OrchestrAD/backend/internal/api/csrf_test.go

package api

import (
	"net/http"
	"net/http/httptest"
	"testing"
)

func TestCSRFTokenIssueAndValidate(t *testing.T) {
	c := NewCSRF([]byte("a-test-secret"))
	token, err := c.IssueToken()
	if err != nil {
		t.Fatalf("IssueToken: %v", err)
	}
	if !c.ValidToken(token) {
		t.Error("a freshly issued token should validate")
	}

	// Tokens are unguessable and signed: tampering, forging, and tokens from a
	// different secret must all fail.
	for name, bad := range map[string]string{
		"empty":        "",
		"no signature": "justanonce",
		"bad sig":      "nonce.not-a-real-signature",
		"tampered":     "x" + token,
	} {
		if c.ValidToken(bad) {
			t.Errorf("%s token should not validate", name)
		}
	}
	if NewCSRF([]byte("a-different-secret")).ValidToken(token) {
		t.Error("a token must not validate under a different secret")
	}
}

// TestCSRFMiddleware pins who is challenged and who is not: cookie-authenticated
// mutations need a valid token; bearer/API-key requests and safe methods do not.
func TestCSRFMiddleware(t *testing.T) {
	c := NewCSRF([]byte("a-test-secret"))
	token, _ := c.IssueToken()
	reached := false
	h := c.Middleware(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		reached = true
	}))

	call := func(method string, setup func(*http.Request)) int {
		reached = false
		req := httptest.NewRequest(method, "/api/v1/rules", nil)
		if setup != nil {
			setup(req)
		}
		rec := httptest.NewRecorder()
		h.ServeHTTP(rec, req)
		return rec.Code
	}

	withCookie := func(r *http.Request) {
		r.AddCookie(&http.Cookie{Name: DocsCookieName, Value: "sometoken"})
	}

	// Safe methods are never challenged.
	if code := call(http.MethodGet, withCookie); code != http.StatusOK || !reached {
		t.Errorf("GET with cookie: code=%d reached=%v, want pass-through", code, reached)
	}

	// Cookie-authenticated mutation without a token is rejected.
	if code := call(http.MethodPost, withCookie); code != http.StatusForbidden || reached {
		t.Errorf("POST with cookie and no CSRF token: code=%d reached=%v, want 403", code, reached)
	}

	// ... and accepted with a valid one.
	if code := call(http.MethodPost, func(r *http.Request) {
		withCookie(r)
		r.Header.Set("X-CSRF-Token", token)
	}); code != http.StatusOK || !reached {
		t.Errorf("POST with a valid CSRF token: code=%d reached=%v, want pass-through", code, reached)
	}

	// An invalid token is rejected even though the header is present — this is
	// exactly what the previous placeholder implementation let through.
	if code := call(http.MethodPost, func(r *http.Request) {
		withCookie(r)
		r.Header.Set("X-CSRF-Token", "anything-at-all")
	}); code != http.StatusForbidden || reached {
		t.Errorf("POST with a bogus CSRF token: code=%d reached=%v, want 403", code, reached)
	}

	// Explicit credentials are not CSRF-reachable, so they pass untouched.
	if code := call(http.MethodPost, func(r *http.Request) {
		r.Header.Set("Authorization", "Bearer sometoken")
	}); code != http.StatusOK || !reached {
		t.Errorf("bearer POST: code=%d reached=%v, want pass-through", code, reached)
	}
	if code := call(http.MethodPost, func(r *http.Request) {
		r.Header.Set("X-API-Key", "somekey")
	}); code != http.StatusOK || !reached {
		t.Errorf("api-key POST: code=%d reached=%v, want pass-through", code, reached)
	}

	// No ambient credential at all: let it through so auth returns 401.
	if code := call(http.MethodPost, nil); code != http.StatusOK || !reached {
		t.Errorf("anonymous POST: code=%d reached=%v, want pass-through to auth", code, reached)
	}
}