kami
4fbf3ac966
A task in retry backoff was filtered out before the candidate loop, so it recorded no rejection at all: queued, apparently assignable, and silent. That is the exact shape that made F5 take a live session to diagnose. It now reports "retry backoff until <time>". Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
95 lines
3.2 KiB
Go
95 lines
3.2 KiB
Go
package authn
|
|
|
|
import (
|
|
"bytes"
|
|
"encoding/json"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"orchestra/internal/authz"
|
|
"testing"
|
|
)
|
|
|
|
func TestHTTPSessionLoginLookupAndLogout(t *testing.T) {
|
|
users, _ := openTestStore(t)
|
|
if _, _, err := users.SetPassword("kami", "correct horse battery"); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
h := HTTP{Users: users, Sessions: &authz.Sessions{}}
|
|
|
|
login := httptest.NewRequest(http.MethodPost, authz.SessionPath, bytes.NewBufferString(`{"username":"kami","password":"correct horse battery"}`))
|
|
w := httptest.NewRecorder()
|
|
h.Session(w, login)
|
|
if w.Code != http.StatusOK {
|
|
t.Fatalf("login status=%d body=%s", w.Code, w.Body)
|
|
}
|
|
response := w.Result()
|
|
cookies := response.Cookies()
|
|
if len(cookies) != 1 || cookies[0].Name != authz.SessionCookie || !cookies[0].HttpOnly {
|
|
t.Fatalf("cookies=%+v", cookies)
|
|
}
|
|
var account User
|
|
if err := json.Unmarshal(w.Body.Bytes(), &account); err != nil || account.Username != "kami" {
|
|
t.Fatalf("account=%+v err=%v", account, err)
|
|
}
|
|
|
|
lookup := httptest.NewRequest(http.MethodGet, authz.SessionPath, nil)
|
|
lookup.AddCookie(cookies[0])
|
|
w = httptest.NewRecorder()
|
|
h.Session(w, lookup)
|
|
if w.Code != http.StatusOK || !bytes.Contains(w.Body.Bytes(), []byte(`"username":"kami"`)) {
|
|
t.Fatalf("lookup status=%d body=%s", w.Code, w.Body)
|
|
}
|
|
|
|
logout := httptest.NewRequest(http.MethodDelete, authz.SessionPath, nil)
|
|
logout.AddCookie(cookies[0])
|
|
w = httptest.NewRecorder()
|
|
h.Session(w, logout)
|
|
if w.Code != http.StatusNoContent || h.Sessions.Valid(cookies[0].Value) {
|
|
t.Fatalf("logout status=%d valid=%v", w.Code, h.Sessions.Valid(cookies[0].Value))
|
|
}
|
|
}
|
|
|
|
func TestHTTPLoginDoesNotRevealUnknownUsername(t *testing.T) {
|
|
users, _ := openTestStore(t)
|
|
if _, _, err := users.SetPassword("kami", "correct horse battery"); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
h := HTTP{Users: users, Sessions: &authz.Sessions{}}
|
|
for _, body := range []string{
|
|
`{"username":"kami","password":"wrong password"}`,
|
|
`{"username":"unknown","password":"wrong password"}`,
|
|
} {
|
|
w := httptest.NewRecorder()
|
|
h.Session(w, httptest.NewRequest(http.MethodPost, authz.SessionPath, bytes.NewBufferString(body)))
|
|
if w.Code != http.StatusUnauthorized || w.Body.String() != "invalid credentials\n" {
|
|
t.Fatalf("status=%d body=%q", w.Code, w.Body.String())
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestHTTPAccountUpdateRevokesExistingSessions(t *testing.T) {
|
|
users, _ := openTestStore(t)
|
|
if _, _, err := users.SetPassword("operator", "original password"); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
sessions := &authz.Sessions{}
|
|
h := HTTP{Users: users, Sessions: sessions}
|
|
value, err := sessions.IssueFor("operator")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
req := httptest.NewRequest(http.MethodPut, "/v1/ui/account", bytes.NewBufferString(`{"current_password":"original password","username":"kami","new_password":"replacement password"}`))
|
|
req.AddCookie(&http.Cookie{Name: authz.SessionCookie, Value: value})
|
|
w := httptest.NewRecorder()
|
|
h.Account(w, req)
|
|
if w.Code != http.StatusOK {
|
|
t.Fatalf("status=%d body=%s", w.Code, w.Body)
|
|
}
|
|
if sessions.Valid(value) {
|
|
t.Fatal("credential update retained an old browser session")
|
|
}
|
|
if _, err := users.Authenticate("kami", "replacement password"); err != nil {
|
|
t.Fatalf("updated login: %v", err)
|
|
}
|
|
}
|