Add tests for workspace app cors

code-asher · code-asher · commit da1298af0ae8 · 2023-06-07T09:52:38.000-08:00
diff --git a/coderd/httpmw/cors_test.go b/coderd/httpmw/cors_test.go
@@ -0,0 +1,87 @@
+package httpmw_test
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/coder/coder/coderd/httpapi"
+	"github.com/coder/coder/coderd/httpmw"
+)
+
+func TestWorkspaceAppCors(t *testing.T) {
+	t.Parallel()
+
+	regex, err := httpapi.CompileHostnamePattern("*--apps.dev.coder.com")
+	require.NoError(t, err)
+
+	app := httpapi.ApplicationURL{
+		AppSlugOrPort: "3000",
+		AgentName:     "agent",
+		WorkspaceName: "ws",
+		Username:      "user",
+	}
+
+	handler := httpmw.WorkspaceAppCors(regex, app)
+	methods := []string{
+		http.MethodOptions,
+		http.MethodHead,
+		http.MethodGet,
+		http.MethodPost,
+		http.MethodPut,
+		http.MethodPatch,
+		http.MethodDelete,
+	}
+
+	tests := []struct {
+		name    string
+		origin  string
+		allowed bool
+	}{
+		{
+			name:    "Self",
+			origin:  "https://3000--agent--ws--user--apps.dev.coder.com",
+			allowed: true,
+		},
+		{
+			name:    "SameWorkspace",
+			origin:  "https://8000--agent--ws--user--apps.dev.coder.com",
+			allowed: true,
+		},
+		{
+			name:    "SameUser",
+			origin:  "https://8000--agent2--ws2--user--apps.dev.coder.com",
+			allowed: true,
+		},
+		{
+			name:    "DifferentUser",
+			origin:  "https://3000--agent--ws--user2--apps.dev.coder.com",
+			allowed: false,
+		},
+	}
+
+	for _, test := range tests {
+		test := test
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+
+			for _, method := range methods {
+				r := httptest.NewRequest(method, "http://localhost", nil)
+				r.Header.Set("Origin", test.origin)
+				rw := httptest.NewRecorder()
+
+				handler(http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
+					rw.WriteHeader(http.StatusOK)
+				})).ServeHTTP(rw, r)
+
+				if test.allowed {
+					require.Equal(t, test.origin, rw.Header().Get("Access-Control-Allow-Origin"))
+				} else {
+					require.Equal(t, "", rw.Header().Get("Access-Control-Allow-Origin"))
+				}
+			}
+		})
+	}
+}
