1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
|
package api
import (
"net/http"
"net/http/httptest"
"testing"
"codeberg.org/snonux/player/internal"
"codeberg.org/snonux/player/internal/repository"
)
func TestServer_CORSDisabled(t *testing.T) {
srv := newCORSTestServer(t, nil)
req := httptest.NewRequest(http.MethodGet, "/api/v1/media", nil)
req.Header.Set("Origin", "http://localhost:5173")
rr := httptest.NewRecorder()
srv.ServeHTTP(rr, req)
if got := rr.Header().Get("Access-Control-Allow-Origin"); got != "" {
t.Fatalf("expected no CORS origin header, got %q", got)
}
if got := rr.Header().Get("Vary"); got != "" {
t.Fatalf("expected no Vary header, got %q", got)
}
}
func TestServer_CORSAllowedOrigin(t *testing.T) {
const origin = "http://localhost:5173"
srv := newCORSTestServer(t, []string{origin})
req := httptest.NewRequest(http.MethodGet, "/api/v1/media", nil)
req.Header.Set("Origin", origin)
rr := httptest.NewRecorder()
srv.ServeHTTP(rr, req)
assertCORSHeaders(t, rr.Header(), origin)
}
func TestServer_CORSDisallowedOrigin(t *testing.T) {
srv := newCORSTestServer(t, []string{"https://player.example.com"})
req := httptest.NewRequest(http.MethodGet, "/api/v1/media", nil)
req.Header.Set("Origin", "http://localhost:5173")
rr := httptest.NewRecorder()
srv.ServeHTTP(rr, req)
if got := rr.Header().Get("Access-Control-Allow-Origin"); got != "" {
t.Fatalf("expected no CORS origin header, got %q", got)
}
if got := rr.Header().Get("Vary"); got != "" {
t.Fatalf("expected no Vary header, got %q", got)
}
}
func TestServer_CORSPreflightAPIV1Media(t *testing.T) {
const origin = "http://localhost:5173"
srv := newCORSTestServer(t, []string{origin})
req := httptest.NewRequest(http.MethodOptions, "/api/v1/media", nil)
req.Header.Set("Origin", origin)
req.Header.Set("Access-Control-Request-Method", http.MethodGet)
rr := httptest.NewRecorder()
srv.ServeHTTP(rr, req)
if rr.Code != http.StatusNoContent {
t.Fatalf("expected status %d, got %d", http.StatusNoContent, rr.Code)
}
assertCORSHeaders(t, rr.Header(), origin)
}
func newCORSTestServer(t *testing.T, allowedOrigins []string) *Server {
t.Helper()
return newTestServer(
t,
&repository.MockStore{},
nil,
nil,
&internal.Config{CORSAllowedOrigins: allowedOrigins},
nil,
nil,
nil,
nil,
nil,
nil,
nil,
nil,
nil,
nil,
)
}
func assertCORSHeaders(t *testing.T, h http.Header, origin string) {
t.Helper()
if got := h.Get("Access-Control-Allow-Origin"); got != origin {
t.Fatalf("Access-Control-Allow-Origin: expected %q, got %q", origin, got)
}
if got := h.Get("Access-Control-Allow-Methods"); got != corsAllowMethods {
t.Fatalf("Access-Control-Allow-Methods: expected %q, got %q", corsAllowMethods, got)
}
if got := h.Get("Access-Control-Allow-Headers"); got != corsAllowHeaders {
t.Fatalf("Access-Control-Allow-Headers: expected %q, got %q", corsAllowHeaders, got)
}
if got := h.Get("Access-Control-Allow-Credentials"); got != "true" {
t.Fatalf("Access-Control-Allow-Credentials: expected true, got %q", got)
}
if got := h.Get("Vary"); got != "Origin" {
t.Fatalf("Vary: expected %q, got %q", "Origin", got)
}
}
|
