services/keep-web/handler_test.go

   1 // Copyright (C) The Arvados Authors. All rights reserved.
   2 //
   3 // SPDX-License-Identifier: AGPL-3.0
   4
   5 package main
   6
   7 import (
   8         "bytes"
   9         "fmt"
  10         "html"
  11         "io/ioutil"
  12         "net/http"
  13         "net/http/httptest"
  14         "net/url"
  15         "os"
  16         "path/filepath"
  17         "regexp"
  18         "strings"
  19
  20         "git.curoverse.com/arvados.git/sdk/go/arvados"
  21         "git.curoverse.com/arvados.git/sdk/go/arvadostest"
  22         "git.curoverse.com/arvados.git/sdk/go/auth"
  23         check "gopkg.in/check.v1"
  24 )
  25
  26 var _ = check.Suite(&UnitSuite{})
  27
  28 type UnitSuite struct{}
  29
  30 func (s *UnitSuite) TestCORSPreflight(c *check.C) {
  31         h := handler{Config: DefaultConfig()}
  32         u, _ := url.Parse("http://keep-web.example/c=" + arvadostest.FooCollection + "/foo")
  33         req := &http.Request{
  34                 Method:     "OPTIONS",
  35                 Host:       u.Host,
  36                 URL:        u,
  37                 RequestURI: u.RequestURI(),
  38                 Header: http.Header{
  39                         "Origin":                        {"https://workbench.example"},
  40                         "Access-Control-Request-Method": {"POST"},
  41                 },
  42         }
  43
  44         // Check preflight for an allowed request
  45         resp := httptest.NewRecorder()
  46         h.ServeHTTP(resp, req)
  47         c.Check(resp.Code, check.Equals, http.StatusOK)
  48         c.Check(resp.Body.String(), check.Equals, "")
  49         c.Check(resp.Header().Get("Access-Control-Allow-Origin"), check.Equals, "*")
  50         c.Check(resp.Header().Get("Access-Control-Allow-Methods"), check.Equals, "COPY, DELETE, GET, MKCOL, MOVE, OPTIONS, POST, PROPFIND, PUT, RMCOL")
  51         c.Check(resp.Header().Get("Access-Control-Allow-Headers"), check.Equals, "Authorization, Content-Type, Range")
  52
  53         // Check preflight for a disallowed request
  54         resp = httptest.NewRecorder()
  55         req.Header.Set("Access-Control-Request-Method", "MAKE-COFFEE")
  56         h.ServeHTTP(resp, req)
  57         c.Check(resp.Body.String(), check.Equals, "")
  58         c.Check(resp.Code, check.Equals, http.StatusMethodNotAllowed)
  59 }
  60
  61 func (s *UnitSuite) TestInvalidUUID(c *check.C) {
  62         bogusID := strings.Replace(arvadostest.FooPdh, "+", "-", 1) + "-"
  63         token := arvadostest.ActiveToken
  64         for _, trial := range []string{
  65                 "http://keep-web/c=" + bogusID + "/foo",
  66                 "http://keep-web/c=" + bogusID + "/t=" + token + "/foo",
  67                 "http://keep-web/collections/download/" + bogusID + "/" + token + "/foo",
  68                 "http://keep-web/collections/" + bogusID + "/foo",
  69                 "http://" + bogusID + ".keep-web/" + bogusID + "/foo",
  70                 "http://" + bogusID + ".keep-web/t=" + token + "/" + bogusID + "/foo",
  71         } {
  72                 c.Log(trial)
  73                 u, err := url.Parse(trial)
  74                 c.Assert(err, check.IsNil)
  75                 req := &http.Request{
  76                         Method:     "GET",
  77                         Host:       u.Host,
  78                         URL:        u,
  79                         RequestURI: u.RequestURI(),
  80                 }
  81                 resp := httptest.NewRecorder()
  82                 cfg := DefaultConfig()
  83                 cfg.AnonymousTokens = []string{arvadostest.AnonymousToken}
  84                 h := handler{Config: cfg}
  85                 h.ServeHTTP(resp, req)
  86                 c.Check(resp.Code, check.Equals, http.StatusNotFound)
  87         }
  88 }
  89
  90 func mustParseURL(s string) *url.URL {
  91         r, err := url.Parse(s)
  92         if err != nil {
  93                 panic("parse URL: " + s)
  94         }
  95         return r
  96 }
  97
  98 func (s *IntegrationSuite) TestVhost404(c *check.C) {
  99         for _, testURL := range []string{
 100                 arvadostest.NonexistentCollection + ".example.com/theperthcountyconspiracy",
 101                 arvadostest.NonexistentCollection + ".example.com/t=" + arvadostest.ActiveToken + "/theperthcountyconspiracy",
 102         } {
 103                 resp := httptest.NewRecorder()
 104                 u := mustParseURL(testURL)
 105                 req := &http.Request{
 106                         Method:     "GET",
 107                         URL:        u,
 108                         RequestURI: u.RequestURI(),
 109                 }
 110                 s.testServer.Handler.ServeHTTP(resp, req)
 111                 c.Check(resp.Code, check.Equals, http.StatusNotFound)
 112                 c.Check(resp.Body.String(), check.Equals, "")
 113         }
 114 }
 115
 116 // An authorizer modifies an HTTP request to make use of the given
 117 // token -- by adding it to a header, cookie, query param, or whatever
 118 // -- and returns the HTTP status code we should expect from keep-web if
 119 // the token is invalid.
 120 type authorizer func(*http.Request, string) int
 121
 122 func (s *IntegrationSuite) TestVhostViaAuthzHeader(c *check.C) {
 123         s.doVhostRequests(c, authzViaAuthzHeader)
 124 }
 125 func authzViaAuthzHeader(r *http.Request, tok string) int {
 126         r.Header.Add("Authorization", "OAuth2 "+tok)
 127         return http.StatusUnauthorized
 128 }
 129
 130 func (s *IntegrationSuite) TestVhostViaCookieValue(c *check.C) {
 131         s.doVhostRequests(c, authzViaCookieValue)
 132 }
 133 func authzViaCookieValue(r *http.Request, tok string) int {
 134         r.AddCookie(&http.Cookie{
 135                 Name:  "arvados_api_token",
 136                 Value: auth.EncodeTokenCookie([]byte(tok)),
 137         })
 138         return http.StatusUnauthorized
 139 }
 140
 141 func (s *IntegrationSuite) TestVhostViaPath(c *check.C) {
 142         s.doVhostRequests(c, authzViaPath)
 143 }
 144 func authzViaPath(r *http.Request, tok string) int {
 145         r.URL.Path = "/t=" + tok + r.URL.Path
 146         return http.StatusNotFound
 147 }
 148
 149 func (s *IntegrationSuite) TestVhostViaQueryString(c *check.C) {
 150         s.doVhostRequests(c, authzViaQueryString)
 151 }
 152 func authzViaQueryString(r *http.Request, tok string) int {
 153         r.URL.RawQuery = "api_token=" + tok
 154         return http.StatusUnauthorized
 155 }
 156
 157 func (s *IntegrationSuite) TestVhostViaPOST(c *check.C) {
 158         s.doVhostRequests(c, authzViaPOST)
 159 }
 160 func authzViaPOST(r *http.Request, tok string) int {
 161         r.Method = "POST"
 162         r.Header.Add("Content-Type", "application/x-www-form-urlencoded")
 163         r.Body = ioutil.NopCloser(strings.NewReader(
 164                 url.Values{"api_token": {tok}}.Encode()))
 165         return http.StatusUnauthorized
 166 }
 167
 168 func (s *IntegrationSuite) TestVhostViaXHRPOST(c *check.C) {
 169         s.doVhostRequests(c, authzViaPOST)
 170 }
 171 func authzViaXHRPOST(r *http.Request, tok string) int {
 172         r.Method = "POST"
 173         r.Header.Add("Content-Type", "application/x-www-form-urlencoded")
 174         r.Header.Add("Origin", "https://origin.example")
 175         r.Body = ioutil.NopCloser(strings.NewReader(
 176                 url.Values{
 177                         "api_token":   {tok},
 178                         "disposition": {"attachment"},
 179                 }.Encode()))
 180         return http.StatusUnauthorized
 181 }
 182
 183 // Try some combinations of {url, token} using the given authorization
 184 // mechanism, and verify the result is correct.
 185 func (s *IntegrationSuite) doVhostRequests(c *check.C, authz authorizer) {
 186         for _, hostPath := range []string{
 187                 arvadostest.FooCollection + ".example.com/foo",
 188                 arvadostest.FooCollection + "--collections.example.com/foo",
 189                 arvadostest.FooCollection + "--collections.example.com/_/foo",
 190                 arvadostest.FooPdh + ".example.com/foo",
 191                 strings.Replace(arvadostest.FooPdh, "+", "-", -1) + "--collections.example.com/foo",
 192                 arvadostest.FooBarDirCollection + ".example.com/dir1/foo",
 193         } {
 194                 c.Log("doRequests: ", hostPath)
 195                 s.doVhostRequestsWithHostPath(c, authz, hostPath)
 196         }
 197 }
 198
 199 func (s *IntegrationSuite) doVhostRequestsWithHostPath(c *check.C, authz authorizer, hostPath string) {
 200         for _, tok := range []string{
 201                 arvadostest.ActiveToken,
 202                 arvadostest.ActiveToken[:15],
 203                 arvadostest.SpectatorToken,
 204                 "bogus",
 205                 "",
 206         } {
 207                 u := mustParseURL("http://" + hostPath)
 208                 req := &http.Request{
 209                         Method:     "GET",
 210                         Host:       u.Host,
 211                         URL:        u,
 212                         RequestURI: u.RequestURI(),
 213                         Header:     http.Header{},
 214                 }
 215                 failCode := authz(req, tok)
 216                 req, resp := s.doReq(req)
 217                 code, body := resp.Code, resp.Body.String()
 218
 219                 // If the initial request had a (non-empty) token
 220                 // showing in the query string, we should have been
 221                 // redirected in order to hide it in a cookie.
 222                 c.Check(req.URL.String(), check.Not(check.Matches), `.*api_token=.+`)
 223
 224                 if tok == arvadostest.ActiveToken {
 225                         c.Check(code, check.Equals, http.StatusOK)
 226                         c.Check(body, check.Equals, "foo")
 227
 228                 } else {
 229                         c.Check(code >= 400, check.Equals, true)
 230                         c.Check(code < 500, check.Equals, true)
 231                         if tok == arvadostest.SpectatorToken {
 232                                 // Valid token never offers to retry
 233                                 // with different credentials.
 234                                 c.Check(code, check.Equals, http.StatusNotFound)
 235                         } else {
 236                                 // Invalid token can ask to retry
 237                                 // depending on the authz method.
 238                                 c.Check(code, check.Equals, failCode)
 239                         }
 240                         c.Check(body, check.Equals, "")
 241                 }
 242         }
 243 }
 244
 245 func (s *IntegrationSuite) doReq(req *http.Request) (*http.Request, *httptest.ResponseRecorder) {
 246         resp := httptest.NewRecorder()
 247         s.testServer.Handler.ServeHTTP(resp, req)
 248         if resp.Code != http.StatusSeeOther {
 249                 return req, resp
 250         }
 251         cookies := (&http.Response{Header: resp.Header()}).Cookies()
 252         u, _ := req.URL.Parse(resp.Header().Get("Location"))
 253         req = &http.Request{
 254                 Method:     "GET",
 255                 Host:       u.Host,
 256                 URL:        u,
 257                 RequestURI: u.RequestURI(),
 258                 Header:     http.Header{},
 259         }
 260         for _, c := range cookies {
 261                 req.AddCookie(c)
 262         }
 263         return s.doReq(req)
 264 }
 265
 266 func (s *IntegrationSuite) TestVhostRedirectQueryTokenToCookie(c *check.C) {
 267         s.testVhostRedirectTokenToCookie(c, "GET",
 268                 arvadostest.FooCollection+".example.com/foo",
 269                 "?api_token="+arvadostest.ActiveToken,
 270                 "",
 271                 "",
 272                 http.StatusOK,
 273                 "foo",
 274         )
 275 }
 276
 277 func (s *IntegrationSuite) TestSingleOriginSecretLink(c *check.C) {
 278         s.testVhostRedirectTokenToCookie(c, "GET",
 279                 "example.com/c="+arvadostest.FooCollection+"/t="+arvadostest.ActiveToken+"/foo",
 280                 "",
 281                 "",
 282                 "",
 283                 http.StatusOK,
 284                 "foo",
 285         )
 286 }
 287
 288 // Bad token in URL is 404 Not Found because it doesn't make sense to
 289 // retry the same URL with different authorization.
 290 func (s *IntegrationSuite) TestSingleOriginSecretLinkBadToken(c *check.C) {
 291         s.testVhostRedirectTokenToCookie(c, "GET",
 292                 "example.com/c="+arvadostest.FooCollection+"/t=bogus/foo",
 293                 "",
 294                 "",
 295                 "",
 296                 http.StatusNotFound,
 297                 "",
 298         )
 299 }
 300
 301 // Bad token in a cookie (even if it got there via our own
 302 // query-string-to-cookie redirect) is, in principle, retryable at the
 303 // same URL so it's 401 Unauthorized.
 304 func (s *IntegrationSuite) TestVhostRedirectQueryTokenToBogusCookie(c *check.C) {
 305         s.testVhostRedirectTokenToCookie(c, "GET",
 306                 arvadostest.FooCollection+".example.com/foo",
 307                 "?api_token=thisisabogustoken",
 308                 "",
 309                 "",
 310                 http.StatusUnauthorized,
 311                 "",
 312         )
 313 }
 314
 315 func (s *IntegrationSuite) TestVhostRedirectQueryTokenSingleOriginError(c *check.C) {
 316         s.testVhostRedirectTokenToCookie(c, "GET",
 317                 "example.com/c="+arvadostest.FooCollection+"/foo",
 318                 "?api_token="+arvadostest.ActiveToken,
 319                 "",
 320                 "",
 321                 http.StatusBadRequest,
 322                 "",
 323         )
 324 }
 325
 326 // If client requests an attachment by putting ?disposition=attachment
 327 // in the query string, and gets redirected, the redirect target
 328 // should respond with an attachment.
 329 func (s *IntegrationSuite) TestVhostRedirectQueryTokenRequestAttachment(c *check.C) {
 330         resp := s.testVhostRedirectTokenToCookie(c, "GET",
 331                 arvadostest.FooCollection+".example.com/foo",
 332                 "?disposition=attachment&api_token="+arvadostest.ActiveToken,
 333                 "",
 334                 "",
 335                 http.StatusOK,
 336                 "foo",
 337         )
 338         c.Check(resp.Header().Get("Content-Disposition"), check.Matches, "attachment(;.*)?")
 339 }
 340
 341 func (s *IntegrationSuite) TestVhostRedirectQueryTokenSiteFS(c *check.C) {
 342         s.testServer.Config.AttachmentOnlyHost = "download.example.com"
 343         resp := s.testVhostRedirectTokenToCookie(c, "GET",
 344                 "download.example.com/by_id/"+arvadostest.FooCollection+"/foo",
 345                 "?api_token="+arvadostest.ActiveToken,
 346                 "",
 347                 "",
 348                 http.StatusOK,
 349                 "foo",
 350         )
 351         c.Check(resp.Header().Get("Content-Disposition"), check.Matches, "attachment(;.*)?")
 352 }
 353
 354 func (s *IntegrationSuite) TestVhostRedirectQueryTokenTrustAllContent(c *check.C) {
 355         s.testServer.Config.TrustAllContent = true
 356         s.testVhostRedirectTokenToCookie(c, "GET",
 357                 "example.com/c="+arvadostest.FooCollection+"/foo",
 358                 "?api_token="+arvadostest.ActiveToken,
 359                 "",
 360                 "",
 361                 http.StatusOK,
 362                 "foo",
 363         )
 364 }
 365
 366 func (s *IntegrationSuite) TestVhostRedirectQueryTokenAttachmentOnlyHost(c *check.C) {
 367         s.testServer.Config.AttachmentOnlyHost = "example.com:1234"
 368
 369         s.testVhostRedirectTokenToCookie(c, "GET",
 370                 "example.com/c="+arvadostest.FooCollection+"/foo",
 371                 "?api_token="+arvadostest.ActiveToken,
 372                 "",
 373                 "",
 374                 http.StatusBadRequest,
 375                 "",
 376         )
 377
 378         resp := s.testVhostRedirectTokenToCookie(c, "GET",
 379                 "example.com:1234/c="+arvadostest.FooCollection+"/foo",
 380                 "?api_token="+arvadostest.ActiveToken,
 381                 "",
 382                 "",
 383                 http.StatusOK,
 384                 "foo",
 385         )
 386         c.Check(resp.Header().Get("Content-Disposition"), check.Equals, "attachment")
 387 }
 388
 389 func (s *IntegrationSuite) TestVhostRedirectPOSTFormTokenToCookie(c *check.C) {
 390         s.testVhostRedirectTokenToCookie(c, "POST",
 391                 arvadostest.FooCollection+".example.com/foo",
 392                 "",
 393                 "application/x-www-form-urlencoded",
 394                 url.Values{"api_token": {arvadostest.ActiveToken}}.Encode(),
 395                 http.StatusOK,
 396                 "foo",
 397         )
 398 }
 399
 400 func (s *IntegrationSuite) TestVhostRedirectPOSTFormTokenToCookie404(c *check.C) {
 401         s.testVhostRedirectTokenToCookie(c, "POST",
 402                 arvadostest.FooCollection+".example.com/foo",
 403                 "",
 404                 "application/x-www-form-urlencoded",
 405                 url.Values{"api_token": {arvadostest.SpectatorToken}}.Encode(),
 406                 http.StatusNotFound,
 407                 "",
 408         )
 409 }
 410
 411 func (s *IntegrationSuite) TestAnonymousTokenOK(c *check.C) {
 412         s.testServer.Config.AnonymousTokens = []string{arvadostest.AnonymousToken}
 413         s.testVhostRedirectTokenToCookie(c, "GET",
 414                 "example.com/c="+arvadostest.HelloWorldCollection+"/Hello%20world.txt",
 415                 "",
 416                 "",
 417                 "",
 418                 http.StatusOK,
 419                 "Hello world\n",
 420         )
 421 }
 422
 423 func (s *IntegrationSuite) TestAnonymousTokenError(c *check.C) {
 424         s.testServer.Config.AnonymousTokens = []string{"anonymousTokenConfiguredButInvalid"}
 425         s.testVhostRedirectTokenToCookie(c, "GET",
 426                 "example.com/c="+arvadostest.HelloWorldCollection+"/Hello%20world.txt",
 427                 "",
 428                 "",
 429                 "",
 430                 http.StatusNotFound,
 431                 "",
 432         )
 433 }
 434
 435 func (s *IntegrationSuite) TestSpecialCharsInPath(c *check.C) {
 436         s.testServer.Config.AttachmentOnlyHost = "download.example.com"
 437
 438         client := s.testServer.Config.Client
 439         client.AuthToken = arvadostest.ActiveToken
 440         fs, err := (&arvados.Collection{}).FileSystem(&client, nil)
 441         c.Assert(err, check.IsNil)
 442         f, err := fs.OpenFile("https:\\\"odd' path chars", os.O_CREATE, 0777)
 443         c.Assert(err, check.IsNil)
 444         f.Close()
 445         mtxt, err := fs.MarshalManifest(".")
 446         c.Assert(err, check.IsNil)
 447         coll := arvados.Collection{ManifestText: mtxt}
 448         err = client.RequestAndDecode(&coll, "POST", "arvados/v1/collections", client.UpdateBody(coll), nil)
 449         c.Assert(err, check.IsNil)
 450
 451         u, _ := url.Parse("http://download.example.com/c=" + coll.UUID + "/")
 452         req := &http.Request{
 453                 Method:     "GET",
 454                 Host:       u.Host,
 455                 URL:        u,
 456                 RequestURI: u.RequestURI(),
 457                 Header: http.Header{
 458                         "Authorization": {"Bearer " + client.AuthToken},
 459                 },
 460         }
 461         resp := httptest.NewRecorder()
 462         s.testServer.Handler.ServeHTTP(resp, req)
 463         c.Check(resp.Code, check.Equals, http.StatusOK)
 464         c.Check(resp.Body.String(), check.Matches, `(?ms).*href="./https:%5c%22odd%27%20path%20chars"\S+https:\\&#34;odd&#39; path chars.*`)
 465 }
 466
 467 // XHRs can't follow redirect-with-cookie so they rely on method=POST
 468 // and disposition=attachment (telling us it's acceptable to respond
 469 // with content instead of a redirect) and an Origin header that gets
 470 // added automatically by the browser (telling us it's desirable to do
 471 // so).
 472 func (s *IntegrationSuite) TestXHRNoRedirect(c *check.C) {
 473         u, _ := url.Parse("http://example.com/c=" + arvadostest.FooCollection + "/foo")
 474         req := &http.Request{
 475                 Method:     "POST",
 476                 Host:       u.Host,
 477                 URL:        u,
 478                 RequestURI: u.RequestURI(),
 479                 Header: http.Header{
 480                         "Origin":       {"https://origin.example"},
 481                         "Content-Type": {"application/x-www-form-urlencoded"},
 482                 },
 483                 Body: ioutil.NopCloser(strings.NewReader(url.Values{
 484                         "api_token":   {arvadostest.ActiveToken},
 485                         "disposition": {"attachment"},
 486                 }.Encode())),
 487         }
 488         resp := httptest.NewRecorder()
 489         s.testServer.Handler.ServeHTTP(resp, req)
 490         c.Check(resp.Code, check.Equals, http.StatusOK)
 491         c.Check(resp.Body.String(), check.Equals, "foo")
 492         c.Check(resp.Header().Get("Access-Control-Allow-Origin"), check.Equals, "*")
 493 }
 494
 495 func (s *IntegrationSuite) testVhostRedirectTokenToCookie(c *check.C, method, hostPath, queryString, contentType, reqBody string, expectStatus int, expectRespBody string) *httptest.ResponseRecorder {
 496         u, _ := url.Parse(`http://` + hostPath + queryString)
 497         req := &http.Request{
 498                 Method:     method,
 499                 Host:       u.Host,
 500                 URL:        u,
 501                 RequestURI: u.RequestURI(),
 502                 Header:     http.Header{"Content-Type": {contentType}},
 503                 Body:       ioutil.NopCloser(strings.NewReader(reqBody)),
 504         }
 505
 506         resp := httptest.NewRecorder()
 507         defer func() {
 508                 c.Check(resp.Code, check.Equals, expectStatus)
 509                 c.Check(resp.Body.String(), check.Equals, expectRespBody)
 510         }()
 511
 512         s.testServer.Handler.ServeHTTP(resp, req)
 513         if resp.Code != http.StatusSeeOther {
 514                 return resp
 515         }
 516         c.Check(resp.Body.String(), check.Matches, `.*href="//`+regexp.QuoteMeta(html.EscapeString(hostPath))+`(\?[^"]*)?".*`)
 517         cookies := (&http.Response{Header: resp.Header()}).Cookies()
 518
 519         u, _ = u.Parse(resp.Header().Get("Location"))
 520         req = &http.Request{
 521                 Method:     "GET",
 522                 Host:       u.Host,
 523                 URL:        u,
 524                 RequestURI: u.RequestURI(),
 525                 Header:     http.Header{},
 526         }
 527         for _, c := range cookies {
 528                 req.AddCookie(c)
 529         }
 530
 531         resp = httptest.NewRecorder()
 532         s.testServer.Handler.ServeHTTP(resp, req)
 533         c.Check(resp.Header().Get("Location"), check.Equals, "")
 534         return resp
 535 }
 536
 537 func (s *IntegrationSuite) TestDirectoryListing(c *check.C) {
 538         s.testServer.Config.AttachmentOnlyHost = "download.example.com"
 539         authHeader := http.Header{
 540                 "Authorization": {"OAuth2 " + arvadostest.ActiveToken},
 541         }
 542         for _, trial := range []struct {
 543                 uri      string
 544                 header   http.Header
 545                 expect   []string
 546                 redirect string
 547                 cutDirs  int
 548         }{
 549                 {
 550                         uri:     strings.Replace(arvadostest.FooAndBarFilesInDirPDH, "+", "-", -1) + ".example.com/",
 551                         header:  authHeader,
 552                         expect:  []string{"dir1/foo", "dir1/bar"},
 553                         cutDirs: 0,
 554                 },
 555                 {
 556                         uri:     strings.Replace(arvadostest.FooAndBarFilesInDirPDH, "+", "-", -1) + ".example.com/dir1/",
 557                         header:  authHeader,
 558                         expect:  []string{"foo", "bar"},
 559                         cutDirs: 1,
 560                 },
 561                 {
 562                         uri:     "download.example.com/collections/" + arvadostest.FooAndBarFilesInDirUUID + "/",
 563                         header:  authHeader,
 564                         expect:  []string{"dir1/foo", "dir1/bar"},
 565                         cutDirs: 2,
 566                 },
 567                 {
 568                         uri:     "download.example.com/users/active/foo_file_in_dir/",
 569                         header:  authHeader,
 570                         expect:  []string{"dir1/"},
 571                         cutDirs: 3,
 572                 },
 573                 {
 574                         uri:     "download.example.com/users/active/foo_file_in_dir/dir1/",
 575                         header:  authHeader,
 576                         expect:  []string{"bar"},
 577                         cutDirs: 4,
 578                 },
 579                 {
 580                         uri:     "download.example.com/",
 581                         header:  authHeader,
 582                         expect:  []string{"users/"},
 583                         cutDirs: 0,
 584                 },
 585                 {
 586                         uri:      "download.example.com/users",
 587                         header:   authHeader,
 588                         redirect: "/users/",
 589                         expect:   []string{"active/"},
 590                         cutDirs:  1,
 591                 },
 592                 {
 593                         uri:     "download.example.com/users/",
 594                         header:  authHeader,
 595                         expect:  []string{"active/"},
 596                         cutDirs: 1,
 597                 },
 598                 {
 599                         uri:      "download.example.com/users/active",
 600                         header:   authHeader,
 601                         redirect: "/users/active/",
 602                         expect:   []string{"foo_file_in_dir/"},
 603                         cutDirs:  2,
 604                 },
 605                 {
 606                         uri:     "download.example.com/users/active/",
 607                         header:  authHeader,
 608                         expect:  []string{"foo_file_in_dir/"},
 609                         cutDirs: 2,
 610                 },
 611                 {
 612                         uri:     "collections.example.com/collections/download/" + arvadostest.FooAndBarFilesInDirUUID + "/" + arvadostest.ActiveToken + "/",
 613                         header:  nil,
 614                         expect:  []string{"dir1/foo", "dir1/bar"},
 615                         cutDirs: 4,
 616                 },
 617                 {
 618                         uri:     "collections.example.com/c=" + arvadostest.FooAndBarFilesInDirUUID + "/t=" + arvadostest.ActiveToken + "/",
 619                         header:  nil,
 620                         expect:  []string{"dir1/foo", "dir1/bar"},
 621                         cutDirs: 2,
 622                 },
 623                 {
 624                         uri:     "collections.example.com/c=" + arvadostest.FooAndBarFilesInDirUUID + "/t=" + arvadostest.ActiveToken,
 625                         header:  nil,
 626                         expect:  []string{"dir1/foo", "dir1/bar"},
 627                         cutDirs: 2,
 628                 },
 629                 {
 630                         uri:     "download.example.com/c=" + arvadostest.FooAndBarFilesInDirUUID,
 631                         header:  authHeader,
 632                         expect:  []string{"dir1/foo", "dir1/bar"},
 633                         cutDirs: 1,
 634                 },
 635                 {
 636                         uri:      "download.example.com/c=" + arvadostest.FooAndBarFilesInDirUUID + "/dir1",
 637                         header:   authHeader,
 638                         redirect: "/c=" + arvadostest.FooAndBarFilesInDirUUID + "/dir1/",
 639                         expect:   []string{"foo", "bar"},
 640                         cutDirs:  2,
 641                 },
 642                 {
 643                         uri:     "download.example.com/c=" + arvadostest.FooAndBarFilesInDirUUID + "/_/dir1/",
 644                         header:  authHeader,
 645                         expect:  []string{"foo", "bar"},
 646                         cutDirs: 3,
 647                 },
 648                 {
 649                         uri:      arvadostest.FooAndBarFilesInDirUUID + ".example.com/dir1?api_token=" + arvadostest.ActiveToken,
 650                         header:   authHeader,
 651                         redirect: "/dir1/",
 652                         expect:   []string{"foo", "bar"},
 653                         cutDirs:  1,
 654                 },
 655                 {
 656                         uri:    "collections.example.com/c=" + arvadostest.FooAndBarFilesInDirUUID + "/theperthcountyconspiracydoesnotexist/",
 657                         header: authHeader,
 658                         expect: nil,
 659                 },
 660         } {
 661                 c.Logf("HTML: %q => %q", trial.uri, trial.expect)
 662                 resp := httptest.NewRecorder()
 663                 u := mustParseURL("//" + trial.uri)
 664                 req := &http.Request{
 665                         Method:     "GET",
 666                         Host:       u.Host,
 667                         URL:        u,
 668                         RequestURI: u.RequestURI(),
 669                         Header:     copyHeader(trial.header),
 670                 }
 671                 s.testServer.Handler.ServeHTTP(resp, req)
 672                 var cookies []*http.Cookie
 673                 for resp.Code == http.StatusSeeOther {
 674                         u, _ := req.URL.Parse(resp.Header().Get("Location"))
 675                         req = &http.Request{
 676                                 Method:     "GET",
 677                                 Host:       u.Host,
 678                                 URL:        u,
 679                                 RequestURI: u.RequestURI(),
 680                                 Header:     copyHeader(trial.header),
 681                         }
 682                         cookies = append(cookies, (&http.Response{Header: resp.Header()}).Cookies()...)
 683                         for _, c := range cookies {
 684                                 req.AddCookie(c)
 685                         }
 686                         resp = httptest.NewRecorder()
 687                         s.testServer.Handler.ServeHTTP(resp, req)
 688                 }
 689                 if trial.redirect != "" {
 690                         c.Check(req.URL.Path, check.Equals, trial.redirect)
 691                 }
 692                 if trial.expect == nil {
 693                         c.Check(resp.Code, check.Equals, http.StatusNotFound)
 694                 } else {
 695                         c.Check(resp.Code, check.Equals, http.StatusOK)
 696                         for _, e := range trial.expect {
 697                                 c.Check(resp.Body.String(), check.Matches, `(?ms).*href="./`+e+`".*`)
 698                         }
 699                         c.Check(resp.Body.String(), check.Matches, `(?ms).*--cut-dirs=`+fmt.Sprintf("%d", trial.cutDirs)+` .*`)
 700                 }
 701
 702                 c.Logf("WebDAV: %q => %q", trial.uri, trial.expect)
 703                 req = &http.Request{
 704                         Method:     "OPTIONS",
 705                         Host:       u.Host,
 706                         URL:        u,
 707                         RequestURI: u.RequestURI(),
 708                         Header:     copyHeader(trial.header),
 709                         Body:       ioutil.NopCloser(&bytes.Buffer{}),
 710                 }
 711                 resp = httptest.NewRecorder()
 712                 s.testServer.Handler.ServeHTTP(resp, req)
 713                 if trial.expect == nil {
 714                         c.Check(resp.Code, check.Equals, http.StatusNotFound)
 715                 } else {
 716                         c.Check(resp.Code, check.Equals, http.StatusOK)
 717                 }
 718
 719                 req = &http.Request{
 720                         Method:     "PROPFIND",
 721                         Host:       u.Host,
 722                         URL:        u,
 723                         RequestURI: u.RequestURI(),
 724                         Header:     copyHeader(trial.header),
 725                         Body:       ioutil.NopCloser(&bytes.Buffer{}),
 726                 }
 727                 resp = httptest.NewRecorder()
 728                 s.testServer.Handler.ServeHTTP(resp, req)
 729                 if trial.expect == nil {
 730                         c.Check(resp.Code, check.Equals, http.StatusNotFound)
 731                 } else {
 732                         c.Check(resp.Code, check.Equals, http.StatusMultiStatus)
 733                         for _, e := range trial.expect {
 734                                 c.Check(resp.Body.String(), check.Matches, `(?ms).*<D:href>`+filepath.Join(u.Path, e)+`</D:href>.*`)
 735                         }
 736                 }
 737         }
 738 }
 739
 740 func (s *IntegrationSuite) TestHealthCheckPing(c *check.C) {
 741         s.testServer.Config.ManagementToken = arvadostest.ManagementToken
 742         authHeader := http.Header{
 743                 "Authorization": {"Bearer " + arvadostest.ManagementToken},
 744         }
 745
 746         resp := httptest.NewRecorder()
 747         u := mustParseURL("http://download.example.com/_health/ping")
 748         req := &http.Request{
 749                 Method:     "GET",
 750                 Host:       u.Host,
 751                 URL:        u,
 752                 RequestURI: u.RequestURI(),
 753                 Header:     authHeader,
 754         }
 755         s.testServer.Handler.ServeHTTP(resp, req)
 756
 757         c.Check(resp.Code, check.Equals, http.StatusOK)
 758         c.Check(resp.Body.String(), check.Matches, `{"health":"OK"}\n`)
 759 }
 760
 761 func copyHeader(h http.Header) http.Header {
 762         hc := http.Header{}
 763         for k, v := range h {
 764                 hc[k] = append([]string(nil), v...)
 765         }
 766         return hc
 767 }