coderd/httpapi/queryparams_test.go
Rama main · réplica de lectura del repositorio original.
package httpapi_test
import (
"database/sql"
"fmt"
"net/http"
"net/url"
"testing"
"time"
"github.com/google/uuid"
"github.com/stretchr/testify/require"
"github.com/coder/coder/v2/coderd/database"
"github.com/coder/coder/v2/coderd/httpapi"
)
type queryParamTestCase[T any] struct {
QueryParam string
// No set does not set the query param, rather than setting the empty value
NoSet bool
// Value vs values is the difference between a single query param and multiple
// to the same key.
// -> key=value
Value string
// -> key=value1 key=value2
Values []string
Default T
Expected T
ExpectedErrorContains string
Parse func(r *http.Request, def T, queryParam string) T
}
func TestParseQueryParams(t *testing.T) {
t.Parallel()
const multipleValuesError = "provided more than once"
t.Run("Enum", func(t *testing.T) {
t.Parallel()
expParams := []queryParamTestCase[database.ResourceType]{
{
QueryParam: "resource_type",
Value: string(database.ResourceTypeWorkspace),
Expected: database.ResourceTypeWorkspace,
},
{
QueryParam: "bad_type",
Value: "foo",
ExpectedErrorContains: "not a valid value",
},
}
parser := httpapi.NewQueryParamParser()
testQueryParams(t, expParams, parser, func(vals url.Values, def database.ResourceType, queryParam string) database.ResourceType {
return httpapi.ParseCustom(parser, vals, def, queryParam, httpapi.ParseEnum[database.ResourceType])
})
})
t.Run("EnumList", func(t *testing.T) {
t.Parallel()
expParams := []queryParamTestCase[[]database.ResourceType]{
{
QueryParam: "resource_type",
Value: fmt.Sprintf("%s,%s", database.ResourceTypeWorkspace, database.ResourceTypeApiKey),
Expected: []database.ResourceType{database.ResourceTypeWorkspace, database.ResourceTypeApiKey},
},
{
QueryParam: "resource_type_as_list",
Values: []string{string(database.ResourceTypeWorkspace), string(database.ResourceTypeApiKey)},
Expected: []database.ResourceType{database.ResourceTypeWorkspace, database.ResourceTypeApiKey},
},
}
parser := httpapi.NewQueryParamParser()
testQueryParams(t, expParams, parser, func(vals url.Values, def []database.ResourceType, queryParam string) []database.ResourceType {
return httpapi.ParseCustomList(parser, vals, def, queryParam, httpapi.ParseEnum[database.ResourceType])
})
})
t.Run("Time", func(t *testing.T) {
t.Parallel()
expParams := []queryParamTestCase[time.Time]{
{
QueryParam: "date",
Value: "2023-01-16T00:00:00+12:00",
Expected: time.Date(2023, 1, 15, 12, 0, 0, 0, time.UTC),
},
{
QueryParam: "bad_date",
Value: "2010",
ExpectedErrorContains: "must be a valid date format",
},
}
parser := httpapi.NewQueryParamParser()
testQueryParams(t, expParams, parser, func(vals url.Values, def time.Time, queryParam string) time.Time {
return parser.Time3339Nano(vals, time.Time{}, queryParam)
})
})
t.Run("UUID", func(t *testing.T) {
t.Parallel()
me := uuid.New()
expParams := []queryParamTestCase[uuid.UUID]{
{
QueryParam: "valid_id",
Value: "afe39fbf-0f52-4a62-b0cc-58670145d773",
Expected: uuid.MustParse("afe39fbf-0f52-4a62-b0cc-58670145d773"),
},
{
QueryParam: "me",
Value: "me",
Expected: me,
},
{
QueryParam: "invalid_id",
Value: "bogus",
ExpectedErrorContains: "invalid UUID length",
},
{
QueryParam: "long_id",
Value: "afe39fbf-0f52-4a62-b0cc-58670145d773-123",
ExpectedErrorContains: "invalid UUID length",
},
{
QueryParam: "no_value",
NoSet: true,
Default: uuid.MustParse("11111111-1111-1111-1111-111111111111"),
Expected: uuid.MustParse("11111111-1111-1111-1111-111111111111"),
},
{
QueryParam: "empty",
Value: "",
Expected: uuid.Nil,
},
}
parser := httpapi.NewQueryParamParser()
testQueryParams(t, expParams, parser, func(vals url.Values, def uuid.UUID, queryParam string) uuid.UUID {
return parser.UUIDorMe(vals, def, me, queryParam)
})
})
t.Run("String", func(t *testing.T) {
t.Parallel()
expParams := []queryParamTestCase[string]{
{
QueryParam: "valid_string",
Value: "random",
Expected: "random",
},
{
QueryParam: "empty",
Value: "",
Expected: "",
},
{
QueryParam: "no_value",
NoSet: true,
Default: "default",
Expected: "default",
},
{
QueryParam: "unexpected_list",
Values: []string{"one", "two"},
ExpectedErrorContains: multipleValuesError,
},
}
parser := httpapi.NewQueryParamParser()
testQueryParams(t, expParams, parser, parser.String)
})
t.Run("Boolean", func(t *testing.T) {
t.Parallel()
expParams := []queryParamTestCase[bool]{
{
QueryParam: "valid_true",
Value: "true",
Expected: true,
},
{
QueryParam: "casing",
Value: "True",
Expected: true,
},
{
QueryParam: "all_caps",
Value: "TRUE",
Expected: true,
},
{
QueryParam: "no_value_true_def",
NoSet: true,
Default: true,
Expected: true,
},
{
QueryParam: "no_value",
NoSet: true,
Expected: false,
},
{
QueryParam: "invalid_boolean",
Value: "yes",
Expected: false,
ExpectedErrorContains: "must be a valid boolean",
},
{
QueryParam: "unexpected_list",
Values: []string{"true", "false"},
ExpectedErrorContains: multipleValuesError,
},
}
parser := httpapi.NewQueryParamParser()
testQueryParams(t, expParams, parser, parser.Boolean)
})
t.Run("NullableBoolean", func(t *testing.T) {
t.Parallel()
expParams := []queryParamTestCase[sql.NullBool]{
{
QueryParam: "valid_true",
Value: "true",
Expected: sql.NullBool{
Bool: true,
Valid: true,
},
},
{
QueryParam: "no_value_true_def",
NoSet: true,
Default: sql.NullBool{
Bool: true,
Valid: true,
},
Expected: sql.NullBool{
Bool: true,
Valid: true,
},
},
{
QueryParam: "no_value",
NoSet: true,
Expected: sql.NullBool{
Bool: false,
Valid: false,
},
},
{
QueryParam: "invalid_boolean",
Value: "yes",
Expected: sql.NullBool{
Bool: false,
Valid: false,
},
ExpectedErrorContains: "must be a valid boolean",
},
{
QueryParam: "unexpected_list",
Values: []string{"true", "false"},
ExpectedErrorContains: multipleValuesError,
// Expected value is a bit strange, but the error is raised
// in the parser, not as a parse failure. Maybe this should be
// fixed, but is how it is done atm.
Expected: sql.NullBool{
Bool: false,
Valid: true,
},
},
}
parser := httpapi.NewQueryParamParser()
testQueryParams(t, expParams, parser, parser.NullableBoolean)
})
t.Run("Int", func(t *testing.T) {
t.Parallel()
expParams := []queryParamTestCase[int]{
{
QueryParam: "valid_integer",
Value: "100",
Expected: 100,
},
{
QueryParam: "empty",
Value: "",
Expected: 0,
},
{
QueryParam: "no_value",
NoSet: true,
Default: 5,
Expected: 5,
},
{
QueryParam: "negative",
Value: "-10",
Expected: -10,
Default: 5,
},
{
QueryParam: "invalid_integer",
Value: "bogus",
Expected: 0,
ExpectedErrorContains: "must be a valid integer",
},
{
QueryParam: "unexpected_list",
Values: []string{"5", "10"},
ExpectedErrorContains: multipleValuesError,
},
}
parser := httpapi.NewQueryParamParser()
testQueryParams(t, expParams, parser, parser.Int)
})
t.Run("PositiveInt32", func(t *testing.T) {
t.Parallel()
expParams := []queryParamTestCase[int32]{
{
QueryParam: "valid_integer",
Value: "100",
Expected: 100,
},
{
QueryParam: "empty",
Value: "",
Expected: 0,
},
{
QueryParam: "no_value",
NoSet: true,
Default: 5,
Expected: 5,
},
{
QueryParam: "negative",
Value: "-1",
Expected: 0,
Default: 5,
ExpectedErrorContains: "must be a valid 32-bit positive integer",
},
{
QueryParam: "invalid_integer",
Value: "bogus",
Expected: 0,
ExpectedErrorContains: "must be a valid 32-bit positive integer",
},
{
QueryParam: "max_int_plus_one",
Value: "2147483648",
Expected: 0,
ExpectedErrorContains: "must be a valid 32-bit positive integer",
},
{
QueryParam: "unexpected_list",
Values: []string{"5", "10"},
ExpectedErrorContains: multipleValuesError,
},
}
parser := httpapi.NewQueryParamParser()
testQueryParams(t, expParams, parser, parser.PositiveInt32)
})
t.Run("UInt", func(t *testing.T) {
t.Parallel()
expParams := []queryParamTestCase[uint64]{
{
QueryParam: "valid_integer",
Value: "100",
Expected: 100,
},
{
QueryParam: "empty",
Value: "",
Expected: 0,
},
{
QueryParam: "no_value",
NoSet: true,
Default: 5,
Expected: 5,
},
{
QueryParam: "negative",
Value: "-10",
Default: 5,
ExpectedErrorContains: "must be a valid positive integer",
},
{
QueryParam: "invalid_integer",
Value: "bogus",
Expected: 0,
ExpectedErrorContains: "must be a valid positive integer",
},
{
QueryParam: "unexpected_list",
Values: []string{"5", "10"},
ExpectedErrorContains: multipleValuesError,
},
}
parser := httpapi.NewQueryParamParser()
testQueryParams(t, expParams, parser, parser.UInt)
})
t.Run("UUIDs", func(t *testing.T) {
t.Parallel()
expParams := []queryParamTestCase[[]uuid.UUID]{
{
QueryParam: "valid_ids_with_spaces",
Value: "6c8ef17d-5dd8-4b92-bac9-41944f90f237, 65fb05f3-12c8-4a0a-801f-40439cf9e681 , 01b94888-1eab-4bbf-aed0-dc7a8010da97",
Expected: []uuid.UUID{
uuid.MustParse("6c8ef17d-5dd8-4b92-bac9-41944f90f237"),
uuid.MustParse("65fb05f3-12c8-4a0a-801f-40439cf9e681"),
uuid.MustParse("01b94888-1eab-4bbf-aed0-dc7a8010da97"),
},
},
{
QueryParam: "empty",
Value: "",
Default: []uuid.UUID{},
Expected: []uuid.UUID{},
},
{
QueryParam: "no_value",
NoSet: true,
Default: []uuid.UUID{},
Expected: []uuid.UUID{},
},
{
QueryParam: "default",
NoSet: true,
Default: []uuid.UUID{uuid.Nil},
Expected: []uuid.UUID{uuid.Nil},
},
{
QueryParam: "invalid_id_in_set",
Value: "6c8ef17d-5dd8-4b92-bac9-41944f90f237,bogus",
Expected: []uuid.UUID{},
Default: []uuid.UUID{},
ExpectedErrorContains: "invalid UUID length",
},
{
QueryParam: "multiple_keys",
Values: []string{"6c8ef17d-5dd8-4b92-bac9-41944f90f237", "65fb05f3-12c8-4a0a-801f-40439cf9e681"},
Expected: []uuid.UUID{
uuid.MustParse("6c8ef17d-5dd8-4b92-bac9-41944f90f237"),
uuid.MustParse("65fb05f3-12c8-4a0a-801f-40439cf9e681"),
},
},
{
QueryParam: "multiple_and_csv",
Values: []string{"6c8ef17d-5dd8-4b92-bac9-41944f90f237", "65fb05f3-12c8-4a0a-801f-40439cf9e681, 01b94888-1eab-4bbf-aed0-dc7a8010da97"},
Expected: []uuid.UUID{
uuid.MustParse("6c8ef17d-5dd8-4b92-bac9-41944f90f237"),
uuid.MustParse("65fb05f3-12c8-4a0a-801f-40439cf9e681"),
uuid.MustParse("01b94888-1eab-4bbf-aed0-dc7a8010da97"),
},
},
}
parser := httpapi.NewQueryParamParser()
testQueryParams(t, expParams, parser, parser.UUIDs)
})
t.Run("JSONStringMap", func(t *testing.T) {
t.Parallel()
expParams := []queryParamTestCase[map[string]string]{
{
QueryParam: "valid_map",
Value: `{"key1": "value1", "key2": "value2"}`,
Expected: map[string]string{
"key1": "value1",
"key2": "value2",
},
},
{
QueryParam: "empty",
Value: "{}",
Default: map[string]string{},
Expected: map[string]string{},
},
{
QueryParam: "no_value",
NoSet: true,
Default: map[string]string{},
Expected: map[string]string{},
},
{
QueryParam: "default",
NoSet: true,
Default: map[string]string{"key": "value"},
Expected: map[string]string{"key": "value"},
},
{
QueryParam: "null",
Value: "null",
Expected: map[string]string(nil),
},
{
QueryParam: "undefined",
Value: "undefined",
Expected: map[string]string(nil),
},
{
QueryParam: "invalid_map",
Value: `{"key1": "value1", "key2": "value2"`, // missing closing brace
Expected: map[string]string(nil),
Default: map[string]string{},
ExpectedErrorContains: `Query param "invalid_map" must be a valid JSON object: unexpected EOF`,
},
{
QueryParam: "incorrect_type",
Value: `{"key1": 1, "key2": true}`,
Expected: map[string]string(nil),
ExpectedErrorContains: `Query param "incorrect_type" must be a valid JSON object: json: cannot unmarshal number into Go value of type string`,
},
{
QueryParam: "multiple_keys",
Values: []string{`{"key1": "value1"}`, `{"key2": "value2"}`},
Expected: map[string]string(nil),
ExpectedErrorContains: `Query param "multiple_keys" provided more than once, found 2 times.`,
},
}
parser := httpapi.NewQueryParamParser()
testQueryParams(t, expParams, parser, parser.JSONStringMap)
})
t.Run("Required", func(t *testing.T) {
t.Parallel()
parser := httpapi.NewQueryParamParser()
parser.RequiredNotEmpty("test_value")
parser.UUID(url.Values{}, uuid.New(), "test_value")
require.Len(t, parser.Errors, 1)
parser = httpapi.NewQueryParamParser()
parser.RequiredNotEmpty("test_value")
parser.String(url.Values{"test_value": {""}}, "", "test_value")
require.Len(t, parser.Errors, 1)
})
}
func testQueryParams[T any](t *testing.T, testCases []queryParamTestCase[T], parser *httpapi.QueryParamParser, parse func(vals url.Values, def T, queryParam string) T) {
v := url.Values{}
for _, c := range testCases {
if c.NoSet {
continue
}
if len(c.Values) > 0 && c.Value != "" {
t.Errorf("test case %q has both value and values, choose one, not both!", c.QueryParam)
t.FailNow()
}
if c.Value != "" {
c.Values = append(c.Values, c.Value)
}
for _, value := range c.Values {
v.Add(c.QueryParam, value)
}
}
for _, c := range testCases {
// !! Do not run these in parallel !!
t.Run(c.QueryParam, func(t *testing.T) {
value := parse(v, c.Default, c.QueryParam)
require.Equal(t, c.Expected, value, fmt.Sprintf("param=%q value=%q", c.QueryParam, c.Value))
if c.ExpectedErrorContains != "" {
errors := parser.Errors
require.True(t, len(errors) > 0, "error exist")
last := errors[len(errors)-1]
require.True(t, last.Field == c.QueryParam, fmt.Sprintf("query param %q did not fail", c.QueryParam))
require.Contains(t, last.Detail, c.ExpectedErrorContains, "correct error")
}
})
}
}
func TestRedirectURL(t *testing.T) {
t.Parallel()
base, err := url.Parse("https://app.example.com/callback")
require.NoError(t, err)
t.Run("Omitted", func(t *testing.T) {
t.Parallel()
parser := httpapi.NewQueryParamParser()
got := parser.RedirectURL(url.Values{}, base, nil, "redirect_uri")
require.Empty(t, parser.Errors)
require.Equal(t, base.String(), got.String())
})
t.Run("ExactMatch", func(t *testing.T) {
t.Parallel()
parser := httpapi.NewQueryParamParser()
vals := url.Values{"redirect_uri": []string{base.String()}}
got := parser.RedirectURL(vals, base, nil, "redirect_uri")
require.Empty(t, parser.Errors)
require.Equal(t, base.String(), got.String())
})
t.Run("Mismatch", func(t *testing.T) {
t.Parallel()
parser := httpapi.NewQueryParamParser()
vals := url.Values{"redirect_uri": []string{"https://evil.example.com/steal"}}
parser.RedirectURL(vals, base, nil, "redirect_uri")
require.Len(t, parser.Errors, 1)
require.Contains(t, parser.Errors[0].Detail, "must match")
})
// url.Parse returns a nil URL alongside its error for these, so a caller
// that reads the result must still get something dereferenceable.
t.Run("Unparsable", func(t *testing.T) {
t.Parallel()
for _, raw := range []string{"\x00", "\x7f", "://"} {
parser := httpapi.NewQueryParamParser()
vals := url.Values{"redirect_uri": []string{raw}}
require.NotPanics(t, func() {
got := parser.RedirectURL(vals, base, nil, "redirect_uri")
require.NotNil(t, got, "a nil URL would panic in the caller")
require.Equal(t, base.String(), got.String())
}, "redirect_uri=%q must not panic", raw)
require.Len(t, parser.Errors, 1, "redirect_uri=%q must report one error", raw)
require.Equal(t, "redirect_uri", parser.Errors[0].Field)
require.Contains(t, parser.Errors[0].Detail, "must be a valid url")
}
})
// RFC 8252 §7.3: a loopback redirect URI may present any port. The returned
// URL is the presented one, since that is where the response must go.
t.Run("LoopbackPortDiffers", func(t *testing.T) {
t.Parallel()
for _, host := range []string{"127.0.0.1", "[::1]", "localhost"} {
registered, err := url.Parse("http://" + host + "/callback")
require.NoError(t, err)
presented := "http://" + host + ":53219/callback"
parser := httpapi.NewQueryParamParser()
vals := url.Values{"redirect_uri": []string{presented}}
got := parser.RedirectURL(vals, registered, nil, "redirect_uri")
require.Empty(t, parser.Errors, "host %s", host)
require.Equal(t, presented, got.String(), "host %s", host)
}
})
t.Run("LoopbackRegisteredWithPort", func(t *testing.T) {
t.Parallel()
registered, err := url.Parse("http://localhost:9876/callback")
require.NoError(t, err)
presented := "http://localhost:53219/callback"
parser := httpapi.NewQueryParamParser()
vals := url.Values{"redirect_uri": []string{presented}}
got := parser.RedirectURL(vals, registered, nil, "redirect_uri")
require.Empty(t, parser.Errors)
require.Equal(t, presented, got.String())
})
// Only the port is excepted. codersdk.TestRedirectURIMatches covers each
// other component; this checks the wrapper reports the mismatch.
t.Run("LoopbackOtherComponentDiffers", func(t *testing.T) {
t.Parallel()
registered, err := url.Parse("http://127.0.0.1/callback")
require.NoError(t, err)
parser := httpapi.NewQueryParamParser()
vals := url.Values{"redirect_uri": []string{"http://127.0.0.1:53219/other"}}
parser.RedirectURL(vals, registered, nil, "redirect_uri")
require.Len(t, parser.Errors, 1)
require.Equal(t, "redirect_uri", parser.Errors[0].Field)
require.Contains(t, parser.Errors[0].Detail, "must match one of")
})
// A non-loopback registration keeps the exact match, port included.
t.Run("NonLoopbackPortDiffers", func(t *testing.T) {
t.Parallel()
parser := httpapi.NewQueryParamParser()
vals := url.Values{"redirect_uri": []string{"https://app.example.com:8443/callback"}}
parser.RedirectURL(vals, base, nil, "redirect_uri")
require.Len(t, parser.Errors, 1)
require.Contains(t, parser.Errors[0].Detail, "must match")
})
// RFC 6749 §3.1.2.3: the presented URI must match one of the registered URIs,
// not only the first.
t.Run("MatchesAnyRegisteredEntry", func(t *testing.T) {
t.Parallel()
second, err := url.Parse("https://www.cursor.com/agents/mcp/oauth/callback")
require.NoError(t, err)
alternates := []*url.URL{second}
for _, want := range []*url.URL{base, second} {
parser := httpapi.NewQueryParamParser()
vals := url.Values{"redirect_uri": []string{want.String()}}
got := parser.RedirectURL(vals, base, alternates, "redirect_uri")
require.Empty(t, parser.Errors, want.String())
require.Equal(t, want.String(), got.String())
}
parser := httpapi.NewQueryParamParser()
vals := url.Values{"redirect_uri": []string{"https://evil.example.com/steal"}}
parser.RedirectURL(vals, base, alternates, "redirect_uri")
require.Len(t, parser.Errors, 1)
require.Contains(t, parser.Errors[0].Detail, "must match one of")
})
t.Run("OmittedWithSeveralRegisteredDefaultsToPrimary", func(t *testing.T) {
t.Parallel()
second, err := url.Parse("https://www.cursor.com/agents/mcp/oauth/callback")
require.NoError(t, err)
parser := httpapi.NewQueryParamParser()
got := parser.RedirectURL(url.Values{}, base, []*url.URL{second}, "redirect_uri")
require.Empty(t, parser.Errors)
require.Equal(t, base.String(), got.String())
})
}