tegwick
c473f1971d
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02e47-6aac-7ee1-914d-0584c75d3c81
78 lines
3.1 KiB
Go
78 lines
3.1 KiB
Go
package callerauth
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"fmt"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
type fakeReviewer struct {
|
|
identity Identity
|
|
err error
|
|
}
|
|
|
|
func (f fakeReviewer) Review(context.Context, string) (Identity, error) {
|
|
return f.identity, f.err
|
|
}
|
|
|
|
func TestAuthenticatorEnforcesAudienceAndSystemBinding(t *testing.T) {
|
|
authenticator, err := New(ModeEnforce, fakeReviewer{identity: Identity{
|
|
Username: "system:serviceaccount:tenant-engine:tenant-engine",
|
|
Audiences: []string{"flex-auth"},
|
|
}}, "flex-auth", map[string]string{
|
|
"tenant-engine": "system:serviceaccount:tenant-engine:tenant-engine",
|
|
}, nil)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := authenticator.Authorize(context.Background(), "Bearer caller-token", []string{"tenant-engine"}); err != nil {
|
|
t.Fatalf("Authorize: %v", err)
|
|
}
|
|
if err := authenticator.Authorize(context.Background(), "Bearer caller-token", []string{"user-engine"}); !errors.Is(err, ErrForbidden) {
|
|
t.Fatalf("system mismatch error = %v; want forbidden", err)
|
|
}
|
|
|
|
wrongAudience, _ := New(ModeEnforce, fakeReviewer{identity: Identity{
|
|
Username: "system:serviceaccount:tenant-engine:tenant-engine",
|
|
Audiences: []string{"kubernetes"},
|
|
}}, "flex-auth", map[string]string{"tenant-engine": "system:serviceaccount:tenant-engine:tenant-engine"}, nil)
|
|
if err := wrongAudience.Authorize(context.Background(), "Bearer caller-token", []string{"tenant-engine"}); !errors.Is(err, ErrUnauthenticated) {
|
|
t.Fatalf("audience error = %v; want unauthenticated", err)
|
|
}
|
|
}
|
|
|
|
func TestAuthenticatorRejectsMissingTokenAndReviewerFailure(t *testing.T) {
|
|
bindings := map[string]string{"tenant-engine": "principal"}
|
|
authenticator, _ := New(ModeEnforce, fakeReviewer{identity: Identity{Username: "principal", Audiences: []string{"flex-auth"}}}, "flex-auth", bindings, nil)
|
|
if err := authenticator.Authorize(context.Background(), "", []string{"tenant-engine"}); !errors.Is(err, ErrUnauthenticated) {
|
|
t.Fatalf("missing token error = %v; want unauthenticated", err)
|
|
}
|
|
|
|
unavailable, _ := New(ModeEnforce, fakeReviewer{err: errors.New("apiserver down")}, "flex-auth", bindings, nil)
|
|
if err := unavailable.Authorize(context.Background(), "Bearer token", []string{"tenant-engine"}); !errors.Is(err, ErrUnavailable) {
|
|
t.Fatalf("reviewer error = %v; want unavailable", err)
|
|
}
|
|
|
|
rejected, _ := New(ModeEnforce, fakeReviewer{err: fmt.Errorf("%w: invalid bearer token", ErrUnauthenticated)}, "flex-auth", bindings, nil)
|
|
if err := rejected.Authorize(context.Background(), "Bearer malformed", []string{"tenant-engine"}); !errors.Is(err, ErrUnauthenticated) {
|
|
t.Fatalf("rejected token error = %v; want unauthenticated", err)
|
|
}
|
|
}
|
|
|
|
func TestAuthenticatorWarnModePermitsButRecordsFailure(t *testing.T) {
|
|
var warning string
|
|
authenticator, err := New(ModeWarn, fakeReviewer{}, "flex-auth", map[string]string{"tenant-engine": "principal"}, func(format string, _ ...any) {
|
|
warning = format
|
|
})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := authenticator.Authorize(context.Background(), "", []string{"tenant-engine"}); err != nil {
|
|
t.Fatalf("warn mode returned error: %v", err)
|
|
}
|
|
if !strings.Contains(warning, "warning") {
|
|
t.Fatalf("warning = %q", warning)
|
|
}
|
|
}
|