TestBearer_APIKey_StillWorks: regression guard. The legacy API-key path must continue to work after we added the OAuth branch.
(t *testing.T)
| 236 | // TestBearer_APIKey_StillWorks: regression guard. The legacy API-key |
| 237 | // path must continue to work after we added the OAuth branch. |
| 238 | func TestBearer_APIKey_StillWorks(t *testing.T) { |
| 239 | f := newConsentFixture(t) |
| 240 | store := identity.NewStore(f.pool) |
| 241 | ctx := context.Background() |
| 242 | user, err := store.CreateOrGetUser(ctx, "apikey-"+randHex8(t)+"@example.com", "API Key User", "google-apikey-"+randHex8(t)) |
| 243 | if err != nil { |
| 244 | t.Fatal(err) |
| 245 | } |
| 246 | key, err := store.CreateAPIKey(ctx, user.ID, "test-key", nil) |
| 247 | if err != nil { |
| 248 | t.Fatal(err) |
| 249 | } |
| 250 | status, wa := callAPIWithBearer(t, f.server.URL, key.PlaintextKey) |
| 251 | if status != http.StatusOK { |
| 252 | t.Fatalf("API key auth regressed: got %d", status) |
| 253 | } |
| 254 | if wa != "" { |
| 255 | t.Errorf("API-key path on a successful 200 must not emit WWW-Authenticate: got %q", wa) |
| 256 | } |
| 257 | } |
| 258 | |
| 259 | // TestBearer_APIKey_Bad: a bad API key 401s with the BARE Bearer |
| 260 | // challenge (no error param). RFC 6750 §3 says any 401 on an |
nothing calls this directly
no test coverage detected