Newer
Older
package rootmux
import (
"encoding/json"
"net/http"
"net/http/cookiejar"
"net/http/httptest"
"net/url"
"os"
"testing"
"forge.grandlyon.com/web-et-numerique/llle_project/backoffice-server/internal/auth"
"forge.grandlyon.com/web-et-numerique/llle_project/backoffice-server/internal/mocks"
"forge.grandlyon.com/web-et-numerique/llle_project/backoffice-server/internal/monthlyNews"
"forge.grandlyon.com/web-et-numerique/llle_project/backoffice-server/internal/poll"
"forge.grandlyon.com/web-et-numerique/llle_project/backoffice-server/internal/tester"
"forge.grandlyon.com/web-et-numerique/llle_project/backoffice-server/internal/tokens"
)
var (
oAuth2Server *httptest.Server
newMonthlyNews = monthlyNews.MonthlyNews{Year: 2020, Month: 0, Header: "newsHeader", Quote: "newsQuote"}
newMonthlyNewsStr string
newPoll = poll.Poll{Year: 2020, Month: 0, Question: "pollQuestion", Link: "pollLink"}
newPollStr string
// Create the OAuth2 mock server
oAuth2Server = httptest.NewServer(mocks.CreateMockOAuth2())
go http.ListenAndServe(":8091", mocks.CreateMockAPI())
// Set the constants with environment variables
os.Setenv("HOSTNAME", "localhost")
os.Setenv("ADMIN_ROLE", "ADMINS")
os.Setenv("CLIENT_ID", "foo")
os.Setenv("CLIENT_SECRET", "bar")
os.Setenv("TOKEN_URL", oAuth2Server.URL+"/token")
os.Setenv("USERINFO_URL", oAuth2Server.URL+"/userinfo")
os.Setenv("LOGOUT_URL", oAuth2Server.URL+"/logout")
// Setup the token manager to use debug mode
os.Setenv("DEBUG_MODE", "true")
tokens.Init("../configs/tokenskey.json", true)
// Convert example objects to string
newMonthlyNewsBytes, _ := json.Marshal(newMonthlyNews)
newMonthlyNewsStr = string(newMonthlyNewsBytes)
newPollBytes, _ := json.Marshal(newPoll)
newPollStr = string(newPollBytes)
code := m.Run()
// Remove the database
os.Remove("backoffice.db")
os.Exit(code)
}
func TestAll(t *testing.T) {
// Set up testers
os.Setenv("AUTH_URL", oAuth2Server.URL+"/auth-wrong-state") // Set the server to access failing OAuth2 endpoints
oauth2Tests(t)
os.Setenv("AUTH_URL", oAuth2Server.URL+"/auth") // Set the server to access the correct OAuth2Endpoint
unloggedTests(t)
os.Setenv("USERINFO_URL", oAuth2Server.URL+"/admininfo")
adminTests(t)
}
/**
SECURITY TESTS (this tests are to check that the security protections works)
**/
func oauth2Tests(t *testing.T) {
// Create the tester
ts, do, _ := createTester(t)
defer ts.Close() // Close the tester
// Try to login (must fail)
do("GET", "/OAuth2Login", noH, "", http.StatusInternalServerError, "invalid oauth state")
}
/**
UNLOGGED USER TESTS (this tests are to check that the security protections works)
**/
func unloggedTests(t *testing.T) {
// Create the tester
ts, do, _ := createTester(t)
defer ts.Close() // Close the tester
// Try to create a monthlyNews (must fail)
do("POST", "/api/admin/monthlyNews", noH, newMonthlyNewsStr, http.StatusUnauthorized, "error extracting token")
}
/**
ADMIN TESTS (this tests are to check that an administrator can alter the apps)
**/
func adminTests(t *testing.T) {
// Create the tester
ts, do, _ := createTester(t)
defer ts.Close() // Close the tester
tests := func() {
// Get the XSRF Token
response := do("GET", "/api/common/WhoAmI", noH, "", http.StatusOK, "")
token := auth.TokenData{}
json.Unmarshal([]byte(response), &token)
xsrfHeader := map[string]string{"XSRF-TOKEN": token.XSRFToken}
// Try to create a monthly news without the XSRF-TOKEN (must fail)
do("POST", "/api/admin/monthlyNews", noH, newMonthlyNewsStr, http.StatusUnauthorized, "XSRF protection triggered")
// Try to create a monthly news without body (must fail)
do("POST", "/api/admin/monthlyNews", xsrfHeader, "", http.StatusBadRequest, "request body is empty")
// Try to get a monthly news before it is created (must pass empty)
do("GET", "/api/admin/monthlyNews/2020/0", xsrfHeader, "", http.StatusOK, "{}")
// Try to create a monthly news (must pass)
do("PUT", "/api/admin/monthlyNews", xsrfHeader, newMonthlyNewsStr, http.StatusCreated, newMonthlyNewsStr)
// Try to update a monthly news (must pass)
do("PUT", "/api/admin/monthlyNews", xsrfHeader, newMonthlyNewsStr, http.StatusOK, newMonthlyNewsStr)
// Try to get the monthly news created (must pass)
do("GET", "/api/admin/monthlyNews/2020/0", xsrfHeader, "", http.StatusOK, newMonthlyNewsStr)
// Try to delete the monthly news created (must pass)
do("DELETE", "/api/admin/monthlyNews/2020/0", xsrfHeader, "", http.StatusOK, "successful delete")
// Try to get a monthly news after it is deleted (must pass empty)
do("GET", "/api/admin/monthlyNews/2020/0", xsrfHeader, "", http.StatusOK, "{}")
// Try to create a poll without the XSRF-TOKEN (must fail)
do("POST", "/api/admin/poll", noH, newPollStr, http.StatusUnauthorized, "XSRF protection triggered")
// Try to create a poll without body (must fail)
do("POST", "/api/admin/poll", xsrfHeader, "", http.StatusBadRequest, "request body is empty")
// Try to get a poll before it is created (must pass empty)
do("GET", "/api/admin/poll/2020/0", xsrfHeader, "", http.StatusOK, "{}")
// Try to create a poll (must pass)
do("PUT", "/api/admin/poll", xsrfHeader, newPollStr, http.StatusCreated, newPollStr)
// Try to update a poll (must pass)
do("PUT", "/api/admin/poll", xsrfHeader, newPollStr, http.StatusOK, newPollStr)
// Try to get the poll created (must pass)
do("GET", "/api/admin/poll/2020/0", xsrfHeader, "", http.StatusOK, newPollStr)
// Try to delete the poll created (must pass)
do("DELETE", "/api/admin/poll/2020/0", xsrfHeader, "", http.StatusOK, "successful delete")
// Try to get a poll after it is deleted (must pass empty)
do("GET", "/api/admin/poll/2020/0", xsrfHeader, "", http.StatusOK, "{}")
do("GET", "/OAuth2Login", noH, "", http.StatusOK, "successful login")
// Run the tests
tests()
// Try to logout (must pass)
do("GET", "/Logout", noH, "", http.StatusOK, "")
// Try to get a monthly news again (must fail)
do("GET", "/api/admin/monthlyNews", noH, "", http.StatusUnauthorized, "error extracting token")
// Try to get a poll again (must fail)
do("GET", "/api/admin/poll", noH, "", http.StatusUnauthorized, "error extracting token")
}
func createTester(t *testing.T) (*httptest.Server, tester.DoFn, tester.DoFn) {
// Create the server
mux := CreateRootMux("../../web")
url, _ := url.Parse(ts.URL)
port := url.Port()
mux.Manager.Config.RedirectURL = "http://" + os.Getenv("HOSTNAME") + ":" + port + "/OAuth2Callback"
mux.Manager.Hostname = "http://" + os.Getenv("HOSTNAME") + ":" + port
// Create the cookie jar
jar, _ := cookiejar.New(nil)
// wrap the testing function
return ts, tester.CreateServerTester(t, port, os.Getenv("HOSTNAME"), jar), tester.CreateServerTester(t, port, os.Getenv("HOSTNAME"), nil)
}