File size: 2,436 Bytes
f1dd159 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 | package adminauth
import (
"context"
"net/http"
"net/http/httptest"
"path/filepath"
"strings"
"testing"
"time"
adminapp "github.com/chenyme/grok2api/backend/internal/application/adminauth"
"github.com/chenyme/grok2api/backend/internal/infra/persistence/relational"
"github.com/chenyme/grok2api/backend/internal/infra/security"
"github.com/gin-gonic/gin"
)
func TestRefreshUsesHTTPOnlyCookieAndDoesNotExposeToken(t *testing.T) {
gin.SetMode(gin.TestMode)
ctx := context.Background()
database, err := relational.OpenSQLite(ctx, filepath.Join(t.TempDir(), "auth.db"))
if err != nil {
t.Fatal(err)
}
defer database.Close()
if err := database.InitializeSchema(ctx); err != nil {
t.Fatal(err)
}
service := adminapp.NewService(
relational.NewAdminRepository(database),
relational.NewAdminSessionRepository(database),
security.NewTokenService("12345678901234567890123456789012"),
15*time.Minute,
30*24*time.Hour,
)
if err := service.Bootstrap(ctx, "admin", "password123"); err != nil {
t.Fatal(err)
}
router := gin.New()
NewHandler(service, true).RegisterPublic(router.Group("/api/admin/v1"))
login := httptest.NewRecorder()
loginRequest := httptest.NewRequest(http.MethodPost, "/api/admin/v1/auth/login", strings.NewReader(`{"username":"admin","password":"password123"}`))
loginRequest.Header.Set("Content-Type", "application/json")
router.ServeHTTP(login, loginRequest)
if login.Code != http.StatusOK {
t.Fatalf("login status = %d, body = %s", login.Code, login.Body.String())
}
if strings.Contains(login.Body.String(), `"refreshToken":`) {
t.Fatalf("login response exposed refresh token: %s", login.Body.String())
}
cookies := login.Result().Cookies()
if len(cookies) != 1 || cookies[0].Name != refreshCookieName || !cookies[0].HttpOnly || !cookies[0].Secure {
t.Fatalf("unexpected refresh cookie: %#v", cookies)
}
refresh := httptest.NewRecorder()
refreshRequest := httptest.NewRequest(http.MethodPost, "/api/admin/v1/auth/refresh", strings.NewReader(`{}`))
refreshRequest.Header.Set("Content-Type", "application/json")
refreshRequest.AddCookie(cookies[0])
router.ServeHTTP(refresh, refreshRequest)
if refresh.Code != http.StatusOK {
t.Fatalf("refresh status = %d, body = %s", refresh.Code, refresh.Body.String())
}
if strings.Contains(refresh.Body.String(), `"refreshToken":`) {
t.Fatalf("refresh response exposed refresh token: %s", refresh.Body.String())
}
}
|