git init

control-plane/backend/agent_test.go

@@ -0,0 +1,64 @@
+package main
+
+import (
+	"context"
+	"io"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestAgentEndpointValidation(t *testing.T) {
+	for _, endpoint := range []string{"http://127.0.0.1:9105", "https://10.10.0.2:9105", "http://[fd00::1]:9105"} {
+		if err := validateAgentEndpoint(endpoint); err != nil {
+			t.Fatalf("%s: %v", endpoint, err)
+		}
+	}
+	for _, endpoint := range []string{"http://0.0.0.0:9105", "http://8.8.8.8:9105", "https://agent.example:9105", "file:///etc/passwd", "http://127.0.0.1:9105/path"} {
+		if validateAgentEndpoint(endpoint) == nil {
+			t.Fatalf("unsafe endpoint accepted: %s", endpoint)
+		}
+	}
+}
+
+func TestCredentialReferences(t *testing.T) {
+	if !validCredentialRef("agent_primary.token") {
+		t.Fatal("valid ref rejected")
+	}
+	for _, value := range []string{"", "../secret", "path/name", ".", "bad ref"} {
+		if validCredentialRef(value) {
+			t.Fatalf("invalid ref accepted: %q", value)
+		}
+	}
+}
+
+func TestAgentClientAuthenticatesAndBoundsPath(t *testing.T) {
+	token := strings.Repeat("a", 32)
+	dir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(dir, "agent"), []byte(token), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	client := NewAgentClient(dir)
+	client.http.Transport = roundTripFunc(func(request *http.Request) (*http.Response, error) {
+		if request.Header.Get("Authorization") != "Bearer "+token {
+			t.Error("missing token")
+		}
+		return &http.Response{StatusCode: 200, Header: make(http.Header), Body: io.NopCloser(strings.NewReader(`{"ok":true}`))}, nil
+	})
+	server := Server{AgentEndpoint: "http://127.0.0.1:9105", CredentialRef: "agent"}
+	status, _, err := client.Do(context.Background(), server, http.MethodGet, "/v1/version", nil)
+	if err != nil || status != 200 {
+		t.Fatalf("agent request failed: status=%d err=%v", status, err)
+	}
+	if _, _, err = client.Do(context.Background(), server, http.MethodGet, "/private", nil); err == nil {
+		t.Fatal("out-of-contract path accepted")
+	}
+}
+
+type roundTripFunc func(*http.Request) (*http.Response, error)
+
+func (function roundTripFunc) RoundTrip(request *http.Request) (*http.Response, error) {
+	return function(request)
+}