@@ -9,6 +9,7 @@ import (
99 "net/http"
1010 "net/http/httptest"
1111 "net/url"
12+ "regexp"
1213 "strings"
1314 "testing"
1415 "time"
@@ -237,3 +238,69 @@ func TestDoNotForwardAccessTokenUpstream(t *testing.T) {
237238 assert.Equal(t, 200, code)
238239 assert.Equal(t, "No access token found.", payload)
239240}
241+
242+type SignInPageTest struct {
243+ opts *Options
244+ proxy *OauthProxy
245+ sign_in_regexp *regexp.Regexp
246+}
247+
248+const signInRedirectPattern = `<input type="hidden" name="rd" value="(.*)">`
249+
250+func NewSignInPageTest() *SignInPageTest {
251+ var sip_test SignInPageTest
252+
253+ sip_test.opts = NewOptions()
254+ sip_test.opts.Upstreams = append(sip_test.opts.Upstreams, "unused")
255+ sip_test.opts.CookieSecret = "foobar"
256+ sip_test.opts.ClientID = "bazquux"
257+ sip_test.opts.ClientSecret = "xyzzyplugh"
258+ sip_test.opts.Validate()
259+
260+ sip_test.proxy = NewOauthProxy(sip_test.opts, func(email string) bool {
261+ return true
262+ })
263+ sip_test.sign_in_regexp = regexp.MustCompile(signInRedirectPattern)
264+
265+ return &sip_test
266+}
267+
268+func (sip_test *SignInPageTest) GetEndpoint(endpoint string) (int, string) {
269+ rw := httptest.NewRecorder()
270+ req, _ := http.NewRequest("GET", endpoint, strings.NewReader(""))
271+ sip_test.proxy.ServeHTTP(rw, req)
272+ return rw.Code, rw.Body.String()
273+}
274+
275+func TestSignInPageIncludesTargetRedirect(t *testing.T) {
276+ sip_test := NewSignInPageTest()
277+ const endpoint = "/some/random/endpoint"
278+
279+ code, body := sip_test.GetEndpoint(endpoint)
280+ assert.Equal(t, 403, code)
281+
282+ match := sip_test.sign_in_regexp.FindStringSubmatch(body)
283+ if match == nil {
284+ t.Fatal("Did not find pattern in body: " +
285+ signInRedirectPattern + "\nBody:\n" + body)
286+ }
287+ if match[1] != endpoint {
288+ t.Fatal(`expected redirect to "` + endpoint +
289+ `", but was "` + match[1] + `"`)
290+ }
291+}
292+
293+func TestSignInPageDirectAccessRedirectsToRoot(t *testing.T) {
294+ sip_test := NewSignInPageTest()
295+ code, body := sip_test.GetEndpoint("/oauth2/sign_in")
296+ assert.Equal(t, 200, code)
297+
298+ match := sip_test.sign_in_regexp.FindStringSubmatch(body)
299+ if match == nil {
300+ t.Fatal("Did not find pattern in body: " +
301+ signInRedirectPattern + "\nBody:\n" + body)
302+ }
303+ if match[1] != "/" {
304+ t.Fatal(`expected redirect to "/", but was "` + match[1] + `"`)
305+ }
306+}