Initial commit: AetherForge Linux (forge-mesh) v0.1.0-dev

internal/auth/auth_test.go

@@ -0,0 +1,82 @@
+package auth
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+func TestTicketStoreIssueValidate(t *testing.T) {
+	store := NewTicketStore(0)
+	ticket, err := store.Issue()
+	if err != nil || ticket == "" {
+		t.Fatal("expected valid ticket")
+	}
+	if !store.Validate(ticket) {
+		t.Fatal("expected valid ticket")
+	}
+	if store.Validate("invalid") {
+		t.Fatal("expected invalid ticket to fail")
+	}
+}
+
+func TestTicketStoreConsume(t *testing.T) {
+	store := NewTicketStore(0)
+	ticket, err := store.Issue()
+	if err != nil || !store.Consume(ticket) {
+		t.Fatal("expected consume to succeed")
+	}
+	if store.Validate(ticket) {
+		t.Fatal("consumed ticket should be invalid")
+	}
+}
+
+func TestBasicAuthMiddleware(t *testing.T) {
+	handler := BasicAuthMiddleware("admin", "secret")(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
+
+	req := httptest.NewRequest(http.MethodGet, "/", nil)
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+	if rec.Code != http.StatusUnauthorized {
+		t.Fatalf("expected 401, got %d", rec.Code)
+	}
+
+	req = httptest.NewRequest(http.MethodGet, "/", nil)
+	req.SetBasicAuth("admin", "secret")
+	rec = httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("expected 200, got %d", rec.Code)
+	}
+}
+
+func TestFleetSecretMiddleware(t *testing.T) {
+	handler := FleetSecretMiddleware("fleet-secret", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
+
+	req := httptest.NewRequest(http.MethodPost, "/beacon", nil)
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+	if rec.Code != http.StatusUnauthorized {
+		t.Fatalf("expected 401, got %d", rec.Code)
+	}
+
+	req = httptest.NewRequest(http.MethodPost, "/beacon", nil)
+	req.Header.Set("Authorization", "Bearer fleet-secret")
+	rec = httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("expected 200, got %d", rec.Code)
+	}
+}
+
+func TestExtractBearer(t *testing.T) {
+	req := httptest.NewRequest(http.MethodGet, "/", nil)
+	req.Header.Set("Authorization", "Bearer abc123")
+	if got := ExtractBearer(req); got != "abc123" {
+		t.Fatalf("expected abc123, got %q", got)
+	}
+}