Authentication: Implements authentication

web/server_test.go

@@ -1,6 +1,7 @@
 package web_test
 
 import (
+	"bytes"
 	"encoding/json"
 	"io"
 	"net/http"
@@ -14,7 +15,7 @@ import (
 )
 
 func TestVersion(t *testing.T) {
-	s := httptest.NewServer(web.NewMockHTTPServer())
+	s := httptest.NewServer(web.NewMockHTTPServer(web.MockHTTPServerConfiguration{}))
 
 	resp, err := http.Get(s.URL + "/version")
 	if err != nil {
@@ -32,7 +33,7 @@ func TestVersion(t *testing.T) {
 }
 
 func TestStatus(t *testing.T) {
-	s := httptest.NewServer(web.NewMockHTTPServer())
+	s := httptest.NewServer(web.NewMockHTTPServer(web.MockHTTPServerConfiguration{}))
 
 	resp, err := http.Get(s.URL + "/status")
 	if err != nil {
@@ -50,7 +51,7 @@ func TestStatus(t *testing.T) {
 }
 
 func TestConversations(t *testing.T) {
-	server := web.NewMockHTTPServer()
+	server := web.NewMockHTTPServer(web.MockHTTPServerConfiguration{})
 	httpServer := httptest.NewServer(server)
 
 	conversation := model.Conversation{
@@ -105,3 +106,91 @@ func TestConversations(t *testing.T) {
 		t.Fatalf("Unexpected conversation Date: %s (expected %s)", convos[0].Date, conversation.Date)
 	}
 }
+
+func TestAuthentication(t *testing.T) {
+	s := web.NewMockHTTPServer(web.MockHTTPServerConfiguration{AuthEnabled: true})
+	httpServer := httptest.NewServer(s)
+
+	// First, try authenticated request and make sure it fails
+	resp, err := http.Get(httpServer.URL + "/status")
+	if err != nil {
+		t.Fatalf("TestAuthentication status error: %s", err)
+	}
+
+	if resp.StatusCode != http.StatusUnauthorized {
+		t.Fatalf("Unexpected status code: %d (expected %d)", resp.StatusCode, http.StatusUnauthorized)
+	}
+
+	tryAuthenticate := func(username string, password string) *http.Response {
+		authRequest := web.AuthenticationRequest{
+			Username: username,
+			Password: password,
+		}
+
+		authRequestJSON, err := json.Marshal(authRequest)
+		if err != nil {
+			t.Fatalf("Error marshalling JSON: %s", err)
+		}
+
+		resp, err := http.Post(httpServer.URL+"/authenticate", "application/json", io.NopCloser(bytes.NewReader(authRequestJSON)))
+		if err != nil {
+			t.Fatalf("TestAuthentication error: %s", err)
+		}
+
+		return resp
+	}
+
+	// Send authentication request with bad credentials
+	resp = tryAuthenticate("bad", "credentials")
+	if resp.StatusCode == http.StatusOK {
+		t.Fatalf("Unexpected status code: %d (expected %d)", resp.StatusCode, http.StatusUnauthorized)
+	}
+
+	// Now try good credentials
+	resp = tryAuthenticate(server.AUTH_USERNAME, server.AUTH_PASSWORD)
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("Unexpected status code: %d (expected %d)", resp.StatusCode, http.StatusOK)
+	}
+
+	// Decode the token from the body.
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		t.Fatalf("Error decoding body: %s", body)
+	}
+
+	var authToken model.AuthToken
+	err = json.Unmarshal(body, &authToken)
+	if err != nil {
+		t.Fatalf("Error unmarshalling JSON: %s, body: %s", err, body)
+	}
+
+	if authToken.SignedToken == "" {
+		t.Fatalf("Unexpected empty signed token")
+	}
+
+	// Send a request with the signed token
+	req, err := http.NewRequest(http.MethodGet, httpServer.URL+"/status", nil)
+	if err != nil {
+		t.Fatalf("Error creating request: %s", err)
+	}
+
+	req.Header.Set("Authorization", "Bearer "+authToken.SignedToken)
+
+	resp, err = http.DefaultClient.Do(req)
+	if err != nil {
+		t.Fatalf("Error sending request: %s", err)
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("Unexpected status code: %d (expected %d)", resp.StatusCode, http.StatusUnauthorized)
+	}
+
+	body, err = io.ReadAll(resp.Body)
+	if err != nil {
+		t.Fatalf("Error decoding body: %s", body)
+	}
+
+	if string(body) != "OK" {
+		t.Fatalf("Unexpected body: %s (expected %s)", body, "OK")
+	}
+}