git.iko.soy/typeable/oauth2-proxy
on v2.2 help sign in
typeable/oauth2-proxy/options_test.go
233 lines 6.6 kB history raw
1package main
3import (
4 "crypto"
5 "fmt"
6 "net/url"
7 "strings"
8 "testing"
9 "time"
11 "github.com/bmizerany/assert"
14func testOptions() *Options {
15 o := NewOptions()
16 o.Upstreams = append(o.Upstreams, "http://127.0.0.1:8080/")
17 o.CookieSecret = "foobar"
18 o.ClientID = "bazquux"
19 o.ClientSecret = "xyzzyplugh"
20 o.EmailDomains = []string{"*"}
21 return o
24func errorMsg(msgs []string) string {
25 result := make([]string, 0)
26 result = append(result, "Invalid configuration:")
27 result = append(result, msgs...)
28 return strings.Join(result, "\n ")
31func TestNewOptions(t *testing.T) {
32 o := NewOptions()
33 o.EmailDomains = []string{"*"}
34 err := o.Validate()
35 assert.NotEqual(t, nil, err)
37 expected := errorMsg([]string{
38 "missing setting: upstream",
39 "missing setting: cookie-secret",
40 "missing setting: client-id",
41 "missing setting: client-secret"})
42 assert.Equal(t, expected, err.Error())
45func TestGoogleGroupOptions(t *testing.T) {
46 o := testOptions()
47 o.GoogleGroups = []string{"googlegroup"}
48 err := o.Validate()
49 assert.NotEqual(t, nil, err)
51 expected := errorMsg([]string{
52 "missing setting: google-admin-email",
53 "missing setting: google-service-account-json"})
54 assert.Equal(t, expected, err.Error())
57func TestGoogleGroupInvalidFile(t *testing.T) {
58 o := testOptions()
59 o.GoogleGroups = []string{"test_group"}
60 o.GoogleAdminEmail = "admin@example.com"
61 o.GoogleServiceAccountJSON = "file_doesnt_exist.json"
62 err := o.Validate()
63 assert.NotEqual(t, nil, err)
65 expected := errorMsg([]string{
66 "invalid Google credentials file: file_doesnt_exist.json",
67 })
68 assert.Equal(t, expected, err.Error())
71func TestInitializedOptions(t *testing.T) {
72 o := testOptions()
73 assert.Equal(t, nil, o.Validate())
76// Note that it's not worth testing nonparseable URLs, since url.Parse()
77// seems to parse damn near anything.
78func TestRedirectURL(t *testing.T) {
79 o := testOptions()
80 o.RedirectURL = "https://myhost.com/oauth2/callback"
81 assert.Equal(t, nil, o.Validate())
82 expected := &url.URL{
83 Scheme: "https", Host: "myhost.com", Path: "/oauth2/callback"}
84 assert.Equal(t, expected, o.redirectURL)
87func TestProxyURLs(t *testing.T) {
88 o := testOptions()
89 o.Upstreams = append(o.Upstreams, "http://127.0.0.1:8081")
90 assert.Equal(t, nil, o.Validate())
91 expected := []*url.URL{
92 &url.URL{Scheme: "http", Host: "127.0.0.1:8080", Path: "/"},
93 // note the '/' was added
94 &url.URL{Scheme: "http", Host: "127.0.0.1:8081", Path: "/"},
95 }
96 assert.Equal(t, expected, o.proxyURLs)
99func TestCompiledRegex(t *testing.T) {
100 o := testOptions()
101 regexps := []string{"/foo/.*", "/ba[rz]/quux"}
102 o.SkipAuthRegex = regexps
103 assert.Equal(t, nil, o.Validate())
104 actual := make([]string, 0)
105 for _, regex := range o.CompiledRegex {
106 actual = append(actual, regex.String())
107 }
108 assert.Equal(t, regexps, actual)
111func TestCompiledRegexError(t *testing.T) {
112 o := testOptions()
113 o.SkipAuthRegex = []string{"(foobaz", "barquux)"}
114 err := o.Validate()
115 assert.NotEqual(t, nil, err)
117 expected := errorMsg([]string{
118 "error compiling regex=\"(foobaz\" error parsing regexp: " +
119 "missing closing ): `(foobaz`",
120 "error compiling regex=\"barquux)\" error parsing regexp: " +
121 "unexpected ): `barquux)`"})
122 assert.Equal(t, expected, err.Error())
125func TestDefaultProviderApiSettings(t *testing.T) {
126 o := testOptions()
127 assert.Equal(t, nil, o.Validate())
128 p := o.provider.Data()
129 assert.Equal(t, "https://accounts.google.com/o/oauth2/auth?access_type=offline",
130 p.LoginURL.String())
131 assert.Equal(t, "https://www.googleapis.com/oauth2/v3/token",
132 p.RedeemURL.String())
133 assert.Equal(t, "", p.ProfileURL.String())
134 assert.Equal(t, "profile email", p.Scope)
137func TestPassAccessTokenRequiresSpecificCookieSecretLengths(t *testing.T) {
138 o := testOptions()
139 assert.Equal(t, nil, o.Validate())
141 assert.Equal(t, false, o.PassAccessToken)
142 o.PassAccessToken = true
143 o.CookieSecret = "cookie of invalid length-"
144 assert.NotEqual(t, nil, o.Validate())
146 o.PassAccessToken = false
147 o.CookieRefresh = time.Duration(24) * time.Hour
148 assert.NotEqual(t, nil, o.Validate())
150 o.CookieSecret = "16 bytes AES-128"
151 assert.Equal(t, nil, o.Validate())
153 o.CookieSecret = "24 byte secret AES-192--"
154 assert.Equal(t, nil, o.Validate())
156 o.CookieSecret = "32 byte secret for AES-256------"
157 assert.Equal(t, nil, o.Validate())
160func TestCookieRefreshMustBeLessThanCookieExpire(t *testing.T) {
161 o := testOptions()
162 assert.Equal(t, nil, o.Validate())
164 o.CookieSecret = "0123456789abcdefabcd"
165 o.CookieRefresh = o.CookieExpire
166 assert.NotEqual(t, nil, o.Validate())
168 o.CookieRefresh -= time.Duration(1)
169 assert.Equal(t, nil, o.Validate())
172func TestBase64CookieSecret(t *testing.T) {
173 o := testOptions()
174 assert.Equal(t, nil, o.Validate())
176 // 32 byte, base64 (urlsafe) encoded key
177 o.CookieSecret = "yHBw2lh2Cvo6aI_jn_qMTr-pRAjtq0nzVgDJNb36jgQ="
178 assert.Equal(t, nil, o.Validate())
180 // 32 byte, base64 (urlsafe) encoded key, w/o padding
181 o.CookieSecret = "yHBw2lh2Cvo6aI_jn_qMTr-pRAjtq0nzVgDJNb36jgQ"
182 assert.Equal(t, nil, o.Validate())
184 // 24 byte, base64 (urlsafe) encoded key
185 o.CookieSecret = "Kp33Gj-GQmYtz4zZUyUDdqQKx5_Hgkv3"
186 assert.Equal(t, nil, o.Validate())
188 // 16 byte, base64 (urlsafe) encoded key
189 o.CookieSecret = "LFEqZYvYUwKwzn0tEuTpLA=="
190 assert.Equal(t, nil, o.Validate())
192 // 16 byte, base64 (urlsafe) encoded key, w/o padding
193 o.CookieSecret = "LFEqZYvYUwKwzn0tEuTpLA"
194 assert.Equal(t, nil, o.Validate())
197func TestValidateSignatureKey(t *testing.T) {
198 o := testOptions()
199 o.SignatureKey = "sha1:secret"
200 assert.Equal(t, nil, o.Validate())
201 assert.Equal(t, o.signatureData.hash, crypto.SHA1)
202 assert.Equal(t, o.signatureData.key, "secret")
205func TestValidateSignatureKeyInvalidSpec(t *testing.T) {
206 o := testOptions()
207 o.SignatureKey = "invalid spec"
208 err := o.Validate()
209 assert.Equal(t, err.Error(), "Invalid configuration:\n"+
210 " invalid signature hash:key spec: "+o.SignatureKey)
213func TestValidateSignatureKeyUnsupportedAlgorithm(t *testing.T) {
214 o := testOptions()
215 o.SignatureKey = "unsupported:default secret"
216 err := o.Validate()
217 assert.Equal(t, err.Error(), "Invalid configuration:\n"+
218 " unsupported signature hash algorithm: "+o.SignatureKey)
221func TestValidateCookie(t *testing.T) {
222 o := testOptions()
223 o.CookieName = "_valid_cookie_name"
224 assert.Equal(t, nil, o.Validate())
227func TestValidateCookieBadName(t *testing.T) {
228 o := testOptions()
229 o.CookieName = "_bad_cookie_name{}"
230 err := o.Validate()
231 assert.Equal(t, err.Error(), "Invalid configuration:\n"+
232 fmt.Sprintf(" invalid cookie name: %q", o.CookieName))