(t *testing.T)
| 297 | } |
| 298 | |
| 299 | func TestInjectionFailureProducesCleanHTML(t *testing.T) { |
| 300 | t.Parallel() |
| 301 | |
| 302 | db, _ := dbtestutil.NewDB(t) |
| 303 | |
| 304 | // Create an expired user with a refresh token, but provide no OAuth2 |
| 305 | // configuration so that refresh is impossible, this should result in |
| 306 | // an error when httpmw.ExtractAPIKey is called. |
| 307 | user := dbgen.User(t, db, database.User{}) |
| 308 | _, token := dbgen.APIKey(t, db, database.APIKey{ |
| 309 | UserID: user.ID, |
| 310 | LastUsed: dbtime.Now().Add(-time.Hour), |
| 311 | ExpiresAt: dbtime.Now().Add(-time.Second), |
| 312 | LoginType: database.LoginTypeGithub, |
| 313 | }) |
| 314 | _ = dbgen.UserLink(t, db, database.UserLink{ |
| 315 | UserID: user.ID, |
| 316 | LoginType: database.LoginTypeGithub, |
| 317 | OAuthRefreshToken: "hello", |
| 318 | OAuthExpiry: dbtime.Now().Add(-time.Second), |
| 319 | }) |
| 320 | |
| 321 | siteFS := fstest.MapFS{ |
| 322 | "index.html": &fstest.MapFile{ |
| 323 | Data: []byte("<html>{{ .User }}</html>"), |
| 324 | }, |
| 325 | } |
| 326 | handler, err := site.New(&site.Options{ |
| 327 | Telemetry: telemetry.NewNoop(), |
| 328 | Database: db, |
| 329 | SiteFS: siteFS, |
| 330 | |
| 331 | // No OAuth2 configs, refresh will fail. |
| 332 | OAuth2Configs: &httpmw.OAuth2Configs{ |
| 333 | Github: nil, |
| 334 | OIDC: nil, |
| 335 | }, |
| 336 | }) |
| 337 | require.NoError(t, err) |
| 338 | |
| 339 | r := httptest.NewRequest("GET", "/", nil) |
| 340 | r.Header.Set(codersdk.SessionTokenHeader, token) |
| 341 | rw := httptest.NewRecorder() |
| 342 | |
| 343 | handler.ServeHTTP(rw, r) |
| 344 | |
| 345 | // Ensure we get a clean HTML response with no user data or errors |
| 346 | // from httpmw.ExtractAPIKey. |
| 347 | assert.Equal(t, http.StatusOK, rw.Code) |
| 348 | body := rw.Body.String() |
| 349 | assert.Equal(t, "<html></html>", body) |
| 350 | } |
| 351 | |
| 352 | func TestCaching(t *testing.T) { |
| 353 | t.Parallel() |
nothing calls this directly
no test coverage detected