50 lines
1.3 KiB
Go
50 lines
1.3 KiB
Go
package api
|
|
|
|
import (
|
|
"encoding/json"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
)
|
|
|
|
func TestTLSStatusRequiresAdmin(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
router := gin.New()
|
|
router.GET("/api/system/tls", func(c *gin.Context) {
|
|
c.Set("role", c.GetHeader("X-Test-Role"))
|
|
c.Next()
|
|
}, requireRole("admin"), (&Server{}).tlsStatus)
|
|
|
|
for _, role := range []string{"", "viewer", "operator"} {
|
|
req := httptest.NewRequest(http.MethodGet, "/api/system/tls", nil)
|
|
req.Header.Set("X-Test-Role", role)
|
|
resp := httptest.NewRecorder()
|
|
router.ServeHTTP(resp, req)
|
|
if resp.Code != http.StatusForbidden {
|
|
t.Errorf("role %q received HTTP %d", role, resp.Code)
|
|
}
|
|
}
|
|
|
|
req := httptest.NewRequest(http.MethodGet, "/api/system/tls", nil)
|
|
req.Header.Set("X-Test-Role", "admin")
|
|
resp := httptest.NewRecorder()
|
|
router.ServeHTTP(resp, req)
|
|
if resp.Code != http.StatusOK {
|
|
t.Fatalf("admin received HTTP %d", resp.Code)
|
|
}
|
|
var data map[string]any
|
|
if err := json.Unmarshal(resp.Body.Bytes(), &data); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if _, ok := data["configured_domain"]; !ok {
|
|
t.Fatal("admin response missing configured domain")
|
|
}
|
|
for _, secret := range []string{"private_key", "account_key", "certificate_pem"} {
|
|
if _, ok := data[secret]; ok {
|
|
t.Errorf("response exposes %s", secret)
|
|
}
|
|
}
|
|
}
|