vole
Clone
Read only, no credentials:
https://rodent.software/vole.git
Write over SSH with a registered key:
git clone ssh://git@rodent.software:2222/vole.git
A free and open-source forge that lives in your Git repo.
|
f09ef39e
Keenan Nemetz
15d ago
|
1 | package web |
| 2 | ||
| 3 | import ( | |
|
ed181212
Keenan Nemetz
13d ago
|
4 | "net/http" |
|
f09ef39e
Keenan Nemetz
15d ago
|
5 | "net/http/httptest" |
| 6 | "testing" | |
| 7 | ||
|
d37d301f
Keenan Nemetz
19h ago
|
8 | "rodent.software/vole/forge/config" |
| 9 | "rodent.software/vole/forge/identity" | |
|
f09ef39e
Keenan Nemetz
15d ago
|
10 | ) |
| 11 | ||
| 12 | func TestDevLoginRefusesANonLoopbackListener(t *testing.T) { | |
| 13 | w := &Web{} | |
| 14 | err := w.enableDevLogin(&config.Config{HTTPAddr: "0.0.0.0:8080", DevLogin: "keenan"}) | |
| 15 | if err == nil { | |
| 16 | t.Fatal("dev_login accepted a listener that is not loopback") | |
| 17 | } | |
| 18 | } | |
| 19 | ||
|
ed181212
Keenan Nemetz
13d ago
|
20 | // TestDevLoginRefusesAPublicInstance: development login is a credential-free |
| 21 | // session, so it may not be configured on an instance that is reachable by name. | |
| 22 | func TestDevLoginRefusesAPublicInstance(t *testing.T) { | |
| 23 | for _, cfg := range []*config.Config{ | |
| 24 | {HTTPAddr: "127.0.0.1:8080", DevLogin: "keenan", PublicURL: "https://forge.example.com"}, | |
| 25 | {HTTPAddr: "127.0.0.1:8080", DevLogin: "keenan", HTTPSAddr: ":443"}, | |
| 26 | } { | |
| 27 | if err := (&Web{}).enableDevLogin(cfg); err == nil { | |
| 28 | t.Fatalf("dev_login accepted an instance with public_url %q / https_addr %q", cfg.PublicURL, cfg.HTTPSAddr) | |
| 29 | } | |
| 30 | } | |
| 31 | } | |
| 32 | ||
| 33 | func TestDevLoginRequestOnlyFromTheConfiguredListener(t *testing.T) { | |
| 34 | cfg := &config.Config{HTTPAddr: "127.0.0.1:8080", DevLogin: "keenan", DevOnly: true} | |
| 35 | w := &Web{Cfg: cfg, devAccount: &identity.Account{Name: "keenan", Status: "active"}} | |
| 36 | ||
| 37 | // The request a development browser makes. | |
|
f09ef39e
Keenan Nemetz
15d ago
|
38 | r := httptest.NewRequest("GET", "http://127.0.0.1:8080/", nil) |
| 39 | r.RemoteAddr = "127.0.0.1:5000" | |
| 40 | if !w.devLoginRequest(r) { | |
|
ed181212
Keenan Nemetz
13d ago
|
41 | t.Fatal("dev login did not apply to a request to the configured loopback listener") |
|
f09ef39e
Keenan Nemetz
15d ago
|
42 | } |
|
ed181212
Keenan Nemetz
13d ago
|
43 | |
| 44 | // A loopback proxy forwarding a public name. | |
|
f09ef39e
Keenan Nemetz
15d ago
|
45 | r.Host = "forge.example.com" |
| 46 | if w.devLoginRequest(r) { | |
| 47 | t.Fatal("dev login applied to a non-loopback Host through a local proxy") | |
| 48 | } | |
|
ed181212
Keenan Nemetz
13d ago
|
49 | |
| 50 | // A proxy that rewrites Host to a loopback name, which the old check allowed. | |
| 51 | r.Host = "127.0.0.1" | |
| 52 | if w.devLoginRequest(r) { | |
| 53 | t.Fatal("dev login applied to a proxy-rewritten Host without the configured port") | |
| 54 | } | |
| 55 | r.Host = "127.0.0.1:8080" | |
| 56 | if !w.devLoginRequest(r) { | |
| 57 | t.Fatal("dev login stopped applying to the configured listener") | |
| 58 | } | |
| 59 | ||
| 60 | // And a proxy that keeps Host intact but announces itself. | |
| 61 | r.Header.Set("X-Forwarded-For", "203.0.113.9") | |
| 62 | if w.devLoginRequest(r) { | |
| 63 | t.Fatal("dev login applied to a proxied request") | |
| 64 | } | |
| 65 | } | |
| 66 | ||
| 67 | // TestDevLoginIgnoresANonLoopbackPeer: a listener bound to 0.0.0.0 accepts remote | |
| 68 | // connections, and no Host header makes those local. | |
| 69 | func TestDevLoginIgnoresANonLoopbackPeer(t *testing.T) { | |
| 70 | cfg := &config.Config{HTTPAddr: "127.0.0.1:8080", DevLogin: "keenan", DevOnly: true} | |
| 71 | w := &Web{Cfg: cfg, devAccount: &identity.Account{Name: "keenan", Status: "active"}} | |
| 72 | r := httptest.NewRequest("GET", "http://127.0.0.1:8080/", nil) | |
| 73 | r.RemoteAddr = "198.51.100.7:5000" | |
| 74 | if w.devLoginRequest(r) { | |
| 75 | t.Fatal("dev login applied to a remote address") | |
| 76 | } | |
| 77 | } | |
| 78 | ||
| 79 | func TestDevLoginOptOutCookie(t *testing.T) { | |
| 80 | cfg := &config.Config{HTTPAddr: "127.0.0.1:8080", DevLogin: "keenan", DevOnly: true} | |
| 81 | w := &Web{Cfg: cfg, devAccount: &identity.Account{Name: "keenan", Status: "active"}} | |
| 82 | r := httptest.NewRequest("GET", "http://127.0.0.1:8080/", nil) | |
| 83 | r.RemoteAddr = "127.0.0.1:5000" | |
| 84 | r.AddCookie(&http.Cookie{Name: devOffCookieName, Value: "1"}) | |
| 85 | if w.devLoginRequest(r) { | |
| 86 | t.Fatal("dev login ignored the opt-out cookie") | |
| 87 | } | |
|
f09ef39e
Keenan Nemetz
15d ago
|
88 | } |