65 lines
2.4 KiB
Go
65 lines
2.4 KiB
Go
package api
|
|
|
|
import (
|
|
"fmt"
|
|
"linkport/internal/model"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"net/url"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestKubernetesPreflightEndpointRedactsSecretsAndReportsChecks(t *testing.T) {
|
|
server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
if r.Method != http.MethodPost || r.URL.Path != "/apis/authorization.k8s.io/v1/selfsubjectaccessreviews" || r.Header.Get("Authorization") != "Bearer preflight-private-token" {
|
|
t.Fatalf("unexpected preflight request: %s %s", r.Method, r.URL)
|
|
}
|
|
w.Header().Set("Content-Type", "application/json")
|
|
fmt.Fprint(w, `{"apiVersion":"authorization.k8s.io/v1","kind":"SelfSubjectAccessReview","status":{"allowed":true}}`)
|
|
}))
|
|
defer server.Close()
|
|
|
|
f := newFixture(t)
|
|
f.login()
|
|
content := fmt.Sprintf(`apiVersion: v1
|
|
kind: Config
|
|
current-context: test
|
|
clusters:
|
|
- name: cluster
|
|
cluster:
|
|
server: %s
|
|
insecure-skip-tls-verify: true
|
|
contexts:
|
|
- name: test
|
|
context:
|
|
cluster: cluster
|
|
user: user
|
|
namespace: application
|
|
users:
|
|
- name: user
|
|
user:
|
|
token: preflight-private-token
|
|
`, server.URL)
|
|
if err := f.store.SaveAsset(model.Asset{ID: "preflight-kube", Name: "preflight", Type: "kubeconfig", Content: content}); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
path := "/api/v1/assets/preflight-kube/kubernetes-preflight?" + url.Values{
|
|
"context": {"test"}, "namespace": {"application"}, "resource": {"deployment/backend"}, "port": {"8080"},
|
|
}.Encode()
|
|
response := f.request("GET", path, nil, true)
|
|
requireStatus(t, response, 200)
|
|
if !strings.Contains(response.Body.String(), `"status":"ready"`) || !strings.Contains(response.Body.String(), `"subresource":"portforward"`) || strings.Contains(response.Body.String(), "preflight-private-token") {
|
|
t.Fatalf("unexpected or unsafe preflight response: %s", response.Body.String())
|
|
}
|
|
invalidPort := f.request("GET", "/api/v1/assets/preflight-kube/kubernetes-preflight?resource=pod%2Fbackend&port=invalid", nil, true)
|
|
requireStatus(t, invalidPort, 422)
|
|
if !strings.Contains(invalidPort.Body.String(), `"code":"invalid_port"`) {
|
|
t.Fatalf("invalid port lost stable code: %s", invalidPort.Body.String())
|
|
}
|
|
if err := f.store.SaveAsset(model.Asset{ID: "preflight-file", Name: "plain", Type: "file", Content: "not a kubeconfig"}); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
requireStatus(t, f.request("GET", "/api/v1/assets/preflight-file/kubernetes-preflight?resource=pod%2Fbackend&port=8080", nil, true), 400)
|
|
}
|