2 changed files with 6 additions and 58 deletions
@ -1,53 +0,0 @@ |
|||
package sts |
|||
|
|||
import ( |
|||
"context" |
|||
"fmt" |
|||
"strings" |
|||
|
|||
"github.com/seaweedfs/seaweedfs/weed/iam/providers" |
|||
) |
|||
|
|||
// MockTrustPolicyValidator is a simple mock for testing STS functionality
|
|||
type MockTrustPolicyValidator struct{} |
|||
|
|||
// ValidateTrustPolicyForWebIdentity allows valid JWT test tokens for STS testing
|
|||
func (m *MockTrustPolicyValidator) ValidateTrustPolicyForWebIdentity(ctx context.Context, roleArn string, webIdentityToken string) error { |
|||
// Reject non-existent roles for testing
|
|||
if strings.Contains(roleArn, "NonExistentRole") { |
|||
return fmt.Errorf("trust policy validation failed: role does not exist") |
|||
} |
|||
|
|||
// For STS unit tests, allow JWT tokens that look valid (contain dots for JWT structure)
|
|||
// In real implementation, this would validate against actual trust policies
|
|||
if len(webIdentityToken) > 20 && strings.Count(webIdentityToken, ".") >= 2 { |
|||
// This appears to be a JWT token - allow it for testing
|
|||
return nil |
|||
} |
|||
|
|||
// Legacy support for specific test tokens during migration
|
|||
if webIdentityToken == "valid_test_token" || webIdentityToken == "valid-oidc-token" { |
|||
return nil |
|||
} |
|||
|
|||
// Reject invalid tokens
|
|||
if webIdentityToken == "invalid_token" || webIdentityToken == "expired_token" || webIdentityToken == "invalid-token" { |
|||
return fmt.Errorf("trust policy denies token") |
|||
} |
|||
|
|||
return nil |
|||
} |
|||
|
|||
// ValidateTrustPolicyForCredentials allows valid test identities for STS testing
|
|||
func (m *MockTrustPolicyValidator) ValidateTrustPolicyForCredentials(ctx context.Context, roleArn string, identity *providers.ExternalIdentity) error { |
|||
// Reject non-existent roles for testing
|
|||
if strings.Contains(roleArn, "NonExistentRole") { |
|||
return fmt.Errorf("trust policy validation failed: role does not exist") |
|||
} |
|||
|
|||
// For STS unit tests, allow test identities
|
|||
if identity != nil && identity.UserID != "" { |
|||
return nil |
|||
} |
|||
return fmt.Errorf("invalid identity for role assumption") |
|||
} |
Write
Preview
Loading…
Cancel
Save
Reference in new issue