mirror of
https://github.com/MengMengCode/CLICD.git
synced 2026-08-04 21:31:23 +08:00
MengMengCode
38debab1aa
- Implement tests for custom KVM and LXC image creation, ensuring invalid sources and architecture mismatches are rejected. - Introduce access policy management in CLI, allowing configuration of allowed sources and trusted proxies. - Add NAT network configuration with validation for RFC1918 compliance and subnet parsing. - Create panel access policy management, including normalization and evaluation of access decisions based on client IPs and forwarded headers. - Develop middleware for enforcing access policies in the server, returning appropriate responses for allowed and denied requests. - Enhance custom image downloading and validation, ensuring integrity and security of downloaded root filesystem archives. - Include comprehensive tests for all new functionalities to ensure reliability and correctness.
47 lines
1.3 KiB
Go
47 lines
1.3 KiB
Go
package server
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
|
|
"clicd/internal/config"
|
|
)
|
|
|
|
func TestPanelAccessMiddleware(t *testing.T) {
|
|
previous := config.AppConfig
|
|
config.AppConfig = &config.ClicdConfig{
|
|
PanelAccessPolicy: config.PanelAccessPolicy{
|
|
Enabled: true,
|
|
AllowedSources: []string{"192.0.2.0/24"},
|
|
TrustedProxies: []string{"10.0.0.1"},
|
|
},
|
|
}
|
|
t.Cleanup(func() {
|
|
config.AppConfig = previous
|
|
})
|
|
|
|
handler := panelAccessMiddleware(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
|
|
w.WriteHeader(http.StatusNoContent)
|
|
}))
|
|
|
|
allowed := httptest.NewRequest(http.MethodGet, "/api/version", nil)
|
|
allowed.RemoteAddr = "192.0.2.8:50000"
|
|
allowedRecorder := httptest.NewRecorder()
|
|
handler.ServeHTTP(allowedRecorder, allowed)
|
|
if allowedRecorder.Code != http.StatusNoContent {
|
|
t.Fatalf("allowed status = %d", allowedRecorder.Code)
|
|
}
|
|
|
|
denied := httptest.NewRequest(http.MethodGet, "/api/version", nil)
|
|
denied.RemoteAddr = "198.51.100.8:50000"
|
|
deniedRecorder := httptest.NewRecorder()
|
|
handler.ServeHTTP(deniedRecorder, denied)
|
|
if deniedRecorder.Code != http.StatusForbidden {
|
|
t.Fatalf("denied status = %d", deniedRecorder.Code)
|
|
}
|
|
if got := deniedRecorder.Header().Get("Content-Type"); got != "application/json" {
|
|
t.Fatalf("denied content type = %q", got)
|
|
}
|
|
}
|