tegwick
c473f1971d
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02e47-6aac-7ee1-914d-0584c75d3c81
46 lines
1.3 KiB
Go
46 lines
1.3 KiB
Go
package callerauth
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"os"
|
|
"path/filepath"
|
|
"testing"
|
|
)
|
|
|
|
func TestKubernetesTokenReviewerClassifiesRejectedTokenAsUnauthenticated(t *testing.T) {
|
|
server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
if r.URL.Path != "/apis/authentication.k8s.io/v1/tokenreviews" {
|
|
t.Fatalf("TokenReview path = %q", r.URL.Path)
|
|
}
|
|
w.Header().Set("Content-Type", "application/json")
|
|
w.WriteHeader(http.StatusCreated)
|
|
_, _ = w.Write([]byte(`{
|
|
"apiVersion": "authentication.k8s.io/v1",
|
|
"kind": "TokenReview",
|
|
"status": {
|
|
"authenticated": false,
|
|
"error": "invalid bearer token"
|
|
}
|
|
}`))
|
|
}))
|
|
defer server.Close()
|
|
|
|
tokenFile := filepath.Join(t.TempDir(), "reviewer-token")
|
|
if err := os.WriteFile(tokenFile, []byte("reviewer-token\n"), 0o600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
reviewer := &KubernetesTokenReviewer{
|
|
endpoint: server.URL + "/apis/authentication.k8s.io/v1/tokenreviews",
|
|
audience: "flex-auth",
|
|
reviewerTokenFile: tokenFile,
|
|
client: server.Client(),
|
|
}
|
|
|
|
_, err := reviewer.Review(context.Background(), "malformed")
|
|
if !errors.Is(err, ErrUnauthenticated) {
|
|
t.Fatalf("Review error = %v; want unauthenticated", err)
|
|
}
|
|
}
|