at-container-registry/pkg/appview/middleware/bearer_challenge_test.go

package middleware

import (
	"net/http"
	"net/http/httptest"
	"testing"
)

func TestBearerChallenge(t *testing.T) {
	const realm = "https://atcr.io/auth/token"
	services := []string{"atcr.io", "buoy.cr"}
	wantChallenge := `Bearer realm="https://atcr.io/auth/token",service="atcr.io"`

	tests := []struct {
		name          string
		handler       http.HandlerFunc
		wantCode      int
		wantChallenge string
	}{
		{
			name: "bare 401 gets a challenge injected",
			handler: func(w http.ResponseWriter, _ *http.Request) {
				w.WriteHeader(http.StatusUnauthorized)
			},
			wantCode:      http.StatusUnauthorized,
			wantChallenge: wantChallenge,
		},
		{
			name: "401 with existing challenge is left untouched",
			handler: func(w http.ResponseWriter, _ *http.Request) {
				w.Header().Set("WWW-Authenticate", `Bearer realm="x",service="y",scope="repository:a/b:pull"`)
				w.WriteHeader(http.StatusUnauthorized)
			},
			wantCode:      http.StatusUnauthorized,
			wantChallenge: `Bearer realm="x",service="y",scope="repository:a/b:pull"`,
		},
		{
			name: "200 is not given a challenge",
			handler: func(w http.ResponseWriter, _ *http.Request) {
				w.WriteHeader(http.StatusOK)
			},
			wantCode:      http.StatusOK,
			wantChallenge: "",
		},
		{
			name: "implicit 200 via Write is not given a challenge",
			handler: func(w http.ResponseWriter, _ *http.Request) {
				_, _ = w.Write([]byte("ok"))
			},
			wantCode:      http.StatusOK,
			wantChallenge: "",
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			wrapped := BearerChallenge(realm, services)(tt.handler)
			req := httptest.NewRequest(http.MethodGet, "/v2/alice/app/blobs/sha256:abc", nil)
			req.Host = "atcr.io"
			w := httptest.NewRecorder()

			wrapped.ServeHTTP(w, req)

			if w.Code != tt.wantCode {
				t.Errorf("status = %d, want %d", w.Code, tt.wantCode)
			}
			if got := w.Header().Get("WWW-Authenticate"); got != tt.wantChallenge {
				t.Errorf("WWW-Authenticate = %q, want %q", got, tt.wantChallenge)
			}
		})
	}
}

// The challenge has to name the domain the request arrived on: the atcr-token
// access controller demands that domain's own audience, so advertising another
// would send the client back with a token this host rejects.
func TestBearerChallengePerDomain(t *testing.T) {
	const realm = "https://seamark.dev/auth/token"
	services := []string{"atcr.io", "buoy.cr"}

	tests := []struct {
		name string
		host string
		want string
	}{
		{
			name: "primary domain",
			host: "atcr.io",
			want: `Bearer realm="https://seamark.dev/auth/token",service="atcr.io"`,
		},
		{
			name: "secondary domain gets its own service",
			host: "buoy.cr",
			want: `Bearer realm="https://seamark.dev/auth/token",service="buoy.cr"`,
		},
		{
			name: "host with port still matches",
			host: "buoy.cr:443",
			want: `Bearer realm="https://seamark.dev/auth/token",service="buoy.cr"`,
		},
		{
			name: "unconfigured host falls back to the primary",
			host: "elsewhere.example",
			want: `Bearer realm="https://seamark.dev/auth/token",service="atcr.io"`,
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			wrapped := BearerChallenge(realm, services)(http.HandlerFunc(
				func(w http.ResponseWriter, _ *http.Request) {
					w.WriteHeader(http.StatusUnauthorized)
				}))
			req := httptest.NewRequest(http.MethodGet, "/v2/alice/app/blobs/sha256:abc", nil)
			req.Host = tt.host
			w := httptest.NewRecorder()

			wrapped.ServeHTTP(w, req)

			if got := w.Header().Get("WWW-Authenticate"); got != tt.want {
				t.Errorf("WWW-Authenticate = %q, want %q", got, tt.want)
			}
		})
	}
}