76 lines
2.2 KiB
Go
76 lines
2.2 KiB
Go
|
package externalprobe
|
||
|
|
|
||
|
|
import (
|
||
|
|
"context"
|
||
|
|
"crypto/x509"
|
||
|
|
"net/http"
|
||
|
|
"net/http/httptest"
|
||
|
|
"strings"
|
||
|
|
"testing"
|
||
|
|
"time"
|
||
|
|
)
|
||
|
|
|
||
|
|
func TestJWKSRequiresSuccessfulDocumentWithKeys(t *testing.T) {
|
||
|
|
tests := []struct {
|
||
|
|
name string
|
||
|
|
status int
|
||
|
|
body string
|
||
|
|
wantErr bool
|
||
|
|
}{
|
||
|
|
{name: "valid", status: http.StatusOK, body: `{"keys":[{"kty":"RSA","kid":"one"}]}`},
|
||
|
|
{name: "empty", status: http.StatusOK, body: `{"keys":[]}`, wantErr: true},
|
||
|
|
{name: "invalid", status: http.StatusOK, body: `{`, wantErr: true},
|
||
|
|
{name: "unavailable", status: http.StatusServiceUnavailable, body: `{}`, wantErr: true},
|
||
|
|
}
|
||
|
|
for _, test := range tests {
|
||
|
|
t.Run(test.name, func(t *testing.T) {
|
||
|
|
server := httptest.NewServer(http.HandlerFunc(func(writer http.ResponseWriter, _ *http.Request) {
|
||
|
|
writer.WriteHeader(test.status)
|
||
|
|
_, _ = writer.Write([]byte(test.body))
|
||
|
|
}))
|
||
|
|
defer server.Close()
|
||
|
|
check, err := JWKS(server.URL, server.Client())
|
||
|
|
if err != nil {
|
||
|
|
t.Fatal(err)
|
||
|
|
}
|
||
|
|
err = check(context.Background())
|
||
|
|
if (err != nil) != test.wantErr {
|
||
|
|
t.Fatalf("check() error=%v, wantErr=%v", err, test.wantErr)
|
||
|
|
}
|
||
|
|
})
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestTLSReachabilityValidatesCertificate(t *testing.T) {
|
||
|
|
server := httptest.NewTLSServer(http.HandlerFunc(func(http.ResponseWriter, *http.Request) {}))
|
||
|
|
defer server.Close()
|
||
|
|
roots := x509.NewCertPool()
|
||
|
|
roots.AddCert(server.Certificate())
|
||
|
|
check, err := TLSReachability(server.URL, roots)
|
||
|
|
if err != nil {
|
||
|
|
t.Fatal(err)
|
||
|
|
}
|
||
|
|
ctx, cancel := context.WithTimeout(context.Background(), time.Second)
|
||
|
|
defer cancel()
|
||
|
|
if err = check(ctx); err != nil {
|
||
|
|
t.Fatalf("TLS check failed: %v", err)
|
||
|
|
}
|
||
|
|
|
||
|
|
untrusted, err := TLSReachability(server.URL, x509.NewCertPool())
|
||
|
|
if err != nil {
|
||
|
|
t.Fatal(err)
|
||
|
|
}
|
||
|
|
if err = untrusted(context.Background()); err == nil || !strings.Contains(err.Error(), "TLS") {
|
||
|
|
t.Fatalf("untrusted TLS check error=%v", err)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestRunnerRejectsInvalidDefinitions(t *testing.T) {
|
||
|
|
if _, err := NewRunner(0, time.Second, nil, nil); err == nil {
|
||
|
|
t.Fatal("zero interval should be rejected")
|
||
|
|
}
|
||
|
|
if _, err := NewRunner(time.Second, time.Second, map[string]CheckFunc{"": func(context.Context) error { return nil }}, nil); err == nil {
|
||
|
|
t.Fatal("empty probe name should be rejected")
|
||
|
|
}
|
||
|
|
}
|