Function TestSessionPasswordInvalidation

rest/session_test.go:527–603

(t *testing.T)

}

func TestSessionPasswordInvalidation(t *testing.T) {
	testCases := []struct {
		name     string
		password string
	}{
		{
			name:     "emptypassword",
			password: "",
		},
		{
			name:     "realpassword",
			password: "password",
		},
	}
	for _, test := range testCases {
		t.Run(test.name, func(t *testing.T) {
			rtConfig := &RestTesterConfig{}
			if test.password == "" {
				rtConfig.DatabaseConfig = &DatabaseConfig{
					DbConfig: DbConfig{
						AllowEmptyPassword: base.Ptr(true),
					},
				}

			}
			rt := NewRestTester(t, rtConfig)
			defer rt.Close()

			const username = "user1"
			originalPassword := test.password

			// create session test users
			response := rt.SendAdminRequest(http.MethodPost, "/{{.db}}/_user/", GetUserPayload(t, username, originalPassword, "", rt.GetSingleDataStore(), []string{"*"}, nil))
			RequireStatus(t, response, http.StatusCreated)

			originalPasswordHeaders := map[string]string{
				"Authorization": "Basic " + base64.StdEncoding.EncodeToString([]byte(username+":"+originalPassword)),
			}
			response = rt.SendRequestWithHeaders(http.MethodPost, "/db/_session", "", originalPasswordHeaders)
			RequireStatus(t, response, http.StatusOK)
			cookie := response.Header().Get("Set-Cookie")
			require.NotEqual(t, "", cookie)

			// Create a doc as the first user, with session auth, channel-restricted to first user
			cookieHeaders := map[string]string{
				"Cookie": cookie,
			}
			response = rt.SendRequestWithHeaders(http.MethodPut, "/{{.keyspace}}/doc1", `{"hi": "there"}`, cookieHeaders)
			RequireStatus(t, response, http.StatusCreated)
			response = rt.SendRequestWithHeaders(http.MethodGet, "/{{.keyspace}}/doc1", "", cookieHeaders)
			RequireStatus(t, response, http.StatusOK)

			response = rt.SendRequestWithHeaders(http.MethodGet, "/{{.keyspace}}/doc1", "", originalPasswordHeaders)
			RequireStatus(t, response, http.StatusOK)

			altPassword := "someotherpassword"
			// TODO CBG-3790: Add POST (upsert) support on User API, and specify only password here.
			// This test was relying on a bug (CBG-3610) which allowed only the password to be specified without wiping channels.