mirror of
https://github.com/warmbly/warmbly.git
synced 2026-08-24 16:00:39 +00:00
Matthew Meszaros
99226338c9
New encryptedkeys.Store interface with three impls:
postgres - backend default, durable via PG
dynamodb - existing AWS path, also covers Scylla Alternator via
AWS_ENDPOINT_URL_DYNAMODB
http - worker-side adapter that talks to the backend's new
/api/v1/internal/dek/:userID endpoint, so workers never
connect directly to Postgres
The HTTP endpoint sits behind a new InternalAuthMiddleware that does
constant-time bearer-token compare against INTERNAL_API_TOKEN. Fail-
closed if the env var is unset.
cipher.Service now takes an encryptedkeys.Store instead of a Dynamo
repository. The old internal/repository/dynamo_user_encrypted_keys.go
is deleted (the file also had a pre-existing copy-paste bug using
EmailMessageMapTable in Get/Del that's gone with it).
New migration 38 adds user_encrypted_keys (user_id PK, encrypted_data_key,
created_at, updated_at).
20 tests cover HTTP round-trip, conflict semantics, factory selection,
middleware auth (fail-closed / wrong-scheme / timing-safe / happy path),
and DEK handler responses through gin's test harness.
103 lines
2.8 KiB
Go
103 lines
2.8 KiB
Go
package middleware
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
)
|
|
|
|
func init() { gin.SetMode(gin.TestMode) }
|
|
|
|
// resetInternalToken lets tests rerun the env-var lookup. Production code
|
|
// only loads the env once via sync.Once.
|
|
func resetInternalToken(t *testing.T, value string) {
|
|
t.Helper()
|
|
t.Setenv("INTERNAL_API_TOKEN", value)
|
|
// Bypass sync.Once by writing the cached token directly.
|
|
internalToken = []byte(value)
|
|
internalTokenOnce.Do(func() {}) // mark Once as fired so loadInternalToken is skipped
|
|
}
|
|
|
|
func newRouterWithInternalAuth(t *testing.T) *gin.Engine {
|
|
t.Helper()
|
|
h := &Handler{}
|
|
r := gin.New()
|
|
r.GET("/internal/ping", h.InternalAuthMiddleware(), func(c *gin.Context) {
|
|
c.JSON(http.StatusOK, gin.H{"ok": true})
|
|
})
|
|
return r
|
|
}
|
|
|
|
func TestInternalAuth_RejectsMissingHeader(t *testing.T) {
|
|
resetInternalToken(t, "secret")
|
|
r := newRouterWithInternalAuth(t)
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest("GET", "/internal/ping", nil)
|
|
r.ServeHTTP(w, req)
|
|
|
|
if w.Code != http.StatusUnauthorized {
|
|
t.Fatalf("missing header should be 401, got %d", w.Code)
|
|
}
|
|
}
|
|
|
|
func TestInternalAuth_RejectsWrongScheme(t *testing.T) {
|
|
resetInternalToken(t, "secret")
|
|
r := newRouterWithInternalAuth(t)
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest("GET", "/internal/ping", nil)
|
|
req.Header.Set("Authorization", "Basic secret")
|
|
r.ServeHTTP(w, req)
|
|
|
|
if w.Code != http.StatusUnauthorized {
|
|
t.Fatalf("Basic should be 401, got %d", w.Code)
|
|
}
|
|
}
|
|
|
|
func TestInternalAuth_RejectsWrongToken(t *testing.T) {
|
|
resetInternalToken(t, "secret")
|
|
r := newRouterWithInternalAuth(t)
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest("GET", "/internal/ping", nil)
|
|
req.Header.Set("Authorization", "Bearer wrong")
|
|
r.ServeHTTP(w, req)
|
|
|
|
if w.Code != http.StatusUnauthorized {
|
|
t.Fatalf("wrong token should be 401, got %d", w.Code)
|
|
}
|
|
}
|
|
|
|
func TestInternalAuth_AcceptsCorrectToken(t *testing.T) {
|
|
resetInternalToken(t, "secret")
|
|
r := newRouterWithInternalAuth(t)
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest("GET", "/internal/ping", nil)
|
|
req.Header.Set("Authorization", "Bearer secret")
|
|
r.ServeHTTP(w, req)
|
|
|
|
if w.Code != http.StatusOK {
|
|
t.Fatalf("correct token should be 200, got %d (body=%s)", w.Code, w.Body.String())
|
|
}
|
|
}
|
|
|
|
func TestInternalAuth_FailsClosedWhenTokenUnset(t *testing.T) {
|
|
// Explicitly empty: the middleware MUST refuse rather than allow.
|
|
resetInternalToken(t, "")
|
|
internalToken = nil // simulate unconfigured server
|
|
r := newRouterWithInternalAuth(t)
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest("GET", "/internal/ping", nil)
|
|
req.Header.Set("Authorization", "Bearer anything")
|
|
r.ServeHTTP(w, req)
|
|
|
|
if w.Code != http.StatusUnauthorized {
|
|
t.Fatalf("unconfigured server must reject, got %d", w.Code)
|
|
}
|
|
}
|