73 lines
2.3 KiB
Go
73 lines
2.3 KiB
Go
package middleware
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestCSRFSkipsChatwootAuthRoutes(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
router := gin.New()
|
|
router.Use(CSRF(CSRFConfig{
|
|
Enabled: true,
|
|
Secret: "test-secret",
|
|
CookieName: "_gochat_csrf",
|
|
HeaderName: "X-CSRF-Token",
|
|
TokenLength: 32,
|
|
SafeMethods: []string{"GET", "HEAD", "OPTIONS"},
|
|
SkipPaths: []string{"/auth/"},
|
|
CookiePath: "/",
|
|
CookieSameSite: "Lax",
|
|
}))
|
|
router.POST("/auth/sign_in", func(c *gin.Context) { c.Status(http.StatusOK) })
|
|
|
|
recorder := httptest.NewRecorder()
|
|
request := httptest.NewRequest(http.MethodPost, "/auth/sign_in", nil)
|
|
router.ServeHTTP(recorder, request)
|
|
|
|
require.Equal(t, http.StatusOK, recorder.Code)
|
|
}
|
|
|
|
func TestCSRFSkipsTokenAuthenticatedAPIRoutes(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
router := gin.New()
|
|
router.Use(CSRF(CSRFConfig{
|
|
Enabled: true,
|
|
Secret: "test-secret",
|
|
CookieName: "_gochat_csrf",
|
|
HeaderName: "X-CSRF-Token",
|
|
TokenLength: 32,
|
|
SafeMethods: []string{"GET", "HEAD", "OPTIONS"},
|
|
SkipPaths: []string{"/api/v1/"},
|
|
CookiePath: "/",
|
|
CookieSameSite: "Lax",
|
|
}))
|
|
router.POST("/api/v1/accounts/:account_id/conversations/:conversation_id/messages", func(c *gin.Context) { c.Status(http.StatusOK) })
|
|
|
|
recorder := httptest.NewRecorder()
|
|
request := httptest.NewRequest(http.MethodPost, "/api/v1/accounts/1/conversations/1/messages", nil)
|
|
router.ServeHTTP(recorder, request)
|
|
|
|
require.Equal(t, http.StatusOK, recorder.Code)
|
|
}
|
|
|
|
func TestCSRFSkipsAccessTokenAuthenticatedEnterpriseRoutes(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
router := gin.New()
|
|
router.Use(CSRF(CSRFConfig{Enabled: true, Secret: "test-secret", CookieName: "_gochat_csrf", HeaderName: "X-CSRF-Token"}))
|
|
router.POST("/enterprise/api/v1/accounts/:account_id/select_billing_currency", func(c *gin.Context) {
|
|
c.Status(http.StatusNoContent)
|
|
})
|
|
|
|
recorder := httptest.NewRecorder()
|
|
request := httptest.NewRequest(http.MethodPost, "/enterprise/api/v1/accounts/1/select_billing_currency", nil)
|
|
request.Header.Set("access-token", "signed-token")
|
|
router.ServeHTTP(recorder, request)
|
|
|
|
require.Equal(t, http.StatusNoContent, recorder.Code)
|
|
}
|