Something went wrong. Try again.
A community based topic aggregation platform built on atproto
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100package main
import ( "context" "encoding/json" "fmt" "net/http" "net/http/httptest" "testing" "time"
"Coves/internal/api/middleware" "Coves/internal/atproto/oauth" "Coves/internal/config" indigooauth "github.com/bluesky-social/indigo/atproto/auth/oauth" "github.com/bluesky-social/indigo/atproto/syntax" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require")
type wiringSessionUnsealer map[string]*oauth.SealedSession
func (unsealer wiringSessionUnsealer) UnsealSession(token string) (*oauth.SealedSession, error) { if session, ok := unsealer[token]; ok { return session, nil } return nil, fmt.Errorf("unknown session")}
type wiringOAuthStore struct { indigooauth.ClientAuthStore sessions map[string]*indigooauth.ClientSessionData}
func (store *wiringOAuthStore) GetSession(_ context.Context, did syntax.DID, sessionID string) (*indigooauth.ClientSessionData, error) { if session, ok := store.sessions[did.String()+":"+sessionID]; ok { return session, nil } return nil, oauth.ErrSessionNotFound}
func TestBuildInstanceAdminMiddlewareUsesModerationAdminsOnly(t *testing.T) { const ( creatorDID = "did:plc:creator" adminDID = "did:plc:admin" path = "/xrpc/social.coves.moderation.getSubjectState" ) for _, test := range []struct { name string admins []string caller string wantStatus int wantCode string wantCalled bool }{ {name: "community creator is not admin", admins: []string{adminDID}, caller: creatorDID, wantStatus: http.StatusForbidden, wantCode: "Forbidden"}, {name: "listed admin is authorized", admins: []string{adminDID}, caller: adminDID, wantStatus: http.StatusNoContent, wantCalled: true}, {name: "empty admin list grants nobody", caller: adminDID, wantStatus: http.StatusForbidden, wantCode: "Forbidden"}, } { t.Run(test.name, func(t *testing.T) { cfg := &config.Config{ Instance: config.InstanceConfig{AllowedCommunityCreators: []string{creatorDID}}, Moderation: config.ModerationConfig{Admins: test.admins}, } unsealer := wiringSessionUnsealer{} store := &wiringOAuthStore{sessions: map[string]*indigooauth.ClientSessionData{}} for _, did := range []string{creatorDID, adminDID} { token := "session-for-" + did unsealer[token] = &oauth.SealedSession{DID: did, SessionID: "browser", ExpiresAt: time.Now().Add(time.Hour).Unix()} store.sessions[did+":browser"] = &indigooauth.ClientSessionData{AccountDID: syntax.DID(did), SessionID: "browser"} }
gate := buildInstanceAdminMiddleware(cfg, unsealer, store, nil) if !assert.NotNil(t, gate, "the server must construct the instance-admin gate") { return } called := false var authenticatedDID string handler := gate.RequireInstanceAdmin(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { called = true authenticatedDID = middleware.GetUserDID(r) w.WriteHeader(http.StatusNoContent) })) request := httptest.NewRequest(http.MethodGet, path, nil) request.Header.Set("Authorization", "Bearer session-for-"+test.caller) response := httptest.NewRecorder() handler.ServeHTTP(response, request) assert.Equal(t, test.wantStatus, response.Code) assert.Equal(t, test.wantCalled, called) if test.wantCalled { assert.Equal(t, test.caller, authenticatedDID) } else if assert.NotEmpty(t, response.Body.Bytes(), "refusal must include a JSON error") { var body map[string]any require.NoError(t, json.Unmarshal(response.Body.Bytes(), &body)) assert.Equal(t, test.wantCode, body["error"]) } }) }}