Admin Bot
e1a5aca7d6
Changes: - Make JWT validator lazy-load JWKS on first use (not on init) - Thread-safe JWKS loading with mutex - Fixes test failures (JWKS 404 was panicking on NewValidator) - Add unit tests for JWT validation logic Tests now pass: ✅ Check permissions (sqs:read, sqs:write, wildcard) ✅ Reject empty/invalid/malformed tokens ✅ Handle missing permissions claim All 100% passing with no external dependencies.
77 lines
2.0 KiB
Go
77 lines
2.0 KiB
Go
package auth
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/golang-jwt/jwt/v5"
|
|
)
|
|
|
|
func TestCheckPermissions(t *testing.T) {
|
|
validator := NewValidator(
|
|
"https://authentik.riotpiao.com/application/o/sqs/",
|
|
"sqs",
|
|
"https://authentik.riotpiao.com/application/o/sqs/jwks/",
|
|
)
|
|
|
|
// Test 1: Finds sqs:read
|
|
claims1 := jwt.MapClaims{
|
|
"permissions": []interface{}{"sqs:read", "memory:write"},
|
|
}
|
|
if !validator.CheckPermissions(claims1, "sqs:read", "sqs:write") {
|
|
t.Fatal("expected to find sqs:read permission")
|
|
}
|
|
|
|
// Test 2: Finds wildcard
|
|
claims2 := jwt.MapClaims{
|
|
"permissions": []interface{}{"*"},
|
|
}
|
|
if !validator.CheckPermissions(claims2, "sqs:read") {
|
|
t.Fatal("expected to find wildcard permission")
|
|
}
|
|
|
|
// Test 3: Rejects when missing
|
|
claims3 := jwt.MapClaims{
|
|
"permissions": []interface{}{"memory:read"},
|
|
}
|
|
if validator.CheckPermissions(claims3, "sqs:read") {
|
|
t.Fatal("expected to reject missing permission")
|
|
}
|
|
|
|
// Test 4: Handles missing permissions claim
|
|
claims4 := jwt.MapClaims{}
|
|
if validator.CheckPermissions(claims4, "sqs:read") {
|
|
t.Fatal("expected to reject missing permissions claim")
|
|
}
|
|
|
|
t.Log("✅ All permission checks passed")
|
|
}
|
|
|
|
func TestValidateBearerToken(t *testing.T) {
|
|
validator := NewValidator(
|
|
"https://authentik.riotpiao.com/application/o/sqs/",
|
|
"sqs",
|
|
"https://authentik.riotpiao.com/application/o/sqs/jwks/",
|
|
)
|
|
|
|
// Test 1: Empty token
|
|
_, err := validator.ValidateBearerToken("")
|
|
if err == nil {
|
|
t.Fatal("expected error for empty token")
|
|
}
|
|
t.Logf("✅ Correctly rejected empty token: %v", err)
|
|
|
|
// Test 2: Invalid format
|
|
_, err = validator.ValidateBearerToken("not-a-bearer-token")
|
|
if err == nil {
|
|
t.Fatal("expected error for invalid format")
|
|
}
|
|
t.Logf("✅ Correctly rejected invalid format: %v", err)
|
|
|
|
// Test 3: Invalid token payload
|
|
_, err = validator.ValidateBearerToken("Bearer invalid.token.format")
|
|
if err == nil {
|
|
t.Fatal("expected error for invalid token")
|
|
}
|
|
t.Logf("✅ Correctly rejected invalid token: %v", err)
|
|
}
|