Unit test the AsAuthzSystem mw

Emyrk · Emyrk · commit c5e69faa74d4 · 2023-02-10T11:42:38.000-06:00
diff --git a/coderd/httpmw/authz_test.go b/coderd/httpmw/authz_test.go
@@ -0,0 +1,90 @@
+package httpmw_test
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/go-chi/chi/v5"
+
+	"github.com/coder/coder/coderd/httpmw"
+
+	"github.com/coder/coder/coderd/database/dbauthz"
+	"github.com/coder/coder/coderd/rbac"
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestAsAuthzSystem(t *testing.T) {
+	userActor := rbac.Subject{ID: uuid.NewString()}
+
+	base := http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
+		actor, ok := dbauthz.ActorFromContext(r.Context())
+		assert.True(t, ok, "actor should exist")
+		assert.True(t, userActor.Equal(actor), "actor should be the user actor")
+	})
+
+	mwSetUser := func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
+			r = r.WithContext(dbauthz.As(r.Context(), userActor))
+			next.ServeHTTP(rw, r)
+		})
+	}
+
+	mwAssertSystem := mwAssert(func(req *http.Request) {
+		actor, ok := dbauthz.ActorFromContext(req.Context())
+		assert.True(t, ok, "actor should exist")
+		assert.False(t, userActor.Equal(actor), "systemActor should not be the user actor")
+		assert.Contains(t, actor.Roles.Names(), "system", "should have system role")
+	})
+
+	mwAssertUser := mwAssert(func(req *http.Request) {
+		actor, ok := dbauthz.ActorFromContext(req.Context())
+		assert.True(t, ok, "actor should exist")
+		assert.True(t, userActor.Equal(actor), "should be the useractor")
+	})
+
+	mwAssertNoUser := mwAssert(func(req *http.Request) {
+		_, ok := dbauthz.ActorFromContext(req.Context())
+		assert.False(t, ok, "actor should not exist")
+	})
+
+	// Request as the user actor
+	const pattern = "/"
+	req := httptest.NewRequest("GET", pattern, nil)
+	res := httptest.NewRecorder()
+
+	handler := chi.NewRouter()
+	handler.Route(pattern, func(r chi.Router) {
+		r.Use(
+			// First assert there is no actor context
+			mwAssertNoUser,
+			// Set to the user actor
+			mwSetUser,
+			// Assert the user actor
+			mwAssertUser,
+			httpmw.AsAuthzSystem(
+				// Assert the system actor
+				mwAssertSystem,
+				mwAssertSystem,
+			),
+			// Check the user actor was returned to the context
+			mwAssertUser,
+		)
+		r.Handle("/", base)
+		r.NotFound(func(writer http.ResponseWriter, request *http.Request) {
+			assert.Fail(t, "should not hit not found, the route should be correct")
+		})
+	})
+
+	handler.ServeHTTP(res, req)
+}
+
+func mwAssert(assert func(req *http.Request)) func(next http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
+			assert(r)
+			next.ServeHTTP(rw, r)
+		})
+	}
+}
