orchestra/internal/authn/http_test.go

package authn

import (
	"bytes"
	"encoding/json"
	"net/http"
	"net/http/httptest"
	"orchestra/internal/authz"
	"testing"
)

func TestHTTPSessionLoginLookupAndLogout(t *testing.T) {
	users, _ := openTestStore(t)
	if _, _, err := users.SetPassword("kami", "correct horse battery"); err != nil {
		t.Fatal(err)
	}
	h := HTTP{Users: users, Sessions: &authz.Sessions{}}

	login := httptest.NewRequest(http.MethodPost, authz.SessionPath, bytes.NewBufferString(`{"username":"kami","password":"correct horse battery"}`))
	w := httptest.NewRecorder()
	h.Session(w, login)
	if w.Code != http.StatusOK {
		t.Fatalf("login status=%d body=%s", w.Code, w.Body)
	}
	response := w.Result()
	cookies := response.Cookies()
	if len(cookies) != 1 || cookies[0].Name != authz.SessionCookie || !cookies[0].HttpOnly {
		t.Fatalf("cookies=%+v", cookies)
	}
	var account User
	if err := json.Unmarshal(w.Body.Bytes(), &account); err != nil || account.Username != "kami" {
		t.Fatalf("account=%+v err=%v", account, err)
	}

	lookup := httptest.NewRequest(http.MethodGet, authz.SessionPath, nil)
	lookup.AddCookie(cookies[0])
	w = httptest.NewRecorder()
	h.Session(w, lookup)
	if w.Code != http.StatusOK || !bytes.Contains(w.Body.Bytes(), []byte(`"username":"kami"`)) {
		t.Fatalf("lookup status=%d body=%s", w.Code, w.Body)
	}

	logout := httptest.NewRequest(http.MethodDelete, authz.SessionPath, nil)
	logout.AddCookie(cookies[0])
	w = httptest.NewRecorder()
	h.Session(w, logout)
	if w.Code != http.StatusNoContent || h.Sessions.Valid(cookies[0].Value) {
		t.Fatalf("logout status=%d valid=%v", w.Code, h.Sessions.Valid(cookies[0].Value))
	}
}

func TestHTTPLoginDoesNotRevealUnknownUsername(t *testing.T) {
	users, _ := openTestStore(t)
	if _, _, err := users.SetPassword("kami", "correct horse battery"); err != nil {
		t.Fatal(err)
	}
	h := HTTP{Users: users, Sessions: &authz.Sessions{}}
	for _, body := range []string{
		`{"username":"kami","password":"wrong password"}`,
		`{"username":"unknown","password":"wrong password"}`,
	} {
		w := httptest.NewRecorder()
		h.Session(w, httptest.NewRequest(http.MethodPost, authz.SessionPath, bytes.NewBufferString(body)))
		if w.Code != http.StatusUnauthorized || w.Body.String() != "invalid credentials\n" {
			t.Fatalf("status=%d body=%q", w.Code, w.Body.String())
		}
	}
}

func TestHTTPAccountUpdateRevokesExistingSessions(t *testing.T) {
	users, _ := openTestStore(t)
	if _, _, err := users.SetPassword("operator", "original password"); err != nil {
		t.Fatal(err)
	}
	sessions := &authz.Sessions{}
	h := HTTP{Users: users, Sessions: sessions}
	value, err := sessions.IssueFor("operator")
	if err != nil {
		t.Fatal(err)
	}
	req := httptest.NewRequest(http.MethodPut, "/v1/ui/account", bytes.NewBufferString(`{"current_password":"original password","username":"kami","new_password":"replacement password"}`))
	req.AddCookie(&http.Cookie{Name: authz.SessionCookie, Value: value})
	w := httptest.NewRecorder()
	h.Account(w, req)
	if w.Code != http.StatusOK {
		t.Fatalf("status=%d body=%s", w.Code, w.Body)
	}
	if sessions.Valid(value) {
		t.Fatal("credential update retained an old browser session")
	}
	if _, err := users.Authenticate("kami", "replacement password"); err != nil {
		t.Fatalf("updated login: %v", err)
	}
}

func TestHTTPAccountRejectsWrongCurrentPasswordWithoutEndingSession(t *testing.T) {
	users, _ := openTestStore(t)
	if _, _, err := users.SetPassword("operator", "original password"); err != nil {
		t.Fatal(err)
	}
	sessions := &authz.Sessions{}
	h := HTTP{Users: users, Sessions: sessions}
	value, err := sessions.IssueFor("operator")
	if err != nil {
		t.Fatal(err)
	}
	req := httptest.NewRequest(http.MethodPut, "/v1/ui/account", bytes.NewBufferString(`{"current_password":"incorrect password","username":"operator","new_password":"replacement password"}`))
	req.AddCookie(&http.Cookie{Name: authz.SessionCookie, Value: value})
	w := httptest.NewRecorder()
	h.Account(w, req)
	if w.Code != http.StatusForbidden {
		t.Fatalf("status=%d body=%s", w.Code, w.Body)
	}
	if !sessions.Valid(value) {
		t.Fatal("a rejected credential update ended the valid browser session")
	}
}

func TestBrowserAuthHandlersComposeWithSessionMiddleware(t *testing.T) {
	users, _ := openTestStore(t)
	if _, _, err := users.SetPassword("operator", "correct horse battery"); err != nil {
		t.Fatal(err)
	}
	sessions := &authz.Sessions{}
	h := HTTP{Users: users, Sessions: sessions}
	mux := http.NewServeMux()
	mux.HandleFunc(authz.SessionPath, h.Session)
	mux.HandleFunc("/v1/ui/account", h.Account)
	server := authz.HTTPWithSessions(nil, sessions, mux)

	w := httptest.NewRecorder()
	server.ServeHTTP(w, httptest.NewRequest(http.MethodGet, "/v1/ui/account", nil))
	if w.Code != http.StatusUnauthorized {
		t.Fatalf("uncredentialed account status=%d", w.Code)
	}

	w = httptest.NewRecorder()
	server.ServeHTTP(w, httptest.NewRequest(http.MethodPost, authz.SessionPath, bytes.NewBufferString(`{"username":"operator","password":"correct horse battery"}`)))
	if w.Code != http.StatusOK || len(w.Result().Cookies()) != 1 {
		t.Fatalf("login status=%d body=%s", w.Code, w.Body)
	}
	cookie := w.Result().Cookies()[0]

	request := httptest.NewRequest(http.MethodGet, "/v1/ui/account", nil)
	request.AddCookie(cookie)
	w = httptest.NewRecorder()
	server.ServeHTTP(w, request)
	if w.Code != http.StatusOK || !bytes.Contains(w.Body.Bytes(), []byte(`"username":"operator"`)) {
		t.Fatalf("authenticated account status=%d body=%s", w.Code, w.Body)
	}
}