lukaszraczylo/traefikoidc
1
0
Fork 0
mirror of https://github.com/lukaszraczylo/traefikoidc.git synced 2026-10-15 04:18:03 +00:00
Code Issues Packages Projects Releases Wiki Activity

Enhance test coverage.

Browse Source
This commit is contained in:
lukaszraczylo
2025-09-17 10:31:41 +01:00
parent ff2562f9fe
commit 397efdae0f
12 changed files with 7521 additions and 1323 deletions
Download Patch File Download Diff File Expand all files Collapse all files
config/config_consolidated_test.go
-557
View File
@@ -1,557 +0,0 @@
package config
import (
"testing"
"text/template"
"time"
)
// ============================================================================
// Config Creation Tests
// ============================================================================
func TestConfigCreation(t *testing.T) {
t.Run("CreateConfig_DefaultValues", func(t *testing.T) {
config := CreateConfig()
// Check default scopes
expectedScopes := []string{"openid", "profile", "email"}
if len(config.Scopes) != len(expectedScopes) {
t.Errorf("Expected %d default scopes, got %d", len(expectedScopes), len(config.Scopes))
}
for i, scope := range expectedScopes {
if config.Scopes[i] != scope {
t.Errorf("Expected scope %s at position %d, got %s", scope, i, config.Scopes[i])
}
}
// Check default log level
if config.LogLevel != "INFO" {
t.Errorf("Expected default log level '%s', got '%s'", "INFO", config.LogLevel)
}
// Check default rate limit
if config.RateLimit != 10 {
t.Errorf("Expected default rate limit %d, got %d", 10, config.RateLimit)
}
// Check ForceHTTPS default
if !config.ForceHTTPS {
t.Error("Expected ForceHTTPS to be true by default")
}
// Check OverrideScopes default
if config.OverrideScopes {
t.Error("Expected OverrideScopes to be false by default")
}
})
t.Run("CreateConfig_EmptyHeaders", func(t *testing.T) {
config := CreateConfig()
if config.Headers == nil {
t.Error("Expected Headers to be initialized, got nil")
}
if len(config.Headers) != 0 {
t.Errorf("Expected empty Headers slice, got %d headers", len(config.Headers))
}
})
}
// ============================================================================
// Config Validation Tests - SKIPPED (no Validate method in real Config)
// ============================================================================
/*
func TestConfigValidation(t *testing.T) {
tests := []struct {
name string
config *Config
expectedError string
}{
{
name: "Empty Config",
config: &Config{},
expectedError: "providerURL is required",
},
{
name: "Missing CallbackURL",
config: &Config{
ProviderURL: "https://provider.com",
},
expectedError: "callbackURL is required",
},
{
name: "Missing ClientID",
config: &Config{
ProviderURL: "https://provider.com",
CallbackURL: "/callback",
},
expectedError: "clientID is required",
},
{
name: "Missing ClientSecret",
config: &Config{
ProviderURL: "https://provider.com",
CallbackURL: "/callback",
ClientID: "client-id",
},
expectedError: "clientSecret is required",
},
{
name: "Missing SessionEncryptionKey",
config: &Config{
ProviderURL: "https://provider.com",
CallbackURL: "/callback",
ClientID: "client-id",
ClientSecret: "client-secret",
},
expectedError: "sessionEncryptionKey is required",
},
{
name: "Short SessionEncryptionKey",
config: &Config{
ProviderURL: "https://provider.com",
CallbackURL: "/callback",
ClientID: "client-id",
ClientSecret: "client-secret",
SessionEncryptionKey: "short",
},
expectedError: "sessionEncryptionKey must be at least 32 characters",
},
{
name: "Invalid LogLevel",
config: &Config{
ProviderURL: "https://provider.com",
CallbackURL: "/callback",
ClientID: "client-id",
ClientSecret: "client-secret",
SessionEncryptionKey: "this-is-a-long-enough-encryption-key",
LogLevel: "invalid",
},
expectedError: "invalid log level: invalid (must be one of: debug, info, warn, error)",
},
{
name: "Invalid RateLimit",
config: &Config{
ProviderURL: "https://provider.com",
CallbackURL: "/callback",
ClientID: "client-id",
ClientSecret: "client-secret",
SessionEncryptionKey: "this-is-a-long-enough-encryption-key",
RateLimit: 0,
},
expectedError: "rateLimit must be greater than 0",
},
{
name: "Valid Config",
config: &Config{
ProviderURL: "https://provider.com",
CallbackURL: "/callback",
ClientID: "client-id",
ClientSecret: "client-secret",
SessionEncryptionKey: "this-is-a-long-enough-encryption-key",
RateLimit: 10,
},
expectedError: "",
},
}
for _, tc := range tests {
t.Run(tc.name, func(t *testing.T) {
err := tc.config.Validate()
if tc.expectedError == "" {
if err != nil {
t.Errorf("Expected no error, got: %v", err)
}
} else {
if err == nil {
t.Errorf("Expected error: %s, got nil", tc.expectedError)
} else if err.Error() != tc.expectedError {
t.Errorf("Expected error: %s, got: %s", tc.expectedError, err.Error())
}
}
})
}
}
*/
// ============================================================================
// Templated Header Config Tests
// ============================================================================
/*
func TestHeaderConfigValidation(t *testing.T) {
tests := []struct {
name string
header HeaderConfig
expectedError string
}{
{
name: "Empty Name",
header: HeaderConfig{Name: "", Value: "{{.Claims.email}}"},
expectedError: "header name cannot be empty",
},
{
name: "Empty Value",
header: HeaderConfig{Name: "X-Email", Value: ""},
expectedError: "header value template cannot be empty",
},
{
name: "Not a Template",
header: HeaderConfig{Name: "X-Email", Value: "static-value"},
expectedError: "header value 'static-value' does not appear to be a valid template (missing {{ }})",
},
{
name: "Lowercase claims",
header: HeaderConfig{Name: "X-Email", Value: "{{.claims.email}}"},
expectedError: "header template '{{.claims.email}}' appears to use lowercase 'claims' - use '{{.Claims...' instead (case sensitive)",
},
{
name: "Lowercase accessToken",
header: HeaderConfig{Name: "X-Token", Value: "Bearer {{.accessToken}}"},
expectedError: "header template 'Bearer {{.accessToken}}' appears to use lowercase 'accessToken' - use '{{.AccessToken...' instead (case sensitive)",
},
{
name: "Lowercase idToken",
header: HeaderConfig{Name: "X-Token", Value: "Bearer {{.idToken}}"},
expectedError: "header template 'Bearer {{.idToken}}' appears to use lowercase 'idToken' - use '{{.IdToken...' instead (case sensitive)",
},
{
name: "Lowercase refreshToken",
header: HeaderConfig{Name: "X-Refresh", Value: "Bearer {{.refreshToken}}"},
expectedError: "header template 'Bearer {{.refreshToken}}' appears to use lowercase 'refreshToken' - use '{{.RefreshToken...' instead (case sensitive)",
},
{
name: "Valid Template",
header: HeaderConfig{Name: "X-Email", Value: "{{.Claims.email}}"},
expectedError: "",
},
{
name: "Valid Bearer Token Template",
header: HeaderConfig{Name: "Authorization", Value: "Bearer {{.AccessToken}}"},
expectedError: "",
},
{
name: "Complex Valid Template",
header: HeaderConfig{Name: "X-User-Info", Value: "{{.Claims.sub}}-{{.Claims.email}}"},
expectedError: "",
},
}
for _, tc := range tests {
t.Run(tc.name, func(t *testing.T) {
config := &Config{
ProviderURL: "https://provider.com",
CallbackURL: "/callback",
ClientID: "client-id",
ClientSecret: "client-secret",
SessionEncryptionKey: "this-is-a-long-enough-encryption-key",
RateLimit: 10,
Headers: []HeaderConfig{tc.header},
}
err := config.Validate()
if tc.expectedError == "" {
if err != nil {
t.Errorf("Expected no error, got: %v", err)
}
} else {
if err == nil {
t.Errorf("Expected error: %s, got nil", tc.expectedError)
} else if err.Error() != tc.expectedError {
t.Errorf("Expected error: %s, got: %s", tc.expectedError, err.Error())
}
}
})
}
}
*/
func TestTemplateParsingInConfig(t *testing.T) {
tests := []struct {
name string
headers []HeaderConfig
expectedTemplates int
expectError bool
}{
{
name: "Single Valid Template",
headers: []HeaderConfig{
{Name: "X-Email", Value: "{{.Claims.email}}"},
},
expectedTemplates: 1,
expectError: false,
},
{
name: "Multiple Valid Templates",
headers: []HeaderConfig{
{Name: "X-Email", Value: "{{.Claims.email}}"},
{Name: "X-Subject", Value: "{{.Claims.sub}}"},
{Name: "Authorization", Value: "Bearer {{.AccessToken}}"},
},
expectedTemplates: 3,
expectError: false,
},
{
name: "Template with Conditional",
headers: []HeaderConfig{
{Name: "X-User", Value: "{{if .Claims.preferred_username}}{{.Claims.preferred_username}}{{else}}{{.Claims.sub}}{{end}}"},
},
expectedTemplates: 1,
expectError: false,
},
{
name: "Template with Range",
headers: []HeaderConfig{
{Name: "X-Groups", Value: "{{range .Claims.groups}}{{.}},{{end}}"},
},
expectedTemplates: 1,
expectError: false,
},
}
for _, tc := range tests {
t.Run(tc.name, func(t *testing.T) {
parsedTemplates := make(map[string]*template.Template)
for _, header := range tc.headers {
tmpl, err := template.New(header.Name).Parse(header.Value)
if err != nil {
if !tc.expectError {
t.Errorf("Failed to parse template for header %s: %v", header.Name, err)
}
continue
}
parsedTemplates[header.Name] = tmpl
}
if !tc.expectError && len(parsedTemplates) != tc.expectedTemplates {
t.Errorf("Expected %d parsed templates, got %d", tc.expectedTemplates, len(parsedTemplates))
}
})
}
}
// ============================================================================
// Auth Config Tests
// ============================================================================
func TestAuthConfig(t *testing.T) {
// AuthURL field removed from Config - test skipped
t.Run("Scopes Configuration", func(t *testing.T) {
tests := []struct {
name string
config *Config
expectedScopes []string
}{
{
name: "Default scopes",
config: &Config{
Scopes: []string{"openid", "profile", "email"},
},
expectedScopes: []string{"openid", "profile", "email"},
},
{
name: "Custom scopes",
config: &Config{
Scopes: []string{"openid", "custom_scope"},
},
expectedScopes: []string{"openid", "custom_scope"},
},
{
name: "Empty scopes",
config: &Config{
Scopes: []string{},
},
expectedScopes: []string{},
},
}
for _, tc := range tests {
t.Run(tc.name, func(t *testing.T) {
if !equalSlices(tc.config.Scopes, tc.expectedScopes) {
t.Errorf("Expected scopes %v, got %v", tc.expectedScopes, tc.config.Scopes)
}
})
}
})
t.Run("Excluded URLs Configuration", func(t *testing.T) {
tests := []struct {
name string
config *Config
expectedExclude []string
}{
{
name: "No excluded URLs",
config: &Config{},
expectedExclude: nil,
},
{
name: "With excluded URLs",
config: &Config{
ExcludedURLs: []string{"/health", "/metrics", "/api/public"},
},
expectedExclude: []string{"/health", "/metrics", "/api/public"},
},
}
for _, tc := range tests {
t.Run(tc.name, func(t *testing.T) {
if tc.expectedExclude == nil {
if tc.config.ExcludedURLs != nil {
t.Errorf("Expected nil ExcludedURLs, got %v", tc.config.ExcludedURLs)
}
} else if !equalSlices(tc.config.ExcludedURLs, tc.expectedExclude) {
t.Errorf("Expected ExcludedURLs %v, got %v", tc.expectedExclude, tc.config.ExcludedURLs)
}
})
}
})
}
// ============================================================================
// Config Parser Tests
// ============================================================================
func TestConfigParser(t *testing.T) {
t.Run("ParseProviderURL", func(t *testing.T) {
tests := []struct {
name string
input string
expected string
expectError bool
}{
{
name: "Valid HTTPS URL",
input: "https://provider.com/.well-known/openid-configuration",
expected: "https://provider.com/.well-known/openid-configuration",
expectError: false,
},
{
name: "Valid HTTP URL",
input: "http://localhost:8080/.well-known/openid-configuration",
expected: "http://localhost:8080/.well-known/openid-configuration",
expectError: false,
},
{
name: "URL with trailing slash",
input: "https://provider.com/",
expected: "https://provider.com/",
expectError: false,
},
{
name: "Invalid URL",
input: "not-a-url",
expected: "",
expectError: true,
},
{
name: "Empty URL",
input: "",
expected: "",
expectError: true,
},
}
for _, tc := range tests {
t.Run(tc.name, func(t *testing.T) {
config := &Config{ProviderURL: tc.input}
// Since we're testing parsing, we'd validate the URL format
if tc.input == "" {
if !tc.expectError {
t.Error("Expected error for empty URL")
}
} else if tc.input == "not-a-url" {
// In real parsing, this would be caught
if !tc.expectError {
t.Error("Expected error for invalid URL")
}
} else {
if config.ProviderURL != tc.expected {
t.Errorf("Expected URL %s, got %s", tc.expected, config.ProviderURL)
}
}
})
}
})
t.Run("ParseTimeouts", func(t *testing.T) {
tests := []struct {
name string
refreshInterval string
gracePeriod string
expectedRefresh time.Duration
expectedGrace time.Duration
}{
{
name: "Default values",
refreshInterval: "",
gracePeriod: "",
expectedRefresh: 0,
expectedGrace: 0,
},
{
name: "Custom refresh interval",
refreshInterval: "5m",
gracePeriod: "",
expectedRefresh: 5 * time.Minute,
expectedGrace: 0,
},
{
name: "Custom grace period",
refreshInterval: "",
gracePeriod: "30s",
expectedRefresh: 0,
expectedGrace: 30 * time.Second,
},
{
name: "Both custom",
refreshInterval: "10m",
gracePeriod: "1m",
expectedRefresh: 10 * time.Minute,
expectedGrace: 1 * time.Minute,
},
}
for _, tc := range tests {
t.Run(tc.name, func(t *testing.T) {
// This would be part of config parsing
// Here we're just testing the concept
var refreshDuration, graceDuration time.Duration
if tc.refreshInterval != "" {
d, _ := time.ParseDuration(tc.refreshInterval)
refreshDuration = d
}
if tc.gracePeriod != "" {
d, _ := time.ParseDuration(tc.gracePeriod)
graceDuration = d
}
if refreshDuration != tc.expectedRefresh {
t.Errorf("Expected refresh %v, got %v", tc.expectedRefresh, refreshDuration)
}
if graceDuration != tc.expectedGrace {
t.Errorf("Expected grace %v, got %v", tc.expectedGrace, graceDuration)
}
})
}
})
}
// ============================================================================
// Helper Functions
// ============================================================================
func equalSlices(a, b []string) bool {
if len(a) != len(b) {
return false
}
for i, v := range a {
if v != b[i] {
return false
}
}
return true
}
config/config_test.go
+1137
View File
File diff suppressed because it is too large Load Diff
handlers/handler_consolidated_test.go → handlers/handlers_test.go
View File
internal/cache/cache_test.go
Vendored
+1799
View File
File diff suppressed because it is too large Load Diff
internal/logger/factory.go
+1 -1
View File
@@ -67,7 +67,7 @@ func (f *Factory) GetLogger(name string) Logger {
// createLogger creates a new logger instance // createLogger creates a new logger instance
func (f *Factory) createLogger(name string) Logger { func (f *Factory) createLogger(name string) Logger {
if name == "noop" || name == "no-op" || name == "discard" { if name == "noop" || name == "no-op" || name == "discard" {
return f.GetNoOpLogger() return GetNoOpLogger()
} }
// Create logger with appropriate outputs based on environment // Create logger with appropriate outputs based on environment
internal/logger/logger_test.go
+1613
View File
File diff suppressed because it is too large Load Diff
internal/pool/pool_test.go
+586
View File
@@ -0,0 +1,586 @@
package pool
import (
"bytes"
"strings"
"sync"
"testing"
)
// TestManager_Singleton tests that Get() returns the same instance
func TestManager_Singleton(t *testing.T) {
manager1 := Get()
manager2 := Get()
if manager1 != manager2 {
t.Error("Get() should return the same instance (singleton)")
}
if manager1 == nil {
t.Error("Get() should not return nil")
}
}
// TestManager_BufferPools tests buffer pool operations
func TestManager_BufferPools(t *testing.T) {
manager := Get()
tests := []struct {
name string
sizeHint int
expected int // expected capacity range
}{
{"small buffer", 512, 1024},
{"medium buffer", 2048, 4096},
{"large buffer", 6144, 8192},
{"xl buffer", 12288, 16384},
{"oversized buffer", 32768, 32768}, // Should create new buffer
}
for _, test := range tests {
t.Run(test.name, func(t *testing.T) {
buf := manager.GetBuffer(test.sizeHint)
if buf == nil {
t.Error("GetBuffer should not return nil")
}
if buf.Cap() < test.sizeHint {
t.Errorf("Buffer capacity %d is less than size hint %d", buf.Cap(), test.sizeHint)
}
// Write some data
buf.WriteString("test data")
if buf.String() != "test data" {
t.Error("Buffer should contain written data")
}
// Return to pool
manager.PutBuffer(buf)
// Buffer should be reset when returned to pool
buf2 := manager.GetBuffer(test.sizeHint)
if buf2.Len() != 0 {
t.Error("Buffer from pool should be reset")
}
})
}
}
// TestManager_PutBuffer_Nil tests putting nil buffer
func TestManager_PutBuffer_Nil(t *testing.T) {
manager := Get()
// Should not panic
manager.PutBuffer(nil)
}
// TestManager_PutBuffer_Oversized tests rejection of oversized buffers
func TestManager_PutBuffer_Oversized(t *testing.T) {
manager := Get()
manager.ResetStats()
// Create oversized buffer
buf := bytes.NewBuffer(make([]byte, 0, 40000))
manager.PutBuffer(buf)
stats := manager.GetStats()
if stats.OversizedRejects == 0 {
t.Error("Oversized buffer should be rejected")
}
}
// TestManager_GzipPools tests gzip writer and reader pools
func TestManager_GzipPools(t *testing.T) {
manager := Get()
// Test gzip writer
writer := manager.GetGzipWriter()
if writer == nil {
t.Error("GetGzipWriter should not return nil")
}
// Test that we can use it
var buf bytes.Buffer
writer.Reset(&buf)
writer.Write([]byte("test data"))
writer.Close()
if buf.Len() == 0 {
t.Error("Gzip writer should have written compressed data")
}
// Return to pool
manager.PutGzipWriter(writer)
// Test gzip reader
reader := manager.GetGzipReader()
// Reader might be nil from pool initially
if reader != nil {
manager.PutGzipReader(reader)
}
}
// TestManager_GzipPools_Nil tests putting nil gzip objects
func TestManager_GzipPools_Nil(t *testing.T) {
manager := Get()
// Should not panic
manager.PutGzipWriter(nil)
manager.PutGzipReader(nil)
}
// TestManager_StringBuilderPool tests string builder pool
func TestManager_StringBuilderPool(t *testing.T) {
manager := Get()
sb := manager.GetStringBuilder()
if sb == nil {
t.Error("GetStringBuilder should not return nil")
}
// Should be reset
if sb.Len() != 0 {
t.Error("String builder from pool should be reset")
}
// Test writing
sb.WriteString("test")
sb.WriteString(" data")
if sb.String() != "test data" {
t.Error("String builder should contain written data")
}
// Return to pool
manager.PutStringBuilder(sb)
// Get another one - should be reset
sb2 := manager.GetStringBuilder()
if sb2.Len() != 0 {
t.Error("String builder from pool should be reset")
}
}
// TestManager_StringBuilderPool_Nil tests putting nil string builder
func TestManager_StringBuilderPool_Nil(t *testing.T) {
manager := Get()
// Should not panic
manager.PutStringBuilder(nil)
}
// TestManager_StringBuilderPool_Oversized tests rejection of oversized string builders
func TestManager_StringBuilderPool_Oversized(t *testing.T) {
manager := Get()
manager.ResetStats()
// Create oversized string builder
sb := &strings.Builder{}
sb.Grow(20000)
sb.WriteString("test")
manager.PutStringBuilder(sb)
stats := manager.GetStats()
if stats.OversizedRejects == 0 {
t.Error("Oversized string builder should be rejected")
}
}
// TestManager_JWTBufferPool tests JWT buffer pool
func TestManager_JWTBufferPool(t *testing.T) {
manager := Get()
jwtBuf := manager.GetJWTBuffer()
if jwtBuf == nil {
t.Error("GetJWTBuffer should not return nil")
return
}
// Check structure
if jwtBuf.Header == nil || jwtBuf.Payload == nil || jwtBuf.Signature == nil {
t.Error("JWT buffer should have all fields initialized")
}
// Should be empty initially
if len(jwtBuf.Header) != 0 || len(jwtBuf.Payload) != 0 || len(jwtBuf.Signature) != 0 {
t.Error("JWT buffer from pool should be reset")
}
// Use the buffer
jwtBuf.Header = append(jwtBuf.Header, []byte("header")...)
jwtBuf.Payload = append(jwtBuf.Payload, []byte("payload")...)
jwtBuf.Signature = append(jwtBuf.Signature, []byte("signature")...)
// Return to pool
manager.PutJWTBuffer(jwtBuf)
// Get another one - should be reset
jwtBuf2 := manager.GetJWTBuffer()
if len(jwtBuf2.Header) != 0 || len(jwtBuf2.Payload) != 0 || len(jwtBuf2.Signature) != 0 {
t.Error("JWT buffer from pool should be reset")
}
}
// TestManager_JWTBufferPool_Nil tests putting nil JWT buffer
func TestManager_JWTBufferPool_Nil(t *testing.T) {
manager := Get()
// Should not panic
manager.PutJWTBuffer(nil)
}
// TestManager_JWTBufferPool_Oversized tests rejection of oversized JWT buffers
func TestManager_JWTBufferPool_Oversized(t *testing.T) {
manager := Get()
manager.ResetStats()
// Create oversized JWT buffer
jwtBuf := &JWTBuffer{
Header: make([]byte, 0, 3000), // Over 2048 limit
Payload: make([]byte, 0, 10000), // Over 8192 limit
Signature: make([]byte, 0, 3000), // Over 2048 limit
}
manager.PutJWTBuffer(jwtBuf)
stats := manager.GetStats()
if stats.OversizedRejects == 0 {
t.Error("Oversized JWT buffer should be rejected")
}
}
// TestManager_HTTPResponsePool tests HTTP response buffer pool
func TestManager_HTTPResponsePool(t *testing.T) {
manager := Get()
buf := manager.GetHTTPResponseBuffer()
if buf == nil {
t.Error("GetHTTPResponseBuffer should not return nil")
}
// Should be empty initially
if len(buf) != 0 {
t.Error("HTTP buffer from pool should be empty")
}
// Use the buffer
buf = append(buf, []byte("HTTP response data")...)
// Return to pool
manager.PutHTTPResponseBuffer(buf)
// Get another one - should be reset
buf2 := manager.GetHTTPResponseBuffer()
if len(buf2) != 0 {
t.Error("HTTP buffer from pool should be reset")
}
}
// TestManager_HTTPResponsePool_Nil tests putting nil HTTP buffer
func TestManager_HTTPResponsePool_Nil(t *testing.T) {
manager := Get()
// Should not panic
manager.PutHTTPResponseBuffer(nil)
}
// TestManager_HTTPResponsePool_Oversized tests rejection of oversized HTTP buffers
func TestManager_HTTPResponsePool_Oversized(t *testing.T) {
manager := Get()
manager.ResetStats()
// Create oversized buffer
buf := make([]byte, 0, 40000)
manager.PutHTTPResponseBuffer(buf)
stats := manager.GetStats()
if stats.OversizedRejects == 0 {
t.Error("Oversized HTTP buffer should be rejected")
}
}
// TestManager_ByteSlicePool tests byte slice pool with dynamic sizing
func TestManager_ByteSlicePool(t *testing.T) {
manager := Get()
tests := []int{256, 512, 1024, 2048, 4096, 8192, 16384}
for _, size := range tests {
t.Run(strings.Join([]string{"size", string(rune(size))}, "_"), func(t *testing.T) {
slice := manager.GetByteSlice(size)
if slice == nil {
t.Error("GetByteSlice should not return nil")
}
if len(slice) != size {
t.Errorf("Byte slice length %d != requested size %d", len(slice), size)
}
if cap(slice) < size {
t.Errorf("Byte slice capacity %d < requested size %d", cap(slice), size)
}
// Use the slice
copy(slice, []byte("test data"))
// Return to pool
manager.PutByteSlice(slice)
})
}
}
// TestManager_ByteSlicePool_CustomSize tests byte slice pool with non-standard sizes
func TestManager_ByteSlicePool_CustomSize(t *testing.T) {
manager := Get()
// Test custom size (should round up to power of 2)
slice := manager.GetByteSlice(300)
if slice == nil {
t.Error("GetByteSlice should not return nil")
}
if len(slice) != 300 {
t.Errorf("Byte slice length %d != requested size 300", len(slice))
}
// Capacity should be >= 300 (likely 512 as next power of 2)
if cap(slice) < 300 {
t.Error("Byte slice capacity should be at least 300")
}
manager.PutByteSlice(slice)
}
// TestManager_ByteSlicePool_Nil tests putting nil byte slice
func TestManager_ByteSlicePool_Nil(t *testing.T) {
manager := Get()
// Should not panic
manager.PutByteSlice(nil)
}
// TestManager_ByteSlicePool_Oversized tests rejection of oversized byte slices
func TestManager_ByteSlicePool_Oversized(t *testing.T) {
manager := Get()
// Create oversized slice
slice := make([]byte, 100000)
// Should not panic and should not be pooled
manager.PutByteSlice(slice)
}
// TestManager_Stats tests statistics tracking
func TestManager_Stats(t *testing.T) {
manager := Get()
manager.ResetStats()
initialStats := manager.GetStats()
if initialStats.BufferGets != 0 || initialStats.BufferPuts != 0 {
t.Error("Stats should be zero after reset")
}
// Perform operations
buf := manager.GetBuffer(1024)
manager.PutBuffer(buf)
writer := manager.GetGzipWriter()
manager.PutGzipWriter(writer)
sb := manager.GetStringBuilder()
manager.PutStringBuilder(sb)
jwtBuf := manager.GetJWTBuffer()
manager.PutJWTBuffer(jwtBuf)
httpBuf := manager.GetHTTPResponseBuffer()
manager.PutHTTPResponseBuffer(httpBuf)
// Check stats
stats := manager.GetStats()
if stats.BufferGets == 0 || stats.BufferPuts == 0 {
t.Error("Buffer stats should be incremented")
}
if stats.GzipGets == 0 || stats.GzipPuts == 0 {
t.Error("Gzip stats should be incremented")
}
if stats.StringGets == 0 || stats.StringPuts == 0 {
t.Error("String stats should be incremented")
}
if stats.JWTGets == 0 || stats.JWTPuts == 0 {
t.Error("JWT stats should be incremented")
}
if stats.HTTPGets == 0 || stats.HTTPPuts == 0 {
t.Error("HTTP stats should be incremented")
}
}
// TestManager_ResetStats tests statistics reset
func TestManager_ResetStats(t *testing.T) {
manager := Get()
// Perform some operations
buf := manager.GetBuffer(1024)
manager.PutBuffer(buf)
// Check that stats are non-zero
stats := manager.GetStats()
if stats.BufferGets == 0 {
t.Error("Stats should be non-zero before reset")
}
// Reset stats
manager.ResetStats()
// Check that stats are zero
resetStats := manager.GetStats()
if resetStats.BufferGets != 0 || resetStats.BufferPuts != 0 {
t.Error("Stats should be zero after reset")
}
}
// TestManager_ConcurrentAccess tests concurrent access to pools
func TestManager_ConcurrentAccess(t *testing.T) {
manager := Get()
manager.ResetStats()
var wg sync.WaitGroup
numGoroutines := 50
operationsPerGoroutine := 10
wg.Add(numGoroutines)
for i := 0; i < numGoroutines; i++ {
go func() {
defer wg.Done()
for j := 0; j < operationsPerGoroutine; j++ {
// Test buffer pool
buf := manager.GetBuffer(1024)
buf.WriteString("test")
manager.PutBuffer(buf)
// Test string builder pool
sb := manager.GetStringBuilder()
sb.WriteString("test")
manager.PutStringBuilder(sb)
// Test JWT buffer pool
jwtBuf := manager.GetJWTBuffer()
jwtBuf.Header = append(jwtBuf.Header, byte(j))
manager.PutJWTBuffer(jwtBuf)
// Test byte slice pool
slice := manager.GetByteSlice(256)
slice[0] = byte(j)
manager.PutByteSlice(slice)
}
}()
}
wg.Wait()
// Check that operations completed without panic
stats := manager.GetStats()
expectedOps := uint64(numGoroutines * operationsPerGoroutine)
if stats.BufferGets < expectedOps || stats.StringGets < expectedOps || stats.JWTGets < expectedOps {
t.Error("Some operations may have failed during concurrent access")
}
}
// TestGlobalConvenienceFunctions tests the global convenience functions
func TestGlobalConvenienceFunctions(t *testing.T) {
// Test buffer functions
buf := Buffer(1024)
if buf == nil {
t.Error("Buffer() should not return nil")
}
buf.WriteString("test")
ReturnBuffer(buf)
// Test gzip functions
writer := GzipWriter()
if writer == nil {
t.Error("GzipWriter() should not return nil")
}
ReturnGzipWriter(writer)
// Test string builder functions
sb := StringBuilder()
if sb == nil {
t.Error("StringBuilder() should not return nil")
}
sb.WriteString("test")
ReturnStringBuilder(sb)
// Test JWT buffer functions
jwtBuf := JWTBuffers()
if jwtBuf == nil {
t.Error("JWTBuffers() should not return nil")
}
ReturnJWTBuffers(jwtBuf)
// Test HTTP buffer functions
httpBuf := HTTPBuffer()
if httpBuf == nil {
t.Error("HTTPBuffer() should not return nil")
}
ReturnHTTPBuffer(httpBuf)
// Test byte slice functions
slice := ByteSlice(256)
if slice == nil {
t.Error("ByteSlice() should not return nil")
}
if len(slice) != 256 {
t.Error("ByteSlice() should return correct size")
}
ReturnByteSlice(slice)
}
// Benchmark tests for performance verification
func BenchmarkManager_GetBuffer(b *testing.B) {
manager := Get()
b.ResetTimer()
for i := 0; i < b.N; i++ {
buf := manager.GetBuffer(1024)
manager.PutBuffer(buf)
}
}
func BenchmarkManager_GetStringBuilder(b *testing.B) {
manager := Get()
b.ResetTimer()
for i := 0; i < b.N; i++ {
sb := manager.GetStringBuilder()
manager.PutStringBuilder(sb)
}
}
func BenchmarkManager_GetJWTBuffer(b *testing.B) {
manager := Get()
b.ResetTimer()
for i := 0; i < b.N; i++ {
jwtBuf := manager.GetJWTBuffer()
manager.PutJWTBuffer(jwtBuf)
}
}
func BenchmarkManager_GetByteSlice(b *testing.B) {
manager := Get()
b.ResetTimer()
for i := 0; i < b.N; i++ {
slice := manager.GetByteSlice(1024)
manager.PutByteSlice(slice)
}
}
func BenchmarkManager_ConcurrentAccess(b *testing.B) {
manager := Get()
b.ResetTimer()
b.RunParallel(func(pb *testing.PB) {
for pb.Next() {
buf := manager.GetBuffer(1024)
buf.WriteString("test")
manager.PutBuffer(buf)
}
})
}
internal/pool/transport_test.go
+593
View File
@@ -0,0 +1,593 @@
package pool
import (
"context"
"crypto/tls"
"net/http"
"sync"
"testing"
"time"
)
// TestGetTransportPool_Singleton tests that GetTransportPool returns the same instance
func TestGetTransportPool_Singleton(t *testing.T) {
pool1 := GetTransportPool()
pool2 := GetTransportPool()
if pool1 != pool2 {
t.Error("GetTransportPool() should return the same instance (singleton)")
}
if pool1 == nil {
t.Error("GetTransportPool() should not return nil")
}
}
// TestDefaultTransportConfig tests the default transport configuration
func TestDefaultTransportConfig(t *testing.T) {
config := DefaultTransportConfig()
// Verify security defaults
if config.MinTLSVersion != tls.VersionTLS12 {
t.Errorf("Default MinTLSVersion should be TLS 1.2, got %d", config.MinTLSVersion)
}
if config.InsecureSkipVerify {
t.Error("Default should not skip TLS verification")
}
if !config.ForceHTTP2 {
t.Error("Default should force HTTP/2")
}
// Verify reasonable timeouts
if config.DialTimeout <= 0 {
t.Error("DialTimeout should be positive")
}
if config.TLSHandshakeTimeout <= 0 {
t.Error("TLSHandshakeTimeout should be positive")
}
if config.ResponseHeaderTimeout <= 0 {
t.Error("ResponseHeaderTimeout should be positive")
}
// Verify connection limits
if config.MaxIdleConns <= 0 {
t.Error("MaxIdleConns should be positive")
}
if config.MaxIdleConnsPerHost <= 0 {
t.Error("MaxIdleConnsPerHost should be positive")
}
if config.MaxConnsPerHost <= 0 {
t.Error("MaxConnsPerHost should be positive")
}
}
// TestTransportPool_GetTransport tests transport creation and reuse
func TestTransportPool_GetTransport(t *testing.T) {
pool := &TransportPool{
transports: make(map[string]*sharedTransport),
maxConns: 20,
maxClients: 5,
}
config := DefaultTransportConfig()
// First call should create new transport
transport1 := pool.GetTransport(config)
if transport1 == nil {
t.Error("GetTransport should not return nil")
}
// Second call with same config should return same transport
transport2 := pool.GetTransport(config)
if transport2 == nil {
t.Error("GetTransport should not return nil")
}
if transport1 != transport2 {
t.Error("GetTransport should return same transport for same config")
}
// Verify reference counting
pool.mu.RLock()
key := pool.configKey(config)
shared := pool.transports[key]
refCount := shared.refCount
pool.mu.RUnlock()
if refCount != 2 {
t.Errorf("Reference count should be 2, got %d", refCount)
}
}
// TestTransportPool_GetTransport_DifferentConfigs tests transport creation with different configs
func TestTransportPool_GetTransport_DifferentConfigs(t *testing.T) {
pool := &TransportPool{
transports: make(map[string]*sharedTransport),
maxConns: 20,
maxClients: 5,
}
config1 := DefaultTransportConfig()
config2 := DefaultTransportConfig()
config2.MaxConnsPerHost = 10 // Different from default
transport1 := pool.GetTransport(config1)
transport2 := pool.GetTransport(config2)
if transport1 == transport2 {
t.Error("Different configs should produce different transports")
}
}
// TestTransportPool_GetTransport_ClientLimit tests client limit enforcement
func TestTransportPool_GetTransport_ClientLimit(t *testing.T) {
pool := &TransportPool{
transports: make(map[string]*sharedTransport),
maxConns: 20,
maxClients: 2, // Low limit for testing
clientCount: 2, // Already at limit
}
config := DefaultTransportConfig()
// Should return existing transport when limit reached
transport := pool.GetTransport(config)
// Transport might be nil if no existing transports
if transport != nil && pool.clientCount > pool.maxClients {
t.Error("Should not exceed client limit")
}
}
// TestTransportPool_ReleaseTransport tests transport reference counting
func TestTransportPool_ReleaseTransport(t *testing.T) {
pool := &TransportPool{
transports: make(map[string]*sharedTransport),
maxConns: 20,
maxClients: 5,
}
config := DefaultTransportConfig()
// Get transport
transport := pool.GetTransport(config)
if transport == nil {
t.Error("GetTransport should not return nil")
}
// Release transport
pool.ReleaseTransport(transport)
// Verify reference count decreased
pool.mu.RLock()
key := pool.configKey(config)
shared := pool.transports[key]
refCount := shared.refCount
pool.mu.RUnlock()
if refCount != 0 {
t.Errorf("Reference count should be 0 after release, got %d", refCount)
}
}
// TestTransportPool_ReleaseTransport_Nil tests releasing nil transport
func TestTransportPool_ReleaseTransport_Nil(t *testing.T) {
pool := &TransportPool{
transports: make(map[string]*sharedTransport),
maxConns: 20,
maxClients: 5,
}
// Should not panic
pool.ReleaseTransport(nil)
}
// TestTransportPool_ReleaseTransport_Unknown tests releasing unknown transport
func TestTransportPool_ReleaseTransport_Unknown(t *testing.T) {
pool := &TransportPool{
transports: make(map[string]*sharedTransport),
maxConns: 20,
maxClients: 5,
}
// Create a transport not from the pool
transport := &http.Transport{}
// Should not panic
pool.ReleaseTransport(transport)
}
// TestTransportPool_createTransport tests transport creation with different configs
func TestTransportPool_createTransport(t *testing.T) {
pool := &TransportPool{}
tests := []struct {
name string
config TransportConfig
}{
{
"default config",
DefaultTransportConfig(),
},
{
"custom timeouts",
TransportConfig{
DialTimeout: 10 * time.Second,
TLSHandshakeTimeout: 5 * time.Second,
MinTLSVersion: tls.VersionTLS13,
},
},
{
"insecure config",
TransportConfig{
InsecureSkipVerify: true,
MinTLSVersion: tls.VersionTLS10,
},
},
{
"no HTTP/2",
TransportConfig{
ForceHTTP2: false,
},
},
}
for _, test := range tests {
t.Run(test.name, func(t *testing.T) {
transport := pool.createTransport(test.config)
if transport == nil {
t.Error("createTransport should not return nil")
return
}
// Verify TLS config
if transport.TLSClientConfig == nil {
t.Error("Transport should have TLS config")
return
}
// Verify minimum TLS version
expectedMinVersion := test.config.MinTLSVersion
if expectedMinVersion == 0 {
expectedMinVersion = tls.VersionTLS12 // Default
}
if transport.TLSClientConfig.MinVersion != expectedMinVersion {
t.Errorf("TLS MinVersion should be %d, got %d", expectedMinVersion, transport.TLSClientConfig.MinVersion)
}
// Verify max TLS version
if transport.TLSClientConfig.MaxVersion != tls.VersionTLS13 {
t.Errorf("TLS MaxVersion should be %d, got %d", tls.VersionTLS13, transport.TLSClientConfig.MaxVersion)
}
// Verify InsecureSkipVerify
if transport.TLSClientConfig.InsecureSkipVerify != test.config.InsecureSkipVerify {
t.Errorf("InsecureSkipVerify should be %v, got %v", test.config.InsecureSkipVerify, transport.TLSClientConfig.InsecureSkipVerify)
}
// Verify HTTP/2
if transport.ForceAttemptHTTP2 != test.config.ForceHTTP2 {
t.Errorf("ForceAttemptHTTP2 should be %v, got %v", test.config.ForceHTTP2, transport.ForceAttemptHTTP2)
}
// Verify timeouts
if test.config.TLSHandshakeTimeout > 0 && transport.TLSHandshakeTimeout != test.config.TLSHandshakeTimeout {
t.Errorf("TLSHandshakeTimeout should be %v, got %v", test.config.TLSHandshakeTimeout, transport.TLSHandshakeTimeout)
}
})
}
}
// TestTransportPool_configKey tests configuration key generation
func TestTransportPool_configKey(t *testing.T) {
pool := &TransportPool{}
config1 := DefaultTransportConfig()
config2 := DefaultTransportConfig()
key1 := pool.configKey(config1)
key2 := pool.configKey(config2)
if key1 != key2 {
t.Error("Same configs should generate same key")
}
// Different config
config3 := config1
config3.MaxConnsPerHost = 999
key3 := pool.configKey(config3)
if key1 == key3 {
t.Error("Different configs should generate different keys")
}
}
// TestTransportPool_cleanupIdle tests idle transport cleanup
func TestTransportPool_cleanupIdle(t *testing.T) {
pool := &TransportPool{
transports: make(map[string]*sharedTransport),
maxConns: 20,
maxClients: 5,
}
config := DefaultTransportConfig()
transport := pool.createTransport(config)
// Add transport to pool with old timestamp
shared := &sharedTransport{
transport: transport,
refCount: 0,
lastUsed: time.Now().Add(-5 * time.Minute), // Old
config: config,
}
key := pool.configKey(config)
pool.transports[key] = shared
// Run cleanup
pool.cleanupIdle()
// Transport should be removed
if _, exists := pool.transports[key]; exists {
t.Error("Old idle transport should be cleaned up")
}
}
// TestTransportPool_cleanup tests full cleanup
func TestTransportPool_cleanup(t *testing.T) {
pool := &TransportPool{
transports: make(map[string]*sharedTransport),
maxConns: 20,
maxClients: 5,
clientCount: 3,
}
config := DefaultTransportConfig()
transport := pool.createTransport(config)
// Add transport to pool
shared := &sharedTransport{
transport: transport,
refCount: 1,
lastUsed: time.Now(),
config: config,
}
key := pool.configKey(config)
pool.transports[key] = shared
// Run cleanup
pool.cleanup()
// All transports should be removed
if len(pool.transports) != 0 {
t.Error("All transports should be cleaned up")
}
// Client count should be reset
if pool.clientCount != 0 {
t.Error("Client count should be reset")
}
}
// TestTransportPool_Shutdown tests graceful shutdown
func TestTransportPool_Shutdown(t *testing.T) {
ctx, cancel := context.WithCancel(context.Background())
pool := &TransportPool{
transports: make(map[string]*sharedTransport),
maxConns: 20,
maxClients: 5,
ctx: ctx,
cancel: cancel,
}
// Should not panic
pool.Shutdown()
}
// TestTransportPool_GetStats tests statistics
func TestTransportPool_GetStats(t *testing.T) {
pool := &TransportPool{
transports: make(map[string]*sharedTransport),
maxConns: 20,
maxClients: 5,
clientCount: 3,
}
config := DefaultTransportConfig()
// Add some transports
for i := 0; i < 3; i++ {
transport := pool.createTransport(config)
shared := &sharedTransport{
transport: transport,
refCount: int32(i % 2), // Some active, some idle
lastUsed: time.Now(),
config: config,
}
pool.transports[string(rune(i))] = shared
}
stats := pool.GetStats()
if stats.TotalClients != 3 {
t.Errorf("TotalClients should be 3, got %d", stats.TotalClients)
}
if stats.MaxClients != 5 {
t.Errorf("MaxClients should be 5, got %d", stats.MaxClients)
}
if stats.ActiveTransports < 0 || stats.ActiveTransports > 3 {
t.Errorf("ActiveTransports should be between 0 and 3, got %d", stats.ActiveTransports)
}
}
// TestCreateHTTPClient tests HTTP client creation
func TestCreateHTTPClient(t *testing.T) {
config := DefaultTransportConfig()
timeout := 30 * time.Second
client := CreateHTTPClient(config, timeout)
if client == nil {
t.Error("CreateHTTPClient should not return nil")
return
}
if client.Timeout != timeout {
t.Errorf("Client timeout should be %v, got %v", timeout, client.Timeout)
}
if client.Transport == nil {
t.Error("Client should have transport")
}
if client.CheckRedirect == nil {
t.Error("Client should have redirect policy")
}
// Test redirect policy
req := &http.Request{}
var via []*http.Request
// Should allow up to 9 redirects (10 total requests)
for i := 0; i < 9; i++ {
via = append(via, &http.Request{})
err := client.CheckRedirect(req, via)
if err != nil {
t.Errorf("Should allow %d redirects, got error: %v", i+1, err)
}
}
// Should reject 10th redirect (11th total request)
via = append(via, &http.Request{})
err := client.CheckRedirect(req, via)
if err != http.ErrUseLastResponse {
t.Error("Should reject too many redirects")
}
}
// TestCreateHTTPClient_Fallback tests fallback when pool is exhausted
func TestCreateHTTPClient_Fallback(t *testing.T) {
// Override global pool with limited one
originalPool := globalTransportPool
defer func() {
globalTransportPool = originalPool
}()
ctx, cancel := context.WithCancel(context.Background())
defer cancel()
globalTransportPool = &TransportPool{
transports: make(map[string]*sharedTransport),
maxConns: 20,
ctx: ctx,
cancel: cancel,
clientCount: 10,
maxClients: 1, // Very low limit
}
config := DefaultTransportConfig()
timeout := 30 * time.Second
client := CreateHTTPClient(config, timeout)
if client == nil {
t.Error("CreateHTTPClient should not return nil even when pool is exhausted")
return
}
if client.Timeout != timeout {
t.Errorf("Client timeout should be %v, got %v", timeout, client.Timeout)
}
}
// TestTransportPool_ConcurrentAccess tests concurrent access to transport pool
func TestTransportPool_ConcurrentAccess(t *testing.T) {
pool := &TransportPool{
transports: make(map[string]*sharedTransport),
maxConns: 20,
maxClients: 50, // High limit for concurrent test
}
// Use different configs to reduce contention on single transport
baseConfig := DefaultTransportConfig()
configs := make([]TransportConfig, 10)
for i := range configs {
configs[i] = baseConfig
configs[i].MaxConnsPerHost = 5 + i // Make each config unique
}
var wg sync.WaitGroup
numGoroutines := 10
operationsPerGoroutine := 3
wg.Add(numGoroutines)
for i := 0; i < numGoroutines; i++ {
go func(goroutineID int) {
defer wg.Done()
config := configs[goroutineID%len(configs)]
for j := 0; j < operationsPerGoroutine; j++ {
transport := pool.GetTransport(config)
if transport == nil {
continue
}
// Use transport briefly
time.Sleep(time.Millisecond)
pool.ReleaseTransport(transport)
}
}(i)
}
wg.Wait()
// Should not panic and should have reasonable stats
stats := pool.GetStats()
if stats.TotalClients < 0 || stats.TotalClients > int32(numGoroutines) {
t.Errorf("Unexpected client count: %d", stats.TotalClients)
}
}
// Benchmark tests for performance verification
func BenchmarkTransportPool_GetTransport(b *testing.B) {
pool := &TransportPool{
transports: make(map[string]*sharedTransport),
maxConns: 20,
maxClients: 100,
}
config := DefaultTransportConfig()
b.ResetTimer()
for i := 0; i < b.N; i++ {
transport := pool.GetTransport(config)
pool.ReleaseTransport(transport)
}
}
func BenchmarkCreateHTTPClient(b *testing.B) {
config := DefaultTransportConfig()
timeout := 30 * time.Second
b.ResetTimer()
for i := 0; i < b.N; i++ {
CreateHTTPClient(config, timeout)
}
}
func BenchmarkTransportPool_configKey(b *testing.B) {
pool := &TransportPool{}
config := DefaultTransportConfig()
b.ResetTimer()
for i := 0; i < b.N; i++ {
pool.configKey(config)
}
}
internal/singleton/singleton_test.go
+970
View File
@@ -0,0 +1,970 @@
package singleton
import (
"context"
"fmt"
"strings"
"sync"
"sync/atomic"
"testing"
"time"
)
// TestGet_Singleton tests that Get() returns the same instance
func TestGet_Singleton(t *testing.T) {
registry1 := Get()
registry2 := Get()
if registry1 != registry2 {
t.Error("Get() should return the same instance (singleton)")
}
if registry1 == nil {
t.Error("Get() should not return nil")
}
}
// TestRegistry_Register tests singleton registration
func TestRegistry_Register(t *testing.T) {
registry := &Registry{
instances: make(map[string]*Instance),
groups: make(map[string]*Group),
}
initializer := func() interface{} {
return "test-value"
}
finalizer := func(v interface{}) {
// Mock finalizer
}
// Test successful registration
err := registry.Register("test-singleton", initializer, finalizer)
if err != nil {
t.Errorf("Register should succeed, got error: %v", err)
}
// Verify instance was registered
if len(registry.instances) != 1 {
t.Error("Instance should be registered")
}
instance := registry.instances["test-singleton"]
if instance == nil {
t.Error("Instance should not be nil")
return
}
if instance.name != "test-singleton" {
t.Errorf("Instance name should be 'test-singleton', got '%s'", instance.name)
}
if instance.initializer == nil {
t.Error("Instance should have initializer")
}
if instance.finalizer == nil {
t.Error("Instance should have finalizer")
}
}
// TestRegistry_Register_Duplicate tests duplicate registration
func TestRegistry_Register_Duplicate(t *testing.T) {
registry := &Registry{
instances: make(map[string]*Instance),
groups: make(map[string]*Group),
}
initializer := func() interface{} {
return "test-value"
}
// Register first time
err := registry.Register("test-singleton", initializer, nil)
if err != nil {
t.Errorf("First registration should succeed, got error: %v", err)
}
// Register again - should fail
err = registry.Register("test-singleton", initializer, nil)
if err == nil {
t.Error("Duplicate registration should fail")
}
if !strings.Contains(err.Error(), "already registered") {
t.Errorf("Error should mention already registered, got: %v", err)
}
}
// TestRegistry_Register_DuringShutdown tests registration during shutdown
func TestRegistry_Register_DuringShutdown(t *testing.T) {
registry := &Registry{
instances: make(map[string]*Instance),
groups: make(map[string]*Group),
shutdown: 1, // Already shutting down
}
initializer := func() interface{} {
return "test-value"
}
err := registry.Register("test-singleton", initializer, nil)
if err == nil {
t.Error("Registration during shutdown should fail")
}
if !strings.Contains(err.Error(), "shutting down") {
t.Errorf("Error should mention shutting down, got: %v", err)
}
}
// TestRegistry_GetInstance tests singleton retrieval and initialization
func TestRegistry_GetInstance(t *testing.T) {
registry := &Registry{
instances: make(map[string]*Instance),
groups: make(map[string]*Group),
}
callCount := int32(0)
testValue := "test-value"
initializer := func() interface{} {
atomic.AddInt32(&callCount, 1)
return testValue
}
// Register singleton
err := registry.Register("test-singleton", initializer, nil)
if err != nil {
t.Errorf("Register should succeed, got error: %v", err)
}
// First get - should initialize
value1, err := registry.GetInstance("test-singleton")
if err != nil {
t.Errorf("GetInstance should succeed, got error: %v", err)
}
if value1 != testValue {
t.Errorf("Value should be '%s', got '%v'", testValue, value1)
}
if atomic.LoadInt32(&callCount) != 1 {
t.Errorf("Initializer should be called once, called %d times", callCount)
}
// Second get - should return same instance without calling initializer
value2, err := registry.GetInstance("test-singleton")
if err != nil {
t.Errorf("GetInstance should succeed, got error: %v", err)
}
if value2 != testValue {
t.Errorf("Value should be '%s', got '%v'", testValue, value2)
}
if atomic.LoadInt32(&callCount) != 1 {
t.Errorf("Initializer should still be called only once, called %d times", callCount)
}
}
// TestRegistry_GetInstance_NotRegistered tests getting unregistered singleton
func TestRegistry_GetInstance_NotRegistered(t *testing.T) {
registry := &Registry{
instances: make(map[string]*Instance),
groups: make(map[string]*Group),
}
value, err := registry.GetInstance("non-existent")
if err == nil {
t.Error("GetInstance of non-existent singleton should fail")
}
if value != nil {
t.Error("Value should be nil for non-existent singleton")
}
if !strings.Contains(err.Error(), "not registered") {
t.Errorf("Error should mention not registered, got: %v", err)
}
}
// TestRegistry_GetInstance_DuringShutdown tests getting instance during shutdown
func TestRegistry_GetInstance_DuringShutdown(t *testing.T) {
registry := &Registry{
instances: make(map[string]*Instance),
groups: make(map[string]*Group),
shutdown: 1, // Already shutting down
}
value, err := registry.GetInstance("test-singleton")
if err == nil {
t.Error("GetInstance during shutdown should fail")
}
if value != nil {
t.Error("Value should be nil during shutdown")
}
if !strings.Contains(err.Error(), "shutting down") {
t.Errorf("Error should mention shutting down, got: %v", err)
}
}
// TestRegistry_MustGet tests MustGet method
func TestRegistry_MustGet(t *testing.T) {
registry := &Registry{
instances: make(map[string]*Instance),
groups: make(map[string]*Group),
}
testValue := "test-value"
initializer := func() interface{} {
return testValue
}
// Register singleton
err := registry.Register("test-singleton", initializer, nil)
if err != nil {
t.Errorf("Register should succeed, got error: %v", err)
}
// MustGet should succeed
value := registry.MustGet("test-singleton")
if value != testValue {
t.Errorf("Value should be '%s', got '%v'", testValue, value)
}
// MustGet non-existent should panic
defer func() {
if r := recover(); r == nil {
t.Error("MustGet of non-existent singleton should panic")
}
}()
registry.MustGet("non-existent")
}
// TestRegistry_RegisterGroup tests group registration
func TestRegistry_RegisterGroup(t *testing.T) {
registry := &Registry{
instances: make(map[string]*Instance),
groups: make(map[string]*Group),
}
// Test successful group registration
err := registry.RegisterGroup("test-group")
if err != nil {
t.Errorf("RegisterGroup should succeed, got error: %v", err)
}
// Verify group was registered
if len(registry.groups) != 1 {
t.Error("Group should be registered")
}
group := registry.groups["test-group"]
if group == nil {
t.Error("Group should not be nil")
return
}
if group.name != "test-group" {
t.Errorf("Group name should be 'test-group', got '%s'", group.name)
}
// Test duplicate group registration
err = registry.RegisterGroup("test-group")
if err == nil {
t.Error("Duplicate group registration should fail")
}
if !strings.Contains(err.Error(), "already exists") {
t.Errorf("Error should mention already exists, got: %v", err)
}
}
// TestRegistry_AddToGroup tests adding singletons to groups
func TestRegistry_AddToGroup(t *testing.T) {
registry := &Registry{
instances: make(map[string]*Instance),
groups: make(map[string]*Group),
}
// Register a singleton
initializer := func() interface{} {
return "test-value"
}
err := registry.Register("test-singleton", initializer, nil)
if err != nil {
t.Errorf("Register should succeed, got error: %v", err)
}
// Register a group
err = registry.RegisterGroup("test-group")
if err != nil {
t.Errorf("RegisterGroup should succeed, got error: %v", err)
}
// Add singleton to group
err = registry.AddToGroup("test-group", "test-singleton")
if err != nil {
t.Errorf("AddToGroup should succeed, got error: %v", err)
}
// Verify singleton is in group
group := registry.groups["test-group"]
if len(group.instances) != 1 {
t.Error("Group should contain one instance")
}
if group.instances["test-singleton"] == nil {
t.Error("Singleton should be in group")
}
// Test adding to non-existent group
err = registry.AddToGroup("non-existent-group", "test-singleton")
if err == nil {
t.Error("Adding to non-existent group should fail")
}
// Test adding non-existent singleton to group
err = registry.AddToGroup("test-group", "non-existent-singleton")
if err == nil {
t.Error("Adding non-existent singleton should fail")
}
}
// TestRegistry_GetGroup tests retrieving group instances
func TestRegistry_GetGroup(t *testing.T) {
registry := &Registry{
instances: make(map[string]*Instance),
groups: make(map[string]*Group),
}
// Register singletons
err := registry.Register("test-singleton-1", func() interface{} {
return "value-1"
}, nil)
if err != nil {
t.Errorf("Register should succeed, got error: %v", err)
}
err = registry.Register("test-singleton-2", func() interface{} {
return "value-2"
}, nil)
if err != nil {
t.Errorf("Register should succeed, got error: %v", err)
}
// Register group and add singletons
err = registry.RegisterGroup("test-group")
if err != nil {
t.Errorf("RegisterGroup should succeed, got error: %v", err)
}
err = registry.AddToGroup("test-group", "test-singleton-1")
if err != nil {
t.Errorf("AddToGroup should succeed, got error: %v", err)
}
err = registry.AddToGroup("test-group", "test-singleton-2")
if err != nil {
t.Errorf("AddToGroup should succeed, got error: %v", err)
}
// Initialize singletons
_, _ = registry.GetInstance("test-singleton-1")
_, _ = registry.GetInstance("test-singleton-2")
// Get group
groupInstances, err := registry.GetGroup("test-group")
if err != nil {
t.Errorf("GetGroup should succeed, got error: %v", err)
}
if len(groupInstances) != 2 {
t.Errorf("Group should contain 2 instances, got %d", len(groupInstances))
}
if groupInstances["test-singleton-1"] != "value-1" {
t.Error("Group should contain correct instance values")
}
if groupInstances["test-singleton-2"] != "value-2" {
t.Error("Group should contain correct instance values")
}
// Test getting non-existent group
_, err = registry.GetGroup("non-existent-group")
if err == nil {
t.Error("Getting non-existent group should fail")
}
}
// TestRegistry_ReferenceCountingv tests reference counting
func TestRegistry_ReferenceCountingv(t *testing.T) {
registry := &Registry{
instances: make(map[string]*Instance),
groups: make(map[string]*Group),
}
finalizerCalled := int32(0)
finalizer := func(v interface{}) {
atomic.AddInt32(&finalizerCalled, 1)
}
// Register singleton
err := registry.Register("test-singleton", func() interface{} {
return "test-value"
}, finalizer)
if err != nil {
t.Errorf("Register should succeed, got error: %v", err)
}
// Initialize singleton (this adds 1 reference)
_, err = registry.GetInstance("test-singleton")
if err != nil {
t.Errorf("GetInstance should succeed, got error: %v", err)
}
// Check initial reference count
count, err := registry.GetReferenceCount("test-singleton")
if err != nil {
t.Errorf("GetReferenceCount should succeed, got error: %v", err)
}
if count != 1 {
t.Errorf("Reference count should be 1, got %d", count)
}
// Add reference
err = registry.AddReference("test-singleton")
if err != nil {
t.Errorf("AddReference should succeed, got error: %v", err)
}
count, _ = registry.GetReferenceCount("test-singleton")
if count != 2 {
t.Errorf("Reference count should be 2, got %d", count)
}
// Release reference
err = registry.ReleaseReference("test-singleton")
if err != nil {
t.Errorf("ReleaseReference should succeed, got error: %v", err)
}
count, _ = registry.GetReferenceCount("test-singleton")
if count != 1 {
t.Errorf("Reference count should be 1, got %d", count)
}
// Release last reference - should trigger finalizer
err = registry.ReleaseReference("test-singleton")
if err != nil {
t.Errorf("ReleaseReference should succeed, got error: %v", err)
}
count, _ = registry.GetReferenceCount("test-singleton")
if count != 0 {
t.Errorf("Reference count should be 0, got %d", count)
}
// Wait for finalizer to run (it runs in goroutine)
time.Sleep(10 * time.Millisecond)
if atomic.LoadInt32(&finalizerCalled) != 1 {
t.Errorf("Finalizer should be called once, called %d times", finalizerCalled)
}
// Test reference operations on non-existent singleton
err = registry.AddReference("non-existent")
if err == nil {
t.Error("AddReference on non-existent singleton should fail")
}
err = registry.ReleaseReference("non-existent")
if err == nil {
t.Error("ReleaseReference on non-existent singleton should fail")
}
_, err = registry.GetReferenceCount("non-existent")
if err == nil {
t.Error("GetReferenceCount on non-existent singleton should fail")
}
}
// TestRegistry_Shutdown tests graceful shutdown
func TestRegistry_Shutdown(t *testing.T) {
registry := &Registry{
instances: make(map[string]*Instance),
groups: make(map[string]*Group),
}
finalizerCalled := int32(0)
finalizer := func(v interface{}) {
atomic.AddInt32(&finalizerCalled, 1)
}
// Register and initialize singletons
err := registry.Register("test-singleton-1", func() interface{} {
return "value-1"
}, finalizer)
if err != nil {
t.Errorf("Register should succeed, got error: %v", err)
}
err = registry.Register("test-singleton-2", func() interface{} {
return "value-2"
}, finalizer)
if err != nil {
t.Errorf("Register should succeed, got error: %v", err)
}
// Initialize singletons
_, _ = registry.GetInstance("test-singleton-1")
_, _ = registry.GetInstance("test-singleton-2")
// Shutdown
ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
defer cancel()
err = registry.Shutdown(ctx)
if err != nil {
t.Errorf("Shutdown should succeed, got error: %v", err)
}
// Verify finalizers were called
if atomic.LoadInt32(&finalizerCalled) != 2 {
t.Errorf("Finalizers should be called 2 times, called %d times", finalizerCalled)
}
// Verify registry is cleared
if len(registry.instances) != 0 {
t.Error("Instances should be cleared after shutdown")
}
if len(registry.groups) != 0 {
t.Error("Groups should be cleared after shutdown")
}
// Verify shutdown flag is set
if atomic.LoadInt32(&registry.shutdown) != 1 {
t.Error("Shutdown flag should be set")
}
// Test double shutdown
err = registry.Shutdown(ctx)
if err == nil {
t.Error("Double shutdown should fail")
}
}
// TestRegistry_Shutdown_Timeout tests shutdown timeout
func TestRegistry_Shutdown_Timeout(t *testing.T) {
registry := &Registry{
instances: make(map[string]*Instance),
groups: make(map[string]*Group),
}
// Register singleton with slow finalizer
slowFinalizer := func(v interface{}) {
time.Sleep(100 * time.Millisecond)
}
err := registry.Register("slow-singleton", func() interface{} {
return "value"
}, slowFinalizer)
if err != nil {
t.Errorf("Register should succeed, got error: %v", err)
}
// Initialize singleton
_, _ = registry.GetInstance("slow-singleton")
// Shutdown with short timeout
ctx, cancel := context.WithTimeout(context.Background(), 10*time.Millisecond)
defer cancel()
err = registry.Shutdown(ctx)
if err == nil {
t.Error("Shutdown should timeout")
}
if !strings.Contains(err.Error(), "timeout") {
t.Errorf("Error should mention timeout, got: %v", err)
}
}
// TestRegistry_Shutdown_PanicRecovery tests panic recovery during shutdown
func TestRegistry_Shutdown_PanicRecovery(t *testing.T) {
registry := &Registry{
instances: make(map[string]*Instance),
groups: make(map[string]*Group),
}
// Register singleton with panicking finalizer
panicFinalizer := func(v interface{}) {
panic("finalizer panic")
}
err := registry.Register("panic-singleton", func() interface{} {
return "value"
}, panicFinalizer)
if err != nil {
t.Errorf("Register should succeed, got error: %v", err)
}
// Initialize singleton
_, _ = registry.GetInstance("panic-singleton")
// Shutdown should handle panic
ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
defer cancel()
err = registry.Shutdown(ctx)
if err == nil {
t.Error("Shutdown should report finalizer panic")
}
if !strings.Contains(err.Error(), "panicked") {
t.Errorf("Error should mention panic, got: %v", err)
}
}
// TestRegistry_Reset tests registry reset
func TestRegistry_Reset(t *testing.T) {
registry := &Registry{
instances: make(map[string]*Instance),
groups: make(map[string]*Group),
shutdown: 1,
}
// Add some data
registry.instances["test"] = &Instance{}
registry.groups["test"] = &Group{}
// Reset
registry.Reset()
// Verify everything is cleared
if len(registry.instances) != 0 {
t.Error("Instances should be cleared after reset")
}
if len(registry.groups) != 0 {
t.Error("Groups should be cleared after reset")
}
if atomic.LoadInt32(&registry.shutdown) != 0 {
t.Error("Shutdown flag should be cleared after reset")
}
}
// TestRegistry_GetStats tests statistics
func TestRegistry_GetStats(t *testing.T) {
registry := &Registry{
instances: make(map[string]*Instance),
groups: make(map[string]*Group),
}
// Register singletons
err := registry.Register("test-singleton-1", func() interface{} {
return "value-1"
}, nil)
if err != nil {
t.Errorf("Register should succeed, got error: %v", err)
}
err = registry.Register("test-singleton-2", func() interface{} {
return "value-2"
}, nil)
if err != nil {
t.Errorf("Register should succeed, got error: %v", err)
}
// Register group
err = registry.RegisterGroup("test-group")
if err != nil {
t.Errorf("RegisterGroup should succeed, got error: %v", err)
}
// Initialize one singleton
_, _ = registry.GetInstance("test-singleton-1")
// Add reference
_ = registry.AddReference("test-singleton-1")
// Get stats
stats := registry.GetStats()
if stats.TotalRegistered != 2 {
t.Errorf("TotalRegistered should be 2, got %d", stats.TotalRegistered)
}
if stats.TotalInitialized != 1 {
t.Errorf("TotalInitialized should be 1, got %d", stats.TotalInitialized)
}
if stats.TotalGroups != 1 {
t.Errorf("TotalGroups should be 1, got %d", stats.TotalGroups)
}
if stats.TotalReferences != 2 { // 1 from initialization + 1 from AddReference
t.Errorf("TotalReferences should be 2, got %d", stats.TotalReferences)
}
}
// TestBuilder tests the fluent builder interface
func TestBuilder(t *testing.T) {
// Reset global registry for clean test
Get().Reset()
testValue := "builder-test-value"
initializer := func() interface{} {
return testValue
}
finalizer := func(v interface{}) {
// Mock finalizer for builder test
}
// Test builder
err := NewBuilder("builder-singleton").
WithInitializer(initializer).
WithFinalizer(finalizer).
InGroup("builder-group").
Register()
if err != nil {
t.Errorf("Builder registration should succeed, got error: %v", err)
}
// Verify singleton was registered
value, err := Get().GetInstance("builder-singleton")
if err != nil {
t.Errorf("GetInstance should succeed, got error: %v", err)
}
if value != testValue {
t.Errorf("Value should be '%s', got '%v'", testValue, value)
}
// Verify group was created and singleton added
groupInstances, err := Get().GetGroup("builder-group")
if err != nil {
t.Errorf("GetGroup should succeed, got error: %v", err)
}
if len(groupInstances) != 1 {
t.Errorf("Group should contain 1 instance, got %d", len(groupInstances))
}
if groupInstances["builder-singleton"] != testValue {
t.Error("Group should contain correct instance")
}
}
// TestBuilder_WithoutGroup tests builder without group
func TestBuilder_WithoutGroup(t *testing.T) {
registry := &Registry{
instances: make(map[string]*Instance),
groups: make(map[string]*Group),
}
builder := &Builder{
registry: registry,
name: "no-group-singleton",
}
err := builder.WithInitializer(func() interface{} {
return "value"
}).Register()
if err != nil {
t.Errorf("Registration without group should succeed, got error: %v", err)
}
// Verify singleton was registered
if len(registry.instances) != 1 {
t.Error("Singleton should be registered")
}
}
// TestContainsHelper tests the helper string contains function
func TestContainsHelper(t *testing.T) {
tests := []struct {
s string
substr string
expect bool
}{
{"hello world", "world", true},
{"hello world", "hello", true},
{"hello world", "lo wo", true},
{"hello world", "xyz", false},
{"hello", "hello world", false},
{"", "test", false},
{"test", "", true},
{"", "", true},
}
for _, test := range tests {
result := contains(test.s, test.substr)
if result != test.expect {
t.Errorf("contains(%q, %q) = %v, want %v", test.s, test.substr, result, test.expect)
}
}
}
// TestRegistry_ConcurrentAccess tests concurrent access to registry
func TestRegistry_ConcurrentAccess(t *testing.T) {
registry := &Registry{
instances: make(map[string]*Instance),
groups: make(map[string]*Group),
}
callCount := int32(0)
initializer := func() interface{} {
atomic.AddInt32(&callCount, 1)
return "concurrent-value"
}
// Register singleton
err := registry.Register("concurrent-singleton", initializer, nil)
if err != nil {
t.Errorf("Register should succeed, got error: %v", err)
}
var wg sync.WaitGroup
numGoroutines := 50
// Concurrent access
wg.Add(numGoroutines)
for i := 0; i < numGoroutines; i++ {
go func() {
defer wg.Done()
value, err := registry.GetInstance("concurrent-singleton")
if err != nil {
t.Errorf("GetInstance should succeed, got error: %v", err)
return
}
if value != "concurrent-value" {
t.Errorf("Value should be 'concurrent-value', got '%v'", value)
}
}()
}
wg.Wait()
// Initializer should be called only once despite concurrent access
if atomic.LoadInt32(&callCount) != 1 {
t.Errorf("Initializer should be called only once, called %d times", callCount)
}
}
// TestRegistry_ConcurrentReferenceOperations tests concurrent reference operations
func TestRegistry_ConcurrentReferenceOperations(t *testing.T) {
registry := &Registry{
instances: make(map[string]*Instance),
groups: make(map[string]*Group),
}
// Register singleton
err := registry.Register("ref-singleton", func() interface{} {
return "ref-value"
}, nil)
if err != nil {
t.Errorf("Register should succeed, got error: %v", err)
}
// Initialize singleton
_, _ = registry.GetInstance("ref-singleton")
var wg sync.WaitGroup
numGoroutines := 20
// Concurrent reference operations
wg.Add(numGoroutines * 2)
for i := 0; i < numGoroutines; i++ {
go func() {
defer wg.Done()
_ = registry.AddReference("ref-singleton")
}()
go func() {
defer wg.Done()
_ = registry.ReleaseReference("ref-singleton")
}()
}
wg.Wait()
// Reference count should be consistent (initial 1 + net operations)
count, err := registry.GetReferenceCount("ref-singleton")
if err != nil {
t.Errorf("GetReferenceCount should succeed, got error: %v", err)
}
// Count should be >= 0 due to balanced add/release operations
if count < 0 {
t.Errorf("Reference count should not be negative, got %d", count)
}
}
// Benchmark tests for performance verification
func BenchmarkRegistry_GetInstance(b *testing.B) {
registry := &Registry{
instances: make(map[string]*Instance),
groups: make(map[string]*Group),
}
registry.Register("benchmark-singleton", func() interface{} {
return "benchmark-value"
}, nil)
b.ResetTimer()
for i := 0; i < b.N; i++ {
registry.GetInstance("benchmark-singleton")
}
}
func BenchmarkRegistry_ConcurrentGetInstance(b *testing.B) {
registry := &Registry{
instances: make(map[string]*Instance),
groups: make(map[string]*Group),
}
registry.Register("concurrent-benchmark", func() interface{} {
return "concurrent-value"
}, nil)
b.ResetTimer()
b.RunParallel(func(pb *testing.PB) {
for pb.Next() {
registry.GetInstance("concurrent-benchmark")
}
})
}
func BenchmarkBuilder_Register(b *testing.B) {
b.ResetTimer()
for i := 0; i < b.N; i++ {
registry := &Registry{
instances: make(map[string]*Instance),
groups: make(map[string]*Group),
}
builder := &Builder{
registry: registry,
name: fmt.Sprintf("benchmark-%d", i),
}
builder.WithInitializer(func() interface{} {
return "value"
}).Register()
}
}
memory_leak_consolidated_test.go
+18 -2
View File
@@ -840,7 +840,15 @@ func TestMemoryThresholds(t *testing.T) {
runtime.ReadMemStats(&after) runtime.ReadMemStats(&after)
cache.Close() cache.Close()
memUsed := after.Alloc - before.Alloc // Handle potential underflow when after.Alloc < before.Alloc (can happen after GC)
var memUsed uint64
if after.Alloc >= before.Alloc {
memUsed = after.Alloc - before.Alloc
} else {
// Memory decreased after GC, which is acceptable - set to 0
memUsed = 0
}
threshold := thresholds["cache_1000_items"] threshold := thresholds["cache_1000_items"]
assert.LessOrEqual(t, memUsed, threshold, assert.LessOrEqual(t, memUsed, threshold,
"Cache memory usage %d exceeds threshold %d", memUsed, threshold) "Cache memory usage %d exceeds threshold %d", memUsed, threshold)
@@ -868,7 +876,15 @@ func TestMemoryThresholds(t *testing.T) {
runtime.ReadMemStats(&after) runtime.ReadMemStats(&after)
// No Cleanup method available // No Cleanup method available
memUsed := after.Alloc - before.Alloc // Handle potential underflow when after.Alloc < before.Alloc (can happen after GC)
var memUsed uint64
if after.Alloc >= before.Alloc {
memUsed = after.Alloc - before.Alloc
} else {
// Memory decreased after GC, which is acceptable - set to 0
memUsed = 0
}
threshold := thresholds["session_100_sessions"] threshold := thresholds["session_100_sessions"]
assert.LessOrEqual(t, memUsed, threshold, assert.LessOrEqual(t, memUsed, threshold,
"Session memory usage %d exceeds threshold %d", memUsed, threshold) "Session memory usage %d exceeds threshold %d", memUsed, threshold)
middleware/middleware_consolidated_test.go
-763
View File
@@ -1,763 +0,0 @@
package middleware
import (
"fmt"
"net/http"
"net/http/httptest"
"sync"
"sync/atomic"
"testing"
"time"
"github.com/gorilla/sessions"
)
// ============================================================================
// Test Suite Setup
// ============================================================================
type MiddlewareTestSuite struct {
t *testing.T
middleware *MockTraefikOidcPlugin
sessionManager *MockSessionManager
config *MockConfig
httpClient *http.Client
mockProvider *mockOIDCProvider
}
func NewMiddlewareTestSuite(t *testing.T) *MiddlewareTestSuite {
return &MiddlewareTestSuite{t: t}
}
func (ts *MiddlewareTestSuite) Setup() {
// Create test config - using mock for now
ts.config = &MockConfig{
providerURL: "https://test-provider.com/.well-known/openid-configuration",
clientID: "test-client-id",
clientSecret: "test-client-secret",
callbackURL: "/auth/callback",
sessionEncryptionKey: "test-encryption-key-32-bytes-long",
logLevel: "debug",
rateLimit: 100,
forceHTTPS: false,
scopes: []string{"openid", "profile", "email"},
}
// Mock HTTP client for provider communication
ts.httpClient = &http.Client{
Timeout: 10 * time.Second,
}
// Mock OIDC Provider
ts.mockProvider = &mockOIDCProvider{
issuer: "https://test-provider.com",
authEndpoint: "https://test-provider.com/authorize",
tokenEndpoint: "https://test-provider.com/token",
userinfoEndpoint: "https://test-provider.com/userinfo",
jwksURI: "https://test-provider.com/jwks",
}
// Session manager
ts.sessionManager = &MockSessionManager{
store: sessions.NewCookieStore([]byte("test-key")),
sessions: make(map[string]*MockSession),
}
// Create middleware instance - mock for now
ts.middleware = &MockTraefikOidcPlugin{
logger: &MockLogger{},
config: ts.config,
}
}
func (ts *MiddlewareTestSuite) Teardown() {
// Cleanup test resources
}
// ============================================================================
// Middleware Core Tests
// ============================================================================
func TestMiddlewareFlow(t *testing.T) {
t.Run("UnauthenticatedUserRedirect", func(t *testing.T) {
// This test is temporarily disabled due to missing middleware setup
t.Skip("Skipping test until proper middleware configuration is available")
suite := NewMiddlewareTestSuite(t)
suite.Setup()
defer suite.Teardown()
tests := []struct {
name string
path string
method string
expectedCode int
checkHeaders bool
}{
{
name: "Basic unauthenticated request",
path: "/protected-resource",
method: "GET",
expectedCode: http.StatusFound,
checkHeaders: true,
},
{
name: "POST request without authentication",
path: "/api/data",
method: "POST",
expectedCode: http.StatusFound,
checkHeaders: true,
},
}
// Test cases would go here when properly implemented
_ = tests
})
t.Run("ExcludedURLsPassthrough", func(t *testing.T) {
// This test is temporarily disabled due to missing middleware setup
t.Skip("Skipping test until proper middleware configuration is available")
suite := NewMiddlewareTestSuite(t)
suite.Setup()
defer suite.Teardown()
excludedPaths := []string{
"/health",
"/metrics",
"/static/",
"/public/css/",
}
for _, path := range excludedPaths {
t.Run(fmt.Sprintf("Excluded path: %s", path), func(t *testing.T) {
req := httptest.NewRequest("GET", path, nil)
w := httptest.NewRecorder()
// Mock next handler
nextCalled := false
next := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
nextCalled = true
w.WriteHeader(http.StatusOK)
})
// Test would execute here
_ = req
_ = w
_ = next
_ = nextCalled
})
}
})
t.Run("AuthenticatedUserPassthrough", func(t *testing.T) {
// This test is temporarily disabled due to missing middleware setup
t.Skip("Skipping test until proper middleware configuration is available")
suite := NewMiddlewareTestSuite(t)
suite.Setup()
defer suite.Teardown()
req := httptest.NewRequest("GET", "/protected-resource", nil)
w := httptest.NewRecorder()
// Setup authenticated session
session := &MockSession{
values: map[string]interface{}{
"authenticated": true,
"id_token": "valid-token",
"access_token": "valid-access-token",
"email": "[email protected]",
},
}
// Test would execute here
_ = req
_ = w
_ = session
})
}
// ============================================================================
// Session Management Tests
// ============================================================================
func TestSessionManagement(t *testing.T) {
t.Run("SessionCreation", func(t *testing.T) {
// This test is temporarily disabled due to missing session types
t.Skip("Skipping test until proper session types are available")
suite := NewMiddlewareTestSuite(t)
suite.Setup()
defer suite.Teardown()
req := httptest.NewRequest("GET", "/", nil)
w := httptest.NewRecorder()
session, err := suite.sessionManager.GetSession(req)
if err != nil {
t.Errorf("Failed to get session: %v", err)
}
// Test would validate session properties
_ = session
_ = w
})
t.Run("SessionPersistence", func(t *testing.T) {
// This test is temporarily disabled due to missing session types
t.Skip("Skipping test until proper session types are available")
suite := NewMiddlewareTestSuite(t)
suite.Setup()
defer suite.Teardown()
req := httptest.NewRequest("GET", "/", nil)
w := httptest.NewRecorder()
// Create session and set data
session, _ := suite.sessionManager.GetSession(req)
session.SetAuthenticated(true)
session.SetIDToken("test-token")
session.Save(req, w)
// Test would validate session persistence
_ = session
})
t.Run("SessionCleanup", func(t *testing.T) {
// This test is temporarily disabled due to missing session types
t.Skip("Skipping test until proper session types are available")
suite := NewMiddlewareTestSuite(t)
suite.Setup()
defer suite.Teardown()
req := httptest.NewRequest("GET", "/logout", nil)
w := httptest.NewRecorder()
session, _ := suite.sessionManager.GetSession(req)
session.Clear(req, w)
session.Save(req, w)
// Test would validate session cleanup
_ = session
})
}
// ============================================================================
// Token Validation Tests
// ============================================================================
func TestTokenValidation(t *testing.T) {
t.Run("ValidTokenAcceptance", func(t *testing.T) {
// This test is temporarily disabled due to missing token validation setup
t.Skip("Skipping test until proper token validation is available")
suite := NewMiddlewareTestSuite(t)
suite.Setup()
defer suite.Teardown()
validToken := "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9..." // Mock JWT
tests := []struct {
name string
token string
expectValid bool
}{
{
name: "Valid token",
token: validToken,
expectValid: true,
},
{
name: "Invalid token format",
token: "invalid-token",
expectValid: false,
},
{
name: "Empty token",
token: "",
expectValid: false,
},
}
// Test cases would go here when properly implemented
_ = tests
})
t.Run("TokenExpiration", func(t *testing.T) {
// This test is temporarily disabled due to missing token validation setup
t.Skip("Skipping test until proper token validation is available")
suite := NewMiddlewareTestSuite(t)
suite.Setup()
defer suite.Teardown()
// Mock expired token
expiredToken := createMockExpiredToken()
validToken := createMockValidToken()
tests := []struct {
name string
token string
expectExp bool
}{
{
name: "Expired token",
token: expiredToken,
expectExp: true,
},
{
name: "Valid token",
token: validToken,
expectExp: false,
},
}
// Test cases would go here when properly implemented
_ = tests
})
t.Run("TokenRefresh", func(t *testing.T) {
// This test is temporarily disabled due to missing token refresh setup
t.Skip("Skipping test until proper token refresh is available")
suite := NewMiddlewareTestSuite(t)
suite.Setup()
defer suite.Teardown()
req := httptest.NewRequest("GET", "/", nil)
w := httptest.NewRecorder()
// Setup session with refresh token
session, _ := suite.sessionManager.GetSession(req)
session.SetRefreshToken("valid-refresh-token")
session.Save(req, w)
// Test would execute token refresh
_ = session
})
}
// ============================================================================
// Error Handling Tests
// ============================================================================
func TestErrorHandling(t *testing.T) {
t.Run("ProviderUnavailable", func(t *testing.T) {
// This test is temporarily disabled due to missing error handling setup
t.Skip("Skipping test until proper error handling is available")
suite := NewMiddlewareTestSuite(t)
suite.Setup()
defer suite.Teardown()
// Mock provider unavailable
suite.mockProvider.available = false
req := httptest.NewRequest("GET", "/", nil)
w := httptest.NewRecorder()
// Test would validate error response
_ = req
_ = w
})
t.Run("InvalidConfiguration", func(t *testing.T) {
// This test is temporarily disabled due to missing error handling setup
t.Skip("Skipping test until proper error handling is available")
invalidConfigs := []MockConfig{
{clientID: ""}, // Missing client ID
{clientSecret: ""}, // Missing client secret
{providerURL: ""}, // Missing provider URL
{sessionEncryptionKey: "short"}, // Short encryption key
}
for i, config := range invalidConfigs {
t.Run(fmt.Sprintf("Invalid config %d", i), func(t *testing.T) {
// Test would validate configuration validation
_ = config
})
}
})
t.Run("NetworkErrors", func(t *testing.T) {
// This test is temporarily disabled due to missing error handling setup
t.Skip("Skipping test until proper error handling is available")
suite := NewMiddlewareTestSuite(t)
suite.Setup()
defer suite.Teardown()
// Mock network timeout
suite.httpClient.Timeout = 1 * time.Millisecond
req := httptest.NewRequest("GET", "/", nil)
w := httptest.NewRecorder()
// Test would validate network error handling
_ = req
_ = w
})
}
// ============================================================================
// Concurrent Access Tests
// ============================================================================
func TestConcurrentAccess(t *testing.T) {
t.Run("ConcurrentRequests", func(t *testing.T) {
// This test is temporarily disabled due to missing concurrency setup
t.Skip("Skipping test until proper concurrency handling is available")
suite := NewMiddlewareTestSuite(t)
suite.Setup()
defer suite.Teardown()
var wg sync.WaitGroup
requestCount := 100
successCount := int32(0)
for i := 0; i < requestCount; i++ {
wg.Add(1)
go func(id int) {
defer wg.Done()
req := httptest.NewRequest("GET", fmt.Sprintf("/test-%d", id), nil)
w := httptest.NewRecorder()
// Test would execute concurrent request
_ = req
_ = w
atomic.AddInt32(&successCount, 1)
}(i)
}
wg.Wait()
// Test would validate concurrent access results
_ = successCount
})
t.Run("SessionConcurrency", func(t *testing.T) {
// This test is temporarily disabled due to missing session concurrency setup
t.Skip("Skipping test until proper session concurrency is available")
suite := NewMiddlewareTestSuite(t)
suite.Setup()
defer suite.Teardown()
var wg sync.WaitGroup
concurrentOps := 50
for i := 0; i < concurrentOps; i++ {
wg.Add(1)
go func(id int) {
defer wg.Done()
req := httptest.NewRequest("GET", "/", nil)
w := httptest.NewRecorder()
session, _ := suite.sessionManager.GetSession(req)
session.SetAuthenticated(id%2 == 0)
session.Save(req, w)
// Test would validate session concurrency
_ = session
}(i)
}
wg.Wait()
})
}
// ============================================================================
// Performance Tests
// ============================================================================
func TestPerformance(t *testing.T) {
if testing.Short() {
t.Skip("Skipping performance tests in short mode")
}
t.Run("RequestThroughput", func(t *testing.T) {
// This test is temporarily disabled due to missing performance setup
t.Skip("Skipping test until proper performance testing is available")
suite := NewMiddlewareTestSuite(t)
suite.Setup()
defer suite.Teardown()
requestCount := 1000
start := time.Now()
for i := 0; i < requestCount; i++ {
req := httptest.NewRequest("GET", "/excluded", nil)
w := httptest.NewRecorder()
// Test would measure request processing time
_ = req
_ = w
}
duration := time.Since(start)
rps := float64(requestCount) / duration.Seconds()
t.Logf("Processed %d requests in %v (%.2f req/sec)", requestCount, duration, rps)
})
t.Run("MemoryUsage", func(t *testing.T) {
// This test is temporarily disabled due to missing memory testing setup
t.Skip("Skipping test until proper memory testing is available")
suite := NewMiddlewareTestSuite(t)
suite.Setup()
defer suite.Teardown()
// Test would measure memory usage patterns
})
}
// ============================================================================
// Mock Implementations
// ============================================================================
type MockTraefikOidcPlugin struct {
logger Logger
config *MockConfig
}
type MockConfig struct {
providerURL string
clientID string
clientSecret string
callbackURL string
sessionEncryptionKey string
logLevel string
rateLimit int
forceHTTPS bool
scopes []string
}
type MockSessionManager struct {
store *sessions.CookieStore
sessions map[string]*MockSession
mu sync.RWMutex
}
func (m *MockSessionManager) GetSession(r *http.Request) (MockSessionInterface, error) {
m.mu.Lock()
defer m.mu.Unlock()
sessionID := "test-session"
if session, exists := m.sessions[sessionID]; exists {
return session, nil
}
session := &MockSession{
values: make(map[string]interface{}),
}
m.sessions[sessionID] = session
return session, nil
}
type MockSession struct {
values map[string]interface{}
mu sync.RWMutex
}
func (s *MockSession) SetAuthenticated(auth bool) error {
s.mu.Lock()
defer s.mu.Unlock()
s.values["authenticated"] = auth
return nil
}
func (s *MockSession) GetAuthenticated() bool {
s.mu.RLock()
defer s.mu.RUnlock()
auth, ok := s.values["authenticated"].(bool)
return ok && auth
}
func (s *MockSession) SetIDToken(token string) {
s.mu.Lock()
defer s.mu.Unlock()
s.values["id_token"] = token
}
func (s *MockSession) GetIDToken() string {
s.mu.RLock()
defer s.mu.RUnlock()
token, _ := s.values["id_token"].(string)
return token
}
func (s *MockSession) SetAccessToken(token string) {
s.mu.Lock()
defer s.mu.Unlock()
s.values["access_token"] = token
}
func (s *MockSession) GetAccessToken() string {
s.mu.RLock()
defer s.mu.RUnlock()
token, _ := s.values["access_token"].(string)
return token
}
func (s *MockSession) SetRefreshToken(token string) {
s.mu.Lock()
defer s.mu.Unlock()
s.values["refresh_token"] = token
}
func (s *MockSession) GetRefreshToken() string {
s.mu.RLock()
defer s.mu.RUnlock()
token, _ := s.values["refresh_token"].(string)
return token
}
func (s *MockSession) SetEmail(email string) {
s.mu.Lock()
defer s.mu.Unlock()
s.values["email"] = email
}
func (s *MockSession) GetEmail() string {
s.mu.RLock()
defer s.mu.RUnlock()
email, _ := s.values["email"].(string)
return email
}
func (s *MockSession) SetCSRF(csrf string) {
s.mu.Lock()
defer s.mu.Unlock()
s.values["csrf"] = csrf
}
func (s *MockSession) GetCSRF() string {
s.mu.RLock()
defer s.mu.RUnlock()
csrf, _ := s.values["csrf"].(string)
return csrf
}
func (s *MockSession) SetNonce(nonce string) {
s.mu.Lock()
defer s.mu.Unlock()
s.values["nonce"] = nonce
}
func (s *MockSession) GetNonce() string {
s.mu.RLock()
defer s.mu.RUnlock()
nonce, _ := s.values["nonce"].(string)
return nonce
}
func (s *MockSession) SetCodeVerifier(verifier string) {
s.mu.Lock()
defer s.mu.Unlock()
s.values["code_verifier"] = verifier
}
func (s *MockSession) GetCodeVerifier() string {
s.mu.RLock()
defer s.mu.RUnlock()
verifier, _ := s.values["code_verifier"].(string)
return verifier
}
func (s *MockSession) SetIncomingPath(path string) {
s.mu.Lock()
defer s.mu.Unlock()
s.values["incoming_path"] = path
}
func (s *MockSession) GetIncomingPath() string {
s.mu.RLock()
defer s.mu.RUnlock()
path, _ := s.values["incoming_path"].(string)
return path
}
func (s *MockSession) ResetRedirectCount() {
s.mu.Lock()
defer s.mu.Unlock()
s.values["redirect_count"] = 0
}
func (s *MockSession) Save(r *http.Request, w http.ResponseWriter) error {
return nil
}
func (s *MockSession) Clear(r *http.Request, w http.ResponseWriter) {
s.mu.Lock()
defer s.mu.Unlock()
s.values = make(map[string]interface{})
}
func (s *MockSession) returnToPoolSafely() {
// No-op for mock
}
type mockOIDCProvider struct {
issuer string
authEndpoint string
tokenEndpoint string
userinfoEndpoint string
jwksURI string
available bool
}
type MockLogger struct{}
func (l *MockLogger) Debug(msg string) {}
func (l *MockLogger) Debugf(format string, args ...interface{}) {}
func (l *MockLogger) Info(msg string) {}
func (l *MockLogger) Infof(format string, args ...interface{}) {}
func (l *MockLogger) Error(msg string) {}
func (l *MockLogger) Errorf(format string, args ...interface{}) {}
// Helper functions for tests
func createMockExpiredToken() string {
// Return a mock expired JWT token
return "expired.jwt.token"
}
func createMockValidToken() string {
// Return a mock valid JWT token
return "valid.jwt.token"
}
// MockSessionInterface for testing - avoid conflict with real SessionData
type MockSessionInterface interface {
SetAuthenticated(bool) error
GetAuthenticated() bool
SetIDToken(string)
GetIDToken() string
SetAccessToken(string)
GetAccessToken() string
SetRefreshToken(string)
GetRefreshToken() string
SetEmail(string)
GetEmail() string
SetCSRF(string)
GetCSRF() string
SetNonce(string)
GetNonce() string
SetCodeVerifier(string)
GetCodeVerifier() string
SetIncomingPath(string)
GetIncomingPath() string
ResetRedirectCount()
Save(*http.Request, http.ResponseWriter) error
Clear(*http.Request, http.ResponseWriter)
returnToPoolSafely()
}
middleware/middleware_test.go
+804
View File
@@ -0,0 +1,804 @@
package middleware
import (
"errors"
"net/http"
"net/http/httptest"
"sync"
"testing"
)
// TestUncoveredMiddlewareFunctions tests the functions with 0% coverage in middleware package
func TestUncoveredMiddlewareFunctions(t *testing.T) {
t.Run("generateNonce", func(t *testing.T) {
// This function currently returns an error in the stub implementation
nonce, err := generateNonce()
if err == nil {
t.Errorf("Expected generateNonce to return an error in stub implementation")
}
if nonce != "" {
t.Errorf("Expected generateNonce to return empty string, got %s", nonce)
}
// Verify the error message
expectedError := "generateNonce not implemented"
if err.Error() != expectedError {
t.Errorf("Expected error message '%s', got '%s'", expectedError, err.Error())
}
})
t.Run("generateCodeVerifier", func(t *testing.T) {
// This function currently returns an error in the stub implementation
verifier, err := generateCodeVerifier()
if err == nil {
t.Errorf("Expected generateCodeVerifier to return an error in stub implementation")
}
if verifier != "" {
t.Errorf("Expected generateCodeVerifier to return empty string, got %s", verifier)
}
// Verify the error message
expectedError := "generateCodeVerifier not implemented"
if err.Error() != expectedError {
t.Errorf("Expected error message '%s', got '%s'", expectedError, err.Error())
}
})
t.Run("deriveCodeChallenge", func(t *testing.T) {
// This function currently returns an error in the stub implementation
challenge, err := deriveCodeChallenge()
if err == nil {
t.Errorf("Expected deriveCodeChallenge to return an error in stub implementation")
}
if challenge != "" {
t.Errorf("Expected deriveCodeChallenge to return empty string, got %s", challenge)
}
// Verify the error message
expectedError := "deriveCodeChallenge not implemented"
if err.Error() != expectedError {
t.Errorf("Expected error message '%s', got '%s'", expectedError, err.Error())
}
})
}
// TestBuildFullURLFunction tests the buildFullURL function that already has 100% coverage
// but this ensures we maintain that coverage and test edge cases
func TestBuildFullURLFunction(t *testing.T) {
t.Run("buildFullURL", func(t *testing.T) {
// Test basic URL building
scheme := "https"
host := "example.com"
path := "/callback"
url := buildFullURL(scheme, host, path)
expected := "https://example.com/callback"
if url != expected {
t.Errorf("Expected URL %s, got %s", expected, url)
}
// Test with path that doesn't start with / (function just concatenates)
url2 := buildFullURL(scheme, host, "callback")
expected2 := "https://example.comcallback"
if url2 != expected2 {
t.Errorf("Expected URL %s, got %s", expected2, url2)
}
// Test with empty path
url3 := buildFullURL(scheme, host, "")
expected3 := "https://example.com"
if url3 != expected3 {
t.Errorf("Expected URL %s, got %s", expected3, url3)
}
// Test with different schemes
url4 := buildFullURL("http", "localhost:8080", "/test")
expected4 := "http://localhost:8080/test"
if url4 != expected4 {
t.Errorf("Expected URL %s, got %s", expected4, url4)
}
// Test with special characters
url5 := buildFullURL("https", "api.example.com", "/v1/auth?redirect=true")
expected5 := "https://api.example.com/v1/auth?redirect=true"
if url5 != expected5 {
t.Errorf("Expected URL %s, got %s", expected5, url5)
}
// Test with empty components
url6 := buildFullURL("", "", "")
expected6 := "://"
if url6 != expected6 {
t.Errorf("Expected URL %s, got %s", expected6, url6)
}
// Test with port numbers
url7 := buildFullURL("http", "localhost:3000", "/admin")
expected7 := "http://localhost:3000/admin"
if url7 != expected7 {
t.Errorf("Expected URL %s, got %s", expected7, url7)
}
})
}
// Mock types for testing
type mockLogger struct {
logs []string
mu sync.Mutex
}
func (m *mockLogger) Debug(msg string) { m.log("DEBUG: " + msg) }
func (m *mockLogger) Debugf(format string, args ...interface{}) { m.log("DEBUG: " + format) }
func (m *mockLogger) Error(msg string) { m.log("ERROR: " + msg) }
func (m *mockLogger) Errorf(format string, args ...interface{}) { m.log("ERROR: " + format) }
func (m *mockLogger) Info(msg string) { m.log("INFO: " + msg) }
func (m *mockLogger) Infof(format string, args ...interface{}) { m.log("INFO: " + format) }
func (m *mockLogger) log(msg string) {
m.mu.Lock()
defer m.mu.Unlock()
m.logs = append(m.logs, msg)
}
type mockSessionManager struct {
getSessionFunc func(req *http.Request) (SessionData, error)
cleanupOldCookiesFunc func(rw http.ResponseWriter, req *http.Request)
}
func (m *mockSessionManager) CleanupOldCookies(rw http.ResponseWriter, req *http.Request) {
if m.cleanupOldCookiesFunc != nil {
m.cleanupOldCookiesFunc(rw, req)
}
}
func (m *mockSessionManager) GetSession(req *http.Request) (SessionData, error) {
if m.getSessionFunc != nil {
return m.getSessionFunc(req)
}
return nil, nil
}
type mockSessionData struct {
email string
accessToken string
idToken string
refreshToken string
clearFunc func(req *http.Request, rw http.ResponseWriter) error
resetRedirectCountFunc func()
}
func (m *mockSessionData) GetEmail() string { return m.email }
func (m *mockSessionData) GetAccessToken() string { return m.accessToken }
func (m *mockSessionData) GetIDToken() string { return m.idToken }
func (m *mockSessionData) GetRefreshToken() string { return m.refreshToken }
func (m *mockSessionData) Clear(req *http.Request, rw http.ResponseWriter) error {
if m.clearFunc != nil {
return m.clearFunc(req, rw)
}
return nil
}
func (m *mockSessionData) ResetRedirectCount() {
if m.resetRedirectCountFunc != nil {
m.resetRedirectCountFunc()
}
}
func (m *mockSessionData) returnToPoolSafely() {}
type mockAuthHandler struct {
initiateAuthFunc func(rw http.ResponseWriter, req *http.Request, session SessionData, redirectURL string,
generateNonce, generateCodeVerifier, deriveCodeChallenge func() (string, error))
}
func (m *mockAuthHandler) InitiateAuthentication(rw http.ResponseWriter, req *http.Request, session SessionData, redirectURL string,
generateNonce, generateCodeVerifier, deriveCodeChallenge func() (string, error)) {
if m.initiateAuthFunc != nil {
m.initiateAuthFunc(rw, req, session, redirectURL, generateNonce, generateCodeVerifier, deriveCodeChallenge)
}
}
type mockURLHelper struct {
determineExcludedFunc func(currentRequest string, excludedURLs map[string]struct{}) bool
determineSchemeFunc func(req *http.Request) string
determineHostFunc func(req *http.Request) string
}
func (m *mockURLHelper) DetermineExcludedURL(currentRequest string, excludedURLs map[string]struct{}) bool {
if m.determineExcludedFunc != nil {
return m.determineExcludedFunc(currentRequest, excludedURLs)
}
return false
}
func (m *mockURLHelper) DetermineScheme(req *http.Request) string {
if m.determineSchemeFunc != nil {
return m.determineSchemeFunc(req)
}
return "https"
}
func (m *mockURLHelper) DetermineHost(req *http.Request) string {
if m.determineHostFunc != nil {
return m.determineHostFunc(req)
}
return "example.com"
}
type mockTokenVerifier struct {
verifyFunc func(token string) error
}
func (m *mockTokenVerifier) VerifyToken(token string) error {
if m.verifyFunc != nil {
return m.verifyFunc(token)
}
return nil
}
// TestStubFunctionsErrorBehavior tests error behaviors more thoroughly
func TestStubFunctionsErrorBehavior(t *testing.T) {
t.Run("generateNonce_multiple_calls", func(t *testing.T) {
// Test multiple calls to ensure consistent behavior
for i := 0; i < 3; i++ {
nonce, err := generateNonce()
if err == nil {
t.Errorf("Call %d: Expected generateNonce to return an error", i)
}
if nonce != "" {
t.Errorf("Call %d: Expected empty nonce, got %s", i, nonce)
}
}
})
t.Run("generateCodeVerifier_multiple_calls", func(t *testing.T) {
// Test multiple calls to ensure consistent behavior
for i := 0; i < 3; i++ {
verifier, err := generateCodeVerifier()
if err == nil {
t.Errorf("Call %d: Expected generateCodeVerifier to return an error", i)
}
if verifier != "" {
t.Errorf("Call %d: Expected empty verifier, got %s", i, verifier)
}
}
})
t.Run("deriveCodeChallenge_multiple_calls", func(t *testing.T) {
// Test multiple calls to ensure consistent behavior
for i := 0; i < 3; i++ {
challenge, err := deriveCodeChallenge()
if err == nil {
t.Errorf("Call %d: Expected deriveCodeChallenge to return an error", i)
}
if challenge != "" {
t.Errorf("Call %d: Expected empty challenge, got %s", i, challenge)
}
}
})
}
// TestHandleTokenRefresh tests the handleTokenRefresh method with various scenarios
func TestHandleTokenRefresh(t *testing.T) {
tests := []struct {
name string
needsRefresh bool
authenticated bool
isAjaxRequest bool
refreshSuccess bool
allowedDomain bool
expectErrorResponse bool
expectProcessAuthorized bool
expectInitAuth bool
}{
{
name: "successful_refresh_authenticated",
needsRefresh: true,
authenticated: true,
isAjaxRequest: false,
refreshSuccess: true,
allowedDomain: true,
expectProcessAuthorized: true,
},
{
name: "successful_refresh_not_authenticated",
needsRefresh: true,
authenticated: false,
isAjaxRequest: false,
refreshSuccess: true,
allowedDomain: true,
expectProcessAuthorized: true,
},
{
name: "successful_refresh_disallowed_domain",
needsRefresh: true,
authenticated: true,
isAjaxRequest: false,
refreshSuccess: true,
allowedDomain: false,
expectErrorResponse: true,
},
{
name: "failed_refresh_browser_request",
needsRefresh: true,
authenticated: true,
isAjaxRequest: false,
refreshSuccess: false,
expectInitAuth: true,
},
{
name: "failed_refresh_ajax_request",
needsRefresh: true,
authenticated: true,
isAjaxRequest: true,
refreshSuccess: false,
expectErrorResponse: true,
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
// Setup mocks
logger := &mockLogger{}
nextHandlerCalled := false
nextHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
nextHandlerCalled = true
w.WriteHeader(http.StatusOK)
})
session := &mockSessionData{
email: "[email protected]",
accessToken: "access_token",
idToken: "id_token",
refreshToken: "refresh_token",
}
initAuthCalled := false
errorResponseSent := false
m := &AuthMiddleware{
logger: logger,
next: nextHandler,
logoutURLPath: "/logout",
refreshTokenFunc: func(rw http.ResponseWriter, req *http.Request, session SessionData) bool {
return tt.refreshSuccess
},
isAllowedDomainFunc: func(email string) bool {
return tt.allowedDomain
},
isAjaxRequestFunc: func(req *http.Request) bool {
return tt.isAjaxRequest
},
sendErrorResponseFunc: func(rw http.ResponseWriter, req *http.Request, message string, code int) {
errorResponseSent = true
rw.WriteHeader(code)
},
authHandler: &mockAuthHandler{
initiateAuthFunc: func(rw http.ResponseWriter, req *http.Request, session SessionData, redirectURL string,
generateNonce, generateCodeVerifier, deriveCodeChallenge func() (string, error)) {
initAuthCalled = true
},
},
extractGroupsAndRolesFunc: func(token string) ([]string, []string, error) {
return nil, nil, nil
},
}
// Create request and response recorder
req := httptest.NewRequest("GET", "/test", nil)
rw := httptest.NewRecorder()
// Call the method under test
m.handleTokenRefresh(rw, req, session, "https://example.com/callback",
tt.needsRefresh, tt.authenticated, tt.isAjaxRequest)
// Verify expectations - processAuthorizedRequest will call the next handler if successful
if tt.expectProcessAuthorized && !nextHandlerCalled {
t.Error("Expected processAuthorizedRequest to complete (next handler called)")
}
if tt.expectInitAuth && !initAuthCalled {
t.Error("Expected InitiateAuthentication to be called")
}
if tt.expectErrorResponse && !errorResponseSent {
t.Error("Expected error response to be sent")
}
})
}
}
// TestProcessAuthorizedRequest tests the processAuthorizedRequest method
func TestProcessAuthorizedRequest(t *testing.T) {
tests := []struct {
name string
email string
idToken string
accessToken string
allowedRoles map[string]struct{}
userGroups []string
userRoles []string
extractError error
expectHeaders bool
expectForbidden bool
expectReauth bool
}{
{
name: "no_email_triggers_reauth",
email: "",
idToken: "token",
expectReauth: true,
},
{
name: "successful_with_id_token",
email: "[email protected]",
idToken: "id_token",
accessToken: "access_token",
expectHeaders: true,
},
{
name: "successful_with_access_token_only",
email: "[email protected]",
idToken: "",
accessToken: "access_token",
expectHeaders: true,
},
{
name: "no_token_with_role_requirements",
email: "[email protected]",
idToken: "",
accessToken: "",
allowedRoles: map[string]struct{}{"admin": {}},
expectReauth: true,
},
{
name: "user_has_allowed_role",
email: "[email protected]",
idToken: "token",
allowedRoles: map[string]struct{}{"admin": {}},
userRoles: []string{"admin", "user"},
expectHeaders: true,
},
{
name: "user_has_allowed_group",
email: "[email protected]",
idToken: "token",
allowedRoles: map[string]struct{}{"developers": {}},
userGroups: []string{"developers", "testers"},
expectHeaders: true,
},
{
name: "user_lacks_required_roles",
email: "[email protected]",
idToken: "token",
allowedRoles: map[string]struct{}{"admin": {}},
userRoles: []string{"user"},
expectForbidden: true,
},
{
name: "extract_error_with_role_requirements",
email: "[email protected]",
idToken: "token",
allowedRoles: map[string]struct{}{"admin": {}},
extractError: errors.New("extraction failed"),
expectReauth: true,
},
{
name: "extract_error_without_role_requirements",
email: "[email protected]",
idToken: "token",
extractError: errors.New("extraction failed"),
expectHeaders: true, // Should continue without roles/groups
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
// Setup mocks
logger := &mockLogger{}
nextHandlerCalled := false
nextHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
nextHandlerCalled = true
w.WriteHeader(http.StatusOK)
})
session := &mockSessionData{
email: tt.email,
accessToken: tt.accessToken,
idToken: tt.idToken,
}
initAuthCalled := false
errorResponseSent := false
var errorCode int
m := &AuthMiddleware{
logger: logger,
next: nextHandler,
allowedRolesAndGroups: tt.allowedRoles,
logoutURLPath: "/logout",
extractGroupsAndRolesFunc: func(tokenString string) ([]string, []string, error) {
if tt.extractError != nil {
return nil, nil, tt.extractError
}
return tt.userGroups, tt.userRoles, nil
},
sendErrorResponseFunc: func(rw http.ResponseWriter, req *http.Request, message string, code int) {
errorResponseSent = true
errorCode = code
rw.WriteHeader(code)
},
authHandler: &mockAuthHandler{
initiateAuthFunc: func(rw http.ResponseWriter, req *http.Request, session SessionData, redirectURL string,
generateNonce, generateCodeVerifier, deriveCodeChallenge func() (string, error)) {
initAuthCalled = true
// Ensure ResetRedirectCount was called
if mockSession, ok := session.(*mockSessionData); ok {
if mockSession.resetRedirectCountFunc != nil {
mockSession.resetRedirectCountFunc()
}
}
},
},
}
// Track ResetRedirectCount calls
resetCountCalled := false
session.resetRedirectCountFunc = func() {
resetCountCalled = true
}
// Create request and response recorder
req := httptest.NewRequest("GET", "/test", nil)
rw := httptest.NewRecorder()
// Call the method under test
m.processAuthorizedRequest(rw, req, session, "https://example.com/callback")
// Verify expectations
if tt.expectHeaders && !nextHandlerCalled {
t.Error("Expected next handler to be called")
}
if tt.expectHeaders {
if req.Header.Get("X-Forwarded-User") != tt.email {
t.Errorf("Expected X-Forwarded-User header to be %s, got %s",
tt.email, req.Header.Get("X-Forwarded-User"))
}
if req.Header.Get("X-Auth-Request-User") != tt.email {
t.Errorf("Expected X-Auth-Request-User header to be %s, got %s",
tt.email, req.Header.Get("X-Auth-Request-User"))
}
if tt.idToken != "" && req.Header.Get("X-Auth-Request-Token") != tt.idToken {
t.Errorf("Expected X-Auth-Request-Token header to be %s, got %s",
tt.idToken, req.Header.Get("X-Auth-Request-Token"))
}
if len(tt.userGroups) > 0 && req.Header.Get("X-User-Groups") == "" {
t.Error("Expected X-User-Groups header to be set")
}
if len(tt.userRoles) > 0 && req.Header.Get("X-User-Roles") == "" {
t.Error("Expected X-User-Roles header to be set")
}
}
if tt.expectForbidden && (!errorResponseSent || errorCode != http.StatusForbidden) {
t.Error("Expected forbidden response")
}
if tt.expectReauth {
if !initAuthCalled {
t.Error("Expected InitiateAuthentication to be called")
}
if !resetCountCalled {
t.Error("Expected ResetRedirectCount to be called before reauth")
}
}
})
}
}
// TestServeHTTP_AdditionalCoverage tests additional ServeHTTP scenarios for better coverage
func TestServeHTTP_AdditionalCoverage(t *testing.T) {
t.Run("first_request_starts_background_tasks", func(t *testing.T) {
// Setup mocks
logger := &mockLogger{}
nextHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
w.WriteHeader(http.StatusOK)
})
tokenCleanupStarted := false
metadataRefreshStarted := false
initComplete := make(chan struct{})
close(initComplete) // Already initialized
wg := &sync.WaitGroup{}
m := &AuthMiddleware{
logger: logger,
next: nextHandler,
issuerURL: "https://issuer.example.com",
providerURL: "https://provider.example.com",
initComplete: initComplete,
goroutineWG: wg,
sessionManager: &mockSessionManager{
getSessionFunc: func(req *http.Request) (SessionData, error) {
return &mockSessionData{
email: "[email protected]",
accessToken: "token",
}, nil
},
},
urlHelper: &mockURLHelper{
determineExcludedFunc: func(path string, urls map[string]struct{}) bool {
return false
},
},
isUserAuthenticatedFunc: func(session SessionData) (bool, bool, bool) {
return true, false, false
},
isAllowedDomainFunc: func(email string) bool {
return true
},
tokenVerifier: &mockTokenVerifier{},
extractGroupsAndRolesFunc: func(token string) ([]string, []string, error) {
return nil, nil, nil
},
startTokenCleanupFunc: func() {
tokenCleanupStarted = true
},
startMetadataRefreshFunc: func(url string) {
metadataRefreshStarted = true
},
}
// First request should start background tasks
req := httptest.NewRequest("GET", "/api/test", nil)
rw := httptest.NewRecorder()
m.ServeHTTP(rw, req)
if !tokenCleanupStarted {
t.Error("Expected token cleanup to be started on first request")
}
if !metadataRefreshStarted {
t.Error("Expected metadata refresh to be started on first request")
}
if !m.firstRequestReceived {
t.Error("Expected firstRequestReceived to be set")
}
// Second request should not start tasks again
tokenCleanupStarted = false
metadataRefreshStarted = false
req2 := httptest.NewRequest("GET", "/api/test2", nil)
rw2 := httptest.NewRecorder()
m.ServeHTTP(rw2, req2)
if tokenCleanupStarted {
t.Error("Token cleanup should not be started again")
}
if metadataRefreshStarted {
t.Error("Metadata refresh should not be started again")
}
})
t.Run("health_endpoint_skips_first_request_logic", func(t *testing.T) {
logger := &mockLogger{}
nextHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
w.WriteHeader(http.StatusOK)
})
tokenCleanupStarted := false
metadataRefreshStarted := false
initComplete := make(chan struct{})
close(initComplete)
m := &AuthMiddleware{
logger: logger,
next: nextHandler,
issuerURL: "https://issuer.example.com",
initComplete: initComplete,
excludedURLs: map[string]struct{}{"/health": {}},
sessionManager: &mockSessionManager{
getSessionFunc: func(req *http.Request) (SessionData, error) {
return &mockSessionData{}, nil
},
},
urlHelper: &mockURLHelper{
determineExcludedFunc: func(path string, urls map[string]struct{}) bool {
_, ok := urls[path]
return ok
},
},
startTokenCleanupFunc: func() {
tokenCleanupStarted = true
},
startMetadataRefreshFunc: func(url string) {
metadataRefreshStarted = true
},
}
// Health request should not trigger background tasks
req := httptest.NewRequest("GET", "/health", nil)
rw := httptest.NewRecorder()
m.ServeHTTP(rw, req)
if tokenCleanupStarted {
t.Error("Token cleanup should not be started for health endpoint")
}
if metadataRefreshStarted {
t.Error("Metadata refresh should not be started for health endpoint")
}
if m.firstRequestReceived {
t.Error("firstRequestReceived should not be set for health endpoint")
}
})
t.Run("opaque_access_token_skips_jwt_verification", func(t *testing.T) {
logger := &mockLogger{}
nextHandlerCalled := false
nextHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
nextHandlerCalled = true
w.WriteHeader(http.StatusOK)
})
initComplete := make(chan struct{})
close(initComplete)
verifyTokenCalled := false
m := &AuthMiddleware{
logger: logger,
next: nextHandler,
issuerURL: "https://issuer.example.com",
initComplete: initComplete,
firstRequestReceived: true, // Skip first request logic
sessionManager: &mockSessionManager{
getSessionFunc: func(req *http.Request) (SessionData, error) {
return &mockSessionData{
email: "[email protected]",
accessToken: "opaque_token_without_dots", // Opaque token
}, nil
},
},
urlHelper: &mockURLHelper{
determineExcludedFunc: func(path string, urls map[string]struct{}) bool {
return false
},
},
isUserAuthenticatedFunc: func(session SessionData) (bool, bool, bool) {
return true, false, false // Authenticated, no refresh needed
},
isAllowedDomainFunc: func(email string) bool {
return true
},
tokenVerifier: &mockTokenVerifier{
verifyFunc: func(token string) error {
verifyTokenCalled = true
return nil
},
},
extractGroupsAndRolesFunc: func(token string) ([]string, []string, error) {
return nil, nil, nil
},
startTokenCleanupFunc: func() {},
startMetadataRefreshFunc: func(url string) {},
}
req := httptest.NewRequest("GET", "/api/test", nil)
rw := httptest.NewRecorder()
m.ServeHTTP(rw, req)
if verifyTokenCalled {
t.Error("JWT verification should be skipped for opaque tokens")
}
if !nextHandlerCalled {
t.Error("Next handler should be called for valid opaque token")
}
})
}