Admin Botandpoimen
136c85ad13
CI / CI (pull_request) Successful in 3m20s
Wire token exchange config for /auth/token and /auth/refresh endpoints. clientSecret loaded from AUTH_CLIENT_SECRET env var (never from YAML). Backward compatible — missing fields default to zero values. 3 new tests covering: full config, env-only secret, backward compat. Closes homelab#12 Co-authored-by: poimen <[email protected]>
105 lines
2.6 KiB
Go
105 lines
2.6 KiB
Go
package config_test
|
|
|
|
import (
|
|
"os"
|
|
"path/filepath"
|
|
"testing"
|
|
|
|
"forgejo.riotpiao.com/rock/homelab-frontend/internal/config"
|
|
)
|
|
|
|
func TestLoadAuthConfig_TokenURLAndClientID(t *testing.T) {
|
|
yaml := `
|
|
routes: []
|
|
models: []
|
|
auth:
|
|
enabled: true
|
|
issuer: "https://authentik.example.com/application/o/api-gw/"
|
|
audience: "api-gw"
|
|
jwksUrl: "https://authentik.example.com/application/o/api-gw/jwks/"
|
|
requiredCapability: "llm:inference"
|
|
tokenUrl: "https://authentik.example.com/application/o/token/"
|
|
clientId: "api-gw"
|
|
`
|
|
dir := t.TempDir()
|
|
path := filepath.Join(dir, "config.yaml")
|
|
if err := os.WriteFile(path, []byte(yaml), 0644); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
// Set env for client secret
|
|
t.Setenv("AUTH_CLIENT_SECRET", "test-secret-value")
|
|
|
|
_, _, _, auth, err := config.LoadRoutesAndModelsFromFile(path)
|
|
if err != nil {
|
|
t.Fatalf("unexpected error: %v", err)
|
|
}
|
|
|
|
if !auth.Enabled {
|
|
t.Error("auth should be enabled")
|
|
}
|
|
if auth.TokenURL != "https://authentik.example.com/application/o/token/" {
|
|
t.Errorf("tokenUrl = %q, want authentik token endpoint", auth.TokenURL)
|
|
}
|
|
if auth.ClientID != "api-gw" {
|
|
t.Errorf("clientId = %q, want api-gw", auth.ClientID)
|
|
}
|
|
if auth.ClientSecret != "test-secret-value" {
|
|
t.Errorf("clientSecret = %q, want test-secret-value", auth.ClientSecret)
|
|
}
|
|
}
|
|
|
|
func TestLoadAuthConfig_ClientSecretFromEnvOnly(t *testing.T) {
|
|
yaml := `
|
|
routes: []
|
|
models: []
|
|
auth:
|
|
enabled: true
|
|
tokenUrl: "https://example.com/token/"
|
|
clientId: "test"
|
|
`
|
|
dir := t.TempDir()
|
|
path := filepath.Join(dir, "config.yaml")
|
|
os.WriteFile(path, []byte(yaml), 0644)
|
|
|
|
// No AUTH_CLIENT_SECRET env set
|
|
t.Setenv("AUTH_CLIENT_SECRET", "")
|
|
|
|
_, _, _, auth, err := config.LoadRoutesAndModelsFromFile(path)
|
|
if err != nil {
|
|
t.Fatalf("unexpected error: %v", err)
|
|
}
|
|
|
|
if auth.ClientSecret != "" {
|
|
t.Errorf("clientSecret should be empty when env not set, got %q", auth.ClientSecret)
|
|
}
|
|
}
|
|
|
|
func TestLoadAuthConfig_BackwardCompatible(t *testing.T) {
|
|
// Config without tokenUrl/clientId should still load (zero values)
|
|
yaml := `
|
|
routes: []
|
|
models: []
|
|
auth:
|
|
enabled: true
|
|
issuer: "https://example.com/"
|
|
jwksUrl: "https://example.com/jwks/"
|
|
requiredCapability: "llm:inference"
|
|
`
|
|
dir := t.TempDir()
|
|
path := filepath.Join(dir, "config.yaml")
|
|
os.WriteFile(path, []byte(yaml), 0644)
|
|
|
|
_, _, _, auth, err := config.LoadRoutesAndModelsFromFile(path)
|
|
if err != nil {
|
|
t.Fatalf("unexpected error: %v", err)
|
|
}
|
|
|
|
if auth.TokenURL != "" {
|
|
t.Errorf("tokenUrl should be empty, got %q", auth.TokenURL)
|
|
}
|
|
if auth.ClientID != "" {
|
|
t.Errorf("clientId should be empty, got %q", auth.ClientID)
|
|
}
|
|
}
|