70 lines
2.1 KiB
Go
70 lines
2.1 KiB
Go
package api
|
|
|
|
import (
|
|
"bytes"
|
|
"encoding/json"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
"vpn-platform/backend/internal/tlsservice"
|
|
)
|
|
|
|
func TestTLSStatusRequiresAdmin(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
router := gin.New()
|
|
router.GET("/api/system/tls", func(c *gin.Context) {
|
|
c.Set("role", c.GetHeader("X-Test-Role"))
|
|
c.Next()
|
|
}, requireRole("admin"), (&Server{}).tlsStatus)
|
|
|
|
for _, role := range []string{"", "viewer", "operator"} {
|
|
req := httptest.NewRequest(http.MethodGet, "/api/system/tls", nil)
|
|
req.Header.Set("X-Test-Role", role)
|
|
resp := httptest.NewRecorder()
|
|
router.ServeHTTP(resp, req)
|
|
if resp.Code != http.StatusForbidden {
|
|
t.Errorf("role %q received HTTP %d", role, resp.Code)
|
|
}
|
|
}
|
|
|
|
req := httptest.NewRequest(http.MethodGet, "/api/system/tls", nil)
|
|
req.Header.Set("X-Test-Role", "admin")
|
|
resp := httptest.NewRecorder()
|
|
router.ServeHTTP(resp, req)
|
|
if resp.Code != http.StatusOK {
|
|
t.Fatalf("admin received HTTP %d", resp.Code)
|
|
}
|
|
var data map[string]any
|
|
if err := json.Unmarshal(resp.Body.Bytes(), &data); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if _, ok := data["configured_domain"]; !ok {
|
|
t.Fatal("admin response missing configured domain")
|
|
}
|
|
for _, secret := range []string{"private_key", "account_key", "certificate_pem"} {
|
|
if _, ok := data[secret]; ok {
|
|
t.Errorf("response exposes %s", secret)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestLegacyGoGatewayRejectsPublicEntryChanges(t *testing.T) {
|
|
t.Setenv("VPN_TLS_MODE", "autocert")
|
|
t.Setenv("VPN_TLS_DOMAIN", "")
|
|
if err := tlsservice.Start(http.NotFoundHandler(), t.TempDir()); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
gin.SetMode(gin.TestMode)
|
|
router := gin.New()
|
|
router.PUT("/api/system/tls/domain", (&Server{}).setTLSDomain)
|
|
request := httptest.NewRequest(http.MethodPut, "/api/system/tls/domain", bytes.NewBufferString(`{"domain":"other.example.com","scheme":"https","port":443}`))
|
|
request.Header.Set("Content-Type", "application/json")
|
|
response := httptest.NewRecorder()
|
|
router.ServeHTTP(response, request)
|
|
if response.Code != http.StatusConflict {
|
|
t.Fatalf("legacy Go mode should require manual migration: %d %s", response.Code, response.Body.String())
|
|
}
|
|
}
|