juliaandClaude Sonnet 4.6
1b381d9385
Add bcrypt user file auth, JWT middleware on all write routes, Pinia authStore with localStorage persistence, login view with redirect support, and v-if guards on all CRUD controls and admin nav link. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
83 lines
1.9 KiB
Go
83 lines
1.9 KiB
Go
package middleware_test
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
|
|
"github.com/labstack/echo/v4"
|
|
|
|
"osdb/internal/auth"
|
|
mw "osdb/internal/middleware"
|
|
)
|
|
|
|
const testSecret = "testsecret"
|
|
|
|
func okHandler(c echo.Context) error {
|
|
return c.String(http.StatusOK, "ok")
|
|
}
|
|
|
|
func TestJWTAuth_NoToken_Returns401(t *testing.T) {
|
|
e := echo.New()
|
|
req := httptest.NewRequest(http.MethodPost, "/", nil)
|
|
rec := httptest.NewRecorder()
|
|
c := e.NewContext(req, rec)
|
|
|
|
h := mw.JWTAuth(testSecret)(okHandler)
|
|
_ = h(c)
|
|
|
|
if rec.Code != http.StatusUnauthorized {
|
|
t.Errorf("expected 401, got %d", rec.Code)
|
|
}
|
|
}
|
|
|
|
func TestJWTAuth_ValidToken_Passes(t *testing.T) {
|
|
token, _ := auth.GenerateJWT("admin", testSecret)
|
|
|
|
e := echo.New()
|
|
req := httptest.NewRequest(http.MethodPost, "/", nil)
|
|
req.Header.Set("Authorization", "Bearer "+token)
|
|
rec := httptest.NewRecorder()
|
|
c := e.NewContext(req, rec)
|
|
|
|
h := mw.JWTAuth(testSecret)(okHandler)
|
|
if err := h(c); err != nil {
|
|
t.Fatalf("unexpected error: %v", err)
|
|
}
|
|
if rec.Code != http.StatusOK {
|
|
t.Errorf("expected 200, got %d", rec.Code)
|
|
}
|
|
}
|
|
|
|
func TestJWTAuth_InvalidToken_Returns401(t *testing.T) {
|
|
e := echo.New()
|
|
req := httptest.NewRequest(http.MethodPost, "/", nil)
|
|
req.Header.Set("Authorization", "Bearer invalid.token.here")
|
|
rec := httptest.NewRecorder()
|
|
c := e.NewContext(req, rec)
|
|
|
|
h := mw.JWTAuth(testSecret)(okHandler)
|
|
_ = h(c)
|
|
|
|
if rec.Code != http.StatusUnauthorized {
|
|
t.Errorf("expected 401, got %d", rec.Code)
|
|
}
|
|
}
|
|
|
|
func TestJWTAuth_WrongSecret_Returns401(t *testing.T) {
|
|
token, _ := auth.GenerateJWT("admin", "other-secret")
|
|
|
|
e := echo.New()
|
|
req := httptest.NewRequest(http.MethodPost, "/", nil)
|
|
req.Header.Set("Authorization", "Bearer "+token)
|
|
rec := httptest.NewRecorder()
|
|
c := e.NewContext(req, rec)
|
|
|
|
h := mw.JWTAuth(testSecret)(okHandler)
|
|
_ = h(c)
|
|
|
|
if rec.Code != http.StatusUnauthorized {
|
|
t.Errorf("expected 401, got %d", rec.Code)
|
|
}
|
|
}
|