patrickandClaude Sonnet 5
b52f46ca15
CI / Web-Barrierefreiheitspruefung (axe, Tastatur, Reflow, Textabstaende) (push) Canceled after 0s
CI / Core-Modul (Build/Vet/Test) (push) Canceled after 0s
CI / DMS Security-Test-Gate (AC5, Merge-Gate) (push) Canceled after 0s
CI / DMS-Modul (Lint/Build/Test/Coverage/Artefakt) (push) Canceled after 0s
CI / DMS-Modul Supply-Chain-Scan (govulncheck) (push) Canceled after 0s
CI / Web (dms-browser) (push) Canceled after 0s
CI / Web (pdf-viewer) (push) Canceled after 0s
CI / Web (shl) (push) Canceled after 0s
Supply-Chain-Scan (Go) / govulncheck (push) Canceled after 0s
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
37 lines
1.3 KiB
Go
37 lines
1.3 KiB
Go
package main
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
)
|
|
|
|
const testToken = "tenantadmin-token-0123456789"
|
|
|
|
func TestAdminRoutes_RequireTokenAndIgnoreSuperadminParameterWithoutIt(t *testing.T) {
|
|
reached := 0
|
|
h := func(w http.ResponseWriter, r *http.Request) { reached++; w.WriteHeader(http.StatusOK) }
|
|
mux := http.NewServeMux()
|
|
registerAdminRoutes(mux, testToken, nil, h, h, h, h)
|
|
|
|
for _, path := range []string{"/admin/tenants", "/admin/tenants/detail", "/admin/tenants/settings", "/admin/tenants/lifecycle"} {
|
|
// Bekannte Superadmin-Kennung allein reicht nicht.
|
|
before := reached
|
|
rec := httptest.NewRecorder()
|
|
mux.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, path+"?superadmin=00000000-0000-0000-0000-000000000001", nil))
|
|
if rec.Code != http.StatusUnauthorized || reached != before {
|
|
t.Fatalf("%s nur mit superadmin-Parameter: code=%d handler=%d", path, rec.Code, reached)
|
|
}
|
|
req := httptest.NewRequest(http.MethodGet, path, nil)
|
|
req.Header.Set("X-Service-Token", testToken)
|
|
rec = httptest.NewRecorder()
|
|
mux.ServeHTTP(rec, req)
|
|
if rec.Code != http.StatusOK {
|
|
t.Fatalf("%s mit Token: %d", path, rec.Code)
|
|
}
|
|
if rec.Header().Get("Access-Control-Allow-Origin") != "" {
|
|
t.Fatalf("%s: ohne Ursprungsliste darf es keine CORS-Freigabe geben", path)
|
|
}
|
|
}
|
|
}
|