Function TestDisablePublicBasicAuth

rest/api_test.go:163–219

(t *testing.T)

}

func TestDisablePublicBasicAuth(t *testing.T) {
	rt := NewRestTester(t, &RestTesterConfig{
		DatabaseConfig: &DatabaseConfig{
			DbConfig: DbConfig{
				DisablePasswordAuth: base.Ptr(true),
				Guest: &auth.PrincipalConfig{
					Disabled: base.Ptr(true),
				},
			},
		},
	})
	defer rt.Close()
	ctx := rt.Context()

	response := rt.SendRequest(http.MethodGet, "/{{.db}}/", "")
	RequireStatus(t, response, http.StatusUnauthorized)
	require.Contains(t, response.Body.String(), ErrLoginRequired.Message)
	assert.NotContains(t, response.Header(), "WWW-Authenticate", "expected to not receive a WWW-Auth header when password auth is disabled")

	response = rt.SendRequest(http.MethodGet, "/notadb/", "")
	RequireStatus(t, response, http.StatusUnauthorized)
	require.Contains(t, response.Body.String(), ErrLoginRequired.Message)
	assert.NotContains(t, response.Header(), "WWW-Authenticate", "expected to not receive a WWW-Auth header when password auth is disabled")

	// Double-check that even if we provide valid credentials we still won't be let in
	a := rt.ServerContext().Database(ctx, "db").Authenticator(ctx)
	user, err := a.NewUser("user1", "letmein", channels.BaseSetOf(t, "foo"))
	assert.NoError(t, err)
	assert.NoError(t, a.Save(user))

	response = rt.SendUserRequest(http.MethodGet, "/{{.db}}/", "", "user1")
	RequireStatus(t, response, http.StatusUnauthorized)
	require.Contains(t, response.Body.String(), ErrInvalidLogin.Message)
	assert.NotContains(t, response.Header(), "WWW-Authenticate", "expected to not receive a WWW-Auth header when password auth is disabled")

	response = rt.SendUserRequest(http.MethodGet, "/notadb/", "", "user1")
	RequireStatus(t, response, http.StatusUnauthorized)
	require.Contains(t, response.Body.String(), ErrInvalidLogin.Message)
	assert.NotContains(t, response.Header(), "WWW-Authenticate", "expected to not receive a WWW-Auth header when password auth is disabled")

	// Also check that we can't create a session through POST /db/_session
	response = rt.SendRequest(http.MethodPost, "/{{.db}}/_session", `{"name":"user1","password":"letmein"}`)
	RequireStatus(t, response, http.StatusUnauthorized)
	require.Contains(t, response.Body.String(), ErrLoginRequired.Message)

	response = rt.SendRequest(http.MethodPost, "/notadb/_session", `{"name":"user1","password":"letmein"}`)
	RequireStatus(t, response, http.StatusUnauthorized)
	require.Contains(t, response.Body.String(), ErrLoginRequired.Message)

	// As a sanity check, ensure it does work when the setting is disabled
	rt.ServerContext().Database(ctx, "db").Options.DisablePasswordAuthentication = false
	response = rt.SendUserRequest(http.MethodGet, "/{{.db}}/", "", "user1")
	RequireStatus(t, response, http.StatusOK)

	response = rt.SendRequest(http.MethodPost, "/{{.db}}/_session", `{"name":"user1","password":"letmein"}`)
	RequireStatus(t, response, http.StatusOK)
}