(t *testing.T)
| 178 | } |
| 179 | |
| 180 | func TestHandleLogin_RejectsInvalidCLICallback(t *testing.T) { |
| 181 | ua, _, _ := setupUserAuth(t) |
| 182 | |
| 183 | req := httptest.NewRequest( |
| 184 | http.MethodGet, |
| 185 | "/api/auth/login?cli_callback=https://example.com/callback&cli_state=cli_state_123", |
| 186 | nil, |
| 187 | ) |
| 188 | w := httptest.NewRecorder() |
| 189 | |
| 190 | ua.HandleLogin(w, req) |
| 191 | |
| 192 | if w.Code != http.StatusBadRequest { |
| 193 | t.Fatalf("status = %d, want %d", w.Code, http.StatusBadRequest) |
| 194 | } |
| 195 | if !strings.Contains(w.Body.String(), "loopback") && !strings.Contains(w.Body.String(), "http") { |
| 196 | t.Fatalf("unexpected error body: %q", w.Body.String()) |
| 197 | } |
| 198 | } |
| 199 | |
| 200 | // fakeGoogleOAuth starts a test server that mimics Google's token and userinfo |
| 201 | // endpoints. Returns the server and an oauth2.Config pointing at it. |
nothing calls this directly
no test coverage detected