From dc469471d3cfefeaf1b131b7a100973a9e19d4b5 Mon Sep 17 00:00:00 2001
From: Drew DeVault <sir@cmpwn.com>
Date: Tue, 6 Oct 2020 13:23:26 -0400
Subject: [PATCH] Add test for internal auth

---
 auth/middleware.go      |  2 +-
 auth/middleware_test.go | 69 ++++++++++++++++++++++++++++++++++++++++-
 2 files changed, 69 insertions(+), 2 deletions(-)

diff --git a/auth/middleware.go b/auth/middleware.go
index 54a710183b1c66df7ed8b86d1e958ddcd354612f..3e5b3252e0cb174589a77ae3909284317384f8d1 100644
--- a/auth/middleware.go
+++ b/auth/middleware.go
@@ -267,7 +267,7 @@ func internalAuth(internalNet []*net.IPNet, payload []byte,
 		}
 	}
 	if !ok {
-		authError(w, "Invalid source IP for internal auth", http.StatusForbidden)
+		authError(w, "Invalid source IP for internal auth", http.StatusUnauthorized)
 		return
 	}
 
diff --git a/auth/middleware_test.go b/auth/middleware_test.go
index 89911e5b90d4c9f6ea8f7b26aedfc31e6f3b94b3..2ba8e89c0faa3075c10fc4f7d3528d47e38bcf54 100644
--- a/auth/middleware_test.go
+++ b/auth/middleware_test.go
@@ -63,7 +63,7 @@ func TestCookie(t *testing.T) {
 	assert.Equal(t, auth.Email, "jdoe@example.org")
 
 	// Test that invalid cookie fails
-	ctx, mock = dbctx()
+	ctx, _ = dbctx()
 	req, err = http.NewRequestWithContext(ctx, "POST",
 		"https://example.org/query",
 		strings.NewReader(`{"query": "query { me { id } }"}`))
@@ -82,6 +82,73 @@ func TestCookie(t *testing.T) {
 	assert.Equal(t, http.StatusForbidden, resp.StatusCode)
 }
 
+func TestInternal(t *testing.T) {
+	mw, subctx, next := middleware()
+	ctx, mock := dbctx()
+	mockUserLookup(mock)
+
+	req, err := http.NewRequestWithContext(ctx, "POST",
+		"https://example.org/query",
+		strings.NewReader(`{"query": "query { me { id } }"}`))
+	assert.Nil(t, err)
+	req.Header.Add("Content-Type", "application/json")
+	internalAuth := InternalAuth{
+		Name: "jdoe",
+		ClientID: "",
+		NodeID: "test.node",
+		OAuthClientUUID: "",
+	}
+	payload, err := json.Marshal(&internalAuth)
+	assert.Nil(t, err)
+	req.Header.Add("Authorization", "Internal " +
+		string(crypto.Encrypt(payload)))
+	req.RemoteAddr = "127.0.0.1"
+
+	resp := &TestResponse{T: t}
+	mw(resp, req)
+	assert.True(t, *next)
+	assert.Nil(t, mock.ExpectationsWereMet())
+
+	auth := ForContext(*subctx)
+	assert.Equal(t, auth.AuthMethod, AUTH_INTERNAL)
+	assert.Equal(t, auth.UserID, 1337)
+	assert.Equal(t, auth.Username, "jdoe")
+	assert.Equal(t, auth.Email, "jdoe@example.org")
+
+	// Expect failure when outside of internal IP network
+	ctx, _ = dbctx()
+	req, err = http.NewRequestWithContext(ctx, "POST",
+		"https://example.org/query",
+		strings.NewReader(`{"query": "query { me { id } }"}`))
+	assert.Nil(t, err)
+	req.Header.Add("Content-Type", "application/json")
+	req.Header.Add("Authorization", "Internal " +
+		string(crypto.Encrypt(payload)))
+	req.RemoteAddr = "1.2.3.4"
+
+	*next = false
+	resp = &TestResponse{T: t}
+	mw(resp, req)
+	assert.False(t, *next)
+	assert.Equal(t, http.StatusUnauthorized, resp.StatusCode)
+
+	// Expect failure with invalid header
+	ctx, _ = dbctx()
+	req, err = http.NewRequestWithContext(ctx, "POST",
+		"https://example.org/query",
+		strings.NewReader(`{"query": "query { me { id } }"}`))
+	assert.Nil(t, err)
+	req.Header.Add("Content-Type", "application/json")
+	req.Header.Add("Authorization", "Internal fakeauth")
+	req.RemoteAddr = "127.0.0.1"
+
+	*next = false
+	resp = &TestResponse{T: t}
+	mw(resp, req)
+	assert.False(t, *next)
+	assert.Equal(t, http.StatusForbidden, resp.StatusCode)
+}
+
 var conf ini.File
 
 func init() {