claude BotandClaude Opus 5.5
eeda956d24
- internal/tokens : jetons personnels hachés (DATA_DIR/.tokens.json), authentification Bearer devant la session, routes /api/tokens, serveur d'autorisation OAuth 2.1 (DCR, PKCE S256, rotation) pour les connecteurs claude.ai / Claude Desktop, consentement adossé à la session. - internal/mcp : JSON-RPC Streamable HTTP, outils list/search/read/ write_diagram et create_folder, normalisation des éléments (label, liaisons start/end des flèches). - main.go : PUBLIC_URL, OAUTH_REDIRECT_HOSTS, chemins OAuth publics. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Nh6YQSjM9ni5jiTc8u5Tj1
90 lines
2.8 KiB
Go
90 lines
2.8 KiB
Go
package main
|
|
|
|
import (
|
|
"context"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestBasicAuthPublicPaths(t *testing.T) {
|
|
ok := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {})
|
|
h := basicAuth(ok, "u", "p", public)
|
|
cases := map[string]int{
|
|
"/healthz": 200,
|
|
"/s/abc.def": 200,
|
|
"/api/public/abc.def": 200,
|
|
"/": 401,
|
|
"/index.html": 401,
|
|
"/api/list": 401,
|
|
"/api/file?path=x": 401,
|
|
"/api/publicx": 401,
|
|
"/assets/": 401, // dossier : pas un fichier statique
|
|
"/inconnu": 401,
|
|
"/.well-known/oauth-protected-resource/mcp": 200,
|
|
"/.well-known/oauth-authorization-server": 200,
|
|
"/oauth/register": 200,
|
|
"/oauth/token": 200,
|
|
"/oauth/authorize": 401, // consentement : session requise
|
|
"/mcp": 401, // jeton requis (middleware des jetons)
|
|
}
|
|
for p, want := range cases {
|
|
rec := httptest.NewRecorder()
|
|
h.ServeHTTP(rec, httptest.NewRequest("GET", p, nil))
|
|
if rec.Code != want {
|
|
t.Errorf("%s : %d, attendu %d", p, rec.Code, want)
|
|
}
|
|
}
|
|
rec := httptest.NewRecorder()
|
|
req := httptest.NewRequest("GET", "/api/list", nil)
|
|
req.SetBasicAuth("u", "p")
|
|
h.ServeHTTP(rec, req)
|
|
if rec.Code != 200 {
|
|
t.Errorf("authentifié : %d", rec.Code)
|
|
}
|
|
}
|
|
|
|
func TestAuthenticateModes(t *testing.T) {
|
|
me := func(t *testing.T, h http.Handler, user string) string {
|
|
rec := httptest.NewRecorder()
|
|
req := httptest.NewRequest("GET", "/api/me", nil)
|
|
if user != "" {
|
|
req.SetBasicAuth(user, "p")
|
|
}
|
|
h.ServeHTTP(rec, req)
|
|
return strings.TrimSpace(rec.Body.String())
|
|
}
|
|
|
|
t.Run("local sans identifiants", func(t *testing.T) {
|
|
t.Setenv("AUTH_MODE", "")
|
|
t.Setenv("AUTH_USER", "")
|
|
h, err := authenticate(context.Background(), http.NewServeMux(), t.TempDir())
|
|
if err != nil || me(t, h, "") != `{"mode":"none","id":"local"}` {
|
|
t.Fatalf("%v %s", err, me(t, h, ""))
|
|
}
|
|
})
|
|
t.Run("local Basic", func(t *testing.T) {
|
|
t.Setenv("AUTH_MODE", "local")
|
|
t.Setenv("AUTH_USER", "u")
|
|
t.Setenv("AUTH_PASSWORD", "p")
|
|
h, err := authenticate(context.Background(), http.NewServeMux(), t.TempDir())
|
|
if err != nil || !strings.Contains(me(t, h, "u"), `"mode":"local"`) {
|
|
t.Fatalf("%v %s", err, me(t, h, "u"))
|
|
}
|
|
})
|
|
t.Run("oidc sans émetteur", func(t *testing.T) {
|
|
t.Setenv("AUTH_MODE", "oidc")
|
|
t.Setenv("OIDC_ISSUER", "")
|
|
if _, err := authenticate(context.Background(), http.NewServeMux(), t.TempDir()); err == nil {
|
|
t.Fatal("configuration incomplète acceptée")
|
|
}
|
|
})
|
|
t.Run("mode inconnu", func(t *testing.T) {
|
|
t.Setenv("AUTH_MODE", "ldap")
|
|
if _, err := authenticate(context.Background(), http.NewServeMux(), t.TempDir()); err == nil {
|
|
t.Fatal("AUTH_MODE inconnu accepté")
|
|
}
|
|
})
|
|
}
|