Wala shell

Advanced PHP File Manager

Server IP: 127.0.0.1 | PHP Version: 8.3.30 | Domains Hosted: 54

Name	Size	Last Modified	Actions
📁 ..	-	2025-05-25 12:27
📄 apikey_auth_test.go // Copyright 2015 go-swagger maintainers // // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package security import ( "context" "fmt" "net/http" "testing" "github.com/go-openapi/errors" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" ) const ( apiKeyParam = "api_key" apiKeyHeader = "X-API-KEY" ) func TestApiKeyAuth(t testing.T) { tokenAuth := TokenAuthentication(func(token string) (interface{}, error) { if token == validToken { return principal, nil } return nil, errors.Unauthenticated("token") }) t.Run("with invalid initialization", func(t testing.T) { assert.Panics(t, func() { APIKeyAuth(apiKeyParam, "qery", tokenAuth) }) }) t.Run("with token in query param", func(t testing.T) { ta := APIKeyAuth(apiKeyParam, query, tokenAuth) t.Run("with valid token", func(t testing.T) { req, err := http.NewRequestWithContext(context.Background(), http.MethodGet, fmt.Sprintf("%s?%s=%s", authPath, apiKeyParam, validToken), nil) require.NoError(t, err) ok, usr, err := ta.Authenticate(req) assert.True(t, ok) assert.Equal(t, principal, usr) require.NoError(t, err) }) t.Run("with invalid token", func(t testing.T) { req, err := http.NewRequestWithContext(context.Background(), http.MethodGet, fmt.Sprintf("%s?%s=%s", authPath, apiKeyParam, invalidToken), nil) require.NoError(t, err) ok, usr, err := ta.Authenticate(req) assert.True(t, ok) assert.Nil(t, usr) require.Error(t, err) }) t.Run("with missing token", func(t testing.T) { // put the token in the header, but query param is expected req, err := http.NewRequestWithContext(context.Background(), http.MethodGet, authPath, nil) require.NoError(t, err) req.Header.Set(apiKeyHeader, validToken) ok, usr, err := ta.Authenticate(req) assert.False(t, ok) assert.Nil(t, usr) require.NoError(t, err) }) }) t.Run("with token in header", func(t testing.T) { ta := APIKeyAuth(apiKeyHeader, header, tokenAuth) t.Run("with valid token", func(t testing.T) { req, err := http.NewRequestWithContext(context.Background(), http.MethodGet, authPath, nil) require.NoError(t, err) req.Header.Set(apiKeyHeader, validToken) ok, usr, err := ta.Authenticate(req) assert.True(t, ok) assert.Equal(t, principal, usr) require.NoError(t, err) }) t.Run("with invalid token", func(t testing.T) { req, err := http.NewRequestWithContext(context.Background(), http.MethodGet, authPath, nil) require.NoError(t, err) req.Header.Set(apiKeyHeader, invalidToken) ok, usr, err := ta.Authenticate(req) assert.True(t, ok) assert.Nil(t, usr) require.Error(t, err) }) t.Run("with missing token", func(t testing.T) { // put the token in the query param, but header is expected req, err := http.NewRequestWithContext(context.Background(), http.MethodGet, fmt.Sprintf("%s?%s=%s", authPath, apiKeyParam, validToken), nil) require.NoError(t, err) ok, usr, err := ta.Authenticate(req) assert.False(t, ok) assert.Nil(t, usr) require.NoError(t, err) }) }) } func TestApiKeyAuthCtx(t testing.T) { tokenAuthCtx := TokenAuthenticationCtx(func(ctx context.Context, token string) (context.Context, interface{}, error) { if token == validToken { return context.WithValue(ctx, extra, extraWisdom), principal, nil } return context.WithValue(ctx, reason, expReason), nil, errors.Unauthenticated("token") }) ctx := context.WithValue(context.Background(), original, wisdom) t.Run("with invalid initialization", func(t testing.T) { assert.Panics(t, func() { APIKeyAuthCtx(apiKeyParam, "qery", tokenAuthCtx) }) }) t.Run("with token in query param", func(t testing.T) { ta := APIKeyAuthCtx(apiKeyParam, query, tokenAuthCtx) t.Run("with valid token", func(t testing.T) { req, err := http.NewRequestWithContext(ctx, http.MethodGet, fmt.Sprintf("%s?%s=%s", authPath, apiKeyParam, validToken), nil) require.NoError(t, err) ok, usr, err := ta.Authenticate(req) assert.True(t, ok) assert.Equal(t, principal, usr) require.NoError(t, err) assert.Equal(t, wisdom, req.Context().Value(original)) assert.Equal(t, extraWisdom, req.Context().Value(extra)) assert.Nil(t, req.Context().Value(reason)) }) t.Run("with invalid token", func(t testing.T) { req, err := http.NewRequestWithContext(ctx, http.MethodGet, fmt.Sprintf("%s?%s=%s", authPath, apiKeyParam, invalidToken), nil) require.NoError(t, err) ok, usr, err := ta.Authenticate(req) assert.True(t, ok) assert.Nil(t, usr) require.Error(t, err) assert.Equal(t, wisdom, req.Context().Value(original)) assert.Equal(t, expReason, req.Context().Value(reason)) assert.Nil(t, req.Context().Value(extra)) }) t.Run("with missing token", func(t testing.T) { req, err := http.NewRequestWithContext(ctx, http.MethodGet, authPath, nil) require.NoError(t, err) req.Header.Set(apiKeyHeader, validToken) ok, usr, err := ta.Authenticate(req) assert.False(t, ok) assert.Nil(t, usr) require.NoError(t, err) assert.Equal(t, wisdom, req.Context().Value(original)) assert.Nil(t, req.Context().Value(reason)) assert.Nil(t, req.Context().Value(extra)) }) }) t.Run("with token in header", func(t testing.T) { ta := APIKeyAuthCtx(apiKeyHeader, header, tokenAuthCtx) t.Run("with valid token", func(t testing.T) { req, err := http.NewRequestWithContext(ctx, http.MethodGet, authPath, nil) require.NoError(t, err) req.Header.Set(apiKeyHeader, validToken) ok, usr, err := ta.Authenticate(req) assert.True(t, ok) assert.Equal(t, principal, usr) require.NoError(t, err) assert.Equal(t, wisdom, req.Context().Value(original)) assert.Equal(t, extraWisdom, req.Context().Value(extra)) assert.Nil(t, req.Context().Value(reason)) }) t.Run("with invalid token", func(t testing.T) { req, err := http.NewRequestWithContext(ctx, http.MethodGet, authPath, nil) require.NoError(t, err) req.Header.Set(apiKeyHeader, invalidToken) ok, usr, err := ta.Authenticate(req) assert.True(t, ok) assert.Nil(t, usr) require.Error(t, err) assert.Equal(t, wisdom, req.Context().Value(original)) assert.Equal(t, expReason, req.Context().Value(reason)) assert.Nil(t, req.Context().Value(extra)) }) t.Run("with missing token", func(t testing.T) { req, err := http.NewRequestWithContext(ctx, http.MethodGet, fmt.Sprintf("%s?%s=%s", authPath, apiKeyParam, validToken), nil) require.NoError(t, err) ok, usr, err := ta.Authenticate(req) assert.False(t, ok) assert.Nil(t, usr) require.NoError(t, err) assert.Equal(t, wisdom, req.Context().Value(original)) assert.Nil(t, req.Context().Value(reason)) assert.Nil(t, req.Context().Value(extra)) }) }) }	7.13 KB	2025-05-25 12:27
📄 authenticator.go // Copyright 2015 go-swagger maintainers // // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package security import ( "context" "net/http" "strings" "github.com/go-openapi/errors" "github.com/go-openapi/runtime" ) const ( query = "query" header = "header" accessTokenParam = "access_token" ) // HttpAuthenticator is a function that authenticates a HTTP request func HttpAuthenticator(handler func(http.Request) (bool, interface{}, error)) runtime.Authenticator { //nolint:revive,stylecheck return runtime.AuthenticatorFunc(func(params interface{}) (bool, interface{}, error) { if request, ok := params.(http.Request); ok { return handler(request) } if scoped, ok := params.(ScopedAuthRequest); ok { return handler(scoped.Request) } return false, nil, nil }) } // ScopedAuthenticator is a function that authenticates a HTTP request against a list of valid scopes func ScopedAuthenticator(handler func(ScopedAuthRequest) (bool, interface{}, error)) runtime.Authenticator { return runtime.AuthenticatorFunc(func(params interface{}) (bool, interface{}, error) { if request, ok := params.(ScopedAuthRequest); ok { return handler(request) } return false, nil, nil }) } // UserPassAuthentication authentication function type UserPassAuthentication func(string, string) (interface{}, error) // UserPassAuthenticationCtx authentication function with context.Context type UserPassAuthenticationCtx func(context.Context, string, string) (context.Context, interface{}, error) // TokenAuthentication authentication function type TokenAuthentication func(string) (interface{}, error) // TokenAuthenticationCtx authentication function with context.Context type TokenAuthenticationCtx func(context.Context, string) (context.Context, interface{}, error) // ScopedTokenAuthentication authentication function type ScopedTokenAuthentication func(string, []string) (interface{}, error) // ScopedTokenAuthenticationCtx authentication function with context.Context type ScopedTokenAuthenticationCtx func(context.Context, string, []string) (context.Context, interface{}, error) var DefaultRealmName = "API" type secCtxKey uint8 const ( failedBasicAuth secCtxKey = iota oauth2SchemeName ) func FailedBasicAuth(r http.Request) string { return FailedBasicAuthCtx(r.Context()) } func FailedBasicAuthCtx(ctx context.Context) string { v, ok := ctx.Value(failedBasicAuth).(string) if !ok { return "" } return v } func OAuth2SchemeName(r http.Request) string { return OAuth2SchemeNameCtx(r.Context()) } func OAuth2SchemeNameCtx(ctx context.Context) string { v, ok := ctx.Value(oauth2SchemeName).(string) if !ok { return "" } return v } // BasicAuth creates a basic auth authenticator with the provided authentication function func BasicAuth(authenticate UserPassAuthentication) runtime.Authenticator { return BasicAuthRealm(DefaultRealmName, authenticate) } // BasicAuthRealm creates a basic auth authenticator with the provided authentication function and realm name func BasicAuthRealm(realm string, authenticate UserPassAuthentication) runtime.Authenticator { if realm == "" { realm = DefaultRealmName } return HttpAuthenticator(func(r http.Request) (bool, interface{}, error) { if usr, pass, ok := r.BasicAuth(); ok { p, err := authenticate(usr, pass) if err != nil { r = r.WithContext(context.WithValue(r.Context(), failedBasicAuth, realm)) } return true, p, err } r = r.WithContext(context.WithValue(r.Context(), failedBasicAuth, realm)) return false, nil, nil }) } // BasicAuthCtx creates a basic auth authenticator with the provided authentication function with support for context.Context func BasicAuthCtx(authenticate UserPassAuthenticationCtx) runtime.Authenticator { return BasicAuthRealmCtx(DefaultRealmName, authenticate) } // BasicAuthRealmCtx creates a basic auth authenticator with the provided authentication function and realm name with support for context.Context func BasicAuthRealmCtx(realm string, authenticate UserPassAuthenticationCtx) runtime.Authenticator { if realm == "" { realm = DefaultRealmName } return HttpAuthenticator(func(r http.Request) (bool, interface{}, error) { if usr, pass, ok := r.BasicAuth(); ok { ctx, p, err := authenticate(r.Context(), usr, pass) if err != nil { ctx = context.WithValue(ctx, failedBasicAuth, realm) } r = r.WithContext(ctx) return true, p, err } r = r.WithContext(context.WithValue(r.Context(), failedBasicAuth, realm)) return false, nil, nil }) } // APIKeyAuth creates an authenticator that uses a token for authorization. // This token can be obtained from either a header or a query string func APIKeyAuth(name, in string, authenticate TokenAuthentication) runtime.Authenticator { inl := strings.ToLower(in) if inl != query && inl != header { // panic because this is most likely a typo panic(errors.New(500, "api key auth: in value needs to be either \"query\" or \"header\"")) } var getToken func(http.Request) string switch inl { case header: getToken = func(r http.Request) string { return r.Header.Get(name) } case query: getToken = func(r http.Request) string { return r.URL.Query().Get(name) } } return HttpAuthenticator(func(r http.Request) (bool, interface{}, error) { token := getToken(r) if token == "" { return false, nil, nil } p, err := authenticate(token) return true, p, err }) } // APIKeyAuthCtx creates an authenticator that uses a token for authorization with support for context.Context. // This token can be obtained from either a header or a query string func APIKeyAuthCtx(name, in string, authenticate TokenAuthenticationCtx) runtime.Authenticator { inl := strings.ToLower(in) if inl != query && inl != header { // panic because this is most likely a typo panic(errors.New(500, "api key auth: in value needs to be either \"query\" or \"header\"")) } var getToken func(http.Request) string switch inl { case header: getToken = func(r http.Request) string { return r.Header.Get(name) } case query: getToken = func(r http.Request) string { return r.URL.Query().Get(name) } } return HttpAuthenticator(func(r http.Request) (bool, interface{}, error) { token := getToken(r) if token == "" { return false, nil, nil } ctx, p, err := authenticate(r.Context(), token) r = r.WithContext(ctx) return true, p, err }) } // ScopedAuthRequest contains both a http request and the required scopes for a particular operation type ScopedAuthRequest struct { Request http.Request RequiredScopes []string } // BearerAuth for use with oauth2 flows func BearerAuth(name string, authenticate ScopedTokenAuthentication) runtime.Authenticator { const prefix = "Bearer " return ScopedAuthenticator(func(r ScopedAuthRequest) (bool, interface{}, error) { var token string hdr := r.Request.Header.Get(runtime.HeaderAuthorization) if strings.HasPrefix(hdr, prefix) { token = strings.TrimPrefix(hdr, prefix) } if token == "" { qs := r.Request.URL.Query() token = qs.Get(accessTokenParam) } //#nosec ct, _, _ := runtime.ContentType(r.Request.Header) if token == "" && (ct == "application/x-www-form-urlencoded" \|\| ct == "multipart/form-data") { token = r.Request.FormValue(accessTokenParam) } if token == "" { return false, nil, nil } rctx := context.WithValue(r.Request.Context(), oauth2SchemeName, name) r.Request = r.Request.WithContext(rctx) p, err := authenticate(token, r.RequiredScopes) return true, p, err }) } // BearerAuthCtx for use with oauth2 flows with support for context.Context. func BearerAuthCtx(name string, authenticate ScopedTokenAuthenticationCtx) runtime.Authenticator { const prefix = "Bearer " return ScopedAuthenticator(func(r ScopedAuthRequest) (bool, interface{}, error) { var token string hdr := r.Request.Header.Get(runtime.HeaderAuthorization) if strings.HasPrefix(hdr, prefix) { token = strings.TrimPrefix(hdr, prefix) } if token == "" { qs := r.Request.URL.Query() token = qs.Get(accessTokenParam) } //#nosec ct, _, _ := runtime.ContentType(r.Request.Header) if token == "" && (ct == "application/x-www-form-urlencoded" \|\| ct == "multipart/form-data") { token = r.Request.FormValue(accessTokenParam) } if token == "" { return false, nil, nil } rctx := context.WithValue(r.Request.Context(), oauth2SchemeName, name) ctx, p, err := authenticate(rctx, token, r.RequiredScopes) r.Request = r.Request.WithContext(ctx) return true, p, err }) }	8.88 KB	2025-05-25 12:27
📄 authorizer.go // Copyright 2015 go-swagger maintainers // // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package security import ( "net/http" "github.com/go-openapi/runtime" ) // Authorized provides a default implementation of the Authorizer interface where all // requests are authorized (successful) func Authorized() runtime.Authorizer { return runtime.AuthorizerFunc(func(_ *http.Request, _ interface{}) error { return nil }) }	932 B	2025-05-25 12:27
📄 authorizer_test.go // Copyright 2015 go-swagger maintainers // // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package security import ( "context" "net/http" "testing" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" ) func TestAuthorized(t testing.T) { authorizer := Authorized() err := authorizer.Authorize(nil, nil) require.NoError(t, err) } func TestAuthenticator(t testing.T) { r, err := http.NewRequestWithContext(context.Background(), http.MethodGet, "/", nil) require.NoError(t, err) t.Run("with HttpAuthenticator", func(t testing.T) { auth := HttpAuthenticator(func(_ http.Request) (bool, interface{}, error) { return true, "test", nil }) t.Run("authenticator should work on http.Request", func(t testing.T) { isAuth, user, err := auth.Authenticate(r) require.NoError(t, err) assert.True(t, isAuth) assert.Equal(t, "test", user) }) t.Run("authenticator should work on ScopedAuthRequest", func(t testing.T) { scoped := &ScopedAuthRequest{Request: r} isAuth, user, err := auth.Authenticate(scoped) require.NoError(t, err) assert.True(t, isAuth) assert.Equal(t, "test", user) }) t.Run("authenticator should return false on other inputs", func(t testing.T) { isAuth, user, err := auth.Authenticate("") require.NoError(t, err) assert.False(t, isAuth) assert.Empty(t, user) }) }) t.Run("with ScopedAuthenticator", func(t testing.T) { auth := ScopedAuthenticator(func(_ ScopedAuthRequest) (bool, interface{}, error) { return true, "test", nil }) t.Run("authenticator should work on ScopedAuthRequest", func(t testing.T) { scoped := &ScopedAuthRequest{Request: r} isAuth, user, err := auth.Authenticate(scoped) require.NoError(t, err) assert.True(t, isAuth) assert.Equal(t, "test", user) }) t.Run("authenticator should return false on other inputs", func(t testing.T) { isAuth, user, err := auth.Authenticate("") require.NoError(t, err) assert.False(t, isAuth) assert.Empty(t, user) }) }) }	2.48 KB	2025-05-25 12:27
📄 basic_auth_test.go // Copyright 2015 go-swagger maintainers // // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package security import ( "context" "net/http" "testing" "github.com/go-openapi/errors" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" ) type secTestKey uint8 const ( original secTestKey = iota extra reason ) const ( wisdom = "The man who is swimming against the stream knows the strength of it." extraWisdom = "Our greatest glory is not in never falling, but in rising every time we fall." expReason = "I like the dreams of the future better than the history of the past." testPassword = "123456" ) func TestBasicAuth(t testing.T) { basicAuthHandler := UserPassAuthentication(func(user, pass string) (interface{}, error) { if user == principal && pass == testPassword { return principal, nil } return "", errors.Unauthenticated("basic") }) ba := BasicAuth(basicAuthHandler) t.Run("with valid basic auth", func(t testing.T) { req, err := http.NewRequestWithContext(context.Background(), http.MethodGet, authPath, nil) require.NoError(t, err) req.SetBasicAuth(principal, testPassword) ok, usr, err := ba.Authenticate(req) require.NoError(t, err) assert.True(t, ok) assert.Equal(t, principal, usr) }) t.Run("with invalid basic auth", func(t testing.T) { req, err := http.NewRequestWithContext(context.Background(), http.MethodGet, authPath, nil) require.NoError(t, err) req.SetBasicAuth(principal, principal) ok, usr, err := ba.Authenticate(req) require.Error(t, err) assert.True(t, ok) assert.Equal(t, "", usr) assert.NotEmpty(t, FailedBasicAuth(req)) assert.Equal(t, DefaultRealmName, FailedBasicAuth(req)) }) t.Run("with missing basic auth", func(t testing.T) { req, err := http.NewRequestWithContext(context.Background(), http.MethodGet, authPath, nil) require.NoError(t, err) ok, usr, err := ba.Authenticate(req) require.NoError(t, err) assert.False(t, ok) assert.Nil(t, usr) assert.NotEmpty(t, FailedBasicAuth(req)) assert.Equal(t, DefaultRealmName, FailedBasicAuth(req)) }) t.Run("basic auth without request", func(testing.T) { ok, usr, err := ba.Authenticate("token") require.NoError(t, err) assert.False(t, ok) assert.Nil(t, usr) }) t.Run("with realm, invalid basic auth", func(t testing.T) { br := BasicAuthRealm("realm", basicAuthHandler) req, err := http.NewRequestWithContext(context.Background(), http.MethodGet, authPath, nil) require.NoError(t, err) req.SetBasicAuth(principal, principal) ok, usr, err := br.Authenticate(req) require.Error(t, err) assert.True(t, ok) assert.Equal(t, "", usr) assert.Equal(t, "realm", FailedBasicAuth(req)) }) t.Run("with empty realm, invalid basic auth", func(t testing.T) { br := BasicAuthRealm("", basicAuthHandler) req, err := http.NewRequestWithContext(context.Background(), http.MethodGet, authPath, nil) require.NoError(t, err) req.SetBasicAuth(principal, principal) ok, usr, err := br.Authenticate(req) require.Error(t, err) assert.True(t, ok) assert.Equal(t, "", usr) assert.Equal(t, DefaultRealmName, FailedBasicAuth(req)) }) } func TestBasicAuthCtx(t testing.T) { basicAuthHandlerCtx := UserPassAuthenticationCtx(func(ctx context.Context, user, pass string) (context.Context, interface{}, error) { if user == principal && pass == testPassword { return context.WithValue(ctx, extra, extraWisdom), principal, nil } return context.WithValue(ctx, reason, expReason), "", errors.Unauthenticated("basic") }) ba := BasicAuthCtx(basicAuthHandlerCtx) ctx := context.WithValue(context.Background(), original, wisdom) t.Run("with valid basic auth", func(t testing.T) { req, err := http.NewRequestWithContext(ctx, http.MethodGet, authPath, nil) require.NoError(t, err) req.SetBasicAuth(principal, testPassword) ok, usr, err := ba.Authenticate(req) require.NoError(t, err) assert.True(t, ok) assert.Equal(t, principal, usr) assert.Equal(t, wisdom, req.Context().Value(original)) assert.Equal(t, extraWisdom, req.Context().Value(extra)) assert.Nil(t, req.Context().Value(reason)) }) t.Run("with invalid basic auth", func(t testing.T) { req, err := http.NewRequestWithContext(ctx, http.MethodGet, authPath, nil) require.NoError(t, err) req.SetBasicAuth(principal, principal) ok, usr, err := ba.Authenticate(req) require.Error(t, err) assert.True(t, ok) assert.Equal(t, "", usr) assert.Equal(t, wisdom, req.Context().Value(original)) assert.Nil(t, req.Context().Value(extra)) assert.Equal(t, expReason, req.Context().Value(reason)) }) t.Run("with missing basic auth", func(t testing.T) { req, err := http.NewRequestWithContext(ctx, http.MethodGet, authPath, nil) require.NoError(t, err) ok, usr, err := ba.Authenticate(req) require.NoError(t, err) assert.False(t, ok) assert.Nil(t, usr) assert.Equal(t, wisdom, req.Context().Value(original)) assert.Nil(t, req.Context().Value(extra)) assert.Nil(t, req.Context().Value(reason)) }) t.Run("basic auth without request", func(testing.T) { ok, usr, err := ba.Authenticate("token") require.NoError(t, err) assert.False(t, ok) assert.Nil(t, usr) }) t.Run("with realm, invalid basic auth", func(t testing.T) { br := BasicAuthRealmCtx("realm", basicAuthHandlerCtx) req, err := http.NewRequestWithContext(context.Background(), http.MethodGet, authPath, nil) require.NoError(t, err) req.SetBasicAuth(principal, principal) ok, usr, err := br.Authenticate(req) require.Error(t, err) assert.True(t, ok) assert.Equal(t, "", usr) assert.Equal(t, "realm", FailedBasicAuth(req)) }) t.Run("with empty realm, invalid basic auth", func(t testing.T) { br := BasicAuthRealmCtx("", basicAuthHandlerCtx) req, err := http.NewRequestWithContext(context.Background(), http.MethodGet, authPath, nil) require.NoError(t, err) req.SetBasicAuth(principal, principal) ok, usr, err := br.Authenticate(req) require.Error(t, err) assert.True(t, ok) assert.Equal(t, "", usr) assert.Equal(t, DefaultRealmName, FailedBasicAuth(req)) }) }	6.48 KB	2025-05-25 12:27
📄 bearer_auth_test.go package security import ( "bytes" "context" "fmt" "mime/multipart" "net/http" "net/url" "strings" "testing" "github.com/go-openapi/errors" "github.com/go-openapi/runtime" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" ) const ( owners = "owners_auth" validToken = "token123" invalidToken = "token124" principal = "admin" authPath = "/blah" invalidParam = "access_toke" ) type authExpectation uint8 const ( expectIsAuthorized authExpectation = iota expectInvalidAuthorization expectNoAuthorization ) func TestBearerAuth(t testing.T) { bearerAuth := ScopedTokenAuthentication(func(token string, _ []string) (interface{}, error) { if token == validToken { return principal, nil } return nil, errors.Unauthenticated("bearer") }) ba := BearerAuth(owners, bearerAuth) ctx := context.Background() t.Run("with valid bearer auth", func(t testing.T) { t.Run("token in query param", testAuthenticateBearerInQuery(ctx, ba, "", validToken, expectIsAuthorized), ) t.Run("token in header", testAuthenticateBearerInHeader(ctx, ba, "", validToken, expectIsAuthorized), ) t.Run("token in urlencoded form", testAuthenticateBearerInForm(ctx, ba, "", validToken, expectIsAuthorized), ) t.Run("token in multipart form", testAuthenticateBearerInMultipartForm(ctx, ba, "", validToken, expectIsAuthorized), ) }) t.Run("with invalid token", func(t testing.T) { t.Run("token in query param", testAuthenticateBearerInQuery(ctx, ba, "", invalidToken, expectInvalidAuthorization), ) t.Run("token in header", testAuthenticateBearerInHeader(ctx, ba, "", invalidToken, expectInvalidAuthorization), ) t.Run("token in urlencoded form", testAuthenticateBearerInForm(ctx, ba, "", invalidToken, expectInvalidAuthorization), ) t.Run("token in multipart form", testAuthenticateBearerInMultipartForm(ctx, ba, "", invalidToken, expectInvalidAuthorization), ) }) t.Run("with missing auth", func(t testing.T) { t.Run("token in query param", testAuthenticateBearerInQuery(ctx, ba, invalidParam, validToken, expectNoAuthorization), ) t.Run("token in header", testAuthenticateBearerInHeader(ctx, ba, "Beare", validToken, expectNoAuthorization), ) t.Run("token in urlencoded form", testAuthenticateBearerInForm(ctx, ba, invalidParam, validToken, expectNoAuthorization), ) t.Run("token in multipart form", testAuthenticateBearerInMultipartForm(ctx, ba, invalidParam, validToken, expectNoAuthorization), ) }) } func TestBearerAuthCtx(t testing.T) { bearerAuthCtx := ScopedTokenAuthenticationCtx(func(ctx context.Context, token string, _ []string) (context.Context, interface{}, error) { if token == validToken { return context.WithValue(ctx, extra, extraWisdom), principal, nil } return context.WithValue(ctx, reason, expReason), nil, errors.Unauthenticated("bearer") }) ba := BearerAuthCtx(owners, bearerAuthCtx) ctx := context.WithValue(context.Background(), original, wisdom) assertContextOK := func(requestContext context.Context, t testing.T) { // when authorized, we have an "extra" key in context assert.Equal(t, wisdom, requestContext.Value(original)) assert.Equal(t, extraWisdom, requestContext.Value(extra)) assert.Nil(t, requestContext.Value(reason)) } assertContextKO := func(requestContext context.Context, t testing.T) { // when not authorized, we have a "reason" key in context assert.Equal(t, wisdom, requestContext.Value(original)) assert.Nil(t, requestContext.Value(extra)) assert.Equal(t, expReason, requestContext.Value(reason)) } assertContextNone := func(requestContext context.Context, t testing.T) { // when missing authorization, we only have the original context assert.Equal(t, wisdom, requestContext.Value(original)) assert.Nil(t, requestContext.Value(extra)) assert.Nil(t, requestContext.Value(reason)) } t.Run("with valid bearer auth", func(t testing.T) { t.Run("token in query param", testAuthenticateBearerInQuery(ctx, ba, "", validToken, expectIsAuthorized, assertContextOK), ) t.Run("token in header", testAuthenticateBearerInHeader(ctx, ba, "", validToken, expectIsAuthorized, assertContextOK), ) t.Run("token in urlencoded form", testAuthenticateBearerInForm(ctx, ba, "", validToken, expectIsAuthorized, assertContextOK), ) t.Run("token in multipart form", testAuthenticateBearerInMultipartForm(ctx, ba, "", validToken, expectIsAuthorized, assertContextOK), ) }) t.Run("with invalid token", func(t testing.T) { t.Run("token in query param", testAuthenticateBearerInQuery(ctx, ba, "", invalidToken, expectInvalidAuthorization, assertContextKO), ) t.Run("token in header", testAuthenticateBearerInHeader(ctx, ba, "", invalidToken, expectInvalidAuthorization, assertContextKO), ) t.Run("token in urlencoded form", testAuthenticateBearerInForm(ctx, ba, "", invalidToken, expectInvalidAuthorization, assertContextKO), ) t.Run("token in multipart form", testAuthenticateBearerInMultipartForm(ctx, ba, "", invalidToken, expectInvalidAuthorization, assertContextKO), ) }) t.Run("with missing auth", func(t testing.T) { t.Run("token in query param", testAuthenticateBearerInQuery(ctx, ba, invalidParam, validToken, expectNoAuthorization, assertContextNone), ) t.Run("token in header", testAuthenticateBearerInHeader(ctx, ba, "Beare", validToken, expectNoAuthorization, assertContextNone), ) t.Run("token in urlencoded form", testAuthenticateBearerInForm(ctx, ba, invalidParam, validToken, expectNoAuthorization, assertContextNone), ) t.Run("token in multipart form", testAuthenticateBearerInMultipartForm(ctx, ba, invalidParam, validToken, expectNoAuthorization, assertContextNone), ) }) } func testIsAuthorized(_ context.Context, req http.Request, authorizer runtime.Authenticator, expectAuthorized authExpectation, extraAsserters ...func(context.Context, testing.T)) func(testing.T) { return func(t testing.T) { hasToken, usr, err := authorizer.Authenticate(&ScopedAuthRequest{Request: req}) switch expectAuthorized { case expectIsAuthorized: require.NoError(t, err) assert.True(t, hasToken) assert.Equal(t, principal, usr) assert.Equal(t, owners, OAuth2SchemeName(req)) case expectInvalidAuthorization: require.Error(t, err) require.ErrorContains(t, err, "unauthenticated") assert.True(t, hasToken) assert.Nil(t, usr) assert.Equal(t, owners, OAuth2SchemeName(req)) case expectNoAuthorization: require.NoError(t, err) assert.False(t, hasToken) assert.Nil(t, usr) assert.Empty(t, OAuth2SchemeName(req)) } for _, contextAsserter := range extraAsserters { contextAsserter(req.Context(), t) } } } func shouldAuthorizeOrNot(expectAuthorized authExpectation) string { if expectAuthorized == expectIsAuthorized { return "should authorize" } return "should not authorize" } func testAuthenticateBearerInQuery( // build a request with the token as a query parameter, then check against the authorizer // // the request context after authorization may be checked with the extraAsserters. ctx context.Context, authorizer runtime.Authenticator, parameter, token string, expectAuthorized authExpectation, extraAsserters ...func(context.Context, testing.T), ) func(testing.T) { if parameter == "" { parameter = accessTokenParam } return func(t testing.T) { req, err := http.NewRequestWithContext( ctx, http.MethodGet, fmt.Sprintf("%s?%s=%s", authPath, parameter, token), nil, ) require.NoError(t, err) t.Run( shouldAuthorizeOrNot(expectAuthorized), testIsAuthorized(ctx, req, authorizer, expectAuthorized, extraAsserters...), ) } } func testAuthenticateBearerInHeader( // build a request with the token as a header, then check against the authorizer ctx context.Context, authorizer runtime.Authenticator, parameter, token string, expectAuthorized authExpectation, extraAsserters ...func(context.Context, testing.T), ) func(testing.T) { if parameter == "" { parameter = "Bearer" } return func(t testing.T) { req, err := http.NewRequestWithContext(ctx, http.MethodGet, authPath, nil) require.NoError(t, err) req.Header.Set(runtime.HeaderAuthorization, fmt.Sprintf("%s %s", parameter, token)) t.Run( shouldAuthorizeOrNot(expectAuthorized), testIsAuthorized(ctx, req, authorizer, expectAuthorized, extraAsserters...), ) } } func testAuthenticateBearerInForm( // build a request with the token as a form field, then check against the authorizer ctx context.Context, authorizer runtime.Authenticator, parameter, token string, expectAuthorized authExpectation, extraAsserters ...func(context.Context, testing.T), ) func(testing.T) { if parameter == "" { parameter = accessTokenParam } return func(t testing.T) { body := url.Values(map[string][]string{}) body.Set(parameter, token) req, err := http.NewRequestWithContext(ctx, http.MethodPost, authPath, strings.NewReader(body.Encode())) require.NoError(t, err) req.Header.Set("Content-Type", "application/x-www-form-urlencoded") t.Run( shouldAuthorizeOrNot(expectAuthorized), testIsAuthorized(ctx, req, authorizer, expectAuthorized, extraAsserters...), ) } } func testAuthenticateBearerInMultipartForm( // build a request with the token as a multipart form field, then check against the authorizer ctx context.Context, authorizer runtime.Authenticator, parameter, token string, expectAuthorized authExpectation, extraAsserters ...func(context.Context, testing.T), ) func(testing.T) { if parameter == "" { parameter = accessTokenParam } return func(t *testing.T) { body := bytes.NewBuffer(nil) writer := multipart.NewWriter(body) require.NoError(t, writer.WriteField(parameter, token)) require.NoError(t, writer.Close()) req, err := http.NewRequestWithContext(ctx, http.MethodPost, authPath, body) require.NoError(t, err) req.Header.Set("Content-Type", writer.FormDataContentType()) t.Run( shouldAuthorizeOrNot(expectAuthorized), testIsAuthorized(ctx, req, authorizer, expectAuthorized, extraAsserters...), ) } }	9.93 KB	2025-05-25 12:27

Terminal