43 lines
1.6 KiB
Go
43 lines
1.6 KiB
Go
package app
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
)
|
|
|
|
func TestAdminRefreshCookieSecurityModes(t *testing.T) {
|
|
production := &App{config: Config{Environment: "production"}}
|
|
recorder := httptest.NewRecorder()
|
|
production.setAdminRefreshCookie(recorder, "token", time.Now().Add(time.Hour))
|
|
cookies := recorder.Result().Cookies()
|
|
if len(cookies) != 1 || !cookies[0].HttpOnly || !cookies[0].Secure || cookies[0].SameSite != http.SameSiteNoneMode {
|
|
t.Fatalf("unexpected production cookie: %#v", cookies)
|
|
}
|
|
|
|
development := &App{config: Config{Environment: "development"}}
|
|
recorder = httptest.NewRecorder()
|
|
development.setAdminRefreshCookie(recorder, "token", time.Now().Add(time.Hour))
|
|
cookies = recorder.Result().Cookies()
|
|
if len(cookies) != 1 || cookies[0].Secure || cookies[0].SameSite != http.SameSiteLaxMode {
|
|
t.Fatalf("unexpected development cookie: %#v", cookies)
|
|
}
|
|
}
|
|
|
|
func TestAdminRefreshTokenRequestFallback(t *testing.T) {
|
|
application := &App{}
|
|
request := httptest.NewRequest(http.MethodPost, "/admin/v1/auth/refresh", strings.NewReader(`{"refreshToken":"body-token"}`))
|
|
request.Header.Set("Content-Type", "application/json")
|
|
if token := application.adminRefreshTokenFromRequest(request); token != "body-token" {
|
|
t.Fatalf("unexpected body token %q", token)
|
|
}
|
|
|
|
request = httptest.NewRequest(http.MethodPost, "/admin/v1/auth/refresh", strings.NewReader(`{"refreshToken":"body-token"}`))
|
|
request.AddCookie(&http.Cookie{Name: adminRefreshCookieKey, Value: "cookie-token"})
|
|
if token := application.adminRefreshTokenFromRequest(request); token != "cookie-token" {
|
|
t.Fatalf("cookie token must take priority, got %q", token)
|
|
}
|
|
}
|