From e0f479dbfed0c475e17111b725af060177ddde22 Mon Sep 17 00:00:00 2001 From: ElvinChan Date: Tue, 4 Sep 2018 21:17:46 +0800 Subject: [PATCH] Add test of security --- security_test.go | 246 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 246 insertions(+) create mode 100644 security_test.go diff --git a/security_test.go b/security_test.go new file mode 100644 index 0000000..a0d6472 --- /dev/null +++ b/security_test.go @@ -0,0 +1,246 @@ +package echoswagger + +import ( + "net/http/httptest" + "testing" + + "github.com/labstack/echo" + "github.com/stretchr/testify/assert" +) + +func TestSecurity(t *testing.T) { + r := New(echo.New(), "/", "doc/", nil) + scope := map[string]string{ + "read:users": "read users", + "write:users": "modify users", + } + r.AddSecurityOAuth2("OAuth2", "OAuth2 Auth", OAuth2FlowAccessCode, "http://petstore.swagger.io/oauth/dialog", "", scope) + r.AddSecurityOAuth2("", "OAuth2 Auth", OAuth2FlowAccessCode, "http://petstore.swagger.io/oauth/dialog", "", scope) + r.AddSecurityAPIKey("JWT", "JWT Token", SecurityInQuery) + r.AddSecurityAPIKey("", "JWT Token", SecurityInHeader) + r.AddSecurityBasic("Basic", "Basic Auth") + r.AddSecurityBasic("Basic", "Basic Auth") + + spec := r.(*Root).spec + assert.Len(t, spec.SecurityDefinitions, 3) + assert.Equal(t, spec.SecurityDefinitions, map[string]*SecurityDefinition{ + "JWT": &SecurityDefinition{ + Type: "apiKey", + Description: "JWT Token", + Name: "JWT", + In: string(SecurityInQuery), + }, + "Basic": &SecurityDefinition{ + Type: "basic", + Description: "Basic Auth", + }, + "OAuth2": &SecurityDefinition{ + Type: "oauth2", + Description: "OAuth2 Auth", + Flow: string(OAuth2FlowAccessCode), + AuthorizationURL: "http://petstore.swagger.io/oauth/dialog", + TokenURL: "", + Scopes: scope, + }, + }) + + t.Run("Or2Security", func(t *testing.T) { + var h func(e echo.Context) error + g := r.Group("OrGroup", "org") + a := g.GET("/or", h) + + a.SetSecurity("JWT", "Basic") + assert.Len(t, a.(*api).security, 1) + assert.Len(t, a.(*api).security[0], 2) + assert.Equal(t, a.(*api).security[0], map[string][]string{ + "JWT": []string{}, + "Basic": []string{}, + }) + + g.SetSecurity("JWT", "Basic") + assert.Len(t, g.(*group).security, 1) + assert.Len(t, g.(*group).security[0], 2) + assert.Equal(t, g.(*group).security[0], map[string][]string{ + "JWT": []string{}, + "Basic": []string{}, + }) + }) + + t.Run("And2Security", func(t *testing.T) { + var h func(e echo.Context) error + g := r.Group("AndGroup", "andg") + a := g.GET("/and", h) + + a.SetSecurity("JWT") + a.SetSecurity("Basic") + assert.Len(t, a.(*api).security, 2) + assert.Len(t, a.(*api).security[0], 1) + assert.Equal(t, a.(*api).security[0], map[string][]string{ + "JWT": []string{}, + }) + assert.Len(t, a.(*api).security[1], 1) + assert.Equal(t, a.(*api).security[1], map[string][]string{ + "Basic": []string{}, + }) + + g.SetSecurity("JWT") + g.SetSecurity("Basic") + assert.Len(t, g.(*group).security, 2) + assert.Len(t, g.(*group).security[0], 1) + assert.Equal(t, g.(*group).security[0], map[string][]string{ + "JWT": []string{}, + }) + assert.Len(t, g.(*group).security[1], 1) + assert.Equal(t, g.(*group).security[1], map[string][]string{ + "Basic": []string{}, + }) + }) + + t.Run("OAuth2Security", func(t *testing.T) { + var h func(e echo.Context) error + g := r.Group("OAuth2Group", "oauth2g") + a := g.GET("/oauth2", h) + + s := map[string][]string{ + "OAuth2": []string{"write:users", "read:users"}, + } + a.SetSecurityWithScope(s) + assert.Len(t, a.(*api).security, 1) + assert.Len(t, a.(*api).security[0], 1) + assert.Equal(t, a.(*api).security[0], map[string][]string{ + "OAuth2": []string{"write:users", "read:users"}, + }) + + g.SetSecurityWithScope(s) + assert.Len(t, g.(*group).security, 1) + assert.Len(t, g.(*group).security[0], 1) + assert.Equal(t, g.(*group).security[0], map[string][]string{ + "OAuth2": []string{"write:users", "read:users"}, + }) + }) + + t.Run("OAuth2SecuritySpecial", func(t *testing.T) { + var h func(e echo.Context) error + g := r.Group("OAuth2GroupSpecial", "oauth2sg") + a := g.GET("/oauth2s", h) + + s1 := map[string][]string{} + a.SetSecurityWithScope(s1) + assert.Len(t, a.(*api).security, 0) + + s2 := map[string][]string{ + "OAuth2": []string{}, + } + g.SetSecurityWithScope(s2) + assert.Len(t, g.(*group).security, 1) + assert.Len(t, g.(*group).security[0], 1) + assert.Equal(t, g.(*group).security[0], map[string][]string{ + "OAuth2": []string{}, + }) + }) + + t.Run("RepeatSecurity", func(t *testing.T) { + var h func(e echo.Context) error + g := r.Group("RepeatGroup", "repeatg") + a := g.GET("/repeat", h) + + a.SetSecurity("JWT") + assert.Len(t, a.(*api).security, 1) + + g.SetSecurity("JWT") + assert.Len(t, g.(*group).security, 1) + + e := r.(*Root).echo + req := httptest.NewRequest(echo.GET, "/doc/swagger.json", nil) + rec := httptest.NewRecorder() + c := e.NewContext(req, rec) + if assert.NoError(t, r.(*Root).genSpec(c)) { + o := r.(*Root).spec.Paths["/repeatg/repeat"] + assert.NotNil(t, o) + assert.Len(t, o.(*Path).Get.Security, 1) + assert.Len(t, o.(*Path).Get.Security[0], 1) + assert.Equal(t, o.(*Path).Get.Security[0], map[string][]string{ + "JWT": []string{}, + }) + } + }) + + t.Run("NotFoundSecurity", func(t *testing.T) { + var h func(e echo.Context) error + g := r.Group("NotFoundGroup", "nfg") + a := g.GET("/notfound", h) + + a.SetSecurity("AuthKey") + assert.Len(t, a.(*api).security, 1) + + e := r.(*Root).echo + req := httptest.NewRequest(echo.GET, "/doc/swagger.json", nil) + rec := httptest.NewRecorder() + c := e.NewContext(req, rec) + assert.Error(t, r.(*Root).genSpec(c)) + }) + + t.Run("EmptySecurity", func(t *testing.T) { + var h func(e echo.Context) error + g := r.Group("EmptyGroup", "eg") + a := g.GET("/empty", h) + + g.SetSecurity() + assert.Len(t, g.(*group).security, 0) + + a.SetSecurity() + assert.Len(t, a.(*api).security, 0) + }) +} + +func TestSecurityRepeat(t *testing.T) { + r := New(echo.New(), "/", "doc/", nil) + scope := map[string]string{ + "read:users": "read users", + "write:users": "modify users", + } + r.AddSecurityOAuth2("OAuth2", "OAuth2 Auth", OAuth2FlowAccessCode, "http://petstore.swagger.io/oauth/dialog", "", scope) + r.AddSecurityAPIKey("JWT", "JWT Token", SecurityInQuery) + r.AddSecurityBasic("Basic", "Basic Auth") + + t.Run("RepeatSecurity", func(t *testing.T) { + h := func(e echo.Context) error { + return nil + } + a := r.GET("/repeat", h) + + sa := map[string][]string{ + "OAuth2": []string{"write:users", "read:users"}, + } + sb := map[string][]string{ + "OAuth2": []string{"write:users"}, + } + sc := map[string][]string{ + "OAuth2": []string{"write:spots"}, + } + a.SetSecurityWithScope(sa) + a.SetSecurityWithScope(sb) + a.SetSecurityWithScope(sc) + a.SetSecurity("JWT", "Basic") + a.SetSecurity("JWT") + a.SetSecurity("Basic") + a.SetSecurity("JWT") + assert.Len(t, a.(*api).security, 7) + assert.Len(t, a.(*api).security[0], 1) + assert.Len(t, a.(*api).security[1], 1) + assert.Len(t, a.(*api).security[2], 1) + assert.Len(t, a.(*api).security[3], 2) + assert.Len(t, a.(*api).security[4], 1) + assert.Len(t, a.(*api).security[5], 1) + assert.Len(t, a.(*api).security[6], 1) + + req := httptest.NewRequest(echo.GET, "/doc/swagger.json", nil) + rec := httptest.NewRecorder() + c := r.(*Root).echo.NewContext(req, rec) + assert.NoError(t, r.(*Root).genSpec(c)) + router := r.(*Root).spec.Paths["/repeat"] + se := router.(*Path).Get.Security + + assert.Len(t, se, 6) + }) +}