33 lines
983 B
Go
33 lines
983 B
Go
|
package httpapi
|
||
|
|
|
||
|
|
import (
|
||
|
|
"net/http"
|
||
|
|
"net/http/httptest"
|
||
|
|
"testing"
|
||
|
|
)
|
||
|
|
|
||
|
|
func TestRouterProductionOmitsImpersonationRoutes(t *testing.T) {
|
||
|
|
t.Parallel()
|
||
|
|
s := testAPIServer()
|
||
|
|
s.Config.AppEnv = "production"
|
||
|
|
h := s.Router()
|
||
|
|
|
||
|
|
for _, path := range []string{
|
||
|
|
"/api/admin/users/00000000-0000-0000-0000-000000000001/impersonate",
|
||
|
|
"/api/admin/dev/stop-impersonate",
|
||
|
|
"/api/admin/dev/switchable-users",
|
||
|
|
} {
|
||
|
|
rec := httptest.NewRecorder()
|
||
|
|
method := http.MethodPost
|
||
|
|
if path == "/api/admin/dev/switchable-users" {
|
||
|
|
method = http.MethodGet
|
||
|
|
}
|
||
|
|
h.ServeHTTP(rec, httptest.NewRequest(method, path, nil))
|
||
|
|
// Unauthenticated session yields 401; production must not expose the route as 200/403 from the handler.
|
||
|
|
// Mounted routes behind RequireSession return 401; unmounted chi paths under /api/admin still hit RequireSession then 404 for unknown — either way not a successful switch.
|
||
|
|
if rec.Code == http.StatusOK {
|
||
|
|
t.Fatalf("%s returned 200 in production", path)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|