hackme/developer_auth_test.go at main · jokeez/hackme · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
package main

import (
	"net/http"
	"net/http/httptest"
	"testing"
)

func TestDeveloperTasksAuthRequiresToken(t *testing.T) {
	t.Setenv("HACKME_ADMIN_TOKEN", "admin-secret")
	t.Setenv("HACKME_DEVELOPER_TOKEN", "dev-secret")
	req := httptest.NewRequest(http.MethodPost, "/api/tasks", nil)
	rec := httptest.NewRecorder()
	if requireDeveloperTasksAuth(rec, req) {
		t.Fatal("expected deny without header")
	}
	if rec.Code != http.StatusUnauthorized {
		t.Fatalf("code %d", rec.Code)
	}
}

func TestDeveloperTasksAuthDeveloperHeader(t *testing.T) {
	t.Setenv("HACKME_ADMIN_TOKEN", "admin-secret")
	t.Setenv("HACKME_DEVELOPER_TOKEN", "dev-secret")
	req := httptest.NewRequest(http.MethodPost, "/api/tasks", nil)
	req.Header.Set("X-Hackme-Developer-Token", "dev-secret")
	rec := httptest.NewRecorder()
	if !requireDeveloperTasksAuth(rec, req) {
		t.Fatal("expected allow with developer header")
	}
}

func TestDeveloperTasksAuthAdminStillWorks(t *testing.T) {
	t.Setenv("HACKME_ADMIN_TOKEN", "admin-secret")
	t.Setenv("HACKME_DEVELOPER_TOKEN", "dev-secret")
	req := httptest.NewRequest(http.MethodPost, "/api/tasks", nil)
	req.Header.Set("X-Hackme-Admin-Token", "admin-secret")
	rec := httptest.NewRecorder()
	if !requireDeveloperTasksAuth(rec, req) {
		t.Fatal("expected allow with admin header")
	}
}

func TestTasksListShowsDetailsPublic(t *testing.T) {
	t.Setenv("HACKME_ADMIN_TOKEN", "admin-secret")
	t.Setenv("HACKME_DEVELOPER_TOKEN", "dev-secret")
	req := httptest.NewRequest(http.MethodGet, "/api/tasks", nil)
	if tasksListShowsDetails(req) {
		t.Fatal("public list must be redacted")
	}
}

func TestTasksListShowsDetailsDeveloper(t *testing.T) {
	t.Setenv("HACKME_ADMIN_TOKEN", "admin-secret")
	t.Setenv("HACKME_DEVELOPER_TOKEN", "dev-secret")
	req := httptest.NewRequest(http.MethodGet, "/api/tasks", nil)
	req.Header.Set("X-Hackme-Developer-Token", "dev-secret")
	if !tasksListShowsDetails(req) {
		t.Fatal("developer should see manifest")
	}
}