test: harden HTTP onboarding coverage
- commit
- d69dfa04911b47fd60c99e70385db313358d1ec0
- author
- brice · · 2026-04-02 03:49 UTC
- parent
- 0b996ab
- signature
- GPG Verified
CD88F9E564E0102646FB6077A1A07C7C7C3E349D· arch-gpg Verified for the committer email
2 files · +13 -4
M internal/adapters/in/http/middleware/cidr_test.go +1 -1
| @@ -175,7 +175,7 @@ func TestHTTPSRedirect_InvalidExplicitPort_IsPreserved(t *testing.T) { | |||
| 175 | 175 | ||
| 176 | 176 | handler := HTTPSRedirect(nil, 8088, 8443, true, log)(ok) | |
| 177 | 177 | ||
| 178 | - | req := httptest.NewRequest(http.MethodGet, "http://example.com/", nil) | |
| 178 | + | req := httptest.NewRequest(http.MethodGet, "http://o2.bnema.dev/", nil) | |
| 179 | 179 | req.Host = "o2.bnema.dev:abcd" | |
| 180 | 180 | req.RemoteAddr = "203.0.113.10:12345" | |
| 181 | 181 | rr := httptest.NewRecorder() | |
| @@ -175,7 +175,7 @@ func TestHTTPSRedirect_InvalidExplicitPort_IsPreserved(t *testing.T) { | |||||
| 175 | 175 | ||||
| 176 | handler := HTTPSRedirect(nil, 8088, 8443, true, log)(ok) | 176 | handler := HTTPSRedirect(nil, 8088, 8443, true, log)(ok) | ||
| 177 | 177 | ||||
| 178 | - | req := httptest.NewRequest(http.MethodGet, "http://example.com/", nil) | 178 | + | req := httptest.NewRequest(http.MethodGet, "http://o2.bnema.dev/", nil) |
| 179 | req.Host = "o2.bnema.dev:abcd" | 179 | req.Host = "o2.bnema.dev:abcd" | ||
| 180 | req.RemoteAddr = "203.0.113.10:12345" | 180 | req.RemoteAddr = "203.0.113.10:12345" | ||
| 181 | rr := httptest.NewRecorder() | 181 | rr := httptest.NewRecorder() | ||
M internal/app/run_http_handlers_test.go +12 -3
| @@ -5,6 +5,8 @@ import ( | |||
| 5 | 5 | "io" | |
| 6 | 6 | "net/http" | |
| 7 | 7 | "net/http/httptest" | |
| 8 | + | "os" | |
| 9 | + | "path/filepath" | |
| 8 | 10 | "testing" | |
| 9 | 11 | ||
| 10 | 12 | "github.com/stretchr/testify/assert" | |
| @@ -244,9 +246,13 @@ func TestCreateHTTPHandlers_HTTPSOnboarding_HEADRoutesRemainAvailable(t *testing | |||
| 244 | 246 | for _, path := range []string{"/ca", "/ca.crt", "/ca.mobileconfig"} { | |
| 245 | 247 | resp, err := ts.Client().Head(ts.URL + path) | |
| 246 | 248 | require.NoError(t, err) | |
| 247 | - | resp.Body.Close() | |
| 249 | + | ||
| 250 | + | body, err := io.ReadAll(resp.Body) | |
| 251 | + | require.NoError(t, err) | |
| 252 | + | require.NoError(t, resp.Body.Close()) | |
| 248 | 253 | ||
| 249 | 254 | assert.Equal(t, http.StatusOK, resp.StatusCode, "HEAD %s should return 200", path) | |
| 255 | + | assert.Empty(t, body, "HEAD %s should have empty body", path) | |
| 250 | 256 | } | |
| 251 | 257 | } | |
| 252 | 258 | ||
| @@ -350,8 +356,11 @@ func TestCreateHTTPHandlers_TLSConfiguredWithoutCA_FailsStartup(t *testing.T) { | |||
| 350 | 356 | svc: &services{}, | |
| 351 | 357 | } | |
| 352 | 358 | si.cfg.Server.TLSPort = 8443 | |
| 353 | - | // Point data dir to a non-existent path under /proc to guarantee failure. | |
| 354 | - | si.cfg.Server.DataDir = "/proc/nonexistent/path" | |
| 359 | + | dataDir := t.TempDir() | |
| 360 | + | blockingPath := filepath.Join(dataDir, "not-a-directory") | |
| 361 | + | require.NoError(t, os.WriteFile(blockingPath, []byte("blocking file"), 0600)) | |
| 362 | + | // Point data dir to a file path so PKI directory creation fails portably. | |
| 363 | + | si.cfg.Server.DataDir = blockingPath | |
| 355 | 364 | ||
| 356 | 365 | err := si.initPKI() | |
| 357 | 366 | assert.Error(t, err, "initPKI should fail when CA cannot be initialized") | |
| @@ -5,6 +5,8 @@ import ( | |||||
| 5 | "io" | 5 | "io" | ||
| 6 | "net/http" | 6 | "net/http" | ||
| 7 | "net/http/httptest" | 7 | "net/http/httptest" | ||
| 8 | + | "os" | |||
| 9 | + | "path/filepath" | |||
| 8 | "testing" | 10 | "testing" | ||
| 9 | 11 | ||||
| 10 | "github.com/stretchr/testify/assert" | 12 | "github.com/stretchr/testify/assert" | ||
| @@ -244,9 +246,13 @@ func TestCreateHTTPHandlers_HTTPSOnboarding_HEADRoutesRemainAvailable(t *testing | |||||
| 244 | for _, path := range []string{"/ca", "/ca.crt", "/ca.mobileconfig"} { | 246 | for _, path := range []string{"/ca", "/ca.crt", "/ca.mobileconfig"} { | ||
| 245 | resp, err := ts.Client().Head(ts.URL + path) | 247 | resp, err := ts.Client().Head(ts.URL + path) | ||
| 246 | require.NoError(t, err) | 248 | require.NoError(t, err) | ||
| 247 | - | resp.Body.Close() | 249 | + | |
| 250 | + | body, err := io.ReadAll(resp.Body) | |||
| 251 | + | require.NoError(t, err) | |||
| 252 | + | require.NoError(t, resp.Body.Close()) | |||
| 248 | 253 | ||||
| 249 | assert.Equal(t, http.StatusOK, resp.StatusCode, "HEAD %s should return 200", path) | 254 | assert.Equal(t, http.StatusOK, resp.StatusCode, "HEAD %s should return 200", path) | ||
| 255 | + | assert.Empty(t, body, "HEAD %s should have empty body", path) | |||
| 250 | } | 256 | } | ||
| 251 | } | 257 | } | ||
| 252 | 258 | ||||
| @@ -350,8 +356,11 @@ func TestCreateHTTPHandlers_TLSConfiguredWithoutCA_FailsStartup(t *testing.T) { | |||||
| 350 | svc: &services{}, | 356 | svc: &services{}, | ||
| 351 | } | 357 | } | ||
| 352 | si.cfg.Server.TLSPort = 8443 | 358 | si.cfg.Server.TLSPort = 8443 | ||
| 353 | - | // Point data dir to a non-existent path under /proc to guarantee failure. | 359 | + | dataDir := t.TempDir() |
| 354 | - | si.cfg.Server.DataDir = "/proc/nonexistent/path" | 360 | + | blockingPath := filepath.Join(dataDir, "not-a-directory") |
| 361 | + | require.NoError(t, os.WriteFile(blockingPath, []byte("blocking file"), 0600)) | |||
| 362 | + | // Point data dir to a file path so PKI directory creation fails portably. | |||
| 363 | + | si.cfg.Server.DataDir = blockingPath | |||
| 355 | 364 | ||||
| 356 | err := si.initPKI() | 365 | err := si.initPKI() | ||
| 357 | assert.Error(t, err, "initPKI should fail when CA cannot be initialized") | 366 | assert.Error(t, err, "initPKI should fail when CA cannot be initialized") | ||