120 lines
2.9 KiB
Go
120 lines
2.9 KiB
Go
// Copyright (c) HashiCorp, Inc.
|
|
// SPDX-License-Identifier: BUSL-1.1
|
|
|
|
package daemon
|
|
|
|
import (
|
|
"context"
|
|
"testing"
|
|
|
|
"github.com/hashicorp/boundary/api"
|
|
"github.com/hashicorp/boundary/api/roles"
|
|
"github.com/hashicorp/boundary/internal/cmd/base"
|
|
"github.com/hashicorp/boundary/internal/daemon/controller"
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
// Note: the name of this test must remain short because the temp dir created
|
|
// includes the name of the test and there is a 108 character limit in allowed
|
|
// unix socket path names.
|
|
func TestDefaultBoundaryTokenReader(t *testing.T) {
|
|
ctx := context.Background()
|
|
|
|
t.Run("nil client provider", func(t *testing.T) {
|
|
resFn, err := defaultBoundaryTokenReader(ctx, nil)
|
|
assert.Error(t, err)
|
|
assert.ErrorContains(t, err, "client provider is nil")
|
|
assert.Nil(t, resFn)
|
|
})
|
|
|
|
tc := controller.NewTestController(t, nil)
|
|
client := tc.Client()
|
|
client.SetToken(tc.Token().Token)
|
|
rclient := roles.NewClient(client)
|
|
rl, err := rclient.List(ctx, "global", roles.WithRecursive(true))
|
|
require.NoError(t, err)
|
|
|
|
// delete everything except for the admin role
|
|
for _, r := range rl.Items {
|
|
if r.Name == "Administration" {
|
|
continue
|
|
}
|
|
_, err := rclient.Delete(ctx, r.Id)
|
|
require.NoError(t, err)
|
|
}
|
|
|
|
cp := fakeClientProvider{tc}
|
|
|
|
cases := []struct {
|
|
name string
|
|
address string
|
|
token string
|
|
errContains string
|
|
}{
|
|
{
|
|
name: "success",
|
|
address: tc.ApiAddrs()[0],
|
|
token: tc.Token().Token,
|
|
errContains: "",
|
|
},
|
|
{
|
|
name: "token cant read itself",
|
|
address: tc.ApiAddrs()[0],
|
|
token: tc.UnprivilegedToken().Token,
|
|
errContains: "PermissionDenied",
|
|
},
|
|
{
|
|
name: "empty address",
|
|
address: "",
|
|
token: "at_123_testtoken",
|
|
errContains: "address is missing",
|
|
},
|
|
{
|
|
name: "empty token",
|
|
address: tc.ApiAddrs()[0],
|
|
token: "",
|
|
errContains: "auth token is missing",
|
|
},
|
|
{
|
|
name: "malformed token to many sections",
|
|
address: tc.ApiAddrs()[0],
|
|
token: "at_123_ignoredtoken_tomanysections",
|
|
errContains: "auth token is malformed",
|
|
},
|
|
{
|
|
name: "malformed token to few sections",
|
|
address: tc.ApiAddrs()[0],
|
|
token: "at_123",
|
|
errContains: "auth token is malformed",
|
|
},
|
|
}
|
|
|
|
for _, tc := range cases {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
retFn, err := defaultBoundaryTokenReader(ctx, cp)
|
|
require.NoError(t, err)
|
|
require.NotNil(t, retFn)
|
|
|
|
at, err := retFn(ctx, tc.address, tc.token)
|
|
switch tc.errContains {
|
|
case "":
|
|
assert.NoError(t, err)
|
|
assert.NotNil(t, at)
|
|
default:
|
|
assert.Error(t, err)
|
|
assert.ErrorContains(t, err, tc.errContains)
|
|
assert.Nil(t, at)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
type fakeClientProvider struct {
|
|
*controller.TestController
|
|
}
|
|
|
|
func (fcp fakeClientProvider) Client(opt ...base.Option) (*api.Client, error) {
|
|
return fcp.TestController.Client(), nil
|
|
}
|