|
| 1 | +// optional_auth_strict_coverage_test.go — registry-iterating regression test |
| 2 | +// for the "anonymous-capable mutating endpoint MUST 401 on a malformed bearer" |
| 3 | +// contract (T19 P1-7, MR-P1-38; rule 18: registry-iterating tests, not |
| 4 | +// hand-typed lists). |
| 5 | +// |
| 6 | +// History: |
| 7 | +// |
| 8 | +// - 2026-05-20: T19 P1-7 migrated /db/new, /vector/new, /cache/new, |
| 9 | +// /nosql/new, /queue/new, /storage/new, /webhook/new from bare |
| 10 | +// OptionalAuth to OptionalAuthStrict so an agent presenting an |
| 11 | +// expired/typo'd bearer header sees a 401 instead of silently |
| 12 | +// getting anonymous-tier provisioning. |
| 13 | +// - 2026-05-21: H46 F1 followed up on /storage/:token/presign for the |
| 14 | +// same reason. |
| 15 | +// - 2026-05-30: this file. /stacks/new + DELETE /stacks/:slug were the |
| 16 | +// two remaining single-site-fallacy misses (rule 17 surface). This |
| 17 | +// test iterates the live route list so the next time a new |
| 18 | +// anonymous-capable mutating endpoint ships, it is verified to be on |
| 19 | +// the strict variant — not by reading the router source, but by |
| 20 | +// replaying a malformed bearer at the route itself. |
| 21 | +// |
| 22 | +// Design: |
| 23 | +// |
| 24 | +// A malformed bearer ("Bearer not-a-jwt") on a strict route MUST |
| 25 | +// produce 401 BEFORE the handler runs. A missing bearer header on the |
| 26 | +// same route must still pass through to the handler (the routes are |
| 27 | +// anonymous-capable). The test asserts both wire shapes per route, so |
| 28 | +// a future drop-back to bare OptionalAuth fails this test loudly |
| 29 | +// regardless of how the route is registered. |
| 30 | +package router_test |
| 31 | + |
| 32 | +import ( |
| 33 | + "net/http" |
| 34 | + "net/http/httptest" |
| 35 | + "testing" |
| 36 | + |
| 37 | + "github.com/stretchr/testify/assert" |
| 38 | + "github.com/stretchr/testify/require" |
| 39 | + |
| 40 | + "instant.dev/internal/email" |
| 41 | + "instant.dev/internal/plans" |
| 42 | + "instant.dev/internal/router" |
| 43 | + "instant.dev/internal/testhelpers" |
| 44 | +) |
| 45 | + |
| 46 | +// anonymousCapableMutatingRoutes is the registry of routes that: |
| 47 | +// |
| 48 | +// 1. accept anonymous callers (no Authorization header is OK), AND |
| 49 | +// 2. mutate state (POST/DELETE/PATCH/PUT — never GET). |
| 50 | +// |
| 51 | +// Every entry MUST be wired with middleware.OptionalAuthStrict (not bare |
| 52 | +// OptionalAuth) per T19 P1-7 / MR-P1-38: a present-but-malformed bearer |
| 53 | +// header is an agent typo / stale token, and silently downgrading to the |
| 54 | +// anonymous tier gives no signal to the caller. |
| 55 | +// |
| 56 | +// Adding a new anonymous-capable mutating endpoint? Add it here AND wire |
| 57 | +// OptionalAuthStrict in router.go. The test below will fail loudly if |
| 58 | +// the chain is wrong. |
| 59 | +var anonymousCapableMutatingRoutes = []struct { |
| 60 | + method string |
| 61 | + path string |
| 62 | +}{ |
| 63 | + {"POST", "/db/new"}, |
| 64 | + {"POST", "/vector/new"}, |
| 65 | + {"POST", "/cache/new"}, |
| 66 | + {"POST", "/nosql/new"}, |
| 67 | + {"POST", "/queue/new"}, |
| 68 | + {"POST", "/storage/new"}, |
| 69 | + {"POST", "/webhook/new"}, |
| 70 | + {"POST", "/stacks/new"}, |
| 71 | + // DELETE /stacks/:slug — anonymous stacks own their slug as a secret; |
| 72 | + // a bad bearer here used to silently downgrade and (after the slug |
| 73 | + // lookup) delete the anonymous stack if the slug happened to match. |
| 74 | + {"DELETE", "/stacks/anonymous-slug-does-not-exist"}, |
| 75 | + // POST /storage/:token/presign — H46 F1 (2026-05-21). Same contract: |
| 76 | + // strict mode keeps a stale session from signing for an unowned |
| 77 | + // tenant prefix. |
| 78 | + {"POST", "/storage/some-token/presign"}, |
| 79 | +} |
| 80 | + |
| 81 | +// TestRouter_AnonymousMutatingRoutes_StrictBearer iterates the registry |
| 82 | +// above and asserts that every entry rejects a malformed bearer with 401 |
| 83 | +// (the OptionalAuthStrict contract). This is a rule-18 registry-driven |
| 84 | +// test: a future drop-back to bare OptionalAuth on any one of these |
| 85 | +// routes fails here regardless of how the router source happens to be |
| 86 | +// arranged. |
| 87 | +func TestRouter_AnonymousMutatingRoutes_StrictBearer(t *testing.T) { |
| 88 | + db, dbClean := testhelpers.SetupTestDB(t) |
| 89 | + defer dbClean() |
| 90 | + rdb, rdbClean := testhelpers.SetupTestRedis(t) |
| 91 | + defer rdbClean() |
| 92 | + |
| 93 | + cfg := newRouterTestConfig() |
| 94 | + cfg.Environment = "production" |
| 95 | + // Storage provider must boot so /storage/new and /storage/:token/presign |
| 96 | + // are registered. shared-key + AllowSharedKey=true reuses the T3 |
| 97 | + // success-branch setup from router_coverage_test.go. |
| 98 | + cfg.ObjectStoreEndpoint = "do-spaces.example.com" |
| 99 | + cfg.ObjectStoreMode = "shared-key" |
| 100 | + cfg.ObjectStoreAllowSharedKey = true |
| 101 | + cfg.ObjectStoreAccessKey = "AKIATEST" |
| 102 | + cfg.ObjectStoreSecretKey = "secret-32-bytes-long-padded-here-okay!" |
| 103 | + cfg.ObjectStoreBucket = "instant-shared-test" |
| 104 | + cfg.ObjectStoreSecure = true |
| 105 | + |
| 106 | + mailer := email.NewNoop() |
| 107 | + planReg := plans.Default() |
| 108 | + |
| 109 | + app, _ := router.NewWithHooks(cfg, db, rdb, nil, mailer, planReg, nil, nil) |
| 110 | + require.NotNil(t, app) |
| 111 | + |
| 112 | + for _, r := range anonymousCapableMutatingRoutes { |
| 113 | + t.Run(r.method+" "+r.path, func(t *testing.T) { |
| 114 | + // Probe 1: malformed bearer → 401. This is the strict-mode |
| 115 | + // contract. The exact 401 reason (malformed/expired/etc.) |
| 116 | + // is asserted in middleware/auth_test.go; here we only care |
| 117 | + // that the route does NOT silently downgrade to anonymous. |
| 118 | + req := httptest.NewRequest(r.method, r.path, nil) |
| 119 | + req.Header.Set("Authorization", "Bearer this-is-not-a-jwt") |
| 120 | + resp, err := app.Test(req, 5_000) |
| 121 | + require.NoError(t, err) |
| 122 | + defer resp.Body.Close() |
| 123 | + assert.Equalf(t, http.StatusUnauthorized, resp.StatusCode, |
| 124 | + "%s %s must 401 on a malformed bearer (OptionalAuthStrict); "+ |
| 125 | + "got %d. If you added this route with bare OptionalAuth, "+ |
| 126 | + "swap to OptionalAuthStrict — see router.go comment "+ |
| 127 | + "above the /db/new line for the rationale.", |
| 128 | + r.method, r.path, resp.StatusCode) |
| 129 | + |
| 130 | + // Probe 2: no Authorization header at all → must NOT 401. |
| 131 | + // The routes are explicitly anonymous-capable; the strict |
| 132 | + // variant only triggers when a header is PRESENT but bad. |
| 133 | + // We accept any non-401 status — the handler downstream |
| 134 | + // may 4xx for a missing body / unknown slug / etc., but |
| 135 | + // that proves the middleware chain let the request through. |
| 136 | + req2 := httptest.NewRequest(r.method, r.path, nil) |
| 137 | + resp2, err := app.Test(req2, 5_000) |
| 138 | + require.NoError(t, err) |
| 139 | + defer resp2.Body.Close() |
| 140 | + assert.NotEqualf(t, http.StatusUnauthorized, resp2.StatusCode, |
| 141 | + "%s %s must NOT 401 when no Authorization header is sent "+ |
| 142 | + "(routes are anonymous-capable); got %d. If you tightened "+ |
| 143 | + "this route to require auth, remove it from the "+ |
| 144 | + "anonymousCapableMutatingRoutes registry above.", |
| 145 | + r.method, r.path, resp2.StatusCode) |
| 146 | + }) |
| 147 | + } |
| 148 | +} |
0 commit comments