36 lines
1.0 KiB
Go
36 lines
1.0 KiB
Go
package divera
|
|
|
|
import (
|
|
"context"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/example/notify-gateway/internal/config"
|
|
)
|
|
|
|
func TestRedirectsAndErrorsDoNotLeakCredentials(t *testing.T) {
|
|
calls := 0
|
|
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
calls++
|
|
if r.URL.Query().Get("accesskey") != "private-key" {
|
|
t.Error("missing key")
|
|
}
|
|
w.Header().Set("Location", "/other")
|
|
w.Header().Set("Retry-After", "90")
|
|
w.WriteHeader(307)
|
|
w.Write([]byte("private-key"))
|
|
}))
|
|
defer srv.Close()
|
|
t.Setenv("TEST_DIVERA_KEY", "private-key")
|
|
c := New(func() config.DiveraConfig {
|
|
return config.DiveraConfig{BaseURL: srv.URL, AccessKey: "env:TEST_DIVERA_KEY", TimeoutS: 2}
|
|
})
|
|
resp, err := c.Create(context.Background(), "news", map[string]any{})
|
|
if err == nil || calls != 1 || strings.Contains(err.Error(), "private-key") || len(resp.Body) != 0 || resp.RetryAfter != 90*time.Second {
|
|
t.Fatalf("response=%+v error=%v calls=%d", resp, err, calls)
|
|
}
|
|
}
|