patrickandClaude Sonnet 5.5
698f0490f2
CI / Web-Barrierefreiheitspruefung (axe, Tastatur, Reflow, Textabstaende) (push) Canceled after 0s
CI / Web-Barrierefreiheitspruefung (axe, Tastatur, Reflow, Textabstaende) (pull_request) Canceled after 0s
CI / Core-Modul (Build/Vet/Test) (push) Successful in 1m6s
CI / DMS Security-Test-Gate (AC5, Merge-Gate) (push) Successful in 4s
CI / Connect Security-Test-Gate (QA-01 AC4, Merge-Gate) (push) Successful in 4s
CI / DMS-Modul Supply-Chain-Scan (govulncheck) (push) Failing after 21s
CI / Web (dms-browser) (push) Failing after 1m23s
CI / Web (pdf-viewer) (push) Failing after 1m2s
CI / Web (shl) (push) Failing after 16s
Supply-Chain-Scan (Go) / govulncheck (push) Failing after 1m2s
AI-Pflichttest-Gate / pflichttest-gate (pull_request) Successful in 24m42s
CI / Core-Modul (Build/Vet/Test) (pull_request) Successful in 1m0s
CI / DMS Security-Test-Gate (AC5, Merge-Gate) (pull_request) Successful in 4s
CI / Connect Security-Test-Gate (QA-01 AC4, Merge-Gate) (pull_request) Successful in 5s
CI / DMS-Modul Supply-Chain-Scan (govulncheck) (pull_request) Failing after 25s
CI / Web (dms-browser) (pull_request) Failing after 1m32s
CI / Web (pdf-viewer) (pull_request) Failing after 55s
CI / Web (shl) (pull_request) Failing after 13s
Core-Schnittstellen-Vertragstests / contract-tests (pull_request) Successful in 24m26s
Supply-Chain-Scan (Go) / govulncheck (pull_request) Failing after 1m2s
Supply-Chain-Scan (npm) / npm-audit (pull_request) Failing after 1m52s
Core-Pflichttest-Gate / pflichttest-gate (pull_request) Successful in 24m43s
RBAC-Rollenhierarchie-Pflichtgate / rbac-policy-invariant (pull_request) Successful in 25m10s
Workflow-Pflichttest-Gate / pflichttest-gate (pull_request) Successful in 24m45s
DB-Integrationstests / db-tests (pull_request) Canceled after 0s
CI / DMS-Modul (Lint/Build/Test/Coverage/Artefakt) (pull_request) Canceled after 0s
CI / DMS-Modul (Lint/Build/Test/Coverage/Artefakt) (push) Canceled after 0s
workflow bearerauth setzt X-User-Role nur aus den Claims (Client-Header werden entfernt); taskapi und connectorsetupapi fragen mit dieser Rolle, Default user. Migration 0029: connect.setup.write nur fuer tenant_admin. ai-app, workflow-app, connect-app starten ohne POLICY_URL nicht mehr, ausser mit NEXARCH_<MODUL>_APP_POLICY_DISABLED=1. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
76 lines
2.6 KiB
Go
76 lines
2.6 KiB
Go
package bearerauth
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
|
|
"gitea.perlbach24.de/scripte/nexarch/common/moduleauth"
|
|
)
|
|
|
|
func echo() http.Handler {
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
_, _ = w.Write([]byte(r.Header.Get("X-User-Id") + "|" + r.Header.Get("X-Tenant-Slug") + "|" + r.Header.Get("X-User-Role")))
|
|
})
|
|
}
|
|
|
|
func do(h http.Handler, hdr map[string]string) *httptest.ResponseRecorder {
|
|
req := httptest.NewRequest(http.MethodGet, "/x", nil)
|
|
for k, v := range hdr {
|
|
req.Header.Set(k, v)
|
|
}
|
|
rec := httptest.NewRecorder()
|
|
h.ServeHTTP(rec, req)
|
|
return rec
|
|
}
|
|
|
|
func TestBearerOverridesClientSuppliedHeaders(t *testing.T) {
|
|
v, iss := moduleauth.NewTestVerifierAndIssuer()
|
|
h := Middleware(v, false, echo())
|
|
rec := do(h, map[string]string{
|
|
"Authorization": "Bearer " + iss.Token("u1", "acme", "user", "", ""),
|
|
"X-User-Id": "fremd", "X-Tenant-Slug": "fremd",
|
|
})
|
|
if rec.Code != 200 || rec.Body.String() != "u1|acme|user" {
|
|
t.Fatalf("code=%d body=%q", rec.Code, rec.Body.String())
|
|
}
|
|
}
|
|
|
|
func TestInvalidBearerIs401(t *testing.T) {
|
|
v, _ := moduleauth.NewTestVerifierAndIssuer()
|
|
_, other := moduleauth.NewTestVerifierAndIssuer()
|
|
h := Middleware(v, true, echo())
|
|
if rec := do(h, map[string]string{"Authorization": "Bearer " + other.Token("u1", "acme", "user", "", ""), "X-User-Id": "evil"}); rec.Code != 401 {
|
|
t.Fatalf("code=%d", rec.Code)
|
|
}
|
|
if rec := do(Middleware(nil, true, echo()), map[string]string{"Authorization": "Bearer x.y.z"}); rec.Code != 401 {
|
|
t.Fatalf("ohne Verifier code=%d", rec.Code)
|
|
}
|
|
}
|
|
|
|
func TestWithoutBearerHeadersStrippedUnlessAllowed(t *testing.T) {
|
|
v, _ := moduleauth.NewTestVerifierAndIssuer()
|
|
hdr := map[string]string{"X-User-Id": "u9", "X-Tenant-Slug": "t9"}
|
|
if rec := do(Middleware(v, false, echo()), hdr); rec.Body.String() != "||" {
|
|
t.Fatalf("Header muessen entfernt werden, bekam %q", rec.Body.String())
|
|
}
|
|
if rec := do(Middleware(v, true, echo()), hdr); rec.Body.String() != "u9|t9|" {
|
|
t.Fatalf("Uebergangsmodus muss Header durchlassen, bekam %q", rec.Body.String())
|
|
}
|
|
}
|
|
|
|
func TestRoleOnlyFromToken(t *testing.T) {
|
|
v, iss := moduleauth.NewTestVerifierAndIssuer()
|
|
h := Middleware(v, true, echo())
|
|
rec := do(h, map[string]string{
|
|
"Authorization": "Bearer " + iss.Token("u1", "acme", "tenant_admin", "", ""),
|
|
"X-User-Role": "tenant_admin_fremd",
|
|
})
|
|
if rec.Body.String() != "u1|acme|tenant_admin" {
|
|
t.Fatalf("Rolle muss aus dem Token kommen, bekam %q", rec.Body.String())
|
|
}
|
|
if rec := do(h, map[string]string{"X-User-Role": "tenant_admin"}); rec.Body.String() != "||" {
|
|
t.Fatalf("Rolle ohne Token muss entfernt werden, bekam %q", rec.Body.String())
|
|
}
|
|
}
|