33 lines
871 B
Go
33 lines
871 B
Go
package httpapi
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
)
|
|
|
|
func TestRouterProductionMountsImpersonationBehindAuth(t *testing.T) {
|
|
t.Parallel()
|
|
s := testAPIServer()
|
|
s.Config.AppEnv = "production"
|
|
h := s.Router()
|
|
|
|
for _, path := range []string{
|
|
"/api/admin/users/00000000-0000-0000-0000-000000000001/impersonate",
|
|
"/api/admin/dev/stop-impersonate",
|
|
"/api/admin/dev/switchable-users",
|
|
"/api/admin/users/00000000-0000-0000-0000-000000000001/dev-password",
|
|
} {
|
|
rec := httptest.NewRecorder()
|
|
method := http.MethodPost
|
|
if path == "/api/admin/dev/switchable-users" {
|
|
method = http.MethodGet
|
|
}
|
|
h.ServeHTTP(rec, httptest.NewRequest(method, path, nil))
|
|
// Unauthenticated: RequireSession → 401. Must not succeed without a session.
|
|
if rec.Code == http.StatusOK {
|
|
t.Fatalf("%s returned 200 without auth in production", path)
|
|
}
|
|
}
|
|
}
|