@@ -0,0 +1,164 @@
1+package validation
2+
3+import (
4+ "encoding/base64"
5+
6+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options"
7+ . "github.com/onsi/ginkgo"
8+ . "github.com/onsi/ginkgo/extensions/table"
9+ . "github.com/onsi/gomega"
10+)
11+
12+var _ = Describe("Headers", func() {
13+ type validateHeaderTableInput struct {
14+ headers []options.Header
15+ expectedMsgs []string
16+ }
17+
18+ validHeader1 := options.Header{
19+ Name: "X-Email",
20+ Values: []options.HeaderValue{
21+ {
22+ ClaimSource: &options.ClaimSource{
23+ Claim: "email",
24+ },
25+ },
26+ },
27+ }
28+
29+ validHeader2 := options.Header{
30+ Name: "X-Forwarded-Auth",
31+ Values: []options.HeaderValue{
32+ {
33+ SecretSource: &options.SecretSource{
34+ Value: []byte(base64.StdEncoding.EncodeToString([]byte("secret"))),
35+ },
36+ },
37+ },
38+ }
39+
40+ validHeader3 := options.Header{
41+ Name: "Authorization",
42+ Values: []options.HeaderValue{
43+ {
44+ ClaimSource: &options.ClaimSource{
45+ Claim: "email",
46+ BasicAuthPassword: &options.SecretSource{
47+ Value: []byte(base64.StdEncoding.EncodeToString([]byte("secret"))),
48+ },
49+ },
50+ },
51+ },
52+ }
53+
54+ DescribeTable("validateHeaders",
55+ func(in validateHeaderTableInput) {
56+ Expect(validateHeaders(in.headers)).To(ConsistOf(in.expectedMsgs))
57+ },
58+ Entry("with no headers", validateHeaderTableInput{
59+ headers: []options.Header{},
60+ expectedMsgs: []string{},
61+ }),
62+ Entry("with valid headers", validateHeaderTableInput{
63+ headers: []options.Header{
64+ validHeader1,
65+ validHeader2,
66+ validHeader3,
67+ },
68+ expectedMsgs: []string{},
69+ }),
70+ Entry("with multiple headers with the same name", validateHeaderTableInput{
71+ headers: []options.Header{
72+ validHeader1,
73+ validHeader1,
74+ validHeader2,
75+ validHeader2,
76+ },
77+ expectedMsgs: []string{
78+ "multiple headers found with name \"X-Email\": header names must be unique",
79+ "multiple headers found with name \"X-Forwarded-Auth\": header names must be unique",
80+ },
81+ }),
82+ Entry("with an unamed header", validateHeaderTableInput{
83+ headers: []options.Header{
84+ {},
85+ validHeader2,
86+ },
87+ expectedMsgs: []string{
88+ "header has empty name: names are required for all headers",
89+ },
90+ }),
91+ Entry("with a header which has a claim and secret source", validateHeaderTableInput{
92+ headers: []options.Header{
93+ {
94+ Name: "With-Claim-And-Secret",
95+ Values: []options.HeaderValue{
96+ {
97+ ClaimSource: &options.ClaimSource{},
98+ SecretSource: &options.SecretSource{},
99+ },
100+ },
101+ },
102+ validHeader1,
103+ },
104+ expectedMsgs: []string{
105+ "invalid header \"With-Claim-And-Secret\": invalid values: header value has multiple entries: only one entry per value is allowed",
106+ },
107+ }),
108+ Entry("with a header which has a claim without a claim", validateHeaderTableInput{
109+ headers: []options.Header{
110+ {
111+ Name: "Without-Claim",
112+ Values: []options.HeaderValue{
113+ {
114+ ClaimSource: &options.ClaimSource{
115+ Prefix: "prefix",
116+ },
117+ },
118+ },
119+ },
120+ validHeader3,
121+ },
122+ expectedMsgs: []string{
123+ "invalid header \"Without-Claim\": invalid values: claim should not be empty",
124+ },
125+ }),
126+ Entry("with a header with invalid secret source", validateHeaderTableInput{
127+ headers: []options.Header{
128+ {
129+ Name: "With-Invalid-Secret",
130+ Values: []options.HeaderValue{
131+ {
132+ SecretSource: &options.SecretSource{},
133+ },
134+ },
135+ },
136+ validHeader1,
137+ },
138+ expectedMsgs: []string{
139+ "invalid header \"With-Invalid-Secret\": invalid values: multiple values specified for secret source: specify either value, fromEnv of fromFile",
140+ },
141+ }),
142+ Entry("with a header with invalid basicAuthPassword source", validateHeaderTableInput{
143+ headers: []options.Header{
144+ {
145+ Name: "With-Invalid-Basic-Auth",
146+ Values: []options.HeaderValue{
147+ {
148+ ClaimSource: &options.ClaimSource{
149+ Claim: "user",
150+ BasicAuthPassword: &options.SecretSource{
151+ Value: []byte("secret"),
152+ },
153+ },
154+ },
155+ },
156+ },
157+ validHeader1,
158+ },
159+ expectedMsgs: []string{
160+ "invalid header \"With-Invalid-Basic-Auth\": invalid values: invalid basicAuthPassword: error decoding secret value: illegal base64 data at input byte 4",
161+ },
162+ }),
163+ )
164+})