Migrate configuration paths to /etc/easyhaproxy and improve health check support in E2E tests
- Refactored HAProxy configuration files, templates, and paths to use `/etc/easyhaproxy` instead of `/etc/haproxy`. - Updated Dockerfile to generate DH params and placeholder certificates in the new configuration directory. - Added health check support with timeout to `DockerComposeFixture` in E2E test utilities. - Adjusted tests, templates, and plugins to use the new `Consts`-based configuration paths. - Introduced pytest fixtures for environment isolation and temporary directory management.
This commit is contained in:
parent
3e963228f3
commit
045dd3817e
73 changed files with 600 additions and 287 deletions
43
tests/conftest.py
Normal file
43
tests/conftest.py
Normal file
|
|
@ -0,0 +1,43 @@
|
|||
"""
|
||||
Pytest configuration and fixtures for EasyHAProxy tests.
|
||||
|
||||
This module provides session-wide and function-level fixtures for testing.
|
||||
"""
|
||||
|
||||
import os
|
||||
import shutil
|
||||
import tempfile
|
||||
import pytest
|
||||
|
||||
|
||||
# Create a session-wide temporary directory for all tests
|
||||
# Use a different prefix to avoid conflicts with cleanup plugin (which looks for "easyhaproxy_*")
|
||||
_test_session_dir = tempfile.mkdtemp(prefix="pytest_easyhaproxy_")
|
||||
os.environ["EASYHAPROXY_BASE_PATH"] = _test_session_dir
|
||||
|
||||
|
||||
@pytest.fixture(scope="function", autouse=True)
|
||||
def reset_consts():
|
||||
"""
|
||||
Reset Consts before and after each test.
|
||||
|
||||
This ensures:
|
||||
1. Each test picks up the EASYHAPROXY_BASE_PATH environment variable
|
||||
2. Tests don't get permission errors trying to write to /etc/easyhaproxy/
|
||||
3. Consts path cache is cleared between tests for isolation
|
||||
"""
|
||||
from functions import Consts
|
||||
Consts.reset()
|
||||
yield
|
||||
Consts.reset()
|
||||
|
||||
|
||||
def pytest_sessionfinish(session, exitstatus):
|
||||
"""
|
||||
Cleanup session temporary directory after all tests complete.
|
||||
"""
|
||||
try:
|
||||
shutil.rmtree(_test_session_dir)
|
||||
except Exception:
|
||||
# Ignore cleanup errors
|
||||
pass
|
||||
|
|
@ -12,7 +12,7 @@ global
|
|||
ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
|
||||
ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
|
||||
|
||||
ssl-dh-param-file /etc/haproxy/dhparam
|
||||
ssl-dh-param-file /etc/easyhaproxy/haproxy/dhparam
|
||||
|
||||
defaults
|
||||
log global
|
||||
|
|
@ -38,7 +38,7 @@ backend srv_stats
|
|||
server Local 127.0.0.1:1936
|
||||
|
||||
frontend http_in_443
|
||||
bind *:443 ssl crt /certs/certbot/ alpn h2,http/1.1 crt /certs/haproxy/ alpn h2,http/1.1
|
||||
bind *:443 ssl crt /etc/easyhaproxy/certs/certbot/ alpn h2,http/1.1 crt /etc/easyhaproxy/certs/haproxy/ alpn h2,http/1.1
|
||||
mode http
|
||||
|
||||
acl is_rule_hostssl_local_443_1 hdr(host) -i hostssl.local
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@ global
|
|||
ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
|
||||
ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
|
||||
|
||||
ssl-dh-param-file /etc/haproxy/dhparam
|
||||
ssl-dh-param-file /etc/easyhaproxy/haproxy/dhparam
|
||||
|
||||
defaults
|
||||
log global
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@ global
|
|||
ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
|
||||
ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
|
||||
|
||||
ssl-dh-param-file /etc/haproxy/dhparam
|
||||
ssl-dh-param-file /etc/easyhaproxy/haproxy/dhparam
|
||||
|
||||
defaults
|
||||
log global
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@ global
|
|||
ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
|
||||
ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
|
||||
|
||||
ssl-dh-param-file /etc/haproxy/dhparam
|
||||
ssl-dh-param-file /etc/easyhaproxy/haproxy/dhparam
|
||||
|
||||
defaults
|
||||
log global
|
||||
|
|
@ -21,13 +21,13 @@ defaults
|
|||
timeout connect 3s
|
||||
timeout client 10s
|
||||
timeout server 10m
|
||||
errorfile 400 /etc/haproxy/errors-custom/400.http
|
||||
errorfile 403 /etc/haproxy/errors-custom/403.http
|
||||
errorfile 408 /etc/haproxy/errors-custom/408.http
|
||||
errorfile 500 /etc/haproxy/errors-custom/500.http
|
||||
errorfile 502 /etc/haproxy/errors-custom/502.http
|
||||
errorfile 503 /etc/haproxy/errors-custom/503.http
|
||||
errorfile 504 /etc/haproxy/errors-custom/504.http
|
||||
errorfile 400 /etc/easyhaproxy/haproxy/errors-custom/400.http
|
||||
errorfile 403 /etc/easyhaproxy/haproxy/errors-custom/403.http
|
||||
errorfile 408 /etc/easyhaproxy/haproxy/errors-custom/408.http
|
||||
errorfile 500 /etc/easyhaproxy/haproxy/errors-custom/500.http
|
||||
errorfile 502 /etc/easyhaproxy/haproxy/errors-custom/502.http
|
||||
errorfile 503 /etc/easyhaproxy/haproxy/errors-custom/503.http
|
||||
errorfile 504 /etc/easyhaproxy/haproxy/errors-custom/504.http
|
||||
|
||||
|
||||
frontend stats
|
||||
|
|
@ -76,7 +76,7 @@ backend srv_test2_example_org_80
|
|||
server srv-0 83d57d592e26:8080 check weight 1
|
||||
|
||||
frontend http_in_443
|
||||
bind *:443 ssl crt /certs/certbot/ alpn h2,http/1.1 crt /certs/haproxy/ alpn h2,http/1.1
|
||||
bind *:443 ssl crt /etc/easyhaproxy/certs/certbot/ alpn h2,http/1.1 crt /etc/easyhaproxy/certs/haproxy/ alpn h2,http/1.1
|
||||
mode http
|
||||
|
||||
acl is_rule_test_example_org_443_1 hdr(host) -i test.example.org
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@ global
|
|||
ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
|
||||
ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
|
||||
|
||||
ssl-dh-param-file /etc/haproxy/dhparam
|
||||
ssl-dh-param-file /etc/easyhaproxy/haproxy/dhparam
|
||||
|
||||
defaults
|
||||
log global
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@ global
|
|||
ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
|
||||
ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
|
||||
|
||||
ssl-dh-param-file /etc/haproxy/dhparam
|
||||
ssl-dh-param-file /etc/easyhaproxy/haproxy/dhparam
|
||||
|
||||
defaults
|
||||
log global
|
||||
|
|
@ -21,13 +21,13 @@ defaults
|
|||
timeout connect 3s
|
||||
timeout client 10s
|
||||
timeout server 10m
|
||||
errorfile 400 /etc/haproxy/errors-custom/400.http
|
||||
errorfile 403 /etc/haproxy/errors-custom/403.http
|
||||
errorfile 408 /etc/haproxy/errors-custom/408.http
|
||||
errorfile 500 /etc/haproxy/errors-custom/500.http
|
||||
errorfile 502 /etc/haproxy/errors-custom/502.http
|
||||
errorfile 503 /etc/haproxy/errors-custom/503.http
|
||||
errorfile 504 /etc/haproxy/errors-custom/504.http
|
||||
errorfile 400 /etc/easyhaproxy/haproxy/errors-custom/400.http
|
||||
errorfile 403 /etc/easyhaproxy/haproxy/errors-custom/403.http
|
||||
errorfile 408 /etc/easyhaproxy/haproxy/errors-custom/408.http
|
||||
errorfile 500 /etc/easyhaproxy/haproxy/errors-custom/500.http
|
||||
errorfile 502 /etc/easyhaproxy/haproxy/errors-custom/502.http
|
||||
errorfile 503 /etc/easyhaproxy/haproxy/errors-custom/503.http
|
||||
errorfile 504 /etc/easyhaproxy/haproxy/errors-custom/504.http
|
||||
|
||||
|
||||
frontend stats
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ global
|
|||
ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
|
||||
ssl-default-server-options no-sslv3 no-tls-tickets
|
||||
|
||||
ssl-dh-param-file /etc/haproxy/dhparam-1024
|
||||
ssl-dh-param-file /etc/easyhaproxy/haproxy/dhparam-1024
|
||||
|
||||
|
||||
defaults
|
||||
|
|
@ -50,7 +50,7 @@ backend srv_host1_local_80
|
|||
server srv-0 5b69bc7fea1b:80 check weight 1
|
||||
|
||||
frontend http_in_443
|
||||
bind *:443 ssl crt /certs/certbot/ alpn h2,http/1.1 crt /certs/haproxy/ alpn h2,http/1.1
|
||||
bind *:443 ssl crt /etc/easyhaproxy/certs/certbot/ alpn h2,http/1.1 crt /etc/easyhaproxy/certs/haproxy/ alpn h2,http/1.1
|
||||
mode http
|
||||
|
||||
acl is_rule_host2_local_443_1 hdr(host) -i host2.local
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@ global
|
|||
ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
|
||||
ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
|
||||
|
||||
ssl-dh-param-file /etc/haproxy/dhparam
|
||||
ssl-dh-param-file /etc/easyhaproxy/haproxy/dhparam
|
||||
|
||||
defaults
|
||||
log global
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@ global
|
|||
ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
|
||||
ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
|
||||
|
||||
ssl-dh-param-file /etc/haproxy/dhparam
|
||||
ssl-dh-param-file /etc/easyhaproxy/haproxy/dhparam
|
||||
|
||||
defaults
|
||||
log global
|
||||
|
|
@ -68,7 +68,7 @@ backend srv_node-exporter_quantum_example_org_31337
|
|||
server srv-0 my-stack_node-exporter:9100 check weight 1
|
||||
|
||||
frontend http_in_443
|
||||
bind *:443 ssl crt /certs/certbot/ alpn h2,http/1.1 crt /certs/haproxy/ alpn h2,http/1.1
|
||||
bind *:443 ssl crt /etc/easyhaproxy/certs/certbot/ alpn h2,http/1.1 crt /etc/easyhaproxy/certs/haproxy/ alpn h2,http/1.1
|
||||
mode http
|
||||
redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i somehost.com.br }
|
||||
redirect prefix https://www.somehost.com.br code 301 if { hdr(host) -i somehost.com }
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ global
|
|||
ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
|
||||
ssl-default-server-options no-sslv3 no-tls-tickets
|
||||
|
||||
ssl-dh-param-file /etc/haproxy/dhparam-1024
|
||||
ssl-dh-param-file /etc/easyhaproxy/haproxy/dhparam-1024
|
||||
|
||||
|
||||
defaults
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@ global
|
|||
ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
|
||||
ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
|
||||
|
||||
ssl-dh-param-file /etc/haproxy/dhparam
|
||||
ssl-dh-param-file /etc/easyhaproxy/haproxy/dhparam
|
||||
|
||||
defaults
|
||||
log global
|
||||
|
|
@ -21,13 +21,13 @@ defaults
|
|||
timeout connect 3s
|
||||
timeout client 10s
|
||||
timeout server 10m
|
||||
errorfile 400 /etc/haproxy/errors-custom/400.http
|
||||
errorfile 403 /etc/haproxy/errors-custom/403.http
|
||||
errorfile 408 /etc/haproxy/errors-custom/408.http
|
||||
errorfile 500 /etc/haproxy/errors-custom/500.http
|
||||
errorfile 502 /etc/haproxy/errors-custom/502.http
|
||||
errorfile 503 /etc/haproxy/errors-custom/503.http
|
||||
errorfile 504 /etc/haproxy/errors-custom/504.http
|
||||
errorfile 400 /etc/easyhaproxy/haproxy/errors-custom/400.http
|
||||
errorfile 403 /etc/easyhaproxy/haproxy/errors-custom/403.http
|
||||
errorfile 408 /etc/easyhaproxy/haproxy/errors-custom/408.http
|
||||
errorfile 500 /etc/easyhaproxy/haproxy/errors-custom/500.http
|
||||
errorfile 502 /etc/easyhaproxy/haproxy/errors-custom/502.http
|
||||
errorfile 503 /etc/easyhaproxy/haproxy/errors-custom/503.http
|
||||
errorfile 504 /etc/easyhaproxy/haproxy/errors-custom/504.http
|
||||
|
||||
|
||||
frontend stats
|
||||
|
|
@ -46,7 +46,7 @@ backend srv_stats
|
|||
server Local 127.0.0.1:1936
|
||||
|
||||
frontend http_in_443
|
||||
bind *:443 ssl crt /certs/certbot/ alpn h2,http/1.1 crt /certs/haproxy/ alpn h2,http/1.1
|
||||
bind *:443 ssl crt /etc/easyhaproxy/certs/certbot/ alpn h2,http/1.1 crt /etc/easyhaproxy/certs/haproxy/ alpn h2,http/1.1
|
||||
mode http
|
||||
|
||||
acl is_rule_host1_com_br_443_1 hdr(host) -i host1.com.br
|
||||
|
|
|
|||
|
|
@ -4,7 +4,6 @@
|
|||
"easyhaproxy.http.port": "80",
|
||||
"easyhaproxy.http.localport": "8080",
|
||||
"easyhaproxy.http.plugins": "cloudflare,deny_pages",
|
||||
"easyhaproxy.http.plugin.cloudflare.ip_list_path": "/etc/haproxy/cloudflare_ips.lst",
|
||||
"easyhaproxy.http.plugin.deny_pages.paths": "/admin,/private",
|
||||
"easyhaproxy.http.plugin.deny_pages.status_code": "403"
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,4 +1,5 @@
|
|||
import os
|
||||
from functions import Consts
|
||||
|
||||
from functions import DaemonizeHAProxy
|
||||
|
||||
|
|
@ -15,12 +16,12 @@ def test_daemonize_haproxy_check_config():
|
|||
def test_daemonize_haproxy_get_haproxy_command_start():
|
||||
daemon = DaemonizeHAProxy()
|
||||
command = daemon.get_haproxy_command(DaemonizeHAProxy.HAPROXY_START)
|
||||
assert command == "/usr/sbin/haproxy -W -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid -S /var/run/haproxy.sock"
|
||||
assert command == f"/usr/sbin/haproxy -W -f {Consts.haproxy_config} -p /run/haproxy.pid -S /var/run/haproxy.sock"
|
||||
|
||||
def test_daemonize_haproxy_get_haproxy_command_reload_nopid():
|
||||
daemon = DaemonizeHAProxy()
|
||||
command = daemon.get_haproxy_command(DaemonizeHAProxy.HAPROXY_RELOAD)
|
||||
assert command == "/usr/sbin/haproxy -W -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid -S /var/run/haproxy.sock"
|
||||
assert command == f"/usr/sbin/haproxy -W -f {Consts.haproxy_config} -p /run/haproxy.pid -S /var/run/haproxy.sock"
|
||||
|
||||
def test_daemonize_haproxy_get_haproxy_command_reload_pidinvalid():
|
||||
daemon = DaemonizeHAProxy()
|
||||
|
|
@ -28,7 +29,7 @@ def test_daemonize_haproxy_get_haproxy_command_reload_pidinvalid():
|
|||
with open("/tmp/temp.pid", 'w') as file:
|
||||
file.write("-1001")
|
||||
command = daemon.get_haproxy_command(DaemonizeHAProxy.HAPROXY_RELOAD, "/tmp/temp.pid")
|
||||
assert command == "/usr/sbin/haproxy -W -f /etc/haproxy/haproxy.cfg -p /tmp/temp.pid -S /var/run/haproxy.sock"
|
||||
assert command == f"/usr/sbin/haproxy -W -f {Consts.haproxy_config} -p /tmp/temp.pid -S /var/run/haproxy.sock"
|
||||
finally:
|
||||
assert not os.path.exists("/tmp/temp.pid")
|
||||
|
||||
|
|
@ -38,7 +39,7 @@ def test_daemonize_haproxy_get_haproxy_command_reload_existing_pin():
|
|||
with open("/tmp/temp.pid", 'w') as file:
|
||||
file.write("1")
|
||||
command = daemon.get_haproxy_command(DaemonizeHAProxy.HAPROXY_RELOAD, "/tmp/temp.pid")
|
||||
assert command == "/usr/sbin/haproxy -W -f /etc/haproxy/haproxy.cfg -p /tmp/temp.pid -x /var/run/haproxy.sock -sf 1"
|
||||
assert command == f"/usr/sbin/haproxy -W -f {Consts.haproxy_config} -p /tmp/temp.pid -x /var/run/haproxy.sock -sf 1"
|
||||
finally:
|
||||
assert os.path.exists("/tmp/temp.pid")
|
||||
os.unlink("/tmp/temp.pid")
|
||||
|
|
@ -54,4 +55,4 @@ def test_daemonize_haproxy2_check_config():
|
|||
def test_daemonize_haproxy2_get_haproxy_command_start():
|
||||
daemon = DaemonizeHAProxy(os.path.abspath(os.path.dirname(__file__)) + '/fixtures')
|
||||
command = daemon.get_haproxy_command(DaemonizeHAProxy.HAPROXY_START)
|
||||
assert command == f"/usr/sbin/haproxy -W -f /etc/haproxy/haproxy.cfg -f {os.path.dirname(__file__)}/fixtures -p /run/haproxy.pid -S /var/run/haproxy.sock"
|
||||
assert command == f"/usr/sbin/haproxy -W -f {Consts.haproxy_config} -f {os.path.dirname(__file__)}/fixtures -p /run/haproxy.pid -S /var/run/haproxy.sock"
|
||||
|
|
|
|||
|
|
@ -17,6 +17,7 @@ import time
|
|||
sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
|
||||
|
||||
import easymapping
|
||||
from functions import Consts
|
||||
from plugins import PluginContext, PluginManager
|
||||
from plugins.builtin.cleanup import CleanupPlugin
|
||||
from plugins.builtin.cloudflare import CloudflarePlugin
|
||||
|
|
@ -43,7 +44,7 @@ class TestCloudflarePlugin:
|
|||
assert plugin.name == "cloudflare"
|
||||
assert plugin.enabled is True
|
||||
assert plugin.use_builtin_ips is True
|
||||
assert plugin.ip_list_path == "/etc/haproxy/cloudflare_ips.lst"
|
||||
assert plugin.ip_list_path == f"{Consts.base_path}/cloudflare_ips.lst"
|
||||
assert len(plugin.CLOUDFLARE_IPS) == 22 # 15 IPv4 + 7 IPv6
|
||||
|
||||
def test_cloudflare_plugin_configuration(self):
|
||||
|
|
@ -85,11 +86,11 @@ class TestCloudflarePlugin:
|
|||
|
||||
assert result.haproxy_config is not None
|
||||
assert "Cloudflare" in result.haproxy_config
|
||||
assert "acl from_cloudflare src -f /etc/haproxy/cloudflare_ips.lst" in result.haproxy_config
|
||||
assert f"acl from_cloudflare src -f {Consts.base_path}/cloudflare_ips.lst" in result.haproxy_config
|
||||
assert "http-request set-var(txn.real_ip) req.hdr(CF-Connecting-IP)" in result.haproxy_config
|
||||
assert "http-request set-header X-Forwarded-For %[var(txn.real_ip)]" in result.haproxy_config
|
||||
assert result.metadata["domain"] == "example.com"
|
||||
assert result.metadata["ip_list_path"] == "/etc/haproxy/cloudflare_ips.lst"
|
||||
assert result.metadata["ip_list_path"] == f"{Consts.base_path}/cloudflare_ips.lst"
|
||||
|
||||
def test_cloudflare_plugin_disabled(self):
|
||||
"""Test plugin returns empty config when disabled"""
|
||||
|
|
@ -123,7 +124,7 @@ class TestCloudflarePlugin:
|
|||
|
||||
# Verify Cloudflare config is in the output
|
||||
assert "Cloudflare - Restore original visitor IP" in haproxy_config
|
||||
assert "acl from_cloudflare src -f /etc/haproxy/cloudflare_ips.lst" in haproxy_config
|
||||
assert f"acl from_cloudflare src -f {Consts.base_path}/cloudflare_ips.lst" in haproxy_config
|
||||
assert "http-request set-var(txn.real_ip) req.hdr(CF-Connecting-IP)" in haproxy_config
|
||||
assert "http-request set-header X-Forwarded-For %[var(txn.real_ip)]" in haproxy_config
|
||||
# Verify log-format is in defaults section (from defaults_configs)
|
||||
|
|
@ -688,7 +689,7 @@ class TestJwtValidatorPlugin:
|
|||
"algorithm": "RS256",
|
||||
"issuer": "https://auth.example.com/",
|
||||
"audience": "https://api.example.com",
|
||||
"pubkey_path": "/etc/haproxy/jwt_keys/api_pubkey.pem"
|
||||
"pubkey_path": f"{Consts.base_path}/jwt_keys/api_pubkey.pem"
|
||||
})
|
||||
|
||||
context = PluginContext(
|
||||
|
|
@ -712,7 +713,7 @@ class TestJwtValidatorPlugin:
|
|||
assert "var(txn.alg) -m str RS256" in result.haproxy_config
|
||||
assert "var(txn.iss) -m str https://auth.example.com/" in result.haproxy_config
|
||||
assert "var(txn.aud) -m str https://api.example.com" in result.haproxy_config
|
||||
assert 'jwt_verify(txn.alg,"/etc/haproxy/jwt_keys/api_pubkey.pem")' in result.haproxy_config
|
||||
assert f'jwt_verify(txn.alg,"{Consts.base_path}/jwt_keys/api_pubkey.pem")' in result.haproxy_config
|
||||
assert "JWT has expired" in result.haproxy_config
|
||||
assert result.metadata["domain"] == "api.example.com"
|
||||
assert result.metadata["algorithm"] == "RS256"
|
||||
|
|
@ -742,7 +743,7 @@ class TestJwtValidatorPlugin:
|
|||
|
||||
assert result.haproxy_config is not None
|
||||
assert "JWT Validator" in result.haproxy_config
|
||||
assert "/etc/haproxy/jwt_keys/api_example_com_pubkey.pem" in result.haproxy_config
|
||||
assert f"{Consts.base_path}/jwt_keys/api_example_com_pubkey.pem" in result.haproxy_config
|
||||
# Verify the decoded content is stored in metadata
|
||||
assert result.metadata["pubkey_content"] == "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqh...\n-----END PUBLIC KEY-----"
|
||||
|
||||
|
|
@ -750,7 +751,7 @@ class TestJwtValidatorPlugin:
|
|||
"""Test plugin skips issuer/audience validation when not configured"""
|
||||
plugin = JwtValidatorPlugin()
|
||||
plugin.configure({
|
||||
"pubkey_path": "/etc/haproxy/jwt_keys/api_pubkey.pem"
|
||||
"pubkey_path": f"{Consts.base_path}/jwt_keys/api_pubkey.pem"
|
||||
})
|
||||
|
||||
context = PluginContext(
|
||||
|
|
@ -775,7 +776,7 @@ class TestJwtValidatorPlugin:
|
|||
plugin = JwtValidatorPlugin()
|
||||
plugin.configure({
|
||||
"enabled": "false",
|
||||
"pubkey_path": "/etc/haproxy/jwt_keys/api_pubkey.pem"
|
||||
"pubkey_path": f"{Consts.base_path}/jwt_keys/api_pubkey.pem"
|
||||
})
|
||||
|
||||
context = PluginContext(
|
||||
|
|
@ -826,7 +827,7 @@ class TestJwtValidatorPlugin:
|
|||
"""Test plugin with paths configured and only_paths=false"""
|
||||
plugin = JwtValidatorPlugin()
|
||||
plugin.configure({
|
||||
"pubkey_path": "/etc/haproxy/jwt_keys/api_pubkey.pem",
|
||||
"pubkey_path": f"{Consts.base_path}/jwt_keys/api_pubkey.pem",
|
||||
"paths": ["/api/admin", "/api/sensitive"],
|
||||
"only_paths": "false"
|
||||
})
|
||||
|
|
@ -860,7 +861,7 @@ class TestJwtValidatorPlugin:
|
|||
"""Test plugin with paths configured and only_paths=true"""
|
||||
plugin = JwtValidatorPlugin()
|
||||
plugin.configure({
|
||||
"pubkey_path": "/etc/haproxy/jwt_keys/api_pubkey.pem",
|
||||
"pubkey_path": f"{Consts.base_path}/jwt_keys/api_pubkey.pem",
|
||||
"paths": ["/api/public"],
|
||||
"only_paths": "true"
|
||||
})
|
||||
|
|
@ -894,7 +895,7 @@ class TestJwtValidatorPlugin:
|
|||
"""Test plugin parses comma-separated paths from container labels"""
|
||||
plugin = JwtValidatorPlugin()
|
||||
plugin.configure({
|
||||
"pubkey_path": "/etc/haproxy/jwt_keys/api_pubkey.pem",
|
||||
"pubkey_path": f"{Consts.base_path}/jwt_keys/api_pubkey.pem",
|
||||
"paths": "/api/admin,/api/sensitive,/api/protected"
|
||||
})
|
||||
|
||||
|
|
@ -904,7 +905,7 @@ class TestJwtValidatorPlugin:
|
|||
"""Test plugin parses paths from list (YAML config)"""
|
||||
plugin = JwtValidatorPlugin()
|
||||
plugin.configure({
|
||||
"pubkey_path": "/etc/haproxy/jwt_keys/api_pubkey.pem",
|
||||
"pubkey_path": f"{Consts.base_path}/jwt_keys/api_pubkey.pem",
|
||||
"paths": ["/api/admin", "/api/sensitive"]
|
||||
})
|
||||
|
||||
|
|
@ -914,7 +915,7 @@ class TestJwtValidatorPlugin:
|
|||
"""Test plugin protects all paths when paths is not configured"""
|
||||
plugin = JwtValidatorPlugin()
|
||||
plugin.configure({
|
||||
"pubkey_path": "/etc/haproxy/jwt_keys/api_pubkey.pem"
|
||||
"pubkey_path": f"{Consts.base_path}/jwt_keys/api_pubkey.pem"
|
||||
})
|
||||
|
||||
context = PluginContext(
|
||||
|
|
@ -947,7 +948,7 @@ class TestFastcgiPlugin:
|
|||
|
||||
assert plugin.name == "fastcgi"
|
||||
assert plugin.enabled is True
|
||||
assert plugin.document_root == "/var/www/html"
|
||||
assert plugin.document_root == f"{Consts.base_path}/www"
|
||||
assert plugin.index_file == "index.php"
|
||||
assert plugin.path_info is True
|
||||
assert plugin.custom_params == {}
|
||||
|
|
@ -969,7 +970,7 @@ class TestFastcgiPlugin:
|
|||
"""Test plugin generates correct HAProxy config"""
|
||||
plugin = FastcgiPlugin()
|
||||
plugin.configure({
|
||||
"document_root": "/var/www/html",
|
||||
"document_root": f"{Consts.base_path}/www",
|
||||
"index_file": "index.php"
|
||||
})
|
||||
|
||||
|
|
@ -991,9 +992,9 @@ class TestFastcgiPlugin:
|
|||
assert len(result.global_configs) == 1
|
||||
fcgi_app_def = result.global_configs[0]
|
||||
assert "fcgi-app fcgi_phpapp_local" in fcgi_app_def
|
||||
assert "docroot /var/www/html" in fcgi_app_def
|
||||
assert f"docroot {Consts.base_path}/www" in fcgi_app_def
|
||||
assert "index index.php" in fcgi_app_def
|
||||
assert result.metadata["document_root"] == "/var/www/html"
|
||||
assert result.metadata["document_root"] == f"{Consts.base_path}/www"
|
||||
assert result.metadata["index_file"] == "index.php"
|
||||
|
||||
def test_fastcgi_plugin_custom_params(self):
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue