96 lines
3.3 KiB
Go
96 lines
3.3 KiB
Go
package httpcors
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
|
|
"github.com/ultisuite/ulti-backend/internal/config"
|
|
)
|
|
|
|
func TestMiddlewareDevAllowsLocalhostOrigin(t *testing.T) {
|
|
cfg := &config.Config{AppEnv: "development"}
|
|
handler := Middleware(cfg)(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
w.WriteHeader(http.StatusNoContent)
|
|
}))
|
|
|
|
req := httptest.NewRequest(http.MethodGet, "/api/v1/mail/settings", nil)
|
|
req.Header.Set("Origin", "http://localhost:3000")
|
|
rec := httptest.NewRecorder()
|
|
handler.ServeHTTP(rec, req)
|
|
|
|
if got := rec.Header().Get("Access-Control-Allow-Origin"); got != "http://localhost:3000" {
|
|
t.Fatalf("Access-Control-Allow-Origin = %q, want http://localhost:3000", got)
|
|
}
|
|
}
|
|
|
|
func TestMiddlewareDevAllowsPrivateLANOrigin(t *testing.T) {
|
|
cfg := &config.Config{AppEnv: "development"}
|
|
handler := Middleware(cfg)(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
w.WriteHeader(http.StatusNoContent)
|
|
}))
|
|
|
|
req := httptest.NewRequest(http.MethodGet, "/api/v1/mail/settings", nil)
|
|
req.Header.Set("Origin", "http://192.168.0.20:3000")
|
|
rec := httptest.NewRecorder()
|
|
handler.ServeHTTP(rec, req)
|
|
|
|
if got := rec.Header().Get("Access-Control-Allow-Origin"); got != "http://192.168.0.20:3000" {
|
|
t.Fatalf("Access-Control-Allow-Origin = %q, want http://192.168.0.20:3000", got)
|
|
}
|
|
}
|
|
|
|
func TestMiddlewareDevPreflightIncludesHeadMethod(t *testing.T) {
|
|
cfg := &config.Config{AppEnv: "development"}
|
|
handler := Middleware(cfg)(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
w.WriteHeader(http.StatusNoContent)
|
|
}))
|
|
|
|
req := httptest.NewRequest(http.MethodOptions, "/api/v1/mail/settings", nil)
|
|
req.Header.Set("Origin", "http://localhost:3000")
|
|
req.Header.Set("Access-Control-Request-Method", "HEAD")
|
|
req.Header.Set("Access-Control-Request-Headers", "authorization")
|
|
rec := httptest.NewRecorder()
|
|
handler.ServeHTTP(rec, req)
|
|
|
|
if got := rec.Header().Get("Access-Control-Allow-Methods"); got != "HEAD" {
|
|
t.Fatalf("Access-Control-Allow-Methods = %q, want HEAD", got)
|
|
}
|
|
}
|
|
|
|
func TestMiddlewareProductionUsesDomainOrigins(t *testing.T) {
|
|
cfg := &config.Config{AppEnv: "production", Domain: "mail.example.com"}
|
|
handler := Middleware(cfg)(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
w.WriteHeader(http.StatusNoContent)
|
|
}))
|
|
|
|
req := httptest.NewRequest(http.MethodGet, "/api/v1/mail/settings", nil)
|
|
req.Header.Set("Origin", "https://mail.example.com")
|
|
rec := httptest.NewRecorder()
|
|
handler.ServeHTTP(rec, req)
|
|
|
|
if got := rec.Header().Get("Access-Control-Allow-Origin"); got != "https://mail.example.com" {
|
|
t.Fatalf("Access-Control-Allow-Origin = %q, want https://mail.example.com", got)
|
|
}
|
|
}
|
|
|
|
func TestMiddlewareExplicitWildcard(t *testing.T) {
|
|
cfg := &config.Config{
|
|
AppEnv: "production",
|
|
Domain: "mail.example.com",
|
|
CORSAllowedOrigins: []string{"*"},
|
|
}
|
|
handler := Middleware(cfg)(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
w.WriteHeader(http.StatusNoContent)
|
|
}))
|
|
|
|
req := httptest.NewRequest(http.MethodGet, "/api/v1/mail/settings", nil)
|
|
req.Header.Set("Origin", "http://localhost:3000")
|
|
rec := httptest.NewRecorder()
|
|
handler.ServeHTTP(rec, req)
|
|
|
|
if got := rec.Header().Get("Access-Control-Allow-Origin"); got != "*" {
|
|
t.Fatalf("Access-Control-Allow-Origin = %q, want *", got)
|
|
}
|
|
}
|