mirror of
https://github.com/seaweedfs/seaweedfs.git
synced 2026-10-29 16:30:44 +01:00
Chris Lu
d5433ae745
vector: cover the identity object in the s3vectors auth context The auth middleware must carry the resolved identity object — only the name survives otherwise and authorization loses actions, account, and claims.
38 lines
1.2 KiB
Go
38 lines
1.2 KiB
Go
package s3vectors
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
|
|
"github.com/seaweedfs/seaweedfs/weed/s3api"
|
|
"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
|
|
"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
|
|
)
|
|
|
|
type fakeAuthenticator struct {
|
|
identity *s3api.Identity
|
|
}
|
|
|
|
func (f *fakeAuthenticator) AuthenticateRequest(r *http.Request) (string, interface{}, s3err.ErrorCode) {
|
|
return f.identity.Name, f.identity, s3err.ErrNone
|
|
}
|
|
|
|
func (f *fakeAuthenticator) DefaultAllow() bool { return true }
|
|
|
|
// The authenticated identity object must ride the request context — only the
|
|
// name survives otherwise, and downstream authorization loses actions,
|
|
// account, and claims.
|
|
func TestAuthKeepsIdentityObject(t *testing.T) {
|
|
want := &s3api.Identity{Name: "alice", Actions: []s3api.Action{"Admin"}}
|
|
s := &Server{authenticator: &fakeAuthenticator{identity: want}}
|
|
var got interface{}
|
|
h := s.Auth(func(w http.ResponseWriter, r *http.Request) {
|
|
got = s3_constants.GetIdentityFromContext(r)
|
|
})
|
|
h(httptest.NewRecorder(), httptest.NewRequest(http.MethodPost, "/", nil))
|
|
if got != interface{}(want) {
|
|
t.Fatalf("identity object missing from context: %v", got)
|
|
}
|
|
}
|