100 lines
3.1 KiB
Rust
100 lines
3.1 KiB
Rust
use chrono::Duration;
|
|
|
|
use super::*;
|
|
use crate::discovery::InstanceId;
|
|
|
|
#[test]
|
|
fn rejects_missing_authorization_header() {
|
|
let token = AuthToken::from_secret("secret");
|
|
let error = token
|
|
.verify_authorization_header(None)
|
|
.expect_err("rejected");
|
|
assert_eq!(error.code, ErrorCode::UnauthorizedLocalClient);
|
|
}
|
|
|
|
#[test]
|
|
fn rejects_malformed_authorization_header() {
|
|
let token = AuthToken::from_secret("secret");
|
|
let error = token
|
|
.verify_authorization_header(Some("Basic secret"))
|
|
.expect_err("rejected");
|
|
assert_eq!(error.code, ErrorCode::UnauthorizedLocalClient);
|
|
}
|
|
|
|
#[test]
|
|
fn rejects_wrong_bearer_token() {
|
|
let token = AuthToken::from_secret("secret");
|
|
let error = token
|
|
.verify_authorization_header(Some("Bearer wrong"))
|
|
.expect_err("rejected");
|
|
assert_eq!(error.code, ErrorCode::UnauthorizedLocalClient);
|
|
}
|
|
|
|
#[test]
|
|
fn accepts_matching_bearer_token() {
|
|
AuthToken::from_secret("secret")
|
|
.verify_authorization_header(Some("Bearer secret"))
|
|
.expect("accepted");
|
|
}
|
|
|
|
#[test]
|
|
fn scoped_credential_allows_only_granted_action() {
|
|
let grant = CredentialGrant::new(
|
|
InstanceId("inst_test".to_owned()),
|
|
ActionKind::TabCreate,
|
|
Duration::minutes(5),
|
|
);
|
|
grant
|
|
.verify_for_action(&grant.instance_id, ActionKind::TabCreate)
|
|
.expect("tab.create grant is accepted");
|
|
let error = grant
|
|
.verify_for_action(&grant.instance_id, ActionKind::WindowCreate)
|
|
.expect_err("other actions are rejected");
|
|
assert_eq!(error.code, ErrorCode::InsufficientPermissions);
|
|
}
|
|
|
|
#[test]
|
|
fn scoped_credential_rejects_different_instance() {
|
|
let grant = CredentialGrant::new(
|
|
InstanceId("inst_test".to_owned()),
|
|
ActionKind::TabCreate,
|
|
Duration::minutes(5),
|
|
);
|
|
let error = grant
|
|
.verify_for_action(&InstanceId("inst_other".to_owned()), ActionKind::TabCreate)
|
|
.expect_err("other instance is rejected");
|
|
assert_eq!(error.code, ErrorCode::UnauthorizedLocalClient);
|
|
}
|
|
|
|
#[test]
|
|
fn scoped_credential_rejects_expired_grant() {
|
|
let grant = CredentialGrant::new(
|
|
InstanceId("inst_test".to_owned()),
|
|
ActionKind::TabCreate,
|
|
Duration::minutes(-1),
|
|
);
|
|
let error = grant
|
|
.verify_for_action(&grant.instance_id, ActionKind::TabCreate)
|
|
.expect_err("expired grant is rejected");
|
|
assert_eq!(error.code, ErrorCode::UnauthorizedLocalClient);
|
|
}
|
|
|
|
#[test]
|
|
fn scoped_credential_allows_confirmation_required_action_scope() {
|
|
let grant = CredentialGrant::new(
|
|
InstanceId("inst_test".to_owned()),
|
|
ActionKind::WindowClose,
|
|
Duration::minutes(5),
|
|
);
|
|
grant
|
|
.verify_for_action(&grant.instance_id, ActionKind::WindowClose)
|
|
.expect("exact-action credential is separate from one-shot confirmation");
|
|
}
|
|
|
|
#[test]
|
|
fn credential_request_carries_only_action() {
|
|
let request = CredentialRequest::new(ActionKind::TabCreate);
|
|
assert_eq!(request.action, ActionKind::TabCreate);
|
|
assert_eq!(request.protocol_version, crate::protocol::PROTOCOL_VERSION);
|
|
}
|