Ilia Denisov
118f7c17a2
Replace the native-gRPC server bootstrap with a single `connectrpc.com/connect` HTTP/h2c listener. Connect-Go natively serves Connect, gRPC, and gRPC-Web on the same port, so browsers can now reach the authenticated surface without giving up the gRPC framing native and desktop clients may use later. The decorator stack (envelope → session → payload-hash → signature → freshness/replay → rate-limit → routing/push) is reused unchanged behind a small Connect → gRPC adapter and a `grpc.ServerStream` shim around `*connect.ServerStream`. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
108 lines
3.5 KiB
Go
108 lines
3.5 KiB
Go
package grpcapi
|
|
|
|
import (
|
|
"context"
|
|
"crypto/sha256"
|
|
"testing"
|
|
|
|
"galaxy/gateway/internal/session"
|
|
|
|
"connectrpc.com/connect"
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestExecuteCommandRejectsPayloadHashWithInvalidLength(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
delegate := &recordingEdgeGatewayService{}
|
|
server, runGateway := newTestGateway(t, ServerDependencies{
|
|
Service: delegate,
|
|
SessionCache: staticSessionCache{lookupFunc: func(context.Context, string) (session.Record, error) { return newActiveSessionRecord(), nil }},
|
|
})
|
|
defer runGateway.stop(t)
|
|
|
|
addr := waitForListenAddr(t, server)
|
|
client := newEdgeClient(t, addr)
|
|
|
|
req := newValidExecuteCommandRequest()
|
|
req.PayloadHash = []byte("short")
|
|
|
|
_, err := client.ExecuteCommand(context.Background(), connect.NewRequest(req))
|
|
require.Error(t, err)
|
|
assert.Equal(t, connect.CodeInvalidArgument, connect.CodeOf(err))
|
|
assert.Equal(t, "payload_hash must be a 32-byte SHA-256 digest", connectErrorMessage(t, err))
|
|
assert.Zero(t, delegate.executeCalls)
|
|
}
|
|
|
|
func TestExecuteCommandRejectsPayloadHashMismatch(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
delegate := &recordingEdgeGatewayService{}
|
|
server, runGateway := newTestGateway(t, ServerDependencies{
|
|
Service: delegate,
|
|
SessionCache: staticSessionCache{lookupFunc: func(context.Context, string) (session.Record, error) { return newActiveSessionRecord(), nil }},
|
|
})
|
|
defer runGateway.stop(t)
|
|
|
|
addr := waitForListenAddr(t, server)
|
|
client := newEdgeClient(t, addr)
|
|
|
|
req := newValidExecuteCommandRequest()
|
|
sum := sha256.Sum256([]byte("other"))
|
|
req.PayloadHash = sum[:]
|
|
|
|
_, err := client.ExecuteCommand(context.Background(), connect.NewRequest(req))
|
|
require.Error(t, err)
|
|
assert.Equal(t, connect.CodeInvalidArgument, connect.CodeOf(err))
|
|
assert.Equal(t, "payload_hash does not match payload_bytes", connectErrorMessage(t, err))
|
|
assert.Zero(t, delegate.executeCalls)
|
|
}
|
|
|
|
func TestSubscribeEventsRejectsPayloadHashWithInvalidLength(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
delegate := &recordingEdgeGatewayService{}
|
|
server, runGateway := newTestGateway(t, ServerDependencies{
|
|
Service: delegate,
|
|
SessionCache: staticSessionCache{lookupFunc: func(context.Context, string) (session.Record, error) { return newActiveSessionRecord(), nil }},
|
|
})
|
|
defer runGateway.stop(t)
|
|
|
|
addr := waitForListenAddr(t, server)
|
|
client := newEdgeClient(t, addr)
|
|
|
|
req := newValidSubscribeEventsRequest()
|
|
req.PayloadHash = []byte("short")
|
|
|
|
err := subscribeEventsError(t, context.Background(), client, req)
|
|
require.Error(t, err)
|
|
assert.Equal(t, connect.CodeInvalidArgument, connect.CodeOf(err))
|
|
assert.Equal(t, "payload_hash must be a 32-byte SHA-256 digest", connectErrorMessage(t, err))
|
|
assert.Zero(t, delegate.subscribeCalls)
|
|
}
|
|
|
|
func TestSubscribeEventsRejectsPayloadHashMismatch(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
delegate := &recordingEdgeGatewayService{}
|
|
server, runGateway := newTestGateway(t, ServerDependencies{
|
|
Service: delegate,
|
|
SessionCache: staticSessionCache{lookupFunc: func(context.Context, string) (session.Record, error) { return newActiveSessionRecord(), nil }},
|
|
})
|
|
defer runGateway.stop(t)
|
|
|
|
addr := waitForListenAddr(t, server)
|
|
client := newEdgeClient(t, addr)
|
|
|
|
req := newValidSubscribeEventsRequest()
|
|
sum := sha256.Sum256([]byte("other"))
|
|
req.PayloadHash = sum[:]
|
|
|
|
err := subscribeEventsError(t, context.Background(), client, req)
|
|
require.Error(t, err)
|
|
assert.Equal(t, connect.CodeInvalidArgument, connect.CodeOf(err))
|
|
assert.Equal(t, "payload_hash does not match payload_bytes", connectErrorMessage(t, err))
|
|
assert.Zero(t, delegate.subscribeCalls)
|
|
}
|