jiazhizhong/higress
1
0
Fork 0
mirror of https://github.com/alibaba/higress.git synced 2026-05-05 02:47:26 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat: ext-auth plugin: Blacklist and whitelist modes support HTTP request method matching (#1798)

Browse Source
This commit is contained in:
韩贤涛
2025-02-26 20:54:52 +08:00
committed by GitHub
parent 2d8a8f26da
commit 90ca903d2e
8 changed files with 311 additions and 132 deletions
Download Patch File Download Diff File Expand all files Collapse all files

220
plugins/wasm-go/extensions/ext-auth/expr/match_rules_test.go
View File

@@ -6,11 +6,20 @@ import (
"github.com/stretchr/testify/assert"
)
func createMatcher(pattern string, caseSensitive bool) Matcher {
pathMatcher, err := newStringExactMatcher(pattern, caseSensitive)
if err != nil {
panic(err)
}
return pathMatcher
}
func TestIsAllowedByMode(t *testing.T) {
tests := []struct {
name string
config MatchRules
domain string
method string
path string
expected bool
}{
@@ -21,17 +30,13 @@ func TestIsAllowedByMode(t *testing.T) {
RuleList: []Rule{
{
Domain: "example.com",
Path: func() Matcher {
pathMatcher, err := newStringExactMatcher("/foo", true)
if err != nil {
t.Fatalf("Failed to create Matcher: %v", err)
}
return pathMatcher
}(),
Method: []string{"GET"},
Path: createMatcher("/foo", true),
},
},
},
domain: "example.com",
method: "GET",
path: "/foo",
expected: true,
},
@@ -42,18 +47,14 @@ func TestIsAllowedByMode(t *testing.T) {
RuleList: []Rule{
{
Domain: "example.com",
Path: func() Matcher {
pathMatcher, err := newStringExactMatcher("/foo", true)
if err != nil {
t.Fatalf("Failed to create Matcher: %v", err)
}
return pathMatcher
}(),
Method: []string{"GET"},
Path: createMatcher("/foo", true),
},
},
},
domain: "example.com",
path: "/bar",
method: "POST",
path: "/foo",
expected: false,
},
{
@@ -63,17 +64,13 @@ func TestIsAllowedByMode(t *testing.T) {
RuleList: []Rule{
{
Domain: "example.com",
Path: func() Matcher {
pathMatcher, err := newStringExactMatcher("/foo", true)
if err != nil {
t.Fatalf("Failed to create Matcher: %v", err)
}
return pathMatcher
}(),
Method: []string{"GET"},
Path: createMatcher("/foo", true),
},
},
},
domain: "example.com",
method: "GET",
path: "/foo",
expected: false,
},
@@ -84,18 +81,14 @@ func TestIsAllowedByMode(t *testing.T) {
RuleList: []Rule{
{
Domain: "example.com",
Path: func() Matcher {
pathMatcher, err := newStringExactMatcher("/foo", true)
if err != nil {
t.Fatalf("Failed to create Matcher: %v", err)
}
return pathMatcher
}(),
Method: []string{"GET"},
Path: createMatcher("/foo", true),
},
},
},
domain: "example.com",
path: "/bar",
method: "POST",
path: "/foo",
expected: true,
},
{
@@ -107,6 +100,7 @@ func TestIsAllowedByMode(t *testing.T) {
},
},
domain: "example.com",
method: "GET",
path: "/foo",
expected: true,
},
@@ -117,29 +111,25 @@ func TestIsAllowedByMode(t *testing.T) {
RuleList: []Rule{
{
Domain: "",
Path: func() Matcher {
pathMatcher, err := newStringExactMatcher("/foo", true)
if err != nil {
t.Fatalf("Failed to create Matcher: %v", err)
}
return pathMatcher
}(),
Path: createMatcher("/foo", true),
},
},
},
domain: "example.com",
method: "GET",
path: "/foo",
expected: true,
},
{
name: "Both Domain and Path are empty",
name: "All fields (Domain, Method, Path) are empty",
config: MatchRules{
Mode: ModeWhitelist,
RuleList: []Rule{
{Domain: "", Path: nil},
{Domain: "", Method: []string{}, Path: nil},
},
},
domain: "example.com",
method: "GET",
path: "/foo",
expected: false,
},
@@ -150,17 +140,13 @@ func TestIsAllowedByMode(t *testing.T) {
RuleList: []Rule{
{
Domain: "example.com",
Path: func() Matcher {
pathMatcher, err := newStringExactMatcher("/foo", true)
if err != nil {
t.Fatalf("Failed to create Matcher: %v", err)
}
return pathMatcher
}(),
Method: []string{"GET"},
Path: createMatcher("/foo", true),
},
},
},
domain: "example.com",
method: "GET",
path: "/foo",
expected: false,
},
@@ -171,17 +157,13 @@ func TestIsAllowedByMode(t *testing.T) {
RuleList: []Rule{
{
Domain: "*.example.com",
Path: func() Matcher {
pathMatcher, err := newStringExactMatcher("/foo", true)
if err != nil {
t.Fatalf("Failed to create Matcher: %v", err)
}
return pathMatcher
}(),
Method: []string{"GET"},
Path: createMatcher("/foo", true),
},
},
},
domain: "sub.example.com",
method: "GET",
path: "/foo",
expected: true,
},
@@ -192,20 +174,48 @@ func TestIsAllowedByMode(t *testing.T) {
RuleList: []Rule{
{
Domain: "*.example.com",
Path: func() Matcher {
pathMatcher, err := newStringExactMatcher("/foo", true)
if err != nil {
t.Fatalf("Failed to create Matcher: %v", err)
}
return pathMatcher
}(),
Method: []string{"GET"},
Path: createMatcher("/foo", true),
},
},
},
domain: "example.com",
method: "GET",
path: "/foo",
expected: false,
},
{
name: "Whitelist mode, only method matches",
config: MatchRules{
Mode: ModeWhitelist,
RuleList: []Rule{
{
Method: []string{"GET"},
Path: nil,
},
},
},
domain: "example.com",
method: "GET",
path: "/foo",
expected: true,
},
{
name: "Whitelist mode, only domain matches",
config: MatchRules{
Mode: ModeWhitelist,
RuleList: []Rule{
{
Domain: "example.com",
Path: nil,
},
},
},
domain: "example.com",
method: "GET",
path: "/foo",
expected: true,
},
{
name: "Blacklist mode, generic domain matches",
config: MatchRules{
@@ -213,17 +223,13 @@ func TestIsAllowedByMode(t *testing.T) {
RuleList: []Rule{
{
Domain: "*.example.com",
Path: func() Matcher {
pathMatcher, err := newStringExactMatcher("/foo", true)
if err != nil {
t.Fatalf("Failed to create Matcher: %v", err)
}
return pathMatcher
}(),
Method: []string{"GET"},
Path: createMatcher("/foo", true),
},
},
},
domain: "sub.example.com",
method: "GET",
path: "/foo",
expected: false,
},
@@ -234,25 +240,89 @@ func TestIsAllowedByMode(t *testing.T) {
RuleList: []Rule{
{
Domain: "*.example.com",
Path: func() Matcher {
pathMatcher, err := newStringExactMatcher("/foo", true)
if err != nil {
t.Fatalf("Failed to create Matcher: %v", err)
}
return pathMatcher
}(),
Method: []string{"GET"},
Path: createMatcher("/foo", true),
},
},
},
domain: "example.com",
method: "GET",
path: "/foo",
expected: true,
},
{
name: "Domain with special characters",
config: MatchRules{
Mode: ModeWhitelist,
RuleList: []Rule{
{
Domain: "example-*.com",
Method: []string{"GET"},
Path: createMatcher("/foo", true),
},
},
},
domain: "example-test.com",
method: "GET",
path: "/foo",
expected: true,
},
{
name: "Path with special characters",
config: MatchRules{
Mode: ModeWhitelist,
RuleList: []Rule{
{
Domain: "example.com",
Method: []string{"GET"},
Path: createMatcher("/foo-bar", true),
},
},
},
domain: "example.com",
method: "GET",
path: "/foo-bar",
expected: true,
},
{
name: "Multiple methods, one matches",
config: MatchRules{
Mode: ModeWhitelist,
RuleList: []Rule{
{
Domain: "example.com",
Method: []string{"GET", "POST"},
Path: createMatcher("/foo", true),
},
},
},
domain: "example.com",
method: "POST",
path: "/foo",
expected: true,
},
{
name: "Multiple methods, none match",
config: MatchRules{
Mode: ModeWhitelist,
RuleList: []Rule{
{
Domain: "example.com",
Method: []string{"GET", "POST"},
Path: createMatcher("/foo", true),
},
},
},
domain: "example.com",
method: "PUT",
path: "/foo",
expected: false,
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
result := tt.config.IsAllowedByMode(tt.domain, tt.path)
result := tt.config.IsAllowedByMode(tt.domain, tt.method, tt.path)
assert.Equal(t, tt.expected, result)
})
}