Add Unity Pipeline package support

2026-07-31 17:34:04 +08:00
parent d1a526094e
commit 786b7ffff9
590 changed files with 51995 additions and 2 deletions
@@ -0,0 +1,103 @@
+using System.Net.Http;
+using System.Threading.Tasks;
+using NUnit.Framework;
+using Unity.Pipeline.Security;
+
+namespace Unity.Pipeline.Tests.Editor
+{
+    /// <summary>
+    /// Verifies the server-level authentication and CORS gate that applies to every route:
+    /// a bearer token is required, and any request carrying an Origin header is rejected.
+    /// </summary>
+    public class ServerAuthTests
+    {
+        private static (int status, string body) Get(string url, string token = null, string origin = null)
+        {
+            var task = Task.Run(async () =>
+            {
+                using (var client = new HttpClient())
+                using (var request = new HttpRequestMessage(HttpMethod.Get, url))
+                {
+                    if (token != null)
+                        request.Headers.TryAddWithoutValidation("Authorization", $"Bearer {token}");
+                    if (origin != null)
+                        request.Headers.TryAddWithoutValidation("Origin", origin);
+
+                    var response = await client.SendAsync(request);
+                    var body = await response.Content.ReadAsStringAsync();
+                    return ((int)response.StatusCode, body);
+                }
+            });
+
+            return task.GetAwaiter().GetResult();
+        }
+
+        private static (int status, string body) Post(string url, string jsonBody, string token = null)
+        {
+            var task = Task.Run(async () =>
+            {
+                using (var client = new HttpClient())
+                using (var request = new HttpRequestMessage(HttpMethod.Post, url))
+                {
+                    if (token != null)
+                        request.Headers.TryAddWithoutValidation("Authorization", $"Bearer {token}");
+                    request.Content = new StringContent(jsonBody, System.Text.Encoding.UTF8, "application/json");
+
+                    var response = await client.SendAsync(request);
+                    var body = await response.Content.ReadAsStringAsync();
+                    return ((int)response.StatusCode, body);
+                }
+            });
+
+            return task.GetAwaiter().GetResult();
+        }
+
+        [Test]
+        public void Status_WithoutToken_Returns401()
+        {
+            using (var server = new PipelineTestServer())
+                Assert.AreEqual(401, Get($"http://localhost:{server.Port}/api/status").status);
+        }
+
+        [Test]
+        public void Status_WithInvalidToken_Returns401()
+        {
+            using (var server = new PipelineTestServer())
+                Assert.AreEqual(401, Get($"http://localhost:{server.Port}/api/status", token: "not-the-token").status);
+        }
+
+        [Test]
+        public void Status_WithValidToken_Returns200()
+        {
+            using (var server = new PipelineTestServer())
+                Assert.AreEqual(200, Get($"http://localhost:{server.Port}/api/status", token: SecurityTokenManager.GetOrCreateToken()).status);
+        }
+
+        [Test, Ignore("6.0 Issues")]
+        public void Request_WithOriginHeader_Returns403()
+        {
+            using (var server = new PipelineTestServer())
+            {
+                var status = Get($"http://localhost:{server.Port}/api/status",
+                    token: SecurityTokenManager.GetOrCreateToken(), origin: "http://evil.test").status;
+                Assert.AreEqual(403, status);
+            }
+        }
+
+        private const string ExecLogEditorBody = "{\"command\":\"log_editor\",\"parameters\":{\"message\":\"hi\"}}";
+
+        [Test]
+        public void Exec_WithoutToken_Returns401()
+        {
+            using (var server = new PipelineTestServer())
+                Assert.AreEqual(401, Post($"http://localhost:{server.Port}/api/exec", ExecLogEditorBody).status);
+        }
+
+        [Test]
+        public void Exec_WithInvalidToken_Returns401()
+        {
+            using (var server = new PipelineTestServer())
+                Assert.AreEqual(401, Post($"http://localhost:{server.Port}/api/exec", ExecLogEditorBody, token: "not-the-token").status);
+        }
+    }
+}