Initial Dever 0.0.1

test/rust/runtime/auth/metadata.rs

@@ -0,0 +1,119 @@
+use super::request::{configured, request};
+use dever_runtime::{
+    auth::{CookieOptions, Error, SameSite},
+    value::secret::Secret,
+};
+
+fn options() -> CookieOptions {
+    CookieOptions {
+        path: "/".into(),
+        domain: None,
+        max_age: None,
+        same_site: SameSite::Lax,
+        secure: true,
+        http_only: true,
+    }
+}
+
+#[test]
+fn metadata_guards_secret_values_cookie_origin_and_response_fields() {
+    let service = configured(Some("https://unit.test"), "user.account.verify").unwrap();
+    let request = request(
+        "POST",
+        &[
+            ("Host", "unit.test"),
+            ("Origin", "https://unit.test"),
+            ("Cookie", "theme=light; private=v1.c2VjcmV0"),
+            ("X-Test", "value"),
+            ("X-Forwarded-For", "203.0.113.9"),
+        ],
+    );
+    let (mut context, _) = service
+        .prepare_at(
+            "admin",
+            &request,
+            true,
+            100,
+            "127.0.0.1:1234".parse().unwrap(),
+        )
+        .unwrap();
+    assert_eq!(context.client_address().unwrap(), "127.0.0.1");
+    assert_eq!(context.request_id().unwrap(), context.request_id().unwrap());
+    assert_eq!(context.header("X-Test").unwrap().as_deref(), Some("value"));
+    assert_eq!(context.cookie("theme").unwrap().as_deref(), Some("light"));
+    assert!(matches!(context.cookie("private"), Err(Error::Forbidden)));
+    assert!(context.secret_cookie("private").unwrap().is_some());
+    assert!(context.secret_cookie("theme").unwrap().is_none());
+    for name in [
+        "Authorization",
+        "Cookie",
+        "Set-Cookie",
+        "Proxy-Authorization",
+        "X-Api-Key",
+    ] {
+        assert!(context.header(name).is_err());
+    }
+    for name in [
+        "Set-Cookie",
+        "Content-Length",
+        "Content-Type",
+        "Connection",
+        "Upgrade",
+    ] {
+        assert!(context.set_header(name, "value").is_err());
+    }
+    assert!(
+        context
+            .set_header("X-Test", "value\r\nInjected: yes")
+            .is_err()
+    );
+    assert!(context.set_header("X-Test", &"x".repeat(9000)).is_err());
+    assert!(
+        context
+            .set_cookie("session", "cannot overwrite provider", options())
+            .is_err()
+    );
+    assert!(
+        context
+            .set_cookie("theme", "bad; value", options())
+            .is_err()
+    );
+    assert!(
+        context
+            .set_secret_cookie(
+                "private",
+                &Secret::from_input(b"bytes".to_vec()),
+                CookieOptions {
+                    secure: false,
+                    ..options()
+                }
+            )
+            .is_err()
+    );
+    context
+        .set_secret_cookie("private", &Secret::from_input(b"bytes".to_vec()), options())
+        .unwrap();
+    assert!(
+        context
+            .set_cookie(
+                "cross",
+                "value",
+                CookieOptions {
+                    same_site: SameSite::None,
+                    secure: false,
+                    ..options()
+                }
+            )
+            .is_err()
+    );
+    context.set_header("X-Test", "response").unwrap();
+    let mut response = dever_runtime::api::response("{}");
+    context.publish(&mut response);
+    assert!(
+        response
+            .headers()
+            .get_all("set-cookie")
+            .iter()
+            .any(|header| header.as_bytes().starts_with(b"private=v1.Ynl0ZXM;"))
+    );
+}