
310 {
311 name: "EmailNotInListThatMatchesNoDomains ",
312 email: "xyzzy.plugh@example.com",
313 allowedEmails: []string{"xyzzy@example.com", "plugh@example.com"},
314 allowedDomains: []string{"example0.com", "example1.com"},
315 expectedAuthZ: false,
316 },
317 {
318 name: "LoadedEmailAddressesAreNotLowerCased",
319 email: "foo.bar@example.com",
320 allowedEmails: []string{"Foo.Bar@Example.Com"},
321 allowedDomains: []string{"Frobozz.Com"},
322 expectedAuthZ: true,
323 },
324 {
325 name: "ValidatedEmailAddressesAreNotLowerCased",
326 email: "Foo.Bar@Example.Com",
327 allowedEmails: []string{"Foo.Bar@Example.Com"},
328 allowedDomains: []string{"Frobozz.Com"},
329 expectedAuthZ: true,
330 },
331 {
332 name: "LoadedDomainsAreNotLowerCased",
333 email: "foo.bar@frobozz.com",
334 allowedEmails: []string{"Foo.Bar@Example.Com"},
335 allowedDomains: []string{"Frobozz.Com"},
336 expectedAuthZ: true,
337 },
338 {
339 name: "ValidatedDomainsAreNotLowerCased",
340 email: "foo.bar@Frobozz.Com",
341 allowedEmails: []string{"Foo.Bar@Example.Com"},
342 allowedDomains: []string{"Frobozz.Com"},
343 expectedAuthZ: true,
344 },
345 {
346 name: "IgnoreSpacesInAuthEmails",
347 email: "foo.bar@example.com",
348 allowedEmails: []string{" foo.bar@example.com "},
349 allowedDomains: []string(nil),
350 expectedAuthZ: true,
351 },
352 {
353 name: "IgnorePrefixSpacesInAuthEmails",
354 email: "foo.bar@example.com",
355 allowedEmails: []string{" foo.bar@example.com"},
356 allowedDomains: []string(nil),
357 expectedAuthZ: true,
358 },
359 {
360 name: "CheckForEqualityNotSuffix",
361 email: "foo@evilcompany.com",
362 allowedEmails: []string(nil),
363 allowedDomains: []string{".company.com"},
364 expectedAuthZ: false,
365 },
366 {
367 name: "CheckForEqualityNotSuffix2",
368 email: "foo@evilcompany.com",
369 allowedEmails: []string(nil),
370 allowedDomains: []string{"company.com"},
371 expectedAuthZ: false,
372 },
373 }
375 for _, tc := range testCases {
376 t.Run(tc.name, func(t *testing.T) {
377 vt := NewValidatorTest(t)
378 defer vt.TearDown()
380 g := NewWithT(t)
381 vt.WriteEmails(t, tc.allowedEmails)
382 validator := vt.NewValidator(tc.allowedDomains, nil)
383 authorized := validator(tc.email)
384 g.Expect(authorized).To(Equal(tc.expectedAuthZ))
385 })
386 }