package web
import (
"net/http"
"net/http/httptest"
"testing"
"craftdesign.group/quarry/internal/api"
"craftdesign.group/quarry/internal/imgproxy"
"craftdesign.group/quarry/internal/ops"
)
// /img is the proxy when one is configured, and absent otherwise; an
// unsigned request through the real handler is refused before any fetch.
func TestImageProxyRouteIsMountedOnlyWithAProxy(t *testing.T) {
r := ops.NewRegistry()
if err := api.RegisterAll(r, api.Deps{Version: "v", Repos: api.NewRepos(map[string]*api.Repo{})}); err != nil {
t.Fatal(err)
}
p, err := imgproxy.New(t.TempDir(), false)
if err != nil {
t.Fatal(err)
}
status := func(h http.Handler, path string) int {
rec := httptest.NewRecorder()
h.ServeHTTP(rec, httptest.NewRequest("GET", path, nil))
return rec.Code
}
signed, _, _ := p.URL("https://example.org/a.png")
with := HandlerWith(r, nil, nil, []Option{WithImageProxy(p)})
if got := status(with, "/img/forged/aHR0cHM6Ly9leGFtcGxlLm9yZy9hLnBuZw.png"); got != http.StatusForbidden {
t.Errorf("a forged signature through the handler = %d, want 403", got)
}
// Signed, but pointing at a name that resolves nowhere this test can
// reach: the route IS mounted, which is what this asserts.
if got := status(with, signed); got == http.StatusNotFound {
t.Errorf("a signed image 404s: the route is not mounted")
}
without := HandlerWith(r, nil, nil, nil)
if got := status(without, signed); got != http.StatusNotFound {
t.Errorf("/img answered %d on a forge with no proxy, want 404", got)
}
}