diff --git a/common/cmd/pflichttestgate/main.go b/common/cmd/pflichttestgate/main.go index 48e3e947..0047043b 100644 --- a/common/cmd/pflichttestgate/main.go +++ b/common/cmd/pflichttestgate/main.go @@ -20,6 +20,7 @@ var sensitive = []*regexp.Regexp{ regexp.MustCompile(`(^|/)common/policyclient/`), regexp.MustCompile(`(^|/)common/apierror/`), regexp.MustCompile(`(^|/)common/httpharden/`), + regexp.MustCompile(`(^|/)common/bearerauth/`), } func main() { diff --git a/connect/cmd/connect-app/main.go b/connect/cmd/connect-app/main.go index 2d52618f..5c973102 100644 --- a/connect/cmd/connect-app/main.go +++ b/connect/cmd/connect-app/main.go @@ -15,10 +15,10 @@ import ( "github.com/jackc/pgx/v5/pgxpool" + "gitea.perlbach24.de/scripte/nexarch/common/bearerauth" "gitea.perlbach24.de/scripte/nexarch/common/moduleauth" "gitea.perlbach24.de/scripte/nexarch/common/policyclient" "gitea.perlbach24.de/scripte/nexarch/connect/internal/archiveclient" - "gitea.perlbach24.de/scripte/nexarch/connect/internal/bearerauth" "gitea.perlbach24.de/scripte/nexarch/connect/internal/connectorsetupapi" "gitea.perlbach24.de/scripte/nexarch/connect/internal/credential" "gitea.perlbach24.de/scripte/nexarch/connect/internal/crypto" diff --git a/connect/go.mod b/connect/go.mod index d6c45234..f3353a84 100644 --- a/connect/go.mod +++ b/connect/go.mod @@ -5,7 +5,7 @@ go 1.25.0 toolchain go1.25.13 require ( - gitea.perlbach24.de/scripte/nexarch/common v0.2.1 + gitea.perlbach24.de/scripte/nexarch/common v0.2.2 github.com/jackc/pgx/v5 v5.9.2 golang.org/x/text v0.29.0 ) diff --git a/connect/go.sum b/connect/go.sum index c33711d0..60820eeb 100644 --- a/connect/go.sum +++ b/connect/go.sum @@ -1,5 +1,5 @@ -gitea.perlbach24.de/scripte/nexarch/common v0.2.1 h1:vIreSocK/F4+uid+lZ7u0CSNlPFvA1N7A77k+RhNeAc= -gitea.perlbach24.de/scripte/nexarch/common v0.2.1/go.mod h1:CiEImG++QMt1xZqSMeDJhPiB7sfWTLZOwjS6OY/Iguc= +gitea.perlbach24.de/scripte/nexarch/common v0.2.2 h1:PupmTMm3xysOP8J+zgqRAgwro1XlaQn0njsuUgbqN14= +gitea.perlbach24.de/scripte/nexarch/common v0.2.2/go.mod h1:CiEImG++QMt1xZqSMeDJhPiB7sfWTLZOwjS6OY/Iguc= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= diff --git a/connect/internal/bearerauth/bearerauth.go b/connect/internal/bearerauth/bearerauth.go deleted file mode 100644 index bea3e87b..00000000 --- a/connect/internal/bearerauth/bearerauth.go +++ /dev/null @@ -1,71 +0,0 @@ -// Package bearerauth setzt die Identitaet der Connect-APIs aus einem -// verifizierten Core-Modul-Token. Die Handler lesen weiter X-User-Id und -// X-Tenant-Slug; die Middleware ueberschreibt beide aus den Claims, sodass ein -// Client sie nicht frei setzen kann. X-User-Role kommt nur aus dem Token. -package bearerauth - -import ( - "encoding/json" - "errors" - "net/http" - "strings" - - "gitea.perlbach24.de/scripte/nexarch/common/moduleauth" -) - -const ( - headerUser = "X-User-Id" - headerTenant = "X-Tenant-Slug" - headerRole = "X-User-Role" -) - -// Middleware verlangt fuer Anfragen mit Authorization: Bearer ein gueltiges -// Token. Ohne Bearer werden X-User-Id und X-Tenant-Slug entfernt, ausser -// allowHeaderAuth ist gesetzt (Uebergang, bis alle Clients Bearer senden). -func Middleware(v *moduleauth.Verifier, allowHeaderAuth bool, next http.Handler) http.Handler { - return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { - r.Header.Del(headerRole) - token, ok := bearer(r) - if !ok { - if !allowHeaderAuth { - r.Header.Del(headerUser) - r.Header.Del(headerTenant) - } - next.ServeHTTP(w, r) - return - } - if v == nil { - writeError(w, http.StatusUnauthorized, "nicht angemeldet") - return - } - claims, err := v.Verify(r.Context(), token) - if err != nil { - if errors.Is(err, moduleauth.ErrInvalidToken) { - writeError(w, http.StatusUnauthorized, "nicht angemeldet") - } else { - writeError(w, http.StatusServiceUnavailable, "identitaetsdienst nicht erreichbar") - } - return - } - r.Header.Set(headerUser, claims.Subject) - r.Header.Set(headerTenant, claims.Tenant) - if claims.Role != "" { - r.Header.Set(headerRole, claims.Role) - } - next.ServeHTTP(w, r) - }) -} - -func bearer(r *http.Request) (string, bool) { - h := r.Header.Get("Authorization") - if len(h) > 7 && strings.EqualFold(h[:7], "bearer ") { - return strings.TrimSpace(h[7:]), true - } - return "", false -} - -func writeError(w http.ResponseWriter, status int, message string) { - w.Header().Set("Content-Type", "application/json") - w.WriteHeader(status) - _ = json.NewEncoder(w).Encode(map[string]string{"error": message}) -} diff --git a/connect/internal/bearerauth/bearerauth_test.go b/connect/internal/bearerauth/bearerauth_test.go deleted file mode 100644 index 685f2fbe..00000000 --- a/connect/internal/bearerauth/bearerauth_test.go +++ /dev/null @@ -1,75 +0,0 @@ -package bearerauth - -import ( - "net/http" - "net/http/httptest" - "testing" - - "gitea.perlbach24.de/scripte/nexarch/common/moduleauth" -) - -func echo() http.Handler { - return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { - _, _ = w.Write([]byte(r.Header.Get("X-User-Id") + "|" + r.Header.Get("X-Tenant-Slug") + "|" + r.Header.Get("X-User-Role"))) - }) -} - -func do(h http.Handler, hdr map[string]string) *httptest.ResponseRecorder { - req := httptest.NewRequest(http.MethodGet, "/x", nil) - for k, v := range hdr { - req.Header.Set(k, v) - } - rec := httptest.NewRecorder() - h.ServeHTTP(rec, req) - return rec -} - -func TestBearerOverridesClientSuppliedHeaders(t *testing.T) { - v, iss := moduleauth.NewTestVerifierAndIssuer() - h := Middleware(v, false, echo()) - rec := do(h, map[string]string{ - "Authorization": "Bearer " + iss.Token("u1", "acme", "user", "", ""), - "X-User-Id": "fremd", "X-Tenant-Slug": "fremd", - }) - if rec.Code != 200 || rec.Body.String() != "u1|acme|user" { - t.Fatalf("code=%d body=%q", rec.Code, rec.Body.String()) - } -} - -func TestInvalidBearerIs401(t *testing.T) { - v, _ := moduleauth.NewTestVerifierAndIssuer() - _, other := moduleauth.NewTestVerifierAndIssuer() - h := Middleware(v, true, echo()) - if rec := do(h, map[string]string{"Authorization": "Bearer " + other.Token("u1", "acme", "user", "", ""), "X-User-Id": "evil"}); rec.Code != 401 { - t.Fatalf("code=%d", rec.Code) - } - if rec := do(Middleware(nil, true, echo()), map[string]string{"Authorization": "Bearer x.y.z"}); rec.Code != 401 { - t.Fatalf("ohne Verifier code=%d", rec.Code) - } -} - -func TestWithoutBearerHeadersStrippedUnlessAllowed(t *testing.T) { - v, _ := moduleauth.NewTestVerifierAndIssuer() - hdr := map[string]string{"X-User-Id": "u9", "X-Tenant-Slug": "t9"} - if rec := do(Middleware(v, false, echo()), hdr); rec.Body.String() != "||" { - t.Fatalf("Header muessen entfernt werden, bekam %q", rec.Body.String()) - } - if rec := do(Middleware(v, true, echo()), hdr); rec.Body.String() != "u9|t9|" { - t.Fatalf("Uebergangsmodus muss Header durchlassen, bekam %q", rec.Body.String()) - } -} - -func TestRoleOnlyFromToken(t *testing.T) { - v, iss := moduleauth.NewTestVerifierAndIssuer() - h := Middleware(v, true, echo()) - rec := do(h, map[string]string{ - "Authorization": "Bearer " + iss.Token("u1", "acme", "tenant_admin", "", ""), - "X-User-Role": "tenant_admin_fremd", - }) - if rec.Body.String() != "u1|acme|tenant_admin" { - t.Fatalf("Rolle muss aus dem Token kommen, bekam %q", rec.Body.String()) - } - if rec := do(h, map[string]string{"X-User-Role": "tenant_admin"}); rec.Body.String() != "||" { - t.Fatalf("Rolle ohne Token muss entfernt werden, bekam %q", rec.Body.String()) - } -} diff --git a/connect/internal/statusapi/statusapi.go b/connect/internal/statusapi/statusapi.go index 7348f108..55af4a39 100644 --- a/connect/internal/statusapi/statusapi.go +++ b/connect/internal/statusapi/statusapi.go @@ -22,8 +22,7 @@ type Server struct { // WithPolicy aktiviert RBAC-12: echte Rechtepruefung gegen Core (POST // /authorize), zusaetzlich zur bestehenden X-User-Id/X-Tenant-Slug-Pruefung. -// Rolle ist mangels eigenem Rollenkonzept in Connect fest "user" (Uebergang, -// wie beim restlichen Header-basierten Identitaetsmodell dieses Pakets). +// Die Rolle kommt aus X-User-Role (setzt bearerauth aus dem Token), sonst "user". func (s *Server) WithPolicy(client *policyclient.Client) *Server { s.policy = client return s @@ -40,7 +39,7 @@ func (s *Server) RegisterRoutes(mux *http.ServeMux) { func (s *Server) requirePermission(permission string, next func(w http.ResponseWriter, r *http.Request, tenantSlug string)) func(w http.ResponseWriter, r *http.Request, tenantSlug string) { return func(w http.ResponseWriter, r *http.Request, tenantSlug string) { if s.policy != nil { - allowed, err := s.policy.Allowed(r.Context(), tenantSlug, "user", permission) + allowed, err := s.policy.Allowed(r.Context(), tenantSlug, roleOf(r), permission) if err != nil { writeError(w, http.StatusServiceUnavailable, "berechtigungsdienst nicht erreichbar") return @@ -54,6 +53,13 @@ func (s *Server) requirePermission(permission string, next func(w http.ResponseW } } +func roleOf(r *http.Request) string { + if role := r.Header.Get("X-User-Role"); role != "" { + return role + } + return "user" +} + func (s *Server) requireIdentity(next func(w http.ResponseWriter, r *http.Request, tenantSlug string)) http.HandlerFunc { return func(w http.ResponseWriter, r *http.Request) { if r.Header.Get("X-User-Id") == "" { diff --git a/connect/internal/statusapi/statusapi_policy_test.go b/connect/internal/statusapi/statusapi_policy_test.go index adad71f9..39a5fb8e 100644 --- a/connect/internal/statusapi/statusapi_policy_test.go +++ b/connect/internal/statusapi/statusapi_policy_test.go @@ -60,3 +60,32 @@ func TestHandleList_PolicyAllows_Passes(t *testing.T) { t.Fatalf("erwartet 200 mit berechtigung, bekam %d: %s", rec.Code, rec.Body.String()) } } + +func TestHandleList_RoleFromHeaderReachesPolicy(t *testing.T) { + var got []string + policyAPI := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + var body struct { + Role string `json:"role"` + } + _ = json.NewDecoder(r.Body).Decode(&body) + got = append(got, body.Role) + _ = json.NewEncoder(w).Encode(map[string]bool{"allowed": true}) + })) + defer policyAPI.Close() + s := newTestServer(t).WithPolicy(policyclient.New(policyAPI.URL, "test-token")) + mux := http.NewServeMux() + s.RegisterRoutes(mux) + + for _, role := range []string{"tenant_admin", ""} { + req := httptest.NewRequest("GET", "/connectors/status", nil) + req.Header.Set("X-User-Id", "u1") + req.Header.Set("X-Tenant-Slug", "acme") + if role != "" { + req.Header.Set("X-User-Role", role) + } + mux.ServeHTTP(httptest.NewRecorder(), req) + } + if len(got) != 2 || got[0] != "tenant_admin" || got[1] != "user" { + t.Fatalf("erwartet [tenant_admin user], bekam %v", got) + } +} diff --git a/workflow/cmd/workflow-app/main.go b/workflow/cmd/workflow-app/main.go index e241dc21..143758c3 100644 --- a/workflow/cmd/workflow-app/main.go +++ b/workflow/cmd/workflow-app/main.go @@ -16,6 +16,7 @@ import ( "github.com/jackc/pgx/v5/pgxpool" + "gitea.perlbach24.de/scripte/nexarch/common/bearerauth" "gitea.perlbach24.de/scripte/nexarch/common/moduleauth" "gitea.perlbach24.de/scripte/nexarch/common/policyclient" "gitea.perlbach24.de/scripte/nexarch/common/tenantregistryclient" @@ -23,7 +24,6 @@ import ( "gitea.perlbach24.de/scripte/nexarch/workflow/internal/approvalapi" "gitea.perlbach24.de/scripte/nexarch/workflow/internal/backchannel" "gitea.perlbach24.de/scripte/nexarch/workflow/internal/backchannelapi" - "gitea.perlbach24.de/scripte/nexarch/workflow/internal/bearerauth" "gitea.perlbach24.de/scripte/nexarch/workflow/internal/caseapi" "gitea.perlbach24.de/scripte/nexarch/workflow/internal/caseobj" "gitea.perlbach24.de/scripte/nexarch/workflow/internal/caseoverview" diff --git a/workflow/docs/TESTSTRATEGIE.md b/workflow/docs/TESTSTRATEGIE.md index 9832f6c3..3bda9886 100644 --- a/workflow/docs/TESTSTRATEGIE.md +++ b/workflow/docs/TESTSTRATEGIE.md @@ -64,8 +64,9 @@ aendert — **jede geaenderte `.go`-Datei muss von einer geaenderten oder neuen - **Auth-nahe Logik:** `workflow/internal/svcauth/` (Service-Token-Vergleich in konstanter Zeit), `workflow/internal/moduleadapter/` (prueft `X-Service-Token` gegen `svcauth.Equal` — der tatsaechliche Durchsetzungspunkt), - `workflow/internal/bearerauth/` (prueft das Bearer-Token der Frontends gegen - die Core-JWKS; `X-User-Id` nur noch ueber den Uebergangsschalter) + `common/bearerauth/` (prueft das Bearer-Token der Frontends gegen die + Core-JWKS; `X-User-Id` nur noch ueber den Uebergangsschalter; Gate im + common-Modul) - **Tenant-Scoping:** `workflow/internal/tenantregistryclient/` (fragt Core TEN-01, muss bei Fehler fail-closed bleiben), `workflow/internal/backchannel/` und `workflow/internal/backchannelapi/` (extern erreichbarer Eingang, der den diff --git a/workflow/go.mod b/workflow/go.mod index 85494818..24984d1d 100644 --- a/workflow/go.mod +++ b/workflow/go.mod @@ -3,7 +3,7 @@ module gitea.perlbach24.de/scripte/nexarch/workflow go 1.25.0 require ( - gitea.perlbach24.de/scripte/nexarch/common v0.2.1 + gitea.perlbach24.de/scripte/nexarch/common v0.2.2 github.com/jackc/pgx/v5 v5.9.2 ) diff --git a/workflow/go.sum b/workflow/go.sum index c33711d0..60820eeb 100644 --- a/workflow/go.sum +++ b/workflow/go.sum @@ -1,5 +1,5 @@ -gitea.perlbach24.de/scripte/nexarch/common v0.2.1 h1:vIreSocK/F4+uid+lZ7u0CSNlPFvA1N7A77k+RhNeAc= -gitea.perlbach24.de/scripte/nexarch/common v0.2.1/go.mod h1:CiEImG++QMt1xZqSMeDJhPiB7sfWTLZOwjS6OY/Iguc= +gitea.perlbach24.de/scripte/nexarch/common v0.2.2 h1:PupmTMm3xysOP8J+zgqRAgwro1XlaQn0njsuUgbqN14= +gitea.perlbach24.de/scripte/nexarch/common v0.2.2/go.mod h1:CiEImG++QMt1xZqSMeDJhPiB7sfWTLZOwjS6OY/Iguc= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= diff --git a/workflow/internal/bearerauth/bearerauth.go b/workflow/internal/bearerauth/bearerauth.go deleted file mode 100644 index efef3e4b..00000000 --- a/workflow/internal/bearerauth/bearerauth.go +++ /dev/null @@ -1,71 +0,0 @@ -// Package bearerauth setzt die Identitaet der Workflow-APIs aus einem -// verifizierten Core-Modul-Token. Die Handler lesen weiter X-User-Id und -// X-Tenant-Slug; die Middleware ueberschreibt beide aus den Claims, sodass ein -// Client sie nicht frei setzen kann. X-User-Role kommt nur aus dem Token. -package bearerauth - -import ( - "encoding/json" - "errors" - "net/http" - "strings" - - "gitea.perlbach24.de/scripte/nexarch/common/moduleauth" -) - -const ( - headerUser = "X-User-Id" - headerTenant = "X-Tenant-Slug" - headerRole = "X-User-Role" -) - -// Middleware verlangt fuer Anfragen mit Authorization: Bearer ein gueltiges -// Token. Ohne Bearer werden X-User-Id und X-Tenant-Slug entfernt, ausser -// allowHeaderAuth ist gesetzt (Uebergang, bis alle Clients Bearer senden). -func Middleware(v *moduleauth.Verifier, allowHeaderAuth bool, next http.Handler) http.Handler { - return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { - r.Header.Del(headerRole) - token, ok := bearer(r) - if !ok { - if !allowHeaderAuth { - r.Header.Del(headerUser) - r.Header.Del(headerTenant) - } - next.ServeHTTP(w, r) - return - } - if v == nil { - writeError(w, http.StatusUnauthorized, "nicht angemeldet") - return - } - claims, err := v.Verify(r.Context(), token) - if err != nil { - if errors.Is(err, moduleauth.ErrInvalidToken) { - writeError(w, http.StatusUnauthorized, "nicht angemeldet") - } else { - writeError(w, http.StatusServiceUnavailable, "identitaetsdienst nicht erreichbar") - } - return - } - r.Header.Set(headerUser, claims.Subject) - r.Header.Set(headerTenant, claims.Tenant) - if claims.Role != "" { - r.Header.Set(headerRole, claims.Role) - } - next.ServeHTTP(w, r) - }) -} - -func bearer(r *http.Request) (string, bool) { - h := r.Header.Get("Authorization") - if len(h) > 7 && strings.EqualFold(h[:7], "bearer ") { - return strings.TrimSpace(h[7:]), true - } - return "", false -} - -func writeError(w http.ResponseWriter, status int, message string) { - w.Header().Set("Content-Type", "application/json") - w.WriteHeader(status) - _ = json.NewEncoder(w).Encode(map[string]string{"error": message}) -} diff --git a/workflow/internal/bearerauth/bearerauth_test.go b/workflow/internal/bearerauth/bearerauth_test.go deleted file mode 100644 index 685f2fbe..00000000 --- a/workflow/internal/bearerauth/bearerauth_test.go +++ /dev/null @@ -1,75 +0,0 @@ -package bearerauth - -import ( - "net/http" - "net/http/httptest" - "testing" - - "gitea.perlbach24.de/scripte/nexarch/common/moduleauth" -) - -func echo() http.Handler { - return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { - _, _ = w.Write([]byte(r.Header.Get("X-User-Id") + "|" + r.Header.Get("X-Tenant-Slug") + "|" + r.Header.Get("X-User-Role"))) - }) -} - -func do(h http.Handler, hdr map[string]string) *httptest.ResponseRecorder { - req := httptest.NewRequest(http.MethodGet, "/x", nil) - for k, v := range hdr { - req.Header.Set(k, v) - } - rec := httptest.NewRecorder() - h.ServeHTTP(rec, req) - return rec -} - -func TestBearerOverridesClientSuppliedHeaders(t *testing.T) { - v, iss := moduleauth.NewTestVerifierAndIssuer() - h := Middleware(v, false, echo()) - rec := do(h, map[string]string{ - "Authorization": "Bearer " + iss.Token("u1", "acme", "user", "", ""), - "X-User-Id": "fremd", "X-Tenant-Slug": "fremd", - }) - if rec.Code != 200 || rec.Body.String() != "u1|acme|user" { - t.Fatalf("code=%d body=%q", rec.Code, rec.Body.String()) - } -} - -func TestInvalidBearerIs401(t *testing.T) { - v, _ := moduleauth.NewTestVerifierAndIssuer() - _, other := moduleauth.NewTestVerifierAndIssuer() - h := Middleware(v, true, echo()) - if rec := do(h, map[string]string{"Authorization": "Bearer " + other.Token("u1", "acme", "user", "", ""), "X-User-Id": "evil"}); rec.Code != 401 { - t.Fatalf("code=%d", rec.Code) - } - if rec := do(Middleware(nil, true, echo()), map[string]string{"Authorization": "Bearer x.y.z"}); rec.Code != 401 { - t.Fatalf("ohne Verifier code=%d", rec.Code) - } -} - -func TestWithoutBearerHeadersStrippedUnlessAllowed(t *testing.T) { - v, _ := moduleauth.NewTestVerifierAndIssuer() - hdr := map[string]string{"X-User-Id": "u9", "X-Tenant-Slug": "t9"} - if rec := do(Middleware(v, false, echo()), hdr); rec.Body.String() != "||" { - t.Fatalf("Header muessen entfernt werden, bekam %q", rec.Body.String()) - } - if rec := do(Middleware(v, true, echo()), hdr); rec.Body.String() != "u9|t9|" { - t.Fatalf("Uebergangsmodus muss Header durchlassen, bekam %q", rec.Body.String()) - } -} - -func TestRoleOnlyFromToken(t *testing.T) { - v, iss := moduleauth.NewTestVerifierAndIssuer() - h := Middleware(v, true, echo()) - rec := do(h, map[string]string{ - "Authorization": "Bearer " + iss.Token("u1", "acme", "tenant_admin", "", ""), - "X-User-Role": "tenant_admin_fremd", - }) - if rec.Body.String() != "u1|acme|tenant_admin" { - t.Fatalf("Rolle muss aus dem Token kommen, bekam %q", rec.Body.String()) - } - if rec := do(h, map[string]string{"X-User-Role": "tenant_admin"}); rec.Body.String() != "||" { - t.Fatalf("Rolle ohne Token muss entfernt werden, bekam %q", rec.Body.String()) - } -} diff --git a/workflow/internal/pflichttestgate/gate.go b/workflow/internal/pflichttestgate/gate.go index 2f3e3856..0e95a2d0 100644 --- a/workflow/internal/pflichttestgate/gate.go +++ b/workflow/internal/pflichttestgate/gate.go @@ -18,7 +18,6 @@ import ( // workflow/docs/TESTSTRATEGIE.md Abschnitt 4. var sensitivePathPatterns = []*regexp.Regexp{ regexp.MustCompile(`(^|/)workflow/internal/moduleadapter/`), - regexp.MustCompile(`(^|/)workflow/internal/bearerauth/`), regexp.MustCompile(`(^|/)workflow/internal/backchannel/`), regexp.MustCompile(`(^|/)workflow/internal/backchannelapi/`), regexp.MustCompile(`(^|/)workflow/internal/dualcheck/`), diff --git a/workflow/internal/pflichttestgate/gate_test.go b/workflow/internal/pflichttestgate/gate_test.go index 2f6a900d..a0d0aa81 100644 --- a/workflow/internal/pflichttestgate/gate_test.go +++ b/workflow/internal/pflichttestgate/gate_test.go @@ -35,7 +35,6 @@ func TestCheckDiff_IgnoresNonSensitivePaths(t *testing.T) { func TestCheckDiff_CoversAllSensitivePackages(t *testing.T) { files := []string{ "workflow/internal/moduleadapter/x.go", - "workflow/internal/bearerauth/x.go", "workflow/internal/backchannel/x.go", "workflow/internal/backchannelapi/x.go", "workflow/internal/dualcheck/x.go", @@ -46,10 +45,3 @@ func TestCheckDiff_CoversAllSensitivePackages(t *testing.T) { t.Fatalf("erwartet %d verstoesse (je package einer), habe %d: %+v", len(files), len(violations), violations) } } - -func TestCheckDiff_FlagsBearerAuthChangeWithoutTest(t *testing.T) { - violations := CheckDiff([]string{"workflow/internal/bearerauth/bearerauth.go"}) - if len(violations) != 1 || violations[0].Package != "workflow/internal/bearerauth" { - t.Fatalf("erwartet 1 verstoss fuer bearerauth, habe: %+v", violations) - } -}