mirror of
https://github.com/go-vikunja/vikunja.git
synced 2026-11-09 00:22:38 -06:00
kolaente
912e899c10
GetAuthFromClaims opened a session and loaded the token owner by id on every call, although the token middleware had already put the user into the context. With the metrics middleware and the handler both resolving the auth, that was two extra transactions and user lookups per request authenticated with an API token.
44 lines
1.5 KiB
Go
44 lines
1.5 KiB
Go
// Vikunja is a to-do list application to facilitate your life.
|
|
// Copyright 2018-present Vikunja and contributors. All rights reserved.
|
|
//
|
|
// This program is free software: you can redistribute it and/or modify
|
|
// it under the terms of the GNU Affero General Public License as published by
|
|
// the Free Software Foundation, either version 3 of the License, or
|
|
// (at your option) any later version.
|
|
//
|
|
// This program is distributed in the hope that it will be useful,
|
|
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
// GNU Affero General Public License for more details.
|
|
//
|
|
// You should have received a copy of the GNU Affero General Public License
|
|
// along with this program. If not, see <https://www.gnu.org/licenses/>.
|
|
|
|
package auth
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
|
|
"code.vikunja.io/api/pkg/models"
|
|
"code.vikunja.io/api/pkg/user"
|
|
|
|
"github.com/labstack/echo/v5"
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestGetAuthFromClaimsUsesTheAPIUserFromContext(t *testing.T) {
|
|
e := echo.New()
|
|
c := e.NewContext(httptest.NewRequest(http.MethodGet, "/", nil), httptest.NewRecorder())
|
|
owner := &user.User{ID: 42, Username: "owner"}
|
|
// No database behind this test: a lookup by token would fail, the context user must win.
|
|
c.Set("api_token", &models.APIToken{ID: 1, OwnerID: 42})
|
|
c.Set("api_user", owner)
|
|
|
|
a, err := GetAuthFromClaims(c)
|
|
require.NoError(t, err)
|
|
assert.Same(t, owner, a)
|
|
}
|