Add editorconfig and analyzers, format backend code
This commit is contained in:
+167
-168
@@ -9,212 +9,211 @@ using Musify.StreamingGateway.Configuration;
|
||||
using Musify.StreamingGateway.Middleware;
|
||||
using Xunit;
|
||||
|
||||
namespace Musify.StreamingGateway.Tests.Middleware
|
||||
namespace Musify.StreamingGateway.Tests.Middleware;
|
||||
|
||||
public sealed class TicketValidationMiddlewareTests : IDisposable
|
||||
{
|
||||
public sealed class TicketValidationMiddlewareTests : IDisposable
|
||||
private const string Prefix = "Tracks/ProcessedAudios/abc";
|
||||
|
||||
private readonly string publicKeyPath = Path.GetTempFileName();
|
||||
private readonly RSA rsa = RSA.Create(2048);
|
||||
private readonly StreamTicketValidationOptions options;
|
||||
|
||||
public TicketValidationMiddlewareTests()
|
||||
{
|
||||
private const string Prefix = "Tracks/ProcessedAudios/abc";
|
||||
|
||||
private readonly string publicKeyPath = Path.GetTempFileName();
|
||||
private readonly RSA rsa = RSA.Create(2048);
|
||||
private readonly StreamTicketValidationOptions options;
|
||||
|
||||
public TicketValidationMiddlewareTests()
|
||||
File.WriteAllText(publicKeyPath, rsa.ExportSubjectPublicKeyInfoPem());
|
||||
options = new StreamTicketValidationOptions
|
||||
{
|
||||
File.WriteAllText(publicKeyPath, rsa.ExportSubjectPublicKeyInfoPem());
|
||||
options = new StreamTicketValidationOptions
|
||||
{
|
||||
PublicKeyPath = publicKeyPath,
|
||||
Audience = "media-gateway",
|
||||
Issuer = "musify-webapi",
|
||||
};
|
||||
}
|
||||
PublicKeyPath = publicKeyPath,
|
||||
Audience = "media-gateway",
|
||||
Issuer = "musify-webapi",
|
||||
};
|
||||
}
|
||||
|
||||
public void Dispose()
|
||||
public void Dispose()
|
||||
{
|
||||
rsa.Dispose();
|
||||
File.Delete(publicKeyPath);
|
||||
}
|
||||
|
||||
private string IssueValidToken(string prefix = Prefix, long? maxBytes = null)
|
||||
{
|
||||
var claims = new Dictionary<string, object> { ["prefix"] = prefix };
|
||||
if (maxBytes != null)
|
||||
claims["maxBytes"] = maxBytes.Value.ToString();
|
||||
|
||||
return new JsonWebTokenHandler().CreateToken(new SecurityTokenDescriptor
|
||||
{
|
||||
rsa.Dispose();
|
||||
File.Delete(publicKeyPath);
|
||||
}
|
||||
Issuer = options.Issuer,
|
||||
Audience = options.Audience,
|
||||
NotBefore = DateTime.UtcNow.AddMinutes(-1),
|
||||
Expires = DateTime.UtcNow.AddMinutes(5),
|
||||
Claims = claims,
|
||||
SigningCredentials = new SigningCredentials(new RsaSecurityKey(rsa), SecurityAlgorithms.RsaSha256),
|
||||
});
|
||||
}
|
||||
|
||||
private string IssueValidToken(string prefix = Prefix, long? maxBytes = null)
|
||||
{
|
||||
var claims = new Dictionary<string, object> { ["prefix"] = prefix };
|
||||
if (maxBytes != null)
|
||||
claims["maxBytes"] = maxBytes.Value.ToString();
|
||||
private (TicketValidationMiddleware Middleware, Func<bool> WasNextCalled) CreateMiddleware()
|
||||
{
|
||||
var nextCalled = false;
|
||||
RequestDelegate next = _ => { nextCalled = true; return Task.CompletedTask; };
|
||||
var validator = new TicketValidator(Options.Create(options));
|
||||
var middleware = new TicketValidationMiddleware(next, validator, Options.Create(options), NullLogger<TicketValidationMiddleware>.Instance);
|
||||
return (middleware, () => nextCalled);
|
||||
}
|
||||
|
||||
return new JsonWebTokenHandler().CreateToken(new SecurityTokenDescriptor
|
||||
{
|
||||
Issuer = options.Issuer,
|
||||
Audience = options.Audience,
|
||||
NotBefore = DateTime.UtcNow.AddMinutes(-1),
|
||||
Expires = DateTime.UtcNow.AddMinutes(5),
|
||||
Claims = claims,
|
||||
SigningCredentials = new SigningCredentials(new RsaSecurityKey(rsa), SecurityAlgorithms.RsaSha256),
|
||||
});
|
||||
}
|
||||
[Fact]
|
||||
public async Task InvokeAsync_PathOutsideMediaPrefix_PassesThroughWithoutValidatingATicket()
|
||||
{
|
||||
var (middleware, wasNextCalled) = CreateMiddleware();
|
||||
var context = new DefaultHttpContext();
|
||||
context.Request.Path = "/health";
|
||||
|
||||
private (TicketValidationMiddleware Middleware, Func<bool> WasNextCalled) CreateMiddleware()
|
||||
{
|
||||
var nextCalled = false;
|
||||
RequestDelegate next = _ => { nextCalled = true; return Task.CompletedTask; };
|
||||
var validator = new TicketValidator(Options.Create(options));
|
||||
var middleware = new TicketValidationMiddleware(next, validator, Options.Create(options), NullLogger<TicketValidationMiddleware>.Instance);
|
||||
return (middleware, () => nextCalled);
|
||||
}
|
||||
await middleware.InvokeAsync(context);
|
||||
|
||||
[Fact]
|
||||
public async Task InvokeAsync_PathOutsideMediaPrefix_PassesThroughWithoutValidatingATicket()
|
||||
{
|
||||
var (middleware, wasNextCalled) = CreateMiddleware();
|
||||
var context = new DefaultHttpContext();
|
||||
context.Request.Path = "/health";
|
||||
Assert.True(wasNextCalled());
|
||||
Assert.Equal(StatusCodes.Status200OK, context.Response.StatusCode);
|
||||
}
|
||||
|
||||
await middleware.InvokeAsync(context);
|
||||
[Fact]
|
||||
public async Task InvokeAsync_NoTicket_ReturnsUnauthorized()
|
||||
{
|
||||
var (middleware, wasNextCalled) = CreateMiddleware();
|
||||
var context = new DefaultHttpContext();
|
||||
context.Request.Path = $"/media/{Prefix}/audio.m4a";
|
||||
|
||||
Assert.True(wasNextCalled());
|
||||
Assert.Equal(StatusCodes.Status200OK, context.Response.StatusCode);
|
||||
}
|
||||
await middleware.InvokeAsync(context);
|
||||
|
||||
[Fact]
|
||||
public async Task InvokeAsync_NoTicket_ReturnsUnauthorized()
|
||||
{
|
||||
var (middleware, wasNextCalled) = CreateMiddleware();
|
||||
var context = new DefaultHttpContext();
|
||||
context.Request.Path = $"/media/{Prefix}/audio.m4a";
|
||||
Assert.False(wasNextCalled());
|
||||
Assert.Equal(StatusCodes.Status401Unauthorized, context.Response.StatusCode);
|
||||
}
|
||||
|
||||
await middleware.InvokeAsync(context);
|
||||
[Fact]
|
||||
public async Task InvokeAsync_ValidTicketAsQueryParameter_ForTheRequestedObject_PassesThroughAndStripsTheTicket()
|
||||
{
|
||||
var (middleware, wasNextCalled) = CreateMiddleware();
|
||||
var context = new DefaultHttpContext();
|
||||
context.Request.Path = $"/media/{Prefix}/audio.m4a";
|
||||
context.Request.QueryString = new QueryString($"?t={IssueValidToken()}&keep=1");
|
||||
|
||||
Assert.False(wasNextCalled());
|
||||
Assert.Equal(StatusCodes.Status401Unauthorized, context.Response.StatusCode);
|
||||
}
|
||||
await middleware.InvokeAsync(context);
|
||||
|
||||
[Fact]
|
||||
public async Task InvokeAsync_ValidTicketAsQueryParameter_ForTheRequestedObject_PassesThroughAndStripsTheTicket()
|
||||
{
|
||||
var (middleware, wasNextCalled) = CreateMiddleware();
|
||||
var context = new DefaultHttpContext();
|
||||
context.Request.Path = $"/media/{Prefix}/audio.m4a";
|
||||
context.Request.QueryString = new QueryString($"?t={IssueValidToken()}&keep=1");
|
||||
Assert.True(wasNextCalled());
|
||||
Assert.Equal("keep=1", context.Request.QueryString.Value?.TrimStart('?'));
|
||||
}
|
||||
|
||||
await middleware.InvokeAsync(context);
|
||||
[Fact]
|
||||
public async Task InvokeAsync_ValidTicketAsHeader_PassesThrough()
|
||||
{
|
||||
var (middleware, wasNextCalled) = CreateMiddleware();
|
||||
var context = new DefaultHttpContext();
|
||||
context.Request.Path = $"/media/{Prefix}/audio.m4a";
|
||||
context.Request.Headers["X-Stream-Ticket"] = IssueValidToken();
|
||||
|
||||
Assert.True(wasNextCalled());
|
||||
Assert.Equal("keep=1", context.Request.QueryString.Value?.TrimStart('?'));
|
||||
}
|
||||
await middleware.InvokeAsync(context);
|
||||
|
||||
[Fact]
|
||||
public async Task InvokeAsync_ValidTicketAsHeader_PassesThrough()
|
||||
{
|
||||
var (middleware, wasNextCalled) = CreateMiddleware();
|
||||
var context = new DefaultHttpContext();
|
||||
context.Request.Path = $"/media/{Prefix}/audio.m4a";
|
||||
context.Request.Headers["X-Stream-Ticket"] = IssueValidToken();
|
||||
Assert.True(wasNextCalled());
|
||||
}
|
||||
|
||||
await middleware.InvokeAsync(context);
|
||||
[Fact]
|
||||
public async Task InvokeAsync_ObjectKeyOutsideAuthorizedPrefix_ReturnsForbidden()
|
||||
{
|
||||
var (middleware, wasNextCalled) = CreateMiddleware();
|
||||
var context = new DefaultHttpContext();
|
||||
context.Request.Path = "/media/Tracks/ProcessedAudios/someone-elses-track/audio.m4a";
|
||||
context.Request.QueryString = new QueryString($"?t={IssueValidToken()}");
|
||||
|
||||
Assert.True(wasNextCalled());
|
||||
}
|
||||
await middleware.InvokeAsync(context);
|
||||
|
||||
[Fact]
|
||||
public async Task InvokeAsync_ObjectKeyOutsideAuthorizedPrefix_ReturnsForbidden()
|
||||
{
|
||||
var (middleware, wasNextCalled) = CreateMiddleware();
|
||||
var context = new DefaultHttpContext();
|
||||
context.Request.Path = "/media/Tracks/ProcessedAudios/someone-elses-track/audio.m4a";
|
||||
context.Request.QueryString = new QueryString($"?t={IssueValidToken()}");
|
||||
Assert.False(wasNextCalled());
|
||||
Assert.Equal(StatusCodes.Status403Forbidden, context.Response.StatusCode);
|
||||
}
|
||||
|
||||
await middleware.InvokeAsync(context);
|
||||
[Theory]
|
||||
[InlineData($"/media/{Prefix}/../../etc/passwd")]
|
||||
[InlineData($"/media/{Prefix}/./audio.m4a")]
|
||||
public async Task InvokeAsync_PathTraversalSegment_ReturnsBadRequest(string path)
|
||||
{
|
||||
var (middleware, wasNextCalled) = CreateMiddleware();
|
||||
var context = new DefaultHttpContext();
|
||||
context.Request.Path = path;
|
||||
context.Request.QueryString = new QueryString($"?t={IssueValidToken()}");
|
||||
|
||||
Assert.False(wasNextCalled());
|
||||
Assert.Equal(StatusCodes.Status403Forbidden, context.Response.StatusCode);
|
||||
}
|
||||
await middleware.InvokeAsync(context);
|
||||
|
||||
[Theory]
|
||||
[InlineData($"/media/{Prefix}/../../etc/passwd")]
|
||||
[InlineData($"/media/{Prefix}/./audio.m4a")]
|
||||
public async Task InvokeAsync_PathTraversalSegment_ReturnsBadRequest(string path)
|
||||
{
|
||||
var (middleware, wasNextCalled) = CreateMiddleware();
|
||||
var context = new DefaultHttpContext();
|
||||
context.Request.Path = path;
|
||||
context.Request.QueryString = new QueryString($"?t={IssueValidToken()}");
|
||||
Assert.False(wasNextCalled());
|
||||
Assert.Equal(StatusCodes.Status400BadRequest, context.Response.StatusCode);
|
||||
}
|
||||
|
||||
await middleware.InvokeAsync(context);
|
||||
[Fact]
|
||||
public async Task InvokeAsync_TicketPrefixExactlyMatchesTheRequestedObject_PassesThrough()
|
||||
{
|
||||
var (middleware, wasNextCalled) = CreateMiddleware();
|
||||
var context = new DefaultHttpContext();
|
||||
context.Request.Path = $"/media/{Prefix}";
|
||||
context.Request.QueryString = new QueryString($"?t={IssueValidToken()}");
|
||||
|
||||
Assert.False(wasNextCalled());
|
||||
Assert.Equal(StatusCodes.Status400BadRequest, context.Response.StatusCode);
|
||||
}
|
||||
await middleware.InvokeAsync(context);
|
||||
|
||||
[Fact]
|
||||
public async Task InvokeAsync_TicketPrefixExactlyMatchesTheRequestedObject_PassesThrough()
|
||||
{
|
||||
var (middleware, wasNextCalled) = CreateMiddleware();
|
||||
var context = new DefaultHttpContext();
|
||||
context.Request.Path = $"/media/{Prefix}";
|
||||
context.Request.QueryString = new QueryString($"?t={IssueValidToken()}");
|
||||
Assert.True(wasNextCalled());
|
||||
}
|
||||
|
||||
await middleware.InvokeAsync(context);
|
||||
[Fact]
|
||||
public async Task InvokeAsync_TicketWithMaxBytes_NoRangeRequested_SynthesizesABoundedRange()
|
||||
{
|
||||
var (middleware, wasNextCalled) = CreateMiddleware();
|
||||
var context = new DefaultHttpContext();
|
||||
context.Request.Path = $"/media/{Prefix}/audio.m4a";
|
||||
context.Request.QueryString = new QueryString($"?t={IssueValidToken(maxBytes: 480_000)}");
|
||||
|
||||
Assert.True(wasNextCalled());
|
||||
}
|
||||
await middleware.InvokeAsync(context);
|
||||
|
||||
[Fact]
|
||||
public async Task InvokeAsync_TicketWithMaxBytes_NoRangeRequested_SynthesizesABoundedRange()
|
||||
{
|
||||
var (middleware, wasNextCalled) = CreateMiddleware();
|
||||
var context = new DefaultHttpContext();
|
||||
context.Request.Path = $"/media/{Prefix}/audio.m4a";
|
||||
context.Request.QueryString = new QueryString($"?t={IssueValidToken(maxBytes: 480_000)}");
|
||||
Assert.True(wasNextCalled());
|
||||
Assert.Equal("bytes=0-479999", context.Request.Headers.Range.ToString());
|
||||
}
|
||||
|
||||
await middleware.InvokeAsync(context);
|
||||
[Fact]
|
||||
public async Task InvokeAsync_TicketWithMaxBytes_RangeWithinCap_ClampsTheEndOnly()
|
||||
{
|
||||
var (middleware, wasNextCalled) = CreateMiddleware();
|
||||
var context = new DefaultHttpContext();
|
||||
context.Request.Path = $"/media/{Prefix}/audio.m4a";
|
||||
context.Request.QueryString = new QueryString($"?t={IssueValidToken(maxBytes: 480_000)}");
|
||||
context.Request.Headers.Range = "bytes=1000-";
|
||||
|
||||
Assert.True(wasNextCalled());
|
||||
Assert.Equal("bytes=0-479999", context.Request.Headers.Range.ToString());
|
||||
}
|
||||
await middleware.InvokeAsync(context);
|
||||
|
||||
[Fact]
|
||||
public async Task InvokeAsync_TicketWithMaxBytes_RangeWithinCap_ClampsTheEndOnly()
|
||||
{
|
||||
var (middleware, wasNextCalled) = CreateMiddleware();
|
||||
var context = new DefaultHttpContext();
|
||||
context.Request.Path = $"/media/{Prefix}/audio.m4a";
|
||||
context.Request.QueryString = new QueryString($"?t={IssueValidToken(maxBytes: 480_000)}");
|
||||
context.Request.Headers.Range = "bytes=1000-";
|
||||
Assert.True(wasNextCalled());
|
||||
Assert.Equal("bytes=1000-479999", context.Request.Headers.Range.ToString());
|
||||
}
|
||||
|
||||
await middleware.InvokeAsync(context);
|
||||
[Fact]
|
||||
public async Task InvokeAsync_TicketWithMaxBytes_RangeStartsAtOrPastTheCap_ReturnsRangeNotSatisfiable()
|
||||
{
|
||||
var (middleware, wasNextCalled) = CreateMiddleware();
|
||||
var context = new DefaultHttpContext();
|
||||
context.Request.Path = $"/media/{Prefix}/audio.m4a";
|
||||
context.Request.QueryString = new QueryString($"?t={IssueValidToken(maxBytes: 480_000)}");
|
||||
context.Request.Headers.Range = "bytes=480000-";
|
||||
|
||||
Assert.True(wasNextCalled());
|
||||
Assert.Equal("bytes=1000-479999", context.Request.Headers.Range.ToString());
|
||||
}
|
||||
await middleware.InvokeAsync(context);
|
||||
|
||||
[Fact]
|
||||
public async Task InvokeAsync_TicketWithMaxBytes_RangeStartsAtOrPastTheCap_ReturnsRangeNotSatisfiable()
|
||||
{
|
||||
var (middleware, wasNextCalled) = CreateMiddleware();
|
||||
var context = new DefaultHttpContext();
|
||||
context.Request.Path = $"/media/{Prefix}/audio.m4a";
|
||||
context.Request.QueryString = new QueryString($"?t={IssueValidToken(maxBytes: 480_000)}");
|
||||
context.Request.Headers.Range = "bytes=480000-";
|
||||
Assert.False(wasNextCalled());
|
||||
Assert.Equal(StatusCodes.Status416RangeNotSatisfiable, context.Response.StatusCode);
|
||||
}
|
||||
|
||||
await middleware.InvokeAsync(context);
|
||||
[Fact]
|
||||
public async Task InvokeAsync_TicketWithoutMaxBytes_LeavesTheRequestedRangeUntouched()
|
||||
{
|
||||
var (middleware, wasNextCalled) = CreateMiddleware();
|
||||
var context = new DefaultHttpContext();
|
||||
context.Request.Path = $"/media/{Prefix}/audio.m4a";
|
||||
context.Request.QueryString = new QueryString($"?t={IssueValidToken()}");
|
||||
context.Request.Headers.Range = "bytes=1000-2000";
|
||||
|
||||
Assert.False(wasNextCalled());
|
||||
Assert.Equal(StatusCodes.Status416RangeNotSatisfiable, context.Response.StatusCode);
|
||||
}
|
||||
await middleware.InvokeAsync(context);
|
||||
|
||||
[Fact]
|
||||
public async Task InvokeAsync_TicketWithoutMaxBytes_LeavesTheRequestedRangeUntouched()
|
||||
{
|
||||
var (middleware, wasNextCalled) = CreateMiddleware();
|
||||
var context = new DefaultHttpContext();
|
||||
context.Request.Path = $"/media/{Prefix}/audio.m4a";
|
||||
context.Request.QueryString = new QueryString($"?t={IssueValidToken()}");
|
||||
context.Request.Headers.Range = "bytes=1000-2000";
|
||||
|
||||
await middleware.InvokeAsync(context);
|
||||
|
||||
Assert.True(wasNextCalled());
|
||||
Assert.Equal("bytes=1000-2000", context.Request.Headers.Range.ToString());
|
||||
}
|
||||
Assert.True(wasNextCalled());
|
||||
Assert.Equal("bytes=1000-2000", context.Request.Headers.Range.ToString());
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user