1package middleware
2
3import (
4 "fmt"
5 "io"
6 "net/http"
7 "net/http/httptest"
8 "testing"
9
10 "github.com/stretchr/testify/assert"
11 "github.com/stretchr/testify/require"
12
13 out "github.com/bnema/gordon/internal/boundaries/out"
14)
15
16// mockAccessLogWriter records written entries and optionally returns an error.
17type mockAccessLogWriter struct {
18 entries []out.AccessLogEntry
19 err error
20}
21
22func (m *mockAccessLogWriter) Write(entry out.AccessLogEntry) error {
23 m.entries = append(m.entries, entry)
24 return m.err
25}
26
27func TestAccessLogger_EmitsEntryPerRequest(t *testing.T) {
28 mock := &mockAccessLogWriter{}
29 log := testLogger()
30
31 handler := AccessLogger(mock, false, log, nil)(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
32 w.WriteHeader(http.StatusOK)
33 _, _ = w.Write([]byte("hello"))
34 }))
35
36 req := httptest.NewRequest(http.MethodGet, "/some/path?foo=bar", nil)
37 req.RemoteAddr = "192.168.1.100:12345"
38 req.Header.Set("User-Agent", "test-agent")
39 req.Header.Set("Referer", "https://example.com")
40 req.RequestURI = "/some/path?foo=bar"
41 req.Host = "example.com"
42 req.Proto = "HTTP/1.1"
43 rw := httptest.NewRecorder()
44
45 handler.ServeHTTP(rw, req)
46
47 require.Len(t, mock.entries, 1)
48 e := mock.entries[0]
49 assert.Equal(t, http.MethodGet, e.Method)
50 assert.Equal(t, "/some/path", e.Path)
51 assert.Equal(t, "foo=bar", e.Query)
52 assert.Equal(t, "example.com", e.Host)
53 assert.Equal(t, http.StatusOK, e.Status)
54 assert.Equal(t, 5, e.BytesSent)
55 assert.Equal(t, "test-agent", e.UserAgent)
56 assert.Equal(t, "https://example.com", e.Referer)
57 assert.Equal(t, "HTTP/1.1", e.Proto)
58 assert.NotEmpty(t, e.RequestID)
59 assert.Equal(t, "192.168.1.100", e.ClientIP)
60}
61
62func TestAccessLogger_RedactsSensitiveQueryParams(t *testing.T) {
63 mock := &mockAccessLogWriter{}
64 log := testLogger()
65
66 handler := AccessLogger(mock, false, log, nil)(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
67 w.WriteHeader(http.StatusOK)
68 }))
69 server := httptest.NewServer(handler)
70 defer server.Close()
71
72 resp, err := http.Get(server.URL + "/oauth/callback?code=secret-code&state=ok&token=secret-token&api_key=top-secret&session_id=session-secret")
73 require.NoError(t, err)
74 defer func() {
75 assert.NoError(t, resp.Body.Close())
76 }()
77 _, err = io.Copy(io.Discard, resp.Body)
78 require.NoError(t, err)
79
80 require.Len(t, mock.entries, 1)
81 assert.Equal(t, "code=[REDACTED]&state=ok&token=[REDACTED]&api_key=[REDACTED]&session_id=[REDACTED]", mock.entries[0].Query)
82}
83
84func TestAccessLogger_RequestIDReused(t *testing.T) {
85 mock := &mockAccessLogWriter{}
86 log := testLogger()
87
88 handler := AccessLogger(mock, false, log, nil)(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
89 w.WriteHeader(http.StatusOK)
90 }))
91
92 req := httptest.NewRequest(http.MethodGet, "/", nil)
93 req.Header.Set("X-Request-ID", "fixed-id-123")
94 rw := httptest.NewRecorder()
95
96 handler.ServeHTTP(rw, req)
97
98 require.Len(t, mock.entries, 1)
99 assert.Equal(t, "fixed-id-123", mock.entries[0].RequestID)
100}
101
102func TestAccessLogger_ExcludeHealthCheckUA(t *testing.T) {
103 mock := &mockAccessLogWriter{}
104 log := testLogger()
105
106 handler := AccessLogger(mock, true, log, nil)(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
107 w.WriteHeader(http.StatusOK)
108 }))
109
110 req := httptest.NewRequest(http.MethodGet, "/health", nil)
111 req.Header.Set("User-Agent", "Gordon-HealthCheck/1.0")
112 rw := httptest.NewRecorder()
113
114 handler.ServeHTTP(rw, req)
115
116 assert.Empty(t, mock.entries, "health-check request should not be logged")
117}
118
119func TestAccessLogger_ExcludeLoopbackIP(t *testing.T) {
120 mock := &mockAccessLogWriter{}
121 log := testLogger()
122
123 handler := AccessLogger(mock, true, log, nil)(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
124 w.WriteHeader(http.StatusOK)
125 }))
126
127 req := httptest.NewRequest(http.MethodGet, "/health", nil)
128 req.RemoteAddr = "127.0.0.1:54321"
129 rw := httptest.NewRecorder()
130
131 handler.ServeHTTP(rw, req)
132
133 assert.Empty(t, mock.entries, "loopback request should not be logged")
134}
135
136func TestAccessLogger_NoExcludeWhenDisabled(t *testing.T) {
137 mock := &mockAccessLogWriter{}
138 log := testLogger()
139
140 handler := AccessLogger(mock, false, log, nil)(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
141 w.WriteHeader(http.StatusOK)
142 }))
143
144 req := httptest.NewRequest(http.MethodGet, "/health", nil)
145 req.Header.Set("User-Agent", "Gordon-HealthCheck/1.0")
146 rw := httptest.NewRecorder()
147
148 handler.ServeHTTP(rw, req)
149
150 assert.Len(t, mock.entries, 1, "health-check request should be logged when excludeHealthChecks=false")
151}
152
153func TestAccessLogger_WriteFailureDoesNotAffectResponse(t *testing.T) {
154 mock := &mockAccessLogWriter{err: fmt.Errorf("disk full")}
155 log := testLogger()
156
157 handler := AccessLogger(mock, false, log, nil)(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
158 w.WriteHeader(http.StatusOK)
159 _, _ = w.Write([]byte("ok"))
160 }))
161
162 req := httptest.NewRequest(http.MethodGet, "/", nil)
163 rw := httptest.NewRecorder()
164
165 // Should not panic or change the response.
166 handler.ServeHTTP(rw, req)
167
168 assert.Equal(t, http.StatusOK, rw.Code)
169 assert.Equal(t, "ok", rw.Body.String())
170}
171
172func TestAccessLogger_PanicRecoveryChain_Captures500(t *testing.T) {
173 mock := &mockAccessLogWriter{}
174 log := testLogger()
175
176 // Chain: AccessLogger (outer) → PanicRecovery → panicking handler
177 panicHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
178 panic("test panic")
179 })
180 chain := AccessLogger(mock, false, log, nil)(PanicRecovery(log)(panicHandler))
181
182 req := httptest.NewRequest(http.MethodGet, "/crash", nil)
183 rw := httptest.NewRecorder()
184
185 chain.ServeHTTP(rw, req)
186
187 // PanicRecovery should have written 500.
188 assert.Equal(t, http.StatusInternalServerError, rw.Code)
189
190 // AccessLogger must have captured the 500.
191 require.Len(t, mock.entries, 1)
192 assert.Equal(t, http.StatusInternalServerError, mock.entries[0].Status)
193}