diff options
Diffstat (limited to 'src/test/scala/xyz/driver/core/rest/DriverRouteTest.scala')
-rw-r--r-- | src/test/scala/xyz/driver/core/rest/DriverRouteTest.scala | 65 |
1 files changed, 59 insertions, 6 deletions
diff --git a/src/test/scala/xyz/driver/core/rest/DriverRouteTest.scala b/src/test/scala/xyz/driver/core/rest/DriverRouteTest.scala index c763dda..60056b7 100644 --- a/src/test/scala/xyz/driver/core/rest/DriverRouteTest.scala +++ b/src/test/scala/xyz/driver/core/rest/DriverRouteTest.scala @@ -1,10 +1,11 @@ package xyz.driver.core.rest -import akka.http.scaladsl.model.StatusCodes +import akka.http.scaladsl.model.{HttpMethod, StatusCodes} +import akka.http.scaladsl.model.headers._ import akka.http.scaladsl.server.Directives.{complete => akkaComplete} -import akka.http.scaladsl.server.Route +import akka.http.scaladsl.server.{Directives, Route} import akka.http.scaladsl.testkit.ScalatestRouteTest -import com.typesafe.config.Config +import com.typesafe.config.{Config, ConfigFactory} import com.typesafe.scalalogging.Logger import org.scalatest.{AsyncFlatSpec, Matchers} import xyz.driver.core.logging.NoLogger @@ -12,10 +13,24 @@ import xyz.driver.core.rest.errors._ import scala.concurrent.Future -class DriverRouteTest extends AsyncFlatSpec with ScalatestRouteTest with Matchers { +class DriverRouteTest extends AsyncFlatSpec with ScalatestRouteTest with Matchers with Directives { class TestRoute(override val route: Route) extends DriverRoute { - override def log: Logger = NoLogger - override def config: Config = xyz.driver.core.config.loadDefaultConfig + override def log: Logger = NoLogger + override def config: Config = + ConfigFactory.parseString(""" + |application { + | cors { + | allowedMethods: ["GET", "PUT", "POST", "PATCH", "DELETE", "OPTIONS"] + | allowedOrigins: [{scheme: https, hostSuffix: example.com}] + | } + |} + """.stripMargin) + } + + val allowedOrigins = Set(HttpOrigin("https", Host("example.com"))) + val allowedMethods: collection.immutable.Seq[HttpMethod] = { + import akka.http.scaladsl.model.HttpMethods._ + collection.immutable.Seq(GET, PUT, POST, PATCH, DELETE, OPTIONS) } "DriverRoute" should "respond with 200 OK for a basic route" in { @@ -88,4 +103,42 @@ class DriverRouteTest extends AsyncFlatSpec with ScalatestRouteTest with Matcher responseAs[String] shouldBe "Database access error" } } + + it should "respond with the correct CORS headers for the swagger OPTIONS route" in { + val route = new TestRoute(get(akkaComplete(StatusCodes.OK))) + Options(s"/api-docs/swagger.json") ~> route.routeWithDefaults ~> check { + status shouldBe StatusCodes.OK + headers should contain(`Access-Control-Allow-Origin`(HttpOriginRange(allowedOrigins.toSeq: _*))) + header[`Access-Control-Allow-Methods`].get.methods should contain theSameElementsAs allowedMethods + } + } + + it should "respond with the correct CORS headers for the test route" in { + val route = new TestRoute(get(akkaComplete(StatusCodes.OK))) + Options(s"/api/v1/test") ~> route.routeWithDefaults ~> check { + status shouldBe StatusCodes.OK + headers should contain(`Access-Control-Allow-Origin`(HttpOriginRange(allowedOrigins.toSeq: _*))) + header[`Access-Control-Allow-Methods`].get.methods should contain theSameElementsAs allowedMethods + } + } + + it should "allow subdomains of allowed origin suffixes" in { + val route = new TestRoute(get(akkaComplete(StatusCodes.OK))) + Options(s"/api/v1/test") + .withHeaders(Origin(HttpOrigin("https", Host("foo.example.com")))) ~> route.routeWithDefaults ~> check { + status shouldBe StatusCodes.OK + headers should contain(`Access-Control-Allow-Origin`(HttpOrigin("https", Host("foo.example.com")))) + header[`Access-Control-Allow-Methods`].get.methods should contain theSameElementsAs allowedMethods + } + } + + it should "respond with default domains for invalid origins" in { + val route = new TestRoute(get(akkaComplete(StatusCodes.OK))) + Options(s"/api/v1/test") + .withHeaders(Origin(HttpOrigin("https", Host("invalid.foo.bar.com")))) ~> route.routeWithDefaults ~> check { + status shouldBe StatusCodes.OK + headers should contain(`Access-Control-Allow-Origin`(HttpOriginRange(allowedOrigins.toSeq: _*))) + header[`Access-Control-Allow-Methods`].get.methods should contain theSameElementsAs allowedMethods + } + } } |