104 lines
4.0 KiB
C#
104 lines
4.0 KiB
C#
using System.Net.Http;
|
|
using System.Threading.Tasks;
|
|
using NUnit.Framework;
|
|
using Unity.Pipeline.Security;
|
|
|
|
namespace Unity.Pipeline.Tests.Editor
|
|
{
|
|
/// <summary>
|
|
/// Verifies the server-level authentication and CORS gate that applies to every route:
|
|
/// a bearer token is required, and any request carrying an Origin header is rejected.
|
|
/// </summary>
|
|
public class ServerAuthTests
|
|
{
|
|
private static (int status, string body) Get(string url, string token = null, string origin = null)
|
|
{
|
|
var task = Task.Run(async () =>
|
|
{
|
|
using (var client = new HttpClient())
|
|
using (var request = new HttpRequestMessage(HttpMethod.Get, url))
|
|
{
|
|
if (token != null)
|
|
request.Headers.TryAddWithoutValidation("Authorization", $"Bearer {token}");
|
|
if (origin != null)
|
|
request.Headers.TryAddWithoutValidation("Origin", origin);
|
|
|
|
var response = await client.SendAsync(request);
|
|
var body = await response.Content.ReadAsStringAsync();
|
|
return ((int)response.StatusCode, body);
|
|
}
|
|
});
|
|
|
|
return task.GetAwaiter().GetResult();
|
|
}
|
|
|
|
private static (int status, string body) Post(string url, string jsonBody, string token = null)
|
|
{
|
|
var task = Task.Run(async () =>
|
|
{
|
|
using (var client = new HttpClient())
|
|
using (var request = new HttpRequestMessage(HttpMethod.Post, url))
|
|
{
|
|
if (token != null)
|
|
request.Headers.TryAddWithoutValidation("Authorization", $"Bearer {token}");
|
|
request.Content = new StringContent(jsonBody, System.Text.Encoding.UTF8, "application/json");
|
|
|
|
var response = await client.SendAsync(request);
|
|
var body = await response.Content.ReadAsStringAsync();
|
|
return ((int)response.StatusCode, body);
|
|
}
|
|
});
|
|
|
|
return task.GetAwaiter().GetResult();
|
|
}
|
|
|
|
[Test]
|
|
public void Status_WithoutToken_Returns401()
|
|
{
|
|
using (var server = new PipelineTestServer())
|
|
Assert.AreEqual(401, Get($"http://localhost:{server.Port}/api/status").status);
|
|
}
|
|
|
|
[Test]
|
|
public void Status_WithInvalidToken_Returns401()
|
|
{
|
|
using (var server = new PipelineTestServer())
|
|
Assert.AreEqual(401, Get($"http://localhost:{server.Port}/api/status", token: "not-the-token").status);
|
|
}
|
|
|
|
[Test]
|
|
public void Status_WithValidToken_Returns200()
|
|
{
|
|
using (var server = new PipelineTestServer())
|
|
Assert.AreEqual(200, Get($"http://localhost:{server.Port}/api/status", token: SecurityTokenManager.GetOrCreateToken()).status);
|
|
}
|
|
|
|
[Test, Ignore("6.0 Issues")]
|
|
public void Request_WithOriginHeader_Returns403()
|
|
{
|
|
using (var server = new PipelineTestServer())
|
|
{
|
|
var status = Get($"http://localhost:{server.Port}/api/status",
|
|
token: SecurityTokenManager.GetOrCreateToken(), origin: "http://evil.test").status;
|
|
Assert.AreEqual(403, status);
|
|
}
|
|
}
|
|
|
|
private const string ExecLogEditorBody = "{\"command\":\"log_editor\",\"parameters\":{\"message\":\"hi\"}}";
|
|
|
|
[Test]
|
|
public void Exec_WithoutToken_Returns401()
|
|
{
|
|
using (var server = new PipelineTestServer())
|
|
Assert.AreEqual(401, Post($"http://localhost:{server.Port}/api/exec", ExecLogEditorBody).status);
|
|
}
|
|
|
|
[Test]
|
|
public void Exec_WithInvalidToken_Returns401()
|
|
{
|
|
using (var server = new PipelineTestServer())
|
|
Assert.AreEqual(401, Post($"http://localhost:{server.Port}/api/exec", ExecLogEditorBody, token: "not-the-token").status);
|
|
}
|
|
}
|
|
}
|