ac5ff854b2
Add omit_auth_context as a safe default for custom menu iframe pages, converge untrusted public output, and document the deployed shop menu configuration.
54 lines
1.8 KiB
Go
54 lines
1.8 KiB
Go
//go:build unit
|
|
|
|
package handler
|
|
|
|
import (
|
|
"encoding/json"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
|
|
"github.com/Wei-Shaw/sub2api/internal/config"
|
|
"github.com/Wei-Shaw/sub2api/internal/handler/dto"
|
|
"github.com/Wei-Shaw/sub2api/internal/service"
|
|
"github.com/gin-gonic/gin"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestSettingHandler_GetPublicSettings_CustomMenuConvergesUntrustedOutput(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
h := NewSettingHandler(service.NewSettingService(&settingHandlerPublicRepoStub{
|
|
values: map[string]string{
|
|
service.SettingKeyCustomMenuItems: `[
|
|
{"id":"legacy","label":"Legacy","url":"https://shop.example.com/pay","visibility":"user"},
|
|
{"id":"unsafe","label":"Unsafe","url":"https://shop.example.com/pay","visibility":"user","omit_auth_context":false},
|
|
{"id":"trusted","label":"Trusted","url":"https://app.example.com/internal","visibility":"user"}
|
|
]`,
|
|
},
|
|
}, &config.Config{
|
|
Server: config.ServerConfig{FrontendURL: "https://app.example.com"},
|
|
}), "test-version")
|
|
|
|
recorder := httptest.NewRecorder()
|
|
c, _ := gin.CreateTestContext(recorder)
|
|
c.Request = httptest.NewRequest(http.MethodGet, "/api/v1/settings/public", nil)
|
|
|
|
h.GetPublicSettings(c)
|
|
|
|
require.Equal(t, http.StatusOK, recorder.Code)
|
|
var resp struct {
|
|
Code int `json:"code"`
|
|
Data struct {
|
|
CustomMenuItems []dto.CustomMenuItem `json:"custom_menu_items"`
|
|
} `json:"data"`
|
|
}
|
|
require.NoError(t, json.Unmarshal(recorder.Body.Bytes(), &resp))
|
|
require.Equal(t, 0, resp.Code)
|
|
require.Len(t, resp.Data.CustomMenuItems, 3)
|
|
require.NotNil(t, resp.Data.CustomMenuItems[0].OmitAuthContext)
|
|
require.True(t, *resp.Data.CustomMenuItems[0].OmitAuthContext)
|
|
require.NotNil(t, resp.Data.CustomMenuItems[1].OmitAuthContext)
|
|
require.True(t, *resp.Data.CustomMenuItems[1].OmitAuthContext)
|
|
require.Nil(t, resp.Data.CustomMenuItems[2].OmitAuthContext)
|
|
}
|