(t *testing.T)
| 20 | ) |
| 21 | |
| 22 | func TestCookieAPIKeySecurity(t *testing.T) { |
| 23 | t.Run("endpoint requirement uses cookie transport", func(t *testing.T) { |
| 24 | root := RunHTTPDSL(t, cookieAPIKeySecurityDSL) |
| 25 | endpoint := root.API.HTTP.Services[0].HTTPEndpoints[0] |
| 26 | require.Len(t, endpoint.Requirements, 1) |
| 27 | require.Len(t, endpoint.Requirements[0].Schemes, 1) |
| 28 | |
| 29 | scheme := endpoint.Requirements[0].Schemes[0] |
| 30 | require.Equal(t, "cookie", scheme.In) |
| 31 | require.Equal(t, "__Host-ak_session", scheme.Name) |
| 32 | |
| 33 | headers := expr.AsObject(endpoint.Headers.Type) |
| 34 | require.Zero(t, len(*headers), "cookie-backed api key must not synthesize an Authorization header") |
| 35 | }) |
| 36 | |
| 37 | t.Run("openapi uses cookie security scheme", func(t *testing.T) { |
| 38 | root := RunHTTPDSL(t, cookieAPIKeySecurityDSL) |
| 39 | openapi.Definitions = make(map[string]*openapi.Schema) |
| 40 | |
| 41 | v2JSON := renderOpenAPIJSON(t, openapiv2.Files, root) |
| 42 | var swagger openapi2.T |
| 43 | require.NoError(t, swagger.UnmarshalJSON(v2JSON)) |
| 44 | require.Len(t, swagger.SecurityDefinitions, 1) |
| 45 | require.Len(t, swagger.Paths, 1) |
| 46 | require.Contains(t, swagger.Paths, "/auth/profile") |
| 47 | require.NotNil(t, swagger.Paths["/auth/profile"].Get.Security) |
| 48 | require.Len(t, *swagger.Paths["/auth/profile"].Get.Security, 1) |
| 49 | for name, def := range swagger.SecurityDefinitions { |
| 50 | require.Equal(t, "apiKey", def.Type, name) |
| 51 | require.Equal(t, "cookie", def.In, name) |
| 52 | require.Equal(t, "__Host-ak_session", def.Name, name) |
| 53 | require.Contains(t, (*swagger.Paths["/auth/profile"].Get.Security)[0], name) |
| 54 | } |
| 55 | |
| 56 | openapi.Definitions = make(map[string]*openapi.Schema) |
| 57 | v3JSON := renderOpenAPIJSON(t, openapiv3.Files, root) |
| 58 | loader := openapi3.NewLoader() |
| 59 | doc, err := loader.LoadFromData(v3JSON) |
| 60 | require.NoError(t, err) |
| 61 | require.NoError(t, doc.Validate(context.Background())) |
| 62 | require.Len(t, doc.Components.SecuritySchemes, 1) |
| 63 | require.NotNil(t, doc.Paths.Find("/auth/profile")) |
| 64 | require.NotNil(t, doc.Paths.Find("/auth/profile").Get.Security) |
| 65 | require.Len(t, *doc.Paths.Find("/auth/profile").Get.Security, 1) |
| 66 | for name, ref := range doc.Components.SecuritySchemes { |
| 67 | require.NotNil(t, ref.Value, name) |
| 68 | require.Equal(t, "apiKey", ref.Value.Type, name) |
| 69 | require.Equal(t, "cookie", ref.Value.In, name) |
| 70 | require.Equal(t, "__Host-ak_session", ref.Value.Name, name) |
| 71 | require.Contains(t, (*doc.Paths.Find("/auth/profile").Get.Security)[0], name) |
| 72 | } |
| 73 | }) |
| 74 | |
| 75 | t.Run("http codegen does not duplicate cookie-backed auth fields", func(t *testing.T) { |
| 76 | root := RunHTTPDSL(t, cookieAPIKeySecurityDSL) |
| 77 | services := CreateHTTPServices(root) |
| 78 | |
| 79 | serverTypes := serverType("gen", root.API.HTTP.Services[0], services) |
nothing calls this directly
no test coverage detected