Sign in

Search issue titles and bodies, change requests and comments. Private repositories you cannot read are not included.

vole
Clone

Read only, no credentials:

https://rodent.software/git/vole.git

Write over SSH with a registered key:

git clone ssh://git@0.0.0.0:2222/vole.git

A free and open-source forge that lives in your Git repo.

Blame · server/web/auth_test.go

Line attribution on main · 50 line(s)

6c84d387
Keenan Nemetz
15d ago
1 package web
2
3 import (
4 "testing"
5
d37d301f
Keenan Nemetz
15h ago
6 "rodent.software/vole/forge/config"
6c84d387
Keenan Nemetz
15d ago
7 )
8
9 func TestNewAuthRequiresHTTPS(t *testing.T) {
10 t.Parallel()
11 for _, c := range []struct {
12 url string
13 want bool
14 }{
15 {"", false},
16 {"http://forge.example.com", false},
17 {"https://forge.example.com", true},
18 {"https://forge.example.com:8443", true},
19 } {
20 cfg := &config.Config{PublicURL: c.url}
21 a, err := newAuth(cfg)
22 if err != nil {
23 t.Fatalf("%q: %v", c.url, err)
24 }
25 if a.Enabled() != c.want {
26 t.Fatalf("%q: Enabled=%v want %v (%s)", c.url, a.Enabled(), c.want, a.Disabled)
27 }
28 }
29 a, err := newAuth(&config.Config{PublicURL: "https://Forge.Example.com:8443/path"})
30 if err != nil {
31 t.Fatal(err)
32 }
33 if a.RPID != "forge.example.com" || a.Origin != "https://Forge.Example.com:8443" {
34 t.Fatalf("RPID/Origin = %q/%q", a.RPID, a.Origin)
35 }
36 }
37
38 func TestSafeNextOnlyAllowsLocalPaths(t *testing.T) {
39 t.Parallel()
40 for _, in := range []string{"", "//evil.example", "https://evil.example", `/\evil`, "/\r\n"} {
41 if got := safeNext(in); got != "/" {
42 t.Errorf("safeNext(%q)=%q, want /", in, got)
43 }
44 }
ed03b3d1
Keenan Nemetz
2h ago
45 for _, in := range []string{"/", "/demo", "/demo?x=1#c-2"} {
6c84d387
Keenan Nemetz
15d ago
46 if got := safeNext(in); got != in {
47 t.Errorf("safeNext(%q)=%q, want itself", in, got)
48 }
49 }
50 }