nexarch/cmd/licadmin-devserver/routes_test.go

package main

import (
	"net/http"
	"net/http/httptest"
	"testing"
)

const testToken = "licadmin-token-0123456789"

func TestAdminRoutes_RequireTokenAndRestrictCORS(t *testing.T) {
	reached := 0
	h := func(w http.ResponseWriter, r *http.Request) { reached++; w.WriteHeader(http.StatusOK) }
	mux := http.NewServeMux()
	registerAdminRoutes(mux, testToken, []string{"https://admin.example.test"}, h, h)

	for _, path := range []string{"/admin/overview", "/admin/flags/toggle"} {
		before := reached
		rec := httptest.NewRecorder()
		mux.ServeHTTP(rec, httptest.NewRequest(http.MethodPost, path, nil))
		if rec.Code != http.StatusUnauthorized || reached != before {
			t.Fatalf("%s ohne Token: code=%d handler=%d", path, rec.Code, reached)
		}

		req := httptest.NewRequest(http.MethodPost, path, nil)
		req.Header.Set("X-Service-Token", testToken)
		req.Header.Set("Origin", "https://evil.example.test")
		rec = httptest.NewRecorder()
		mux.ServeHTTP(rec, req)
		if rec.Code != http.StatusOK {
			t.Fatalf("%s mit Token: %d", path, rec.Code)
		}
		if got := rec.Header().Get("Access-Control-Allow-Origin"); got != "" {
			t.Fatalf("%s: fremder Ursprung bekam CORS-Freigabe %q", path, got)
		}

		req = httptest.NewRequest(http.MethodOptions, path, nil)
		req.Header.Set("Origin", "https://admin.example.test")
		rec = httptest.NewRecorder()
		mux.ServeHTTP(rec, req)
		if got := rec.Header().Get("Access-Control-Allow-Origin"); got != "https://admin.example.test" {
			t.Fatalf("%s: erlaubter Ursprung fehlt: %q", path, got)
		}
		if rec.Header().Get("Access-Control-Allow-Origin") == "*" {
			t.Fatal("Platzhalter-Ursprung")
		}
	}
}