chore: establish local platform baseline

internal/httpapi/device_auth_test.go

@@ -0,0 +1,66 @@
+package httpapi
+
+import (
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"data-terminal-cloud/internal/deviceauth"
+)
+
+type fakeDeviceVerifier struct {
+	identity deviceauth.Identity
+	err      error
+}
+
+func (v fakeDeviceVerifier) Verify(*http.Request) (deviceauth.Identity, error) {
+	return v.identity, v.err
+}
+
+func TestDeviceAuthAddsIdentityContext(t *testing.T) {
+	expected := deviceauth.Identity{PublicID: "device-1", TenantID: "tenant-1"}
+	handler := DeviceAuth(fakeDeviceVerifier{identity: expected}, http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) {
+		actual, ok := deviceauth.FromContext(request.Context())
+		if !ok || actual.PublicID != expected.PublicID {
+			t.Fatalf("identity = %#v, ok = %v", actual, ok)
+		}
+		writer.WriteHeader(http.StatusNoContent)
+	}))
+	recorder := httptest.NewRecorder()
+	handler.ServeHTTP(recorder, httptest.NewRequest(http.MethodGet, "/device/v2/config", nil))
+	if recorder.Code != http.StatusNoContent {
+		t.Fatalf("status = %d", recorder.Code)
+	}
+}
+
+func TestDeviceAuthDoesNotExposeCredentialFailure(t *testing.T) {
+	for _, authError := range []error{
+		deviceauth.ErrCredentialsMissing, deviceauth.ErrCredentialInvalid,
+		deviceauth.ErrDeviceInactive, deviceauth.ErrRequestExpired, deviceauth.ErrReplayDetected,
+	} {
+		handler := DeviceAuth(fakeDeviceVerifier{err: authError}, http.HandlerFunc(func(http.ResponseWriter, *http.Request) {
+			t.Fatal("downstream must not be called")
+		}))
+		recorder := httptest.NewRecorder()
+		handler.ServeHTTP(recorder, httptest.NewRequest(http.MethodGet, "/device/v2/config", nil))
+		if recorder.Code != http.StatusUnauthorized || !containsText(recorder.Body.String(), "DEVICE_AUTHENTICATION_FAILED") {
+			t.Fatalf("error %v returned status %d and body %s", authError, recorder.Code, recorder.Body.String())
+		}
+	}
+	handler := DeviceAuth(fakeDeviceVerifier{err: errors.New("redis down")}, http.HandlerFunc(func(http.ResponseWriter, *http.Request) {}))
+	recorder := httptest.NewRecorder()
+	handler.ServeHTTP(recorder, httptest.NewRequest(http.MethodGet, "/device/v2/config", nil))
+	if recorder.Code != http.StatusServiceUnavailable || !containsText(recorder.Body.String(), `"retryable":true`) {
+		t.Fatalf("unexpected unavailable response: %d %s", recorder.Code, recorder.Body.String())
+	}
+}
+
+func containsText(value, part string) bool {
+	for index := 0; index+len(part) <= len(value); index++ {
+		if value[index:index+len(part)] == part {
+			return true
+		}
+	}
+	return false
+}