Ilia Denisov
509 lines
20 KiB
Go
509 lines
20 KiB
Go
// Package lobbyauthsession_test exercises the authenticated context
|
|
// propagation between Auth/Session Service and Game Lobby. The
|
|
// architecture wires the two services through Gateway: AuthSession
|
|
// owns the device-session lifecycle, Gateway projects sessions into
|
|
// its cache and signs request envelopes, and Lobby reads the
|
|
// resolved `X-User-Id` from the gateway-authenticated downstream
|
|
// hop.
|
|
//
|
|
// The boundary contract under test is: revoking a device session
|
|
// through AuthSession's internal API removes the session projection
|
|
// from the gateway cache, after which Gateway refuses to route any
|
|
// subsequent `lobby.*` command for that session. The suite asserts
|
|
// the boundary on the public surfaces: AuthSession internal REST,
|
|
// Gateway authenticated gRPC, and Lobby state via direct REST
|
|
// observation.
|
|
//
|
|
// Coverage maps onto `TESTING.md §6` `Lobby ↔ Auth/Session`:
|
|
// "authenticated context correctly propagated from gateway".
|
|
package lobbyauthsession_test
|
|
|
|
import (
|
|
"bytes"
|
|
"context"
|
|
"crypto/ed25519"
|
|
"crypto/sha256"
|
|
"encoding/base64"
|
|
"encoding/json"
|
|
"errors"
|
|
"io"
|
|
"net/http"
|
|
"path/filepath"
|
|
"testing"
|
|
"time"
|
|
|
|
gatewayv1 "galaxy/gateway/proto/galaxy/gateway/v1"
|
|
contractsgatewayv1 "galaxy/integration/internal/contracts/gatewayv1"
|
|
"galaxy/integration/internal/harness"
|
|
lobbymodel "galaxy/model/lobby"
|
|
"galaxy/transcoder"
|
|
|
|
"github.com/redis/go-redis/v9"
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
"google.golang.org/grpc"
|
|
"google.golang.org/grpc/codes"
|
|
"google.golang.org/grpc/credentials/insecure"
|
|
"google.golang.org/grpc/status"
|
|
)
|
|
|
|
// TestSessionRevocationStopsGatewayFromRoutingLobbyCommands proves
|
|
// that AuthSession owns the authenticated context: a successful
|
|
// `lobby.my.games.list` command before the revoke must succeed, and
|
|
// the same command after the revoke must fail at Gateway with
|
|
// Unauthenticated, never reaching Lobby.
|
|
func TestSessionRevocationStopsGatewayFromRoutingLobbyCommands(t *testing.T) {
|
|
h := newHarness(t)
|
|
|
|
clientKey := newClientPrivateKey("g4-revoke")
|
|
deviceSessionID, _ := h.authenticate(t, "revoke@example.com", clientKey)
|
|
|
|
conn := h.dialGateway(t)
|
|
client := gatewayv1.NewEdgeGatewayClient(conn)
|
|
|
|
// Pre-revoke: lobby.my.games.list must succeed.
|
|
requestBytes, err := transcoder.MyGamesListRequestToPayload(&lobbymodel.MyGamesListRequest{})
|
|
require.NoError(t, err)
|
|
preResponse, err := client.ExecuteCommand(context.Background(),
|
|
newExecuteCommandRequest(deviceSessionID, "req-pre-revoke", lobbymodel.MessageTypeMyGamesList, requestBytes, clientKey),
|
|
)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, "ok", preResponse.GetResultCode())
|
|
|
|
// Revoke through AuthSession internal API.
|
|
h.revokeSession(t, deviceSessionID)
|
|
|
|
// Wait for the gateway projection to drop / flip to revoked.
|
|
h.waitForSessionGone(t, deviceSessionID, 5*time.Second)
|
|
|
|
// Post-revoke: same command must be rejected at Gateway.
|
|
postResponse, err := client.ExecuteCommand(context.Background(),
|
|
newExecuteCommandRequest(deviceSessionID, "req-post-revoke", lobbymodel.MessageTypeMyGamesList, requestBytes, clientKey),
|
|
)
|
|
require.Error(t, err, "post-revoke command must fail at Gateway")
|
|
require.Nil(t, postResponse)
|
|
|
|
statusCode := status.Code(err)
|
|
require.Truef(t,
|
|
statusCode == codes.Unauthenticated ||
|
|
statusCode == codes.PermissionDenied ||
|
|
statusCode == codes.FailedPrecondition,
|
|
"post-revoke must fail with Unauthenticated/PermissionDenied/FailedPrecondition, got %s: %v",
|
|
statusCode, err,
|
|
)
|
|
}
|
|
|
|
// --- harness ---
|
|
|
|
type lobbyAuthsessionHarness struct {
|
|
redis *redis.Client
|
|
|
|
mailStub *harness.MailStub
|
|
|
|
authsessionPublicURL string
|
|
authsessionInternalURL string
|
|
gatewayPublicURL string
|
|
gatewayGRPCAddr string
|
|
userServiceURL string
|
|
lobbyPublicURL string
|
|
|
|
processes []*harness.Process
|
|
}
|
|
|
|
func newHarness(t *testing.T) *lobbyAuthsessionHarness {
|
|
t.Helper()
|
|
|
|
redisRuntime := harness.StartRedisContainer(t)
|
|
redisClient := redis.NewClient(&redis.Options{
|
|
Addr: redisRuntime.Addr,
|
|
Protocol: 2,
|
|
DisableIdentity: true,
|
|
})
|
|
t.Cleanup(func() { require.NoError(t, redisClient.Close()) })
|
|
|
|
mailStub := harness.NewMailStub(t)
|
|
responseSignerPath, _ := harness.WriteResponseSignerPEM(t, t.Name())
|
|
|
|
userServiceAddr := harness.FreeTCPAddress(t)
|
|
authsessionPublicAddr := harness.FreeTCPAddress(t)
|
|
authsessionInternalAddr := harness.FreeTCPAddress(t)
|
|
gatewayPublicAddr := harness.FreeTCPAddress(t)
|
|
gatewayGRPCAddr := harness.FreeTCPAddress(t)
|
|
lobbyPublicAddr := harness.FreeTCPAddress(t)
|
|
lobbyInternalAddr := harness.FreeTCPAddress(t)
|
|
|
|
userServiceBinary := harness.BuildBinary(t, "userservice", "./user/cmd/userservice")
|
|
authsessionBinary := harness.BuildBinary(t, "authsession", "./authsession/cmd/authsession")
|
|
gatewayBinary := harness.BuildBinary(t, "gateway", "./gateway/cmd/gateway")
|
|
lobbyBinary := harness.BuildBinary(t, "lobby", "./lobby/cmd/lobby")
|
|
|
|
userServiceEnv := harness.StartUserServicePersistence(t, redisRuntime.Addr).Env
|
|
userServiceEnv["USERSERVICE_LOG_LEVEL"] = "info"
|
|
userServiceEnv["USERSERVICE_INTERNAL_HTTP_ADDR"] = userServiceAddr
|
|
userServiceEnv["OTEL_TRACES_EXPORTER"] = "none"
|
|
userServiceEnv["OTEL_METRICS_EXPORTER"] = "none"
|
|
userServiceProcess := harness.StartProcess(t, "userservice", userServiceBinary, userServiceEnv)
|
|
waitForUserServiceReady(t, userServiceProcess, "http://"+userServiceAddr)
|
|
|
|
authsessionEnv := map[string]string{
|
|
"AUTHSESSION_LOG_LEVEL": "info",
|
|
"AUTHSESSION_PUBLIC_HTTP_ADDR": authsessionPublicAddr,
|
|
"AUTHSESSION_PUBLIC_HTTP_REQUEST_TIMEOUT": time.Second.String(),
|
|
"AUTHSESSION_INTERNAL_HTTP_ADDR": authsessionInternalAddr,
|
|
"AUTHSESSION_INTERNAL_HTTP_REQUEST_TIMEOUT": time.Second.String(),
|
|
"AUTHSESSION_REDIS_MASTER_ADDR": redisRuntime.Addr,
|
|
"AUTHSESSION_REDIS_PASSWORD": "integration",
|
|
"AUTHSESSION_USER_SERVICE_MODE": "rest",
|
|
"AUTHSESSION_USER_SERVICE_BASE_URL": "http://" + userServiceAddr,
|
|
"AUTHSESSION_USER_SERVICE_REQUEST_TIMEOUT": time.Second.String(),
|
|
"AUTHSESSION_MAIL_SERVICE_MODE": "rest",
|
|
"AUTHSESSION_MAIL_SERVICE_BASE_URL": mailStub.BaseURL(),
|
|
"AUTHSESSION_MAIL_SERVICE_REQUEST_TIMEOUT": time.Second.String(),
|
|
"AUTHSESSION_REDIS_GATEWAY_SESSION_CACHE_KEY_PREFIX": "gateway:session:",
|
|
"AUTHSESSION_REDIS_GATEWAY_SESSION_EVENTS_STREAM": "gateway:session_events",
|
|
"OTEL_TRACES_EXPORTER": "none",
|
|
"OTEL_METRICS_EXPORTER": "none",
|
|
}
|
|
authsessionProcess := harness.StartProcess(t, "authsession", authsessionBinary, authsessionEnv)
|
|
waitForAuthsessionReady(t, authsessionProcess, "http://"+authsessionPublicAddr)
|
|
|
|
lobbyEnv := harness.StartLobbyServicePersistence(t, redisRuntime.Addr).Env
|
|
lobbyEnv["LOBBY_LOG_LEVEL"] = "info"
|
|
lobbyEnv["LOBBY_PUBLIC_HTTP_ADDR"] = lobbyPublicAddr
|
|
lobbyEnv["LOBBY_INTERNAL_HTTP_ADDR"] = lobbyInternalAddr
|
|
lobbyEnv["LOBBY_USER_SERVICE_BASE_URL"] = "http://" + userServiceAddr
|
|
lobbyEnv["LOBBY_GM_BASE_URL"] = mailStub.BaseURL()
|
|
lobbyEnv["LOBBY_RUNTIME_JOB_RESULTS_READ_BLOCK_TIMEOUT"] = "200ms"
|
|
lobbyEnv["LOBBY_USER_LIFECYCLE_READ_BLOCK_TIMEOUT"] = "200ms"
|
|
lobbyEnv["LOBBY_GM_EVENTS_READ_BLOCK_TIMEOUT"] = "200ms"
|
|
lobbyEnv["OTEL_TRACES_EXPORTER"] = "none"
|
|
lobbyEnv["OTEL_METRICS_EXPORTER"] = "none"
|
|
lobbyProcess := harness.StartProcess(t, "lobby", lobbyBinary, lobbyEnv)
|
|
harness.WaitForHTTPStatus(t, lobbyProcess, "http://"+lobbyInternalAddr+"/readyz", http.StatusOK)
|
|
|
|
gatewayEnv := map[string]string{
|
|
"GATEWAY_LOG_LEVEL": "info",
|
|
"GATEWAY_PUBLIC_HTTP_ADDR": gatewayPublicAddr,
|
|
"GATEWAY_AUTHENTICATED_GRPC_ADDR": gatewayGRPCAddr,
|
|
"GATEWAY_REDIS_MASTER_ADDR": redisRuntime.Addr,
|
|
"GATEWAY_REDIS_PASSWORD": "integration",
|
|
"GATEWAY_SESSION_CACHE_REDIS_KEY_PREFIX": "gateway:session:",
|
|
"GATEWAY_SESSION_EVENTS_REDIS_STREAM": "gateway:session_events",
|
|
"GATEWAY_CLIENT_EVENTS_REDIS_STREAM": "gateway:client_events",
|
|
"GATEWAY_REPLAY_REDIS_KEY_PREFIX": "gateway:replay:",
|
|
"GATEWAY_RESPONSE_SIGNER_PRIVATE_KEY_PEM_PATH": filepath.Clean(responseSignerPath),
|
|
"GATEWAY_AUTH_SERVICE_BASE_URL": "http://" + authsessionPublicAddr,
|
|
"GATEWAY_USER_SERVICE_BASE_URL": "http://" + userServiceAddr,
|
|
"GATEWAY_LOBBY_SERVICE_BASE_URL": "http://" + lobbyPublicAddr,
|
|
"GATEWAY_PUBLIC_AUTH_UPSTREAM_TIMEOUT": (500 * time.Millisecond).String(),
|
|
"GATEWAY_PUBLIC_HTTP_ANTI_ABUSE_PUBLIC_AUTH_RATE_LIMIT_REQUESTS": "100",
|
|
"GATEWAY_PUBLIC_HTTP_ANTI_ABUSE_PUBLIC_AUTH_RATE_LIMIT_WINDOW": "1s",
|
|
"GATEWAY_PUBLIC_HTTP_ANTI_ABUSE_PUBLIC_AUTH_RATE_LIMIT_BURST": "100",
|
|
"GATEWAY_PUBLIC_HTTP_ANTI_ABUSE_SEND_EMAIL_CODE_IDENTITY_RATE_LIMIT_REQUESTS": "100",
|
|
"GATEWAY_PUBLIC_HTTP_ANTI_ABUSE_SEND_EMAIL_CODE_IDENTITY_RATE_LIMIT_WINDOW": "1s",
|
|
"GATEWAY_PUBLIC_HTTP_ANTI_ABUSE_SEND_EMAIL_CODE_IDENTITY_RATE_LIMIT_BURST": "100",
|
|
"GATEWAY_PUBLIC_HTTP_ANTI_ABUSE_CONFIRM_EMAIL_CODE_IDENTITY_RATE_LIMIT_REQUESTS": "100",
|
|
"GATEWAY_PUBLIC_HTTP_ANTI_ABUSE_CONFIRM_EMAIL_CODE_IDENTITY_RATE_LIMIT_WINDOW": "1s",
|
|
"GATEWAY_PUBLIC_HTTP_ANTI_ABUSE_CONFIRM_EMAIL_CODE_IDENTITY_RATE_LIMIT_BURST": "100",
|
|
"OTEL_TRACES_EXPORTER": "none",
|
|
"OTEL_METRICS_EXPORTER": "none",
|
|
}
|
|
gatewayProcess := harness.StartProcess(t, "gateway", gatewayBinary, gatewayEnv)
|
|
harness.WaitForHTTPStatus(t, gatewayProcess, "http://"+gatewayPublicAddr+"/healthz", http.StatusOK)
|
|
harness.WaitForTCP(t, gatewayProcess, gatewayGRPCAddr)
|
|
|
|
return &lobbyAuthsessionHarness{
|
|
redis: redisClient,
|
|
mailStub: mailStub,
|
|
authsessionPublicURL: "http://" + authsessionPublicAddr,
|
|
authsessionInternalURL: "http://" + authsessionInternalAddr,
|
|
gatewayPublicURL: "http://" + gatewayPublicAddr,
|
|
gatewayGRPCAddr: gatewayGRPCAddr,
|
|
userServiceURL: "http://" + userServiceAddr,
|
|
lobbyPublicURL: "http://" + lobbyPublicAddr,
|
|
processes: []*harness.Process{userServiceProcess, authsessionProcess, lobbyProcess, gatewayProcess},
|
|
}
|
|
}
|
|
|
|
// authenticate runs the public-auth flow through the Gateway and
|
|
// returns the resulting `device_session_id` plus the resolved user_id.
|
|
func (h *lobbyAuthsessionHarness) authenticate(t *testing.T, email string, clientKey ed25519.PrivateKey) (string, string) {
|
|
t.Helper()
|
|
|
|
challengeID := h.sendChallenge(t, email)
|
|
code := h.waitForChallengeCode(t, email)
|
|
|
|
confirm := h.confirmCode(t, challengeID, code, clientKey)
|
|
require.Equalf(t, http.StatusOK, confirm.StatusCode, "confirm: %s", confirm.Body)
|
|
|
|
var confirmBody struct {
|
|
DeviceSessionID string `json:"device_session_id"`
|
|
}
|
|
require.NoError(t, decodeStrictJSONPayload([]byte(confirm.Body), &confirmBody))
|
|
require.NotEmpty(t, confirmBody.DeviceSessionID)
|
|
|
|
user := h.lookupUserByEmail(t, email)
|
|
|
|
deadline := time.Now().Add(5 * time.Second)
|
|
for time.Now().Before(deadline) {
|
|
if _, err := h.redis.Get(context.Background(), "gateway:session:"+confirmBody.DeviceSessionID).Bytes(); err == nil {
|
|
return confirmBody.DeviceSessionID, user.UserID
|
|
}
|
|
time.Sleep(25 * time.Millisecond)
|
|
}
|
|
t.Fatalf("gateway session projection for %s never arrived", confirmBody.DeviceSessionID)
|
|
return "", ""
|
|
}
|
|
|
|
func (h *lobbyAuthsessionHarness) sendChallenge(t *testing.T, email string) string {
|
|
t.Helper()
|
|
resp := postJSON(t, h.gatewayPublicURL+"/api/v1/public/auth/send-email-code", map[string]string{
|
|
"email": email,
|
|
}, nil)
|
|
require.Equalf(t, http.StatusOK, resp.StatusCode, "send-email-code: %s", resp.Body)
|
|
var body struct {
|
|
ChallengeID string `json:"challenge_id"`
|
|
}
|
|
require.NoError(t, decodeStrictJSONPayload([]byte(resp.Body), &body))
|
|
return body.ChallengeID
|
|
}
|
|
|
|
func (h *lobbyAuthsessionHarness) confirmCode(t *testing.T, challengeID, code string, clientKey ed25519.PrivateKey) httpResponse {
|
|
t.Helper()
|
|
return postJSON(t, h.gatewayPublicURL+"/api/v1/public/auth/confirm-email-code", map[string]string{
|
|
"challenge_id": challengeID,
|
|
"code": code,
|
|
"client_public_key": base64.StdEncoding.EncodeToString(clientKey.Public().(ed25519.PublicKey)),
|
|
"time_zone": "Europe/Kaliningrad",
|
|
}, nil)
|
|
}
|
|
|
|
func (h *lobbyAuthsessionHarness) waitForChallengeCode(t *testing.T, email string) string {
|
|
t.Helper()
|
|
deadline := time.Now().Add(5 * time.Second)
|
|
for time.Now().Before(deadline) {
|
|
for _, delivery := range h.mailStub.RecordedDeliveries() {
|
|
if delivery.Email == email && delivery.Code != "" {
|
|
return delivery.Code
|
|
}
|
|
}
|
|
time.Sleep(25 * time.Millisecond)
|
|
}
|
|
t.Fatalf("auth code for %s never arrived", email)
|
|
return ""
|
|
}
|
|
|
|
func (h *lobbyAuthsessionHarness) lookupUserByEmail(t *testing.T, email string) struct {
|
|
UserID string `json:"user_id"`
|
|
} {
|
|
t.Helper()
|
|
resp := postJSON(t, h.userServiceURL+"/api/v1/internal/user-lookups/by-email", map[string]string{"email": email}, nil)
|
|
require.Equalf(t, http.StatusOK, resp.StatusCode, "user lookup: %s", resp.Body)
|
|
var body struct {
|
|
User struct {
|
|
UserID string `json:"user_id"`
|
|
} `json:"user"`
|
|
}
|
|
require.NoError(t, json.Unmarshal([]byte(resp.Body), &body))
|
|
return struct {
|
|
UserID string `json:"user_id"`
|
|
}{UserID: body.User.UserID}
|
|
}
|
|
|
|
// revokeSession calls AuthSession's internal revoke surface for a
|
|
// specific device session. The body shape is defined by
|
|
// `authsession/api/internal-openapi.yaml#RevokeDeviceSessionRequest`.
|
|
func (h *lobbyAuthsessionHarness) revokeSession(t *testing.T, deviceSessionID string) {
|
|
t.Helper()
|
|
target := h.authsessionInternalURL + "/api/v1/internal/sessions/" + deviceSessionID + "/revoke"
|
|
resp := postJSON(t, target, map[string]any{
|
|
"reason_code": "test_revocation",
|
|
"actor": map[string]string{
|
|
"type": "test",
|
|
"id": "lobbyauthsession-suite",
|
|
},
|
|
}, nil)
|
|
require.Truef(t,
|
|
resp.StatusCode == http.StatusOK || resp.StatusCode == http.StatusNoContent,
|
|
"revoke session %s: status=%d body=%s", deviceSessionID, resp.StatusCode, resp.Body,
|
|
)
|
|
}
|
|
|
|
// waitForSessionGone polls the gateway session cache until the
|
|
// session record is removed or marked revoked.
|
|
func (h *lobbyAuthsessionHarness) waitForSessionGone(t *testing.T, deviceSessionID string, timeout time.Duration) {
|
|
t.Helper()
|
|
deadline := time.Now().Add(timeout)
|
|
for time.Now().Before(deadline) {
|
|
payload, err := h.redis.Get(context.Background(), "gateway:session:"+deviceSessionID).Bytes()
|
|
if err == redis.Nil {
|
|
return
|
|
}
|
|
if err == nil {
|
|
var record struct {
|
|
Status string `json:"status"`
|
|
}
|
|
if json.Unmarshal(payload, &record) == nil && record.Status != "active" {
|
|
return
|
|
}
|
|
}
|
|
time.Sleep(25 * time.Millisecond)
|
|
}
|
|
t.Fatalf("session %s still active in gateway cache after %s", deviceSessionID, timeout)
|
|
}
|
|
|
|
func (h *lobbyAuthsessionHarness) dialGateway(t *testing.T) *grpc.ClientConn {
|
|
t.Helper()
|
|
ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
|
|
defer cancel()
|
|
|
|
conn, err := grpc.DialContext(ctx, h.gatewayGRPCAddr,
|
|
grpc.WithTransportCredentials(insecure.NewCredentials()),
|
|
grpc.WithBlock(),
|
|
)
|
|
require.NoError(t, err)
|
|
t.Cleanup(func() { require.NoError(t, conn.Close()) })
|
|
return conn
|
|
}
|
|
|
|
// --- shared helpers ---
|
|
|
|
func newExecuteCommandRequest(deviceSessionID, requestID, messageType string, payload []byte, clientKey ed25519.PrivateKey) *gatewayv1.ExecuteCommandRequest {
|
|
payloadHash := contractsgatewayv1.ComputePayloadHash(payload)
|
|
request := &gatewayv1.ExecuteCommandRequest{
|
|
ProtocolVersion: contractsgatewayv1.ProtocolVersionV1,
|
|
DeviceSessionId: deviceSessionID,
|
|
MessageType: messageType,
|
|
TimestampMs: time.Now().UnixMilli(),
|
|
RequestId: requestID,
|
|
PayloadBytes: payload,
|
|
PayloadHash: payloadHash,
|
|
TraceId: "trace-" + requestID,
|
|
}
|
|
request.Signature = contractsgatewayv1.SignRequest(clientKey, contractsgatewayv1.RequestSigningFields{
|
|
ProtocolVersion: request.GetProtocolVersion(),
|
|
DeviceSessionID: request.GetDeviceSessionId(),
|
|
MessageType: request.GetMessageType(),
|
|
TimestampMS: request.GetTimestampMs(),
|
|
RequestID: request.GetRequestId(),
|
|
PayloadHash: request.GetPayloadHash(),
|
|
})
|
|
return request
|
|
}
|
|
|
|
type httpResponse struct {
|
|
StatusCode int
|
|
Body string
|
|
Header http.Header
|
|
}
|
|
|
|
func postJSON(t *testing.T, url string, body any, header http.Header) httpResponse {
|
|
t.Helper()
|
|
var reader io.Reader
|
|
if body != nil {
|
|
payload, err := json.Marshal(body)
|
|
require.NoError(t, err)
|
|
reader = bytes.NewReader(payload)
|
|
}
|
|
req, err := http.NewRequest(http.MethodPost, url, reader)
|
|
require.NoError(t, err)
|
|
if body != nil {
|
|
req.Header.Set("Content-Type", "application/json")
|
|
}
|
|
for k, vs := range header {
|
|
for _, v := range vs {
|
|
req.Header.Add(k, v)
|
|
}
|
|
}
|
|
return doRequest(t, req)
|
|
}
|
|
|
|
func doRequest(t *testing.T, request *http.Request) httpResponse {
|
|
t.Helper()
|
|
client := &http.Client{
|
|
Timeout: 5 * time.Second,
|
|
Transport: &http.Transport{DisableKeepAlives: true},
|
|
}
|
|
t.Cleanup(client.CloseIdleConnections)
|
|
|
|
response, err := client.Do(request)
|
|
require.NoError(t, err)
|
|
defer response.Body.Close()
|
|
|
|
payload, err := io.ReadAll(response.Body)
|
|
require.NoError(t, err)
|
|
return httpResponse{
|
|
StatusCode: response.StatusCode,
|
|
Body: string(payload),
|
|
Header: response.Header.Clone(),
|
|
}
|
|
}
|
|
|
|
func decodeStrictJSONPayload(payload []byte, target any) error {
|
|
decoder := json.NewDecoder(bytes.NewReader(payload))
|
|
decoder.DisallowUnknownFields()
|
|
if err := decoder.Decode(target); err != nil {
|
|
return err
|
|
}
|
|
if err := decoder.Decode(&struct{}{}); err != io.EOF {
|
|
if err == nil {
|
|
return errors.New("unexpected trailing JSON input")
|
|
}
|
|
return err
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func waitForUserServiceReady(t *testing.T, process *harness.Process, baseURL string) {
|
|
t.Helper()
|
|
client := &http.Client{Timeout: 250 * time.Millisecond}
|
|
t.Cleanup(client.CloseIdleConnections)
|
|
|
|
deadline := time.Now().Add(10 * time.Second)
|
|
for time.Now().Before(deadline) {
|
|
req, err := http.NewRequest(http.MethodGet, baseURL+"/api/v1/internal/users/user-readiness-probe/exists", nil)
|
|
require.NoError(t, err)
|
|
response, err := client.Do(req)
|
|
if err == nil {
|
|
_, _ = io.Copy(io.Discard, response.Body)
|
|
response.Body.Close()
|
|
if response.StatusCode == http.StatusOK {
|
|
return
|
|
}
|
|
}
|
|
time.Sleep(25 * time.Millisecond)
|
|
}
|
|
t.Fatalf("wait for userservice readiness: timeout\n%s", process.Logs())
|
|
}
|
|
|
|
func waitForAuthsessionReady(t *testing.T, process *harness.Process, baseURL string) {
|
|
t.Helper()
|
|
// AuthSession's public listener has no /healthz; posting an empty
|
|
// email send-email-code request is the cheapest readiness probe.
|
|
client := &http.Client{Timeout: 250 * time.Millisecond}
|
|
t.Cleanup(client.CloseIdleConnections)
|
|
|
|
deadline := time.Now().Add(10 * time.Second)
|
|
for time.Now().Before(deadline) {
|
|
body := bytes.NewReader([]byte(`{"email":""}`))
|
|
req, err := http.NewRequest(http.MethodPost, baseURL+"/api/v1/public/auth/send-email-code", body)
|
|
require.NoError(t, err)
|
|
req.Header.Set("Content-Type", "application/json")
|
|
response, err := client.Do(req)
|
|
if err == nil {
|
|
_, _ = io.Copy(io.Discard, response.Body)
|
|
response.Body.Close()
|
|
if response.StatusCode == http.StatusBadRequest {
|
|
return
|
|
}
|
|
}
|
|
time.Sleep(25 * time.Millisecond)
|
|
}
|
|
t.Fatalf("wait for authsession readiness: timeout\n%s", process.Logs())
|
|
}
|
|
|
|
func newClientPrivateKey(label string) ed25519.PrivateKey {
|
|
seed := sha256.Sum256([]byte("galaxy-integration-lobby-authsession-client-" + label))
|
|
return ed25519.NewKeyFromSeed(seed[:])
|
|
}
|