fix: restore jwt login and control-plane checks

2026-04-27 09:00:46 +03:00
parent 221a42dd17
commit 6e2d070b05
6 changed files with 248 additions and 45 deletions
@@ -37,37 +37,32 @@ func (s *Server) userNS(r *http.Request) string {
 func (s *Server) authMiddleware(h http.HandlerFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		var ns string
+		env := strings.TrimSpace(strings.ToLower(r.Header.Get("X-Auth-Env")))
+		if _, ok := deckAPIs[env]; !ok {
+			env = "test"
+		}

 		if s.testMode {
 			sub := strings.TrimSpace(r.Header.Get("X-Test-Sub"))
-			if sub == "" {
-				sub = strings.TrimSpace(r.Header.Get("X-Auth-Token"))
+			if sub != "" {
+				ns = namespaceFromSub(sub)
+			} else {
+				token := strings.TrimSpace(r.Header.Get("X-Auth-Token"))
+				resolvedNS, err := s.resolveNamespaceForToken(token, env, true)
+				if err != nil {
+					writeJSONError(w, http.StatusUnauthorized, "unauthorized")
+					return
+				}
+				ns = resolvedNS
 			}
-			if sub == "" {
-				writeJSONError(w, http.StatusUnauthorized, "test mode: X-Test-Sub required")
-				return
-			}
-			h32 := sha256.Sum256([]byte(sub))
-			ns = "fission-" + hex.EncodeToString(h32[:8])
 		} else {
 			token := strings.TrimSpace(r.Header.Get("X-Auth-Token"))
-			env := strings.TrimSpace(strings.ToLower(r.Header.Get("X-Auth-Env")))
-			if _, ok := deckAPIs[env]; !ok {
-				env = "test"
-			}
-			if token == "" {
-				writeJSONError(w, http.StatusUnauthorized, "unauthorized")
-				return
-			}
-			if err := s.validateDeckToken(token, env); err != nil {
-				writeJSONError(w, http.StatusUnauthorized, "unauthorized")
-				return
-			}
-			var err error
-			ns, err = namespaceFromJWT(token)
+			resolvedNS, err := s.resolveNamespaceForToken(token, env, false)
 			if err != nil {
-				ns = s.ns
+				writeJSONError(w, http.StatusUnauthorized, "unauthorized")
+				return
 			}
+			ns = resolvedNS
 		}

 		ctx := context.WithValue(r.Context(), ctxKeyNS{}, ns)
@@ -83,6 +78,35 @@ func (s *Server) authMiddleware(h http.HandlerFunc) http.HandlerFunc {
 	}
 }

+func namespaceFromSub(sub string) string {
+	h32 := sha256.Sum256([]byte(sub))
+	return "fission-" + hex.EncodeToString(h32[:8])
+}
+
+func (s *Server) resolveNamespaceForToken(token, env string, allowTestSub bool) (string, error) {
+	token = strings.TrimSpace(token)
+	if token == "" {
+		if allowTestSub {
+			return "", fmt.Errorf("test mode: X-Test-Sub required")
+		}
+		return "", fmt.Errorf("unauthorized")
+	}
+
+	if err := s.validateDeckToken(token, env); err == nil {
+		ns, nsErr := namespaceFromJWT(token)
+		if nsErr != nil {
+			return s.ns, nil
+		}
+		return ns, nil
+	}
+
+	if allowTestSub && strings.Contains(token, "@") {
+		return namespaceFromSub(token), nil
+	}
+
+	return "", fmt.Errorf("invalid token")
+}
+
 // namespaceFromJWT декодирует JWT payload (без верификации подписи),
 // извлекает claim "sub" и вычисляет namespace: "fission-" + hex(SHA256(sub)[:8]).
 //
@@ -0,0 +1,112 @@
+package api
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+)
+
+const validJWTForTests = "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ0ZXN0LXVzZXItMTIzIn0.signature"
+
+func TestResolveNamespaceForTokenRejectsInvalidTokenOutsideTestMode(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/index.cfm/instances" {
+			t.Fatalf("unexpected path: %s", r.URL.Path)
+		}
+		w.WriteHeader(http.StatusUnauthorized)
+	}))
+	defer server.Close()
+
+	oldDeckAPIs := deckAPIs
+	deckAPIs = map[string]string{"test": server.URL}
+	defer func() { deckAPIs = oldDeckAPIs }()
+
+	s := &Server{http: server.Client()}
+	if _, err := s.resolveNamespaceForToken("user@example.com", "test", false); err == nil {
+		t.Fatal("expected invalid token to be rejected outside test mode")
+	}
+}
+
+func TestResolveNamespaceForTokenAllowsValidatedJWTInTestMode(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if got := r.Header.Get("Authorization"); got == "" {
+			t.Fatal("expected Authorization header")
+		}
+		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write([]byte(`{"results":[]}`))
+	}))
+	defer server.Close()
+
+	oldDeckAPIs := deckAPIs
+	deckAPIs = map[string]string{"test": server.URL}
+	defer func() { deckAPIs = oldDeckAPIs }()
+
+	s := &Server{http: server.Client()}
+	ns, err := s.resolveNamespaceForToken(validJWTForTests, "test", true)
+	if err != nil {
+		t.Fatalf("expected JWT to pass in test mode: %v", err)
+	}
+
+	expected, err := namespaceFromJWT(validJWTForTests)
+	if err != nil {
+		t.Fatalf("namespaceFromJWT: %v", err)
+	}
+	if ns != expected {
+		t.Fatalf("expected namespace %q, got %q", expected, ns)
+	}
+}
+
+func TestResolveNamespaceForTokenAllowsEmailFallbackOnlyInTestMode(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusUnauthorized)
+	}))
+	defer server.Close()
+
+	oldDeckAPIs := deckAPIs
+	deckAPIs = map[string]string{"test": server.URL}
+	defer func() { deckAPIs = oldDeckAPIs }()
+
+	s := &Server{http: server.Client()}
+	ns, err := s.resolveNamespaceForToken("user@example.com", "test", true)
+	if err != nil {
+		t.Fatalf("expected email fallback in test mode: %v", err)
+	}
+	if ns != namespaceFromSub("user@example.com") {
+		t.Fatalf("unexpected namespace: %q", ns)
+	}
+
+	_, err = s.resolveNamespaceForToken("user@example.com", "test", false)
+	if err == nil {
+		t.Fatal("expected email fallback to be rejected outside test mode")
+	}
+}
+
+func TestValidateDeckTokenCachesSuccessfulValidation(t *testing.T) {
+	requests := 0
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		requests++
+		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write([]byte(`{"results":[]}`))
+	}))
+	defer server.Close()
+
+	oldDeckAPIs := deckAPIs
+	deckAPIs = map[string]string{"test": server.URL}
+	defer func() { deckAPIs = oldDeckAPIs }()
+
+	s := &Server{http: server.Client()}
+	if err := s.validateDeckToken(validJWTForTests, "test"); err != nil {
+		t.Fatalf("first validate failed: %v", err)
+	}
+	if err := s.validateDeckToken(validJWTForTests, "test"); err != nil {
+		t.Fatalf("second validate failed: %v", err)
+	}
+	if requests != 1 {
+		t.Fatalf("expected 1 upstream request because of cache, got %d", requests)
+	}
+
+	if v, ok := s.tokenCache.Load("test:" + validJWTForTests); !ok || time.Now().After(v.(time.Time)) {
+		t.Fatal("expected token to be cached")
+	}
+}
@@ -3,7 +3,6 @@ package api
 import (
 	"bytes"
 	"context"
-	"crypto/sha256"
 	"encoding/base64"
 	"encoding/json"
 	"errors"
@@ -659,26 +658,10 @@ func (s *Server) handleAuth(w http.ResponseWriter, r *http.Request) {
 		env = "test"
 	}

-	var ns string
-	if s.testMode {
-		// testMode: токен — это email (sub), Deck не вызывается
-		if !strings.Contains(body.Token, "@") {
-			writeJSONError(w, http.StatusUnauthorized, "invalid token")
-			return
-		}
-		h32 := sha256.Sum256([]byte(body.Token))
-		ns = "fission-" + fmt.Sprintf("%x", h32[:8])
-	} else {
-		if err := s.validateDeckToken(body.Token, env); err != nil {
-			writeJSONError(w, http.StatusUnauthorized, "invalid token")
-			return
-		}
-		var err error
-		ns, err = namespaceFromJWT(body.Token)
-		if err != nil {
-			log.Printf("handleAuth: namespaceFromJWT: %v", err)
-			ns = s.ns
-		}
+	ns, err := s.resolveNamespaceForToken(body.Token, env, s.testMode)
+	if err != nil {
+		writeJSONError(w, http.StatusUnauthorized, "invalid token")
+		return
 	}

 	ctx, cancel := context.WithTimeout(r.Context(), 60*time.Second)