services/arv-git-httpd/auth_handler_test.go

   1 // Copyright (C) The Arvados Authors. All rights reserved.
   2 //
   3 // SPDX-License-Identifier: AGPL-3.0
   4
   5 package main
   6
   7 import (
   8         "net/http"
   9         "net/http/httptest"
  10         "net/url"
  11
  12         check "gopkg.in/check.v1"
  13 )
  14
  15 var _ = check.Suite(&AuthHandlerSuite{})
  16
  17 type AuthHandlerSuite struct{}
  18
  19 func (s *AuthHandlerSuite) TestCORS(c *check.C) {
  20         h := &authHandler{}
  21
  22         // CORS preflight
  23         resp := httptest.NewRecorder()
  24         req := &http.Request{
  25                 Method: "OPTIONS",
  26                 Header: http.Header{
  27                         "Origin":                        {"*"},
  28                         "Access-Control-Request-Method": {"GET"},
  29                 },
  30         }
  31         h.ServeHTTP(resp, req)
  32         c.Check(resp.Code, check.Equals, http.StatusOK)
  33         c.Check(resp.Header().Get("Access-Control-Allow-Methods"), check.Equals, "GET, POST")
  34         c.Check(resp.Header().Get("Access-Control-Allow-Headers"), check.Equals, "Authorization, Content-Type")
  35         c.Check(resp.Header().Get("Access-Control-Allow-Origin"), check.Equals, "*")
  36         c.Check(resp.Body.String(), check.Equals, "")
  37
  38         // CORS actual request. Bogus token and path ensure
  39         // authHandler responds 4xx without calling our wrapped (nil)
  40         // handler.
  41         u, err := url.Parse("git.zzzzz.arvadosapi.com/test")
  42         c.Assert(err, check.Equals, nil)
  43         resp = httptest.NewRecorder()
  44         req = &http.Request{
  45                 Method: "GET",
  46                 URL:    u,
  47                 Header: http.Header{
  48                         "Origin":        {"*"},
  49                         "Authorization": {"OAuth2 foobar"},
  50                 },
  51         }
  52         h.ServeHTTP(resp, req)
  53         c.Check(resp.Header().Get("Access-Control-Allow-Origin"), check.Equals, "*")
  54 }