c15d5b72f2
1. Tenant isolation bypass (CRITICAL): TenantResolver now verifies user has access to X-Tenant-ID via user_tenants lookup before setting context. Added VerifyAccess method to TenantLookup interface and TenantService. 2. Consolidated tenant resolution: Removed duplicate resolveTenant() from helpers.go and tenant resolution from auth middleware. TenantResolver is now the single source of truth. Deadlines and AI handlers use auth.TenantFromContext() instead of direct DB queries. 3. CalDAV credential masking: tenant settings responses now mask CalDAV passwords with "********" via maskSettingsPassword helper. Applied to GetTenant, ListTenants, and UpdateSettings responses. 4. CORS + security headers: New middleware/security.go with CORS (restricted to FRONTEND_ORIGIN) and security headers (X-Frame-Options, X-Content-Type-Options, HSTS, Referrer-Policy, X-XSS-Protection). 5. Internal error leaking: All writeError(w, 500, err.Error()) replaced with internalError() that logs via slog and returns generic "internal error" to client. Same for jsonError in tenant handler. 6. Input validation: Max length on title (500), description (10000), case_number (100), search (200). Pagination clamped to max 100. Content-Disposition filename sanitized against header injection. Regression test added for tenant access denial (403 on unauthorized X-Tenant-ID). All existing tests pass, go vet clean.
151 lines
3.9 KiB
Go
151 lines
3.9 KiB
Go
package auth
|
|
|
|
import (
|
|
"context"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
|
|
"github.com/google/uuid"
|
|
)
|
|
|
|
type mockTenantLookup struct {
|
|
tenantID *uuid.UUID
|
|
err error
|
|
hasAccess bool
|
|
accessErr error
|
|
}
|
|
|
|
func (m *mockTenantLookup) FirstTenantForUser(ctx context.Context, userID uuid.UUID) (*uuid.UUID, error) {
|
|
return m.tenantID, m.err
|
|
}
|
|
|
|
func (m *mockTenantLookup) VerifyAccess(ctx context.Context, userID, tenantID uuid.UUID) (bool, error) {
|
|
return m.hasAccess, m.accessErr
|
|
}
|
|
|
|
func TestTenantResolver_FromHeader(t *testing.T) {
|
|
tenantID := uuid.New()
|
|
tr := NewTenantResolver(&mockTenantLookup{hasAccess: true})
|
|
|
|
var gotTenantID uuid.UUID
|
|
next := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
id, ok := TenantFromContext(r.Context())
|
|
if !ok {
|
|
t.Fatal("tenant ID not in context")
|
|
}
|
|
gotTenantID = id
|
|
w.WriteHeader(http.StatusOK)
|
|
})
|
|
|
|
r := httptest.NewRequest("GET", "/api/cases", nil)
|
|
r.Header.Set("X-Tenant-ID", tenantID.String())
|
|
r = r.WithContext(ContextWithUserID(r.Context(), uuid.New()))
|
|
w := httptest.NewRecorder()
|
|
|
|
tr.Resolve(next).ServeHTTP(w, r)
|
|
|
|
if w.Code != http.StatusOK {
|
|
t.Fatalf("expected 200, got %d", w.Code)
|
|
}
|
|
if gotTenantID != tenantID {
|
|
t.Errorf("expected tenant %s, got %s", tenantID, gotTenantID)
|
|
}
|
|
}
|
|
|
|
func TestTenantResolver_FromHeader_NoAccess(t *testing.T) {
|
|
tenantID := uuid.New()
|
|
tr := NewTenantResolver(&mockTenantLookup{hasAccess: false})
|
|
|
|
next := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
t.Fatal("next should not be called")
|
|
})
|
|
|
|
r := httptest.NewRequest("GET", "/api/cases", nil)
|
|
r.Header.Set("X-Tenant-ID", tenantID.String())
|
|
r = r.WithContext(ContextWithUserID(r.Context(), uuid.New()))
|
|
w := httptest.NewRecorder()
|
|
|
|
tr.Resolve(next).ServeHTTP(w, r)
|
|
|
|
if w.Code != http.StatusForbidden {
|
|
t.Errorf("expected 403, got %d", w.Code)
|
|
}
|
|
}
|
|
|
|
func TestTenantResolver_DefaultsToFirst(t *testing.T) {
|
|
tenantID := uuid.New()
|
|
tr := NewTenantResolver(&mockTenantLookup{tenantID: &tenantID})
|
|
|
|
var gotTenantID uuid.UUID
|
|
next := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
id, _ := TenantFromContext(r.Context())
|
|
gotTenantID = id
|
|
w.WriteHeader(http.StatusOK)
|
|
})
|
|
|
|
r := httptest.NewRequest("GET", "/api/cases", nil)
|
|
r = r.WithContext(ContextWithUserID(r.Context(), uuid.New()))
|
|
w := httptest.NewRecorder()
|
|
|
|
tr.Resolve(next).ServeHTTP(w, r)
|
|
|
|
if w.Code != http.StatusOK {
|
|
t.Fatalf("expected 200, got %d", w.Code)
|
|
}
|
|
if gotTenantID != tenantID {
|
|
t.Errorf("expected tenant %s, got %s", tenantID, gotTenantID)
|
|
}
|
|
}
|
|
|
|
func TestTenantResolver_NoUser(t *testing.T) {
|
|
tr := NewTenantResolver(&mockTenantLookup{})
|
|
next := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
t.Fatal("next should not be called")
|
|
})
|
|
|
|
r := httptest.NewRequest("GET", "/api/cases", nil)
|
|
w := httptest.NewRecorder()
|
|
|
|
tr.Resolve(next).ServeHTTP(w, r)
|
|
|
|
if w.Code != http.StatusUnauthorized {
|
|
t.Errorf("expected 401, got %d", w.Code)
|
|
}
|
|
}
|
|
|
|
func TestTenantResolver_InvalidHeader(t *testing.T) {
|
|
tr := NewTenantResolver(&mockTenantLookup{})
|
|
next := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
t.Fatal("next should not be called")
|
|
})
|
|
|
|
r := httptest.NewRequest("GET", "/api/cases", nil)
|
|
r.Header.Set("X-Tenant-ID", "not-a-uuid")
|
|
r = r.WithContext(ContextWithUserID(r.Context(), uuid.New()))
|
|
w := httptest.NewRecorder()
|
|
|
|
tr.Resolve(next).ServeHTTP(w, r)
|
|
|
|
if w.Code != http.StatusBadRequest {
|
|
t.Errorf("expected 400, got %d", w.Code)
|
|
}
|
|
}
|
|
|
|
func TestTenantResolver_NoTenantForUser(t *testing.T) {
|
|
tr := NewTenantResolver(&mockTenantLookup{tenantID: nil})
|
|
next := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
t.Fatal("next should not be called")
|
|
})
|
|
|
|
r := httptest.NewRequest("GET", "/api/cases", nil)
|
|
r = r.WithContext(ContextWithUserID(r.Context(), uuid.New()))
|
|
w := httptest.NewRecorder()
|
|
|
|
tr.Resolve(next).ServeHTTP(w, r)
|
|
|
|
if w.Code != http.StatusBadRequest {
|
|
t.Errorf("expected 400, got %d", w.Code)
|
|
}
|
|
}
|