tao.chenandClaude
2c39091706
Phase 3 (httpclient): - shared Client (Timeout + MaxResponseBytes 截断) - SSRF: 16 段私网 CIDR (含 169.254/::ffff:0:0/96 IPv4-mapped) + hostname allowlist (精确/后缀/*. 通配) + scheme 校验 (仅 http/https) - auth 适配器: none / simple (YARN user.name) / basic (SetBasicAuth) - DoWithRedirect: 跨主机跳转保留 Authorization, max 5 默认 - 19 个测试全绿 (httptest 模拟) Phase 4 (admin + audit): - internal/audit: Entry + Repo.Insert/List + MarshalDetails, snake_case JSON - internal/middleware: AdminAuth/AgentAuth (constant-time 比对) - internal/admin: 6 端点 (GET/POST/PUT/DELETE /admin/clusters, GET /admin/audit) + 写操作触发 audit_log (含 before/after diff) + AuthPassword 空=保留旧密码 + 校验: 必填字段 + auth_type 枚举 + rate_limit>=0 - main.go: 挂载 storage.Open + admin.Mount - L fix: audit.Entry 加 json tag (smoke test 发现大写 key 不规范) Co-Authored-By: Claude <noreply@anthropic.com>
100 lines
3.3 KiB
Go
100 lines
3.3 KiB
Go
package httpclient
|
|
|
|
import (
|
|
"encoding/base64"
|
|
"net/http"
|
|
"strings"
|
|
"testing"
|
|
|
|
"spark-mcp-go/internal/cluster"
|
|
)
|
|
|
|
func TestApplyAuth_None(t *testing.T) {
|
|
req, _ := http.NewRequest(http.MethodGet, "http://example.com/foo", nil)
|
|
c := &cluster.Cluster{AuthType: cluster.AuthNone}
|
|
if err := ApplyAuth(req, "", c); err != nil {
|
|
t.Fatalf("apply auth: %v", err)
|
|
}
|
|
if req.Header.Get("Authorization") != "" {
|
|
t.Errorf("expected no Authorization header")
|
|
}
|
|
if req.URL.Query().Get("user.name") != "" {
|
|
t.Errorf("expected no user.name query parameter")
|
|
}
|
|
}
|
|
|
|
func TestApplyAuth_Simple_DefaultUser(t *testing.T) {
|
|
req, _ := http.NewRequest(http.MethodGet, "http://rm.example.com/ws/v1/cluster/apps", nil)
|
|
c := &cluster.Cluster{AuthType: cluster.AuthSimple}
|
|
if err := ApplyAuth(req, "", c); err != nil {
|
|
t.Fatalf("apply auth: %v", err)
|
|
}
|
|
if got := req.URL.Query().Get("user.name"); got != "yarn" {
|
|
t.Errorf("user.name=%q, want yarn", got)
|
|
}
|
|
}
|
|
|
|
func TestApplyAuth_Simple_CustomUser(t *testing.T) {
|
|
req, _ := http.NewRequest(http.MethodGet, "http://rm.example.com/ws/v1/cluster/apps", nil)
|
|
c := &cluster.Cluster{AuthType: cluster.AuthSimple, AuthUsername: "alice"}
|
|
if err := ApplyAuth(req, "", c); err != nil {
|
|
t.Fatalf("apply auth: %v", err)
|
|
}
|
|
if got := req.URL.Query().Get("user.name"); got != "alice" {
|
|
t.Errorf("user.name=%q, want alice", got)
|
|
}
|
|
}
|
|
|
|
func TestApplyAuth_Simple_PreservesExistingQuery(t *testing.T) {
|
|
req, _ := http.NewRequest(http.MethodGet, "http://rm.example.com/ws/v1/cluster/apps?foo=bar", nil)
|
|
c := &cluster.Cluster{AuthType: cluster.AuthSimple}
|
|
if err := ApplyAuth(req, "", c); err != nil {
|
|
t.Fatalf("apply auth: %v", err)
|
|
}
|
|
q := req.URL.Query()
|
|
if q.Get("foo") != "bar" {
|
|
t.Errorf("foo=%q, want bar", q.Get("foo"))
|
|
}
|
|
if q.Get("user.name") != "yarn" {
|
|
t.Errorf("user.name=%q, want yarn", q.Get("user.name"))
|
|
}
|
|
raw := req.URL.RawQuery
|
|
if !strings.Contains(raw, "foo=bar") || !strings.Contains(raw, "user.name=yarn") {
|
|
t.Errorf("raw query %q missing expected parameters", raw)
|
|
}
|
|
}
|
|
|
|
func TestApplyAuth_Basic(t *testing.T) {
|
|
req, _ := http.NewRequest(http.MethodGet, "http://rm.example.com/foo", nil)
|
|
c := &cluster.Cluster{AuthType: cluster.AuthBasic, AuthUsername: "u", AuthPassword: "p"}
|
|
if err := ApplyAuth(req, "", c); err != nil {
|
|
t.Fatalf("apply auth: %v", err)
|
|
}
|
|
want := "Basic " + base64.StdEncoding.EncodeToString([]byte("u:p"))
|
|
if got := req.Header.Get("Authorization"); got != want {
|
|
t.Errorf("Authorization=%q, want %q", got, want)
|
|
}
|
|
}
|
|
|
|
func TestApplyAuth_Basic_MissingCreds(t *testing.T) {
|
|
req, _ := http.NewRequest(http.MethodGet, "http://rm.example.com/foo", nil)
|
|
c := &cluster.Cluster{AuthType: cluster.AuthBasic, AuthUsername: "", AuthPassword: "p"}
|
|
if err := ApplyAuth(req, "", c); err == nil {
|
|
t.Error("expected error for missing username")
|
|
}
|
|
|
|
req2, _ := http.NewRequest(http.MethodGet, "http://rm.example.com/foo", nil)
|
|
c2 := &cluster.Cluster{AuthType: cluster.AuthBasic, AuthUsername: "u", AuthPassword: ""}
|
|
if err := ApplyAuth(req2, "", c2); err == nil {
|
|
t.Error("expected error for missing password")
|
|
}
|
|
}
|
|
|
|
func TestApplyAuth_UnknownAuthType(t *testing.T) {
|
|
req, _ := http.NewRequest(http.MethodGet, "http://rm.example.com/foo", nil)
|
|
c := &cluster.Cluster{AuthType: "kerberos"}
|
|
if err := ApplyAuth(req, "", c); err == nil {
|
|
t.Error("expected error for unknown auth type")
|
|
}
|
|
}
|