Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type MockUserTransport ¶
type MockUserTransport struct {
// contains filtered or unexported fields
}
MockUserTransport implements http.RoundTripper for integration tests. Directly injects X-Auth-Request-User header without token validation.
Thread Safety: Safe for concurrent use (clones request to avoid mutation).
func NewMockUserTransport ¶
func NewMockUserTransport(userID string) *MockUserTransport
NewMockUserTransport creates a test-only transport that injects X-Auth-Request-User header.
Used by: Integration tests (no oauth-proxy, no token validation) Injects: X-Auth-Request-User: <mockUserID> Simulates: What oauth-proxy would inject after JWT validation + SAR
Example:
transport := mocks.NewMockUserTransport("test-operator@example.com")
httpClient := &http.Client{Transport: transport}
dsClient := datastorage.NewClientWithResponses(url, datastorage.WithHTTPClient(httpClient))
// All DataStorage API calls will have X-Auth-Request-User: test-operator@example.com
resp, err := dsClient.PlaceLegalHoldWithResponse(ctx, req)
DD-AUTH-005: This is the ONLY way integration tests should authenticate with DataStorage.
func NewMockUserTransportWithBase ¶
func NewMockUserTransportWithBase(userID string, base http.RoundTripper) *MockUserTransport
NewMockUserTransportWithBase creates a mock user transport with custom base transport. Useful for testing or custom transport configuration.
type ServiceAccountTransport ¶
type ServiceAccountTransport struct {
// contains filtered or unexported fields
}
ServiceAccountTransport is an http.RoundTripper that injects Kubernetes ServiceAccount Bearer tokens into HTTP requests for E2E testing with real middleware-based authentication.
Authority: DD-AUTH-014 (Middleware-Based SAR Authentication)
Usage:
token, err := infrastructure.GetServiceAccountToken(ctx, namespace, "datastorage-e2e-sa", kubeconfigPath)
transport := auth.NewServiceAccountTransport(token)
client := &http.Client{Transport: transport}
This injects Bearer tokens that are validated by DataStorage middleware using: 1. Kubernetes TokenReview API (authentication) 2. Kubernetes SubjectAccessReview API (authorization with SAR)
func NewServiceAccountTransport ¶
func NewServiceAccountTransport(token string) *ServiceAccountTransport
NewServiceAccountTransport creates a new ServiceAccountTransport with the given token.
Parameters:
- token: Kubernetes ServiceAccount Bearer token (from Secret)
Returns:
- *ServiceAccountTransport: HTTP transport that injects Bearer token
func NewServiceAccountTransportWithBase ¶ added in v1.3.0
func NewServiceAccountTransportWithBase(token string, base http.RoundTripper) *ServiceAccountTransport
NewServiceAccountTransportWithBase creates a ServiceAccountTransport with a custom base RoundTripper. Use this to layer token injection on top of a TLS-aware transport.
Issue #753: Required for inter-service TLS where the base transport must trust the private CA.
type StaticTokenTransport ¶
type StaticTokenTransport struct {
// contains filtered or unexported fields
}
StaticTokenTransport implements http.RoundTripper for E2E tests. Injects static token (acquired externally) without token refresh.
Thread Safety: Safe for concurrent use (clones request to avoid mutation).
func NewStaticTokenTransport ¶
func NewStaticTokenTransport(token string) *StaticTokenTransport
NewStaticTokenTransport creates a test-only transport that injects static tokens.
Used by: E2E tests that run externally (outside Kubernetes, no mounted tokens) Injects: Authorization: Bearer <token> Token source: TokenRequest API or kubectl whoami -t
Example (ServiceAccount token via TokenRequest API):
token := getServiceAccountToken("datastorage-e2e-sa", "default", 3600)
transport := testutil.NewStaticTokenTransport(token)
httpClient := &http.Client{Transport: transport}
dsClient := datastorage.NewClientWithResponses(nodePortURL, datastorage.WithHTTPClient(httpClient))
// All DataStorage API calls will have Authorization: Bearer <token>
resp, err := dsClient.CreateAuditEvent(ctx, req)
Example (Kubeadmin token via kubectl):
output, _ := exec.Command("kubectl", "whoami", "-t").Output()
token := strings.TrimSpace(string(output))
transport := testutil.NewStaticTokenTransport(token)
// ... same as above
DD-AUTH-005: This is the ONLY way E2E tests (running externally) should authenticate.
func NewStaticTokenTransportWithBase ¶
func NewStaticTokenTransportWithBase(token string, base http.RoundTripper) *StaticTokenTransport
NewStaticTokenTransportWithBase creates a static token transport with custom base transport. Useful for custom transport configuration (e.g., timeouts, TLS).
Source Files