91 lines
3.2 KiB
Go
91 lines
3.2 KiB
Go
package config
|
|
|
|
import (
|
|
"os"
|
|
"path/filepath"
|
|
"testing"
|
|
|
|
"github.com/example/sessionguard/internal/model"
|
|
)
|
|
|
|
func TestAgentDefaults(t *testing.T) {
|
|
p := filepath.Join(t.TempDir(), "agent.json")
|
|
if err := os.WriteFile(p, []byte(`{"listen":"127.0.0.1:9091","policy":{"cleanup":{"enabled":true}}}`), 0600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
c, err := LoadAgent(p)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if c.Policy.Cleanup.GraceSeconds != 600 {
|
|
t.Fatalf("grace=%d", c.Policy.Cleanup.GraceSeconds)
|
|
}
|
|
if len(c.Policy.Cleanup.AllowedProfileRoots) == 0 {
|
|
t.Fatal("missing allowed profile root")
|
|
}
|
|
}
|
|
|
|
func TestValidateProfilePolicy(t *testing.T) {
|
|
p := model.Policy{
|
|
Cleanup: model.CleanupPolicy{GraceSeconds: 600, PollSeconds: 10, RetrySeconds: 60, AllowedProfileRoots: []string{`C:\Users`}},
|
|
Profiles: model.ProfilePolicy{Enabled: true, StoreRoot: `\\server\profiles`, RetrySeconds: 60, RestoreWindowSeconds: 120, Folders: []model.ProfileFolder{{Path: `AppData\Roaming\Example`}}},
|
|
Sessions: model.SessionPolicy{DisconnectedTimeoutSeconds: 3600},
|
|
}
|
|
if err := ValidatePolicy(p); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
p.Profiles.Folders[0].Path = `..\Windows`
|
|
if err := ValidatePolicy(p); err == nil {
|
|
t.Fatal("expected profile traversal validation error")
|
|
}
|
|
}
|
|
|
|
func TestDisconnectedTimeoutMinimum(t *testing.T) {
|
|
p := model.Policy{Cleanup: model.CleanupPolicy{GraceSeconds: 600, PollSeconds: 10, RetrySeconds: 60}, Sessions: model.SessionPolicy{DisconnectedLogoffEnabled: true, DisconnectedTimeoutSeconds: 30}}
|
|
NormalizePolicy(&p)
|
|
p.Sessions.DisconnectedTimeoutSeconds = 30
|
|
if err := ValidatePolicy(p); err == nil {
|
|
t.Fatal("expected disconnected timeout validation error")
|
|
}
|
|
}
|
|
|
|
func TestValidateAccessAuthRequiresHTTPSForSecureCookie(t *testing.T) {
|
|
c := model.AccessAuthConfig{
|
|
Enabled: true, Issuer: "https://id.example.org", ClientID: "client", ClientSecret: "secret",
|
|
RedirectURL: "http://guac.example.org/_sessionguard/auth/oidc/callback", LogoutRedirectURL: "https://guac.example.org/",
|
|
CookieName: "sg_access_session", SecureCookie: true, SessionHours: 8,
|
|
}
|
|
if err := validateAccessAuth(c); err == nil {
|
|
t.Fatal("expected https validation error")
|
|
}
|
|
c.RedirectURL = "https://guac.example.org/_sessionguard/auth/oidc/callback"
|
|
if err := validateAccessAuth(c); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|
|
|
|
func TestValidateAccessAuthRequiresClientSecret(t *testing.T) {
|
|
c := model.AccessAuthConfig{
|
|
Issuer: "https://id.example.org", ClientID: "client",
|
|
RedirectURL: "https://guac.example.org/_sessionguard/auth/oidc/callback", LogoutRedirectURL: "https://guac.example.org/",
|
|
CookieName: "sg_access_session", SecureCookie: true, SessionHours: 8,
|
|
}
|
|
if err := validateAccessAuth(c); err == nil {
|
|
t.Fatal("expected missing client secret validation error")
|
|
}
|
|
}
|
|
|
|
func TestValidateOIDCLogoutRedirectRequiresHTTPSForSecureCookie(t *testing.T) {
|
|
c := model.OIDCConfig{
|
|
Issuer: "https://id.example.org", ClientID: "client", ClientSecret: "secret",
|
|
RedirectURL: "https://director.example.org/oidc/callback", LogoutRedirectURL: "http://director.example.org/", SecureCookie: true,
|
|
}
|
|
if err := validateOIDC(c); err == nil {
|
|
t.Fatal("expected https validation error")
|
|
}
|
|
c.LogoutRedirectURL = "https://director.example.org/"
|
|
if err := validateOIDC(c); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|