Merge branch 'patch-1' of https://github.com/mr-c/arvados into mr-c-patch-1

[arvados.git] / lib / controller / handler_test.go

diff --git a/lib/controller/handler_test.go b/lib/controller/handler_test.go
index d54f50cf1ff2a8b9f52c3149548e74257443dbb8..ef6b9195f10be05b1dd69bcbedda800df66dfdb3 100644 (file)
--- a/lib/controller/handler_test.go
+++ b/lib/controller/handler_test.go
@@ -19,6 +19,7 @@ import (
 
        "git.arvados.org/arvados.git/sdk/go/arvados"
        "git.arvados.org/arvados.git/sdk/go/arvadostest"
+       "git.arvados.org/arvados.git/sdk/go/auth"
        "git.arvados.org/arvados.git/sdk/go/ctxlog"
        "git.arvados.org/arvados.git/sdk/go/httpserver"
        "github.com/prometheus/client_golang/prometheus"
@@ -51,6 +52,7 @@ func (s *HandlerSuite) SetUpTest(c *check.C) {
                PostgreSQL:       integrationTestCluster().PostgreSQL,
                ForceLegacyAPI14: forceLegacyAPI14,
        }
+       s.cluster.API.RequestTimeout = arvados.Duration(5 * time.Minute)
        s.cluster.TLS.Insecure = true
        arvadostest.SetServiceURL(&s.cluster.Services.RailsAPI, "https://"+os.Getenv("ARVADOS_TEST_API_HOST"))
        arvadostest.SetServiceURL(&s.cluster.Services.Controller, "http://localhost:/")
@@ -70,7 +72,10 @@ func (s *HandlerSuite) TestConfigExport(c *check.C) {
                req := httptest.NewRequest(method, "/arvados/v1/config", nil)
                resp := httptest.NewRecorder()
                s.handler.ServeHTTP(resp, req)
-               c.Check(resp.Code, check.Equals, http.StatusOK)
+               c.Log(resp.Body.String())
+               if !c.Check(resp.Code, check.Equals, http.StatusOK) {
+                       continue
+               }
                c.Check(resp.Header().Get("Access-Control-Allow-Origin"), check.Equals, `*`)
                c.Check(resp.Header().Get("Access-Control-Allow-Methods"), check.Matches, `.*\bGET\b.*`)
                c.Check(resp.Header().Get("Access-Control-Allow-Headers"), check.Matches, `.+`)
@@ -79,12 +84,11 @@ func (s *HandlerSuite) TestConfigExport(c *check.C) {
                        continue
                }
                var cluster arvados.Cluster
-               c.Log(resp.Body.String())
                err := json.Unmarshal(resp.Body.Bytes(), &cluster)
                c.Check(err, check.IsNil)
                c.Check(cluster.ManagementToken, check.Equals, "")
                c.Check(cluster.SystemRootToken, check.Equals, "")
-               c.Check(cluster.Collections.BlobSigning, check.DeepEquals, true)
+               c.Check(cluster.Collections.BlobSigning, check.Equals, true)
                c.Check(cluster.Collections.BlobSigningTTL, check.Equals, arvados.Duration(23*time.Second))
        }
 }
@@ -166,8 +170,9 @@ func (s *HandlerSuite) TestProxyNotFound(c *check.C) {
 }
 
 func (s *HandlerSuite) TestProxyRedirect(c *check.C) {
-       s.cluster.Login.ProviderAppID = "test"
-       s.cluster.Login.ProviderAppSecret = "test"
+       s.cluster.Login.SSO.Enable = true
+       s.cluster.Login.SSO.ProviderAppID = "test"
+       s.cluster.Login.SSO.ProviderAppSecret = "test"
        req := httptest.NewRequest("GET", "https://0.0.0.0:1/login?return_to=foo", nil)
        resp := httptest.NewRecorder()
        s.handler.ServeHTTP(resp, req)
@@ -180,6 +185,34 @@ func (s *HandlerSuite) TestProxyRedirect(c *check.C) {
        c.Check(resp.Header().Get("Location"), check.Matches, `(https://0.0.0.0:1)?/auth/joshid\?return_to=%2Cfoo&?`)
 }
 
+func (s *HandlerSuite) TestLogoutSSO(c *check.C) {
+       s.cluster.Login.SSO.Enable = true
+       s.cluster.Login.SSO.ProviderAppID = "test"
+       req := httptest.NewRequest("GET", "https://0.0.0.0:1/logout?return_to=https://example.com/foo", nil)
+       resp := httptest.NewRecorder()
+       s.handler.ServeHTTP(resp, req)
+       if !c.Check(resp.Code, check.Equals, http.StatusFound) {
+               c.Log(resp.Body.String())
+       }
+       c.Check(resp.Header().Get("Location"), check.Equals, "http://localhost:3002/users/sign_out?"+url.Values{"redirect_uri": {"https://example.com/foo"}}.Encode())
+}
+
+func (s *HandlerSuite) TestLogoutGoogle(c *check.C) {
+       if s.cluster.ForceLegacyAPI14 {
+               // Google login N/A
+               return
+       }
+       s.cluster.Login.Google.Enable = true
+       s.cluster.Login.Google.ClientID = "test"
+       req := httptest.NewRequest("GET", "https://0.0.0.0:1/logout?return_to=https://example.com/foo", nil)
+       resp := httptest.NewRecorder()
+       s.handler.ServeHTTP(resp, req)
+       if !c.Check(resp.Code, check.Equals, http.StatusFound) {
+               c.Log(resp.Body.String())
+       }
+       c.Check(resp.Header().Get("Location"), check.Equals, "https://example.com/foo")
+}
+
 func (s *HandlerSuite) TestValidateV1APIToken(c *check.C) {
        req := httptest.NewRequest("GET", "/arvados/v1/users/current", nil)
        user, ok, err := s.handler.(*Handler).validateAPItoken(req, arvadostest.ActiveToken)
@@ -203,6 +236,26 @@ func (s *HandlerSuite) TestValidateV2APIToken(c *check.C) {
        c.Check(user.Authorization.TokenV2(), check.Equals, arvadostest.ActiveTokenV2)
 }
 
+func (s *HandlerSuite) TestValidateRemoteToken(c *check.C) {
+       saltedToken, err := auth.SaltToken(arvadostest.ActiveTokenV2, "abcde")
+       c.Assert(err, check.IsNil)
+       for _, trial := range []struct {
+               code  int
+               token string
+       }{
+               {http.StatusOK, saltedToken},
+               {http.StatusUnauthorized, "bogus"},
+       } {
+               req := httptest.NewRequest("GET", "https://0.0.0.0:1/arvados/v1/users/current?remote=abcde", nil)
+               req.Header.Set("Authorization", "Bearer "+trial.token)
+               resp := httptest.NewRecorder()
+               s.handler.ServeHTTP(resp, req)
+               if !c.Check(resp.Code, check.Equals, trial.code) {
+                       c.Logf("HTTP %d: %s", resp.Code, resp.Body.String())
+               }
+       }
+}
+
 func (s *HandlerSuite) TestCreateAPIToken(c *check.C) {
        req := httptest.NewRequest("GET", "/arvados/v1/users/current", nil)
        auth, err := s.handler.(*Handler).createAPItoken(req, arvadostest.ActiveUserUUID, nil)