Function TestCORSMiddleware

app/artifact-cas/internal/server/cors_test.go:26–145

(t *testing.T)

)

func TestCORSMiddleware(t *testing.T) {
	handlerCalled := false
	inner := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
		handlerCalled = true
		w.WriteHeader(http.StatusOK)
	})

	tests := []struct {
		name           string
		allowedOrigins []string
		method         string
		origin         string
		wantStatus     int
		wantACHeader   string // expected Access-Control-Allow-Origin value, empty if absent
		wantVary       bool
		wantHandler    bool // whether inner handler should be called
	}{
		{
			name:           "empty origins - passthrough",
			allowedOrigins: nil,
			method:         http.MethodGet,
			origin:         "http://example.com",
			wantStatus:     http.StatusOK,
			wantHandler:    true,
		},
		{
			name:           "no Origin header - passthrough",
			allowedOrigins: []string{"http://example.com"},
			method:         http.MethodGet,
			origin:         "",
			wantStatus:     http.StatusOK,
			wantHandler:    true,
		},
		{
			name:           "matching origin GET",
			allowedOrigins: []string{"http://example.com"},
			method:         http.MethodGet,
			origin:         "http://example.com",
			wantStatus:     http.StatusOK,
			wantACHeader:   "http://example.com",
			wantVary:       true,
			wantHandler:    true,
		},
		{
			name:           "matching origin OPTIONS preflight",
			allowedOrigins: []string{"http://example.com"},
			method:         http.MethodOptions,
			origin:         "http://example.com",
			wantStatus:     http.StatusNoContent,
			wantACHeader:   "http://example.com",
			wantVary:       true,
			wantHandler:    false,
		},
		{
			name:           "non-matching origin",
			allowedOrigins: []string{"http://example.com"},
			method:         http.MethodGet,
			origin:         "http://evil.com",