Changeset 0.24.1 (#157)

2026-03-07 17:11:32 +00:00
parent a63728a481
commit b6cc4df6e7
27 changed files with 2094 additions and 453 deletions
--- a/server/auth/mtls_test.go
+++ b/server/auth/mtls_test.go
@@ -0,0 +1,135 @@
+package auth
+
+import (
+	"testing"
+
+	"git.gobha.me/xcaliber/chat-switchboard/store"
+)
+
+func TestParseDN(t *testing.T) {
+	tests := []struct {
+		name   string
+		dn     string
+		expect map[string]string
+	}{
+		{
+			name: "standard cert DN",
+			dn:   "CN=Jeff Smith,O=Acme Corp,OU=Engineering",
+			expect: map[string]string{
+				"CN": "Jeff Smith",
+				"O":  "Acme Corp",
+				"OU": "Engineering",
+			},
+		},
+		{
+			name: "with email",
+			dn:   "CN=Jane Doe,emailAddress=jane@acme.com,O=Acme Corp",
+			expect: map[string]string{
+				"CN":           "Jane Doe",
+				"emailAddress": "jane@acme.com",
+				"O":            "Acme Corp",
+			},
+		},
+		{
+			name: "spaces around equals",
+			dn:   "CN = Test User , O = Test Org",
+			expect: map[string]string{
+				"CN": "Test User",
+				"O":  "Test Org",
+			},
+		},
+		{
+			name: "single field",
+			dn:   "CN=Solo",
+			expect: map[string]string{
+				"CN": "Solo",
+			},
+		},
+		{
+			name:   "empty string",
+			dn:     "",
+			expect: map[string]string{},
+		},
+		{
+			name: "no equals sign",
+			dn:   "garbage,data",
+			expect: map[string]string{},
+		},
+		{
+			name: "country and state",
+			dn:   "CN=Server,C=US,ST=Maryland,L=Laurel,O=DoD",
+			expect: map[string]string{
+				"CN": "Server",
+				"C":  "US",
+				"ST": "Maryland",
+				"L":  "Laurel",
+				"O":  "DoD",
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := ParseDN(tt.dn)
+			for k, want := range tt.expect {
+				got := result[k]
+				if got != want {
+					t.Errorf("ParseDN(%q)[%q] = %q, want %q", tt.dn, k, got, want)
+				}
+			}
+			if len(result) != len(tt.expect) {
+				t.Errorf("ParseDN(%q) returned %d fields, want %d", tt.dn, len(result), len(tt.expect))
+			}
+		})
+	}
+}
+
+func TestMTLSConfig_Defaults(t *testing.T) {
+	p := NewMTLSProvider(MTLSConfig{})
+
+	if p.cfg.HeaderDN != "X-SSL-Client-DN" {
+		t.Errorf("HeaderDN = %q, want X-SSL-Client-DN", p.cfg.HeaderDN)
+	}
+	if p.cfg.HeaderVerify != "X-SSL-Client-Verify" {
+		t.Errorf("HeaderVerify = %q, want X-SSL-Client-Verify", p.cfg.HeaderVerify)
+	}
+	if p.cfg.HeaderFingerprint != "X-SSL-Client-Fingerprint" {
+		t.Errorf("HeaderFingerprint = %q, want X-SSL-Client-Fingerprint", p.cfg.HeaderFingerprint)
+	}
+	if p.cfg.DefaultRole != "user" {
+		t.Errorf("DefaultRole = %q, want user", p.cfg.DefaultRole)
+	}
+}
+
+func TestMTLSConfig_Custom(t *testing.T) {
+	p := NewMTLSProvider(MTLSConfig{
+		HeaderDN:     "X-Client-Cert-DN",
+		HeaderVerify: "X-Client-Cert-Verify",
+		DefaultRole:  "admin",
+	})
+
+	if p.cfg.HeaderDN != "X-Client-Cert-DN" {
+		t.Errorf("HeaderDN = %q, want X-Client-Cert-DN", p.cfg.HeaderDN)
+	}
+	if p.cfg.DefaultRole != "admin" {
+		t.Errorf("DefaultRole = %q, want admin", p.cfg.DefaultRole)
+	}
+}
+
+func TestMTLSProvider_Mode(t *testing.T) {
+	p := NewMTLSProvider(MTLSConfig{})
+	if p.Mode() != ModeMTLS {
+		t.Errorf("Mode() = %q, want %q", p.Mode(), ModeMTLS)
+	}
+}
+
+func TestMTLSProvider_NoRegistration(t *testing.T) {
+	p := NewMTLSProvider(MTLSConfig{})
+	if p.SupportsRegistration() {
+		t.Error("mTLS should not support registration")
+	}
+	_, err := p.Register(nil, store.Stores{})
+	if err != ErrNotSupported {
+		t.Errorf("Register() = %v, want ErrNotSupported", err)
+	}
+}