86 lines
4.0 KiB
JavaScript
86 lines
4.0 KiB
JavaScript
var assert = require('assert')
|
|
, _ = require('underscore')
|
|
, redis = require('redis')
|
|
, test_helper = require('../../support/test_helper')
|
|
, tests = module.exports = {};
|
|
|
|
suite('req2params', function() {
|
|
|
|
// configure redis pool instance to use in tests
|
|
var opts = require('../../../lib/cartodb/server_options');
|
|
|
|
test('can be found in server_options', function(){
|
|
assert.ok(_.isFunction(opts.req2params));
|
|
});
|
|
|
|
test('cleans up request', function(done){
|
|
opts.req2params({headers: { host:'localhost' }, query: {dbuser:'hacker',dbname:'secret'}}, function(err, req) {
|
|
if ( err ) { console.log(err); throw new Error(err); }
|
|
assert.ok(_.isObject(req.query), 'request has query');
|
|
assert.ok(!req.query.hasOwnProperty('dbuser'), 'dbuser was removed from query');
|
|
assert.ok(req.hasOwnProperty('params'), 'request has params');
|
|
assert.ok(req.params.hasOwnProperty('interactivity'), 'request params have interactivity');
|
|
assert.equal(req.params.dbname, 'cartodb_test_user_1_db', 'could forge dbname: '+ req.params.dbname);
|
|
assert.ok(!req.hasOwnProperty('dbuser'), 'could inject dbuser ('+req.params.dbuser+')');
|
|
done();
|
|
});
|
|
});
|
|
|
|
test('sets dbname from redis metadata', function(done){
|
|
opts.req2params({headers: { host:'localhost' }, query: {} }, function(err, req) {
|
|
if ( err ) { console.log(err); throw new Error(err); }
|
|
//console.dir(req);
|
|
assert.ok(_.isObject(req.query), 'request has query');
|
|
assert.ok(!req.query.hasOwnProperty('dbuser'), 'dbuser was removed from query');
|
|
assert.ok(req.hasOwnProperty('params'), 'request has params');
|
|
assert.ok(req.params.hasOwnProperty('interactivity'), 'request params have interactivity');
|
|
// database_name for user "localhost" (see test/support/prepare_db.sh)
|
|
assert.equal(req.params.dbname, 'cartodb_test_user_1_db');
|
|
// unauthenticated request gets no dbuser
|
|
assert.ok(!req.params.hasOwnProperty('dbuser'), 'could inject dbuser ('+req.params.dbuser+')');
|
|
done();
|
|
});
|
|
});
|
|
|
|
test('sets also dbuser for authenticated requests', function(done){
|
|
opts.req2params({headers: { host:'localhost' }, query: {map_key: '1234'} }, function(err, req) {
|
|
if ( err ) { console.log(err); throw new Error(err); }
|
|
//console.dir(req);
|
|
assert.ok(_.isObject(req.query), 'request has query');
|
|
assert.ok(!req.query.hasOwnProperty('dbuser'), 'dbuser was removed from query');
|
|
assert.ok(req.hasOwnProperty('params'), 'request has params');
|
|
assert.ok(req.params.hasOwnProperty('interactivity'), 'request params have interactivity');
|
|
// database_name for user "localhost" (see test/support/prepare_db.sh)
|
|
assert.equal(req.params.dbname, 'cartodb_test_user_1_db');
|
|
// id for user "localhost" (see test/support/prepare_db.sh)
|
|
assert.equal(req.dbuser, 'test_cartodb_user_1');
|
|
|
|
opts.req2params({headers: { host:'localhost' }, query: {map_key: '1235'} }, function(err, req) {
|
|
// wrong key resets params to no user
|
|
assert.ok(!req.hasOwnProperty('dbuser'), 'could inject dbuser ('+req.params.dbuser+')');
|
|
done();
|
|
});
|
|
});
|
|
});
|
|
|
|
test('it should extend params with decoded lzma', function(done) {
|
|
var qo = {
|
|
style: 'test',
|
|
style_version: '2.1.0',
|
|
cache_buster: 5
|
|
};
|
|
test_helper.lzma_compress_to_base64(JSON.stringify(qo), 1, function(err, data) {
|
|
opts.req2params({ query: { non_included: 'toberemoved', api_key: 'test', style: 'override', lzma: data }}, function(err, req) {
|
|
var query = req.params
|
|
assert.equal(qo.style, query.style)
|
|
assert.equal(qo.style_version, query.style_version)
|
|
assert.equal(qo.cache_buster, query.cache_buster)
|
|
assert.equal('test', query.api_key)
|
|
assert.equal(undefined, query.non_included)
|
|
done();
|
|
});
|
|
});
|
|
});
|
|
|
|
});
|