Files

525 lines
20 KiB
Go

package app
import (
"bufio"
"bytes"
"context"
"database/sql"
"encoding/json"
"fmt"
"io"
"net/http"
"net/http/httptest"
"net/url"
"os"
"os/exec"
"path/filepath"
"strings"
"syscall"
"testing"
"time"
"git.ipao.vip/rogee/creator-hub/internal/account"
hub "git.ipao.vip/rogee/creator-hub/internal/environment"
"git.ipao.vip/rogee/creator-hub/internal/taskstate"
"github.com/gofiber/fiber/v3"
"github.com/gofiber/fiber/v3/middleware/adaptor"
"github.com/sirupsen/logrus"
"github.com/spf13/cobra"
)
func TestExecuteContextStopsOnSIGTERM(t *testing.T) {
if os.Getenv("CREATORHUB_SIGTERM_HELPER") == "1" {
command := &cobra.Command{Use: "shutdown-test", RunE: func(command *cobra.Command, _ []string) error {
_, _ = os.Stdout.WriteString("ready\n")
<-command.Context().Done()
_, _ = os.Stdout.WriteString("stopped\n")
return nil
}}
if err := execute(command); err != nil {
t.Fatal(err)
}
return
}
ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
defer cancel()
process := exec.CommandContext(ctx, os.Args[0], "-test.run=^TestExecuteContextStopsOnSIGTERM$")
process.Env = append(os.Environ(), "CREATORHUB_SIGTERM_HELPER=1")
stdout, err := process.StdoutPipe()
if err != nil {
t.Fatal(err)
}
if err := process.Start(); err != nil {
t.Fatal(err)
}
scanner := bufio.NewScanner(stdout)
if !scanner.Scan() || scanner.Text() != "ready" {
t.Fatalf("helper did not become ready: %q err=%v", scanner.Text(), scanner.Err())
}
if err := process.Process.Signal(syscall.SIGTERM); err != nil {
t.Fatal(err)
}
if !scanner.Scan() || scanner.Text() != "stopped" {
t.Fatalf("helper did not finish cleanup: %q err=%v", scanner.Text(), scanner.Err())
}
if err := process.Wait(); err != nil || ctx.Err() != nil {
t.Fatalf("process did not exit gracefully after SIGTERM: wait=%v context=%v", err, ctx.Err())
}
}
func TestLoadConfigRejectsInvalidDatabase(t *testing.T) {
t.Setenv("CONTROL_PLANE_USERNAME", "operator")
t.Setenv("CONTROL_PLANE_PASSWORD", "unit-test-password")
t.Setenv("DATABASE_URL", "file:///tmp/creatorhub.db")
if _, err := loadConfig(); err == nil {
t.Fatal("expected non-Postgres database URL to be rejected")
}
}
func TestLoadConfigRequiresControlPlaneCredentials(t *testing.T) {
t.Setenv("CONTROL_PLANE_USERNAME", "")
t.Setenv("CONTROL_PLANE_PASSWORD", "")
if _, err := loadConfig(); err == nil {
t.Fatal("expected missing control-plane credentials to be rejected")
}
}
func TestLoadConfigPasswordLength(t *testing.T) {
t.Setenv("CONTROL_PLANE_USERNAME", "operator")
t.Setenv("CREATORHUB_CREDENTIAL_MASTER_KEY", "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=")
for _, test := range []struct {
password string
wantErr bool
}{
{"12345", true},
{"123456", false},
} {
t.Run(test.password, func(t *testing.T) {
t.Setenv("CONTROL_PLANE_PASSWORD", test.password)
_, err := loadConfig()
if (err != nil) != test.wantErr {
t.Fatalf("loadConfig() error = %v, wantErr %v", err, test.wantErr)
}
})
}
}
func TestLoadConfigRequiresCredentialMasterKey(t *testing.T) {
t.Setenv("CONTROL_PLANE_USERNAME", "operator")
t.Setenv("CONTROL_PLANE_PASSWORD", "unit-test-password")
for _, key := range []string{"", "not-base64", "c2hvcnQ="} {
t.Setenv("CREATORHUB_CREDENTIAL_MASTER_KEY", key)
if _, err := loadConfig(); err == nil {
t.Fatalf("accepted invalid credential master key %q", key)
}
}
}
func TestControlPlaneAuthentication(t *testing.T) {
logger := logrus.StandardLogger()
previousOutput := logger.Out
var logs bytes.Buffer
logrus.SetOutput(&logs)
t.Cleanup(func() { logrus.SetOutput(previousOutput) })
directory := t.TempDir()
if err := os.WriteFile(filepath.Join(directory, "index.html"), []byte("index"), 0o600); err != nil {
t.Fatal(err)
}
app := newHandler(directory, "operator", "unit-test-password")
health, err := app.Test(httptest.NewRequest(http.MethodGet, "/healthz", nil))
if err != nil || health.StatusCode != http.StatusNoContent {
t.Fatalf("health check must remain public: status=%d err=%v", health.StatusCode, err)
}
health.Body.Close()
ready, err := app.Test(httptest.NewRequest(http.MethodGet, "/readyz", nil))
if err != nil || ready.StatusCode != http.StatusServiceUnavailable {
t.Fatalf("readiness must fail without stores: status=%d err=%v", ready.StatusCode, err)
}
ready.Body.Close()
unknown := httptest.NewRequest(http.MethodGet, "/api/not-registered", nil)
unknown.SetBasicAuth("operator", "unit-test-password")
unknownResponse, err := app.Test(unknown)
if err != nil || unknownResponse.StatusCode != http.StatusNotFound {
t.Fatalf("unknown API must be JSON 404: status=%d err=%v", unknownResponse.StatusCode, err)
}
if got := unknownResponse.Header.Get("Content-Type"); !strings.HasPrefix(got, "application/json") {
t.Fatalf("unknown API content type=%q", got)
}
unknownResponse.Body.Close()
for _, path := range []string{
"/", "/api/phase-a/accounts", "/api/browsers", "/api/network-exits", "/api/phase-a/tasks", "/api/phase-a/audit",
} {
request := httptest.NewRequest(http.MethodGet, path, nil)
response, err := app.Test(request)
if err != nil {
t.Fatal(err)
}
response.Body.Close()
if response.StatusCode != http.StatusUnauthorized || response.Header.Get("WWW-Authenticate") == "" {
t.Fatalf("GET %s was not protected: status=%d", path, response.StatusCode)
}
}
for name, test := range map[string]struct {
user, password string
want int
}{
"valid": {"operator", "unit-test-password", http.StatusOK},
"wrong user": {"other", "unit-test-password", http.StatusUnauthorized},
"wrong password": {"operator", "credential-must-not-be-logged", http.StatusUnauthorized},
} {
t.Run(name, func(t *testing.T) {
request := httptest.NewRequest(http.MethodGet, "/", nil)
request.SetBasicAuth(test.user, test.password)
response, err := app.Test(request)
if err != nil {
t.Fatal(err)
}
response.Body.Close()
if response.StatusCode != test.want {
t.Fatalf("status=%d want=%d", response.StatusCode, test.want)
}
})
}
if strings.Contains(logs.String(), "credential-must-not-be-logged") {
t.Fatalf("authentication credential reached logs: %s", logs.String())
}
}
type controlPlaneRouteCase struct {
method, pattern, path, body string
wantAuthenticatedStatus int
}
type testCredentialBridge struct {
values map[string]string
}
func (bridge *testCredentialBridge) Store(ctx context.Context, _ account.CredentialReference, key, value string) error {
if err := ctx.Err(); err != nil {
return err
}
bridge.values[key] = value
return nil
}
func (bridge *testCredentialBridge) Delete(ctx context.Context, _ account.CredentialReference, key string) error {
if err := ctx.Err(); err != nil {
return err
}
delete(bridge.values, key)
return nil
}
func TestControlPlaneRouteRegistrationMatrix(t *testing.T) {
app := fiber.New()
app.Use(authenticate("operator", "unit-test-password"))
registerHubWithNetwork(app, nil, nil, nil)
registerPhaseA(app, nil, nil, nil)
routes := controlPlaneRouteMatrix()
assertControlPlaneRouteMatrix(t, app, routes)
for _, route := range routes {
if response := do(app, route.method, route.path, route.body); response.Code != http.StatusUnauthorized {
t.Fatalf("registered route %s %s returned %d without credentials, want %d", route.method, route.path,
response.Code, http.StatusUnauthorized)
}
}
if response := do(app, http.MethodPost, "/api/not-registered", ""); response.Code != http.StatusUnauthorized {
t.Fatalf("unregistered route returned %d without credentials, want %d", response.Code, http.StatusUnauthorized)
}
}
func TestControlPlaneRegisteredRouteMatrix(t *testing.T) {
databaseURL := os.Getenv("CREATORHUB_POSTGRES_TEST_URL")
if databaseURL == "" {
t.Skip("set CREATORHUB_POSTGRES_TEST_URL to run control-plane route coverage")
}
databaseURL = isolatedControlPlaneDatabaseURL(t, databaseURL)
ctx := context.Background()
phaseAStore, err := account.Open(ctx, databaseURL)
if err != nil {
t.Fatal(err)
}
t.Cleanup(func() { _ = phaseAStore.Close() })
hubStore, err := hub.Open(ctx, databaseURL)
if err != nil {
t.Fatal(err)
}
t.Cleanup(func() { _ = hubStore.Close() })
webDirectory := t.TempDir()
if err := os.WriteFile(filepath.Join(webDirectory, "index.html"), []byte("index"), 0o600); err != nil {
t.Fatal(err)
}
app := newHandlerWithStores(webDirectory, "operator", "unit-test-password", phaseAStore, hubStore)
routes := controlPlaneRouteMatrix()
assertControlPlaneRouteMatrix(t, app, routes)
for _, route := range routes {
route := route
t.Run(route.method+" "+route.pattern, func(t *testing.T) {
if response := do(app, route.method, route.path, route.body); response.Code != http.StatusUnauthorized {
t.Fatalf("unauthenticated %s %s returned %d, want %d", route.method, route.path, response.Code, http.StatusUnauthorized)
}
response := do(app, route.method, route.path, route.body, "operator", "unit-test-password")
if response.Code != route.wantAuthenticatedStatus {
t.Fatalf("authenticated %s %s returned %d, want %d: %s", route.method, route.path, response.Code,
route.wantAuthenticatedStatus, response.Body.String())
}
})
}
for _, route := range []struct {
method, path string
want int
}{
{http.MethodPost, "/api/not-registered", http.StatusNotFound},
{http.MethodDelete, "/api/not-registered", http.StatusNotFound},
} {
t.Run("unregistered "+route.method, func(t *testing.T) {
if response := do(app, route.method, route.path, ""); response.Code != http.StatusUnauthorized {
t.Fatalf("unauthenticated unregistered %s %s returned %d, want %d", route.method, route.path, response.Code, http.StatusUnauthorized)
}
if response := do(app, route.method, route.path, "", "operator", "unit-test-password"); response.Code != route.want {
t.Fatalf("authenticated unregistered %s %s returned %d, want %d", route.method, route.path, response.Code, route.want)
}
})
}
}
func assertControlPlaneRouteMatrix(t *testing.T, app *fiber.App, routes []controlPlaneRouteCase) {
t.Helper()
expected := make(map[string]struct{}, len(routes))
for _, route := range routes {
key := controlPlaneRouteKey(route.method, route.pattern)
if _, exists := expected[key]; exists {
t.Fatalf("duplicate route matrix entry: %s", key)
}
expected[key] = struct{}{}
}
actual := registeredControlPlaneRoutes(app)
for key := range expected {
if _, exists := actual[key]; !exists {
t.Errorf("route matrix is missing registered route: %s", key)
}
}
for key := range actual {
if _, exists := expected[key]; !exists {
t.Errorf("registered API route is missing from route matrix: %s", key)
}
}
}
func controlPlaneRouteKey(method, path string) string { return method + " " + path }
func registeredControlPlaneRoutes(app *fiber.App) map[string]struct{} {
routes := map[string]struct{}{}
for _, methodRoutes := range app.Stack() {
for _, route := range methodRoutes {
if !strings.HasPrefix(route.Path, "/api/") {
continue
}
switch route.Method {
case http.MethodGet, http.MethodPost, http.MethodPut, http.MethodDelete:
routes[controlPlaneRouteKey(route.Method, route.Path)] = struct{}{}
}
}
}
return routes
}
func controlPlaneRouteMatrix() []controlPlaneRouteCase {
return []controlPlaneRouteCase{
{http.MethodGet, "/api/browsers", "/api/browsers", "", http.StatusOK},
{http.MethodGet, "/api/browsers/:alias", "/api/browsers/missing", "", http.StatusNotFound},
{http.MethodPost, "/api/browsers", "/api/browsers", "", http.StatusBadRequest},
{http.MethodPost, "/api/browsers/:alias/:action", "/api/browsers/missing/start", "", http.StatusNotFound},
{http.MethodDelete, "/api/browsers/:alias", "/api/browsers/missing", "", http.StatusNotFound},
{http.MethodGet, "/api/network-exits", "/api/network-exits", "", http.StatusOK},
{http.MethodGet, "/api/network-exits/:id", "/api/network-exits/missing", "", http.StatusNotFound},
{http.MethodPost, "/api/network-exits", "/api/network-exits", "", http.StatusBadRequest},
{http.MethodPost, "/api/network-exits/:id/check", "/api/network-exits/missing/check", "", http.StatusNotFound},
{http.MethodPost, "/api/network-exits/:id/disable", "/api/network-exits/missing/disable", "", http.StatusNotFound},
{http.MethodPut, "/api/network-exits/:id", "/api/network-exits/missing", "", http.StatusBadRequest},
{http.MethodPost, "/api/network-exits/:id/enable", "/api/network-exits/missing/enable", "", http.StatusNotFound},
{http.MethodDelete, "/api/network-exits/:id", "/api/network-exits/missing", "", http.StatusNotFound},
{http.MethodGet, "/api/gateways", "/api/gateways", "", http.StatusOK},
{http.MethodPost, "/api/gateways", "/api/gateways", "", http.StatusBadRequest},
{http.MethodPut, "/api/gateways/:name", "/api/gateways/missing", `{"name":"gw-missing","endpoint":"http://gw-missing:8081","token":""}`, http.StatusNotFound},
{http.MethodDelete, "/api/gateways/:name", "/api/gateways/missing", "", http.StatusNotFound},
{http.MethodPost, "/api/phase-a/accounts", "/api/phase-a/accounts", "", http.StatusBadRequest},
{http.MethodGet, "/api/phase-a/accounts", "/api/phase-a/accounts", "", http.StatusOK},
{http.MethodGet, "/api/phase-a/accounts/:id", "/api/phase-a/accounts/missing", "", http.StatusNotFound},
{http.MethodPost, "/api/phase-a/accounts/:id/pause", "/api/phase-a/accounts/missing/pause", "", http.StatusNotFound},
{http.MethodPost, "/api/phase-a/accounts/:id/resume", "/api/phase-a/accounts/missing/resume", "", http.StatusNotFound},
{http.MethodPost, "/api/phase-a/accounts/:id/revoke", "/api/phase-a/accounts/missing/revoke", "", http.StatusNotFound},
{http.MethodPost, "/api/phase-a/drafts", "/api/phase-a/drafts", "", http.StatusBadRequest},
{http.MethodGet, "/api/phase-a/drafts", "/api/phase-a/drafts", "", http.StatusOK},
{http.MethodGet, "/api/phase-a/drafts/:id", "/api/phase-a/drafts/missing", "", http.StatusNotFound},
{http.MethodPost, "/api/phase-a/confirmations", "/api/phase-a/confirmations", "", http.StatusBadRequest},
{http.MethodGet, "/api/phase-a/confirmations", "/api/phase-a/confirmations", "", http.StatusOK},
{http.MethodGet, "/api/phase-a/confirmations/:id", "/api/phase-a/confirmations/missing", "", http.StatusNotFound},
{http.MethodPost, "/api/phase-a/tasks", "/api/phase-a/tasks", "", http.StatusBadRequest},
{http.MethodGet, "/api/phase-a/tasks", "/api/phase-a/tasks", "", http.StatusOK},
{http.MethodGet, "/api/phase-a/tasks/:id", "/api/phase-a/tasks/missing", "", http.StatusNotFound},
{http.MethodGet, "/api/phase-a/attempts/:id", "/api/phase-a/attempts/missing", "", http.StatusNotFound},
{http.MethodPost, "/api/phase-a/tasks/:id/cancel", "/api/phase-a/tasks/missing/cancel", "", http.StatusNotFound},
{http.MethodPost, "/api/phase-a/tasks/:id/verify", "/api/phase-a/tasks/missing/verify", "", http.StatusBadRequest},
{http.MethodPost, "/api/phase-a/tasks/:id/resume", "/api/phase-a/tasks/missing/resume", "", http.StatusNotFound},
{http.MethodPost, "/api/phase-a/tasks/:id/finish", "/api/phase-a/tasks/missing/finish", "", http.StatusNotFound},
{http.MethodPost, "/api/phase-a/mock/execute", "/api/phase-a/mock/execute", "", http.StatusBadRequest},
{http.MethodGet, "/api/phase-a/audit", "/api/phase-a/audit", "", http.StatusOK},
}
}
func TestOperatorNotificationFiltersAndRedacts(t *testing.T) {
previousLevel := logrus.GetLevel()
t.Cleanup(func() { logrus.SetLevel(previousLevel) })
var output bytes.Buffer
notify := newAttentionNotifier(&output)
notify(taskstate.Transition{State: "succeeded", ReasonCode: "task_succeeded", AccountID: "account-a", TaskID: "task-a"})
if output.Len() != 0 {
t.Fatalf("successful task emitted a notification: %s", output.String())
}
for _, level := range []logrus.Level{logrus.ErrorLevel, logrus.FatalLevel, logrus.PanicLevel} {
for _, test := range []struct{ state, reason string }{
{"policy_hold", "account_paused"}, {"needs_confirmation", "exit_unhealthy"},
} {
output.Reset()
logrus.SetLevel(level)
notify(taskstate.Transition{State: test.state, ReasonCode: test.reason, AccountID: "account-a", TaskID: "task-a"})
var entry map[string]any
if err := json.Unmarshal(output.Bytes(), &entry); err != nil {
t.Fatal(err)
}
if entry["event_type"] != test.state || entry["reason_code"] != test.reason ||
entry["notification_channel"] != "structured_log" || entry["account_id"] != "account-a" || entry["task_id"] != "task-a" {
t.Fatalf("unexpected notification at LOG_LEVEL=%s: %#v", level, entry)
}
for _, forbidden := range []string{"password", "authorization", "credential", "token", "secret"} {
if strings.Contains(strings.ToLower(output.String()), forbidden) {
t.Fatalf("notification contained sensitive field %q: %s", forbidden, output.String())
}
}
}
}
}
func TestSPAServesFileAndIndexFallback(t *testing.T) {
directory := t.TempDir()
files := map[string]string{
"index.html": "index",
"app.js": "asset",
"hello world.js": "space",
"应用.js": "unicode",
}
for name, body := range files {
if err := os.WriteFile(filepath.Join(directory, name), []byte(body), 0o600); err != nil {
t.Fatal(err)
}
}
if err := os.WriteFile(filepath.Join(directory, "..", "outside-secret.txt"), []byte("secret"), 0o600); err != nil {
t.Fatal(err)
}
app := newHandler(directory, "operator", "unit-test-password")
for path, want := range map[string]string{
"/app.js": "asset",
"/hello%20world.js": "space",
"/%E5%BA%94%E7%94%A8.js": "unicode",
"/%2e%2e%2foutside-secret.txt": "index",
"/dashboard": "index",
} {
request := httptest.NewRequest(http.MethodGet, path, nil)
request.SetBasicAuth("operator", "unit-test-password")
response, err := app.Test(request)
if err != nil {
t.Fatal(err)
}
body, readErr := io.ReadAll(response.Body)
response.Body.Close()
if readErr != nil || response.StatusCode != http.StatusOK || string(body) != want {
t.Fatalf("GET %s: status=%d body=%q err=%v", path, response.StatusCode, body, readErr)
}
}
}
func TestStartupLogIncludesListenAddress(t *testing.T) {
logger := logrus.StandardLogger()
previousOutput, previousFormatter, previousLevel := logger.Out, logger.Formatter, logger.Level
t.Cleanup(func() {
logrus.SetOutput(previousOutput)
logrus.SetFormatter(previousFormatter)
logrus.SetLevel(previousLevel)
})
var output bytes.Buffer
logrus.SetOutput(&output)
logrus.SetFormatter(&logrus.JSONFormatter{})
logrus.SetLevel(logrus.InfoLevel)
logStartup(config{listenAddr: ":8080"})
var entry map[string]any
if err := json.Unmarshal(output.Bytes(), &entry); err != nil {
t.Fatal(err)
}
if entry["listen_addr"] != ":8080" || entry["service"] != "control-plane" {
t.Fatalf("unexpected startup log: %#v", entry)
}
}
func do(appInstance *fiber.App, method, path, body string, credentials ...string) *httptest.ResponseRecorder {
response := httptest.NewRecorder()
var reader io.Reader
if body != "" {
reader = strings.NewReader(body)
}
request := httptest.NewRequest(method, path, reader)
if len(credentials) == 2 {
request.SetBasicAuth(credentials[0], credentials[1])
}
adaptor.FiberApp(appInstance).ServeHTTP(response, request)
return response
}
func isolatedControlPlaneDatabaseURL(t *testing.T, databaseURL string) string {
t.Helper()
admin, err := sql.Open("pgx", databaseURL)
if err != nil {
t.Fatal(err)
}
t.Cleanup(func() { _ = admin.Close() })
schema := fmt.Sprintf("creatorhub_hh803_%d", time.Now().UnixNano())
if _, err := admin.Exec("CREATE SCHEMA " + schema); err != nil {
t.Fatal(err)
}
t.Cleanup(func() {
if _, err := admin.Exec("DROP SCHEMA " + schema + " CASCADE"); err != nil {
t.Errorf("drop test schema: %v", err)
}
})
parsed, err := url.Parse(databaseURL)
if err != nil {
t.Fatal(err)
}
query := parsed.Query()
query.Set("search_path", schema)
parsed.RawQuery = query.Encode()
return parsed.String()
}