@@ -923,186 +923,6 @@ func TestMiddleware_WithTracing(t *testing.T) {
923923 })
924924}
925925
926- func TestMiddleware_WithMetrics (t * testing.T ) {
927- t .Run ("records metrics when metrics is available" , func (t * testing.T ) {
928- mockMetrics := & mockMetrics {
929- counterIncremented : make (map [string ]bool ),
930- }
931-
932- config := & Config {
933- Endpoints : []EndpointMapping {
934- {Path : "/api" , Methods : []string {"GET" }, RequiredPermissions : []string {"admin:read" }},
935- },
936- RoleHeader : "X-User-Role" ,
937- Metrics : mockMetrics ,
938- }
939- err := config .processUnifiedConfig ()
940- require .NoError (t , err )
941-
942- middlewareFunc := Middleware (config )
943- handler := http .HandlerFunc (func (w http.ResponseWriter , _ * http.Request ) {
944- w .WriteHeader (http .StatusOK )
945- })
946-
947- wrapped := middlewareFunc (handler )
948- w := httptest .NewRecorder ()
949- req := httptest .NewRequest (http .MethodGet , "/api" , http .NoBody )
950- req .Header .Set ("X-User-Role" , "admin" )
951-
952- // Setup role permissions
953- config .rolePermissionsMap = map [string ][]string {
954- "admin" : {"admin:read" },
955- }
956-
957- wrapped .ServeHTTP (w , req )
958-
959- assert .Equal (t , http .StatusOK , w .Code )
960- // Metrics should be recorded
961- assert .True (t , mockMetrics .counterIncremented ["rbac_authorization_decisions" ])
962- })
963- }
964-
965- // mockMetrics implements the Metrics interface for testing.
966- type mockMetrics struct {
967- histogramCreated bool
968- counterCreated bool
969- counterIncremented map [string ]bool
970- counterLabels map [string ][]string // Track labels for each counter call
971- }
972-
973- func (m * mockMetrics ) NewHistogram (_ , _ string , _ ... float64 ) {
974- m .histogramCreated = true
975- }
976-
977- func (* mockMetrics ) RecordHistogram (_ context.Context , _ string , _ float64 , _ ... string ) {
978- // Mock implementation
979- }
980-
981- func (m * mockMetrics ) NewCounter (_ , _ string ) {
982- m .counterCreated = true
983- }
984-
985- func (m * mockMetrics ) IncrementCounter (_ context.Context , name string , labels ... string ) {
986- if m .counterIncremented == nil {
987- m .counterIncremented = make (map [string ]bool )
988- }
989-
990- if m .counterLabels == nil {
991- m .counterLabels = make (map [string ][]string )
992- }
993-
994- m .counterIncremented [name ] = true
995- m .counterLabels [name ] = labels
996- }
997-
998- func (* mockMetrics ) NewUpDownCounter (_ , _ string ) {
999- // Mock implementation
1000- }
1001-
1002- func (* mockMetrics ) NewGauge (_ , _ string ) {
1003- // Mock implementation
1004- }
1005-
1006- func (* mockMetrics ) DeltaUpDownCounter (_ context.Context , _ string , _ float64 , _ ... string ) {
1007- // Mock implementation
1008- }
1009-
1010- func (* mockMetrics ) SetGauge (_ string , _ float64 , _ ... string ) {
1011- // Mock implementation
1012- }
1013-
1014- func TestMiddleware_RoleNotInMetrics (t * testing.T ) {
1015- t .Run ("role is not included in metric labels" , func (t * testing.T ) {
1016- mockMetrics := & mockMetrics {
1017- counterIncremented : make (map [string ]bool ),
1018- counterLabels : make (map [string ][]string ),
1019- }
1020-
1021- config := & Config {
1022- Endpoints : []EndpointMapping {
1023- {Path : "/api" , Methods : []string {"GET" }, RequiredPermissions : []string {"admin:read" }},
1024- },
1025- RoleHeader : "X-User-Role" ,
1026- Metrics : mockMetrics ,
1027- }
1028- err := config .processUnifiedConfig ()
1029- require .NoError (t , err )
1030-
1031- middlewareFunc := Middleware (config )
1032- handler := http .HandlerFunc (func (w http.ResponseWriter , _ * http.Request ) {
1033- w .WriteHeader (http .StatusOK )
1034- })
1035-
1036- wrapped := middlewareFunc (handler )
1037- w := httptest .NewRecorder ()
1038- req := httptest .NewRequest (http .MethodGet , "/api" , http .NoBody )
1039- req .Header .Set ("X-User-Role" , "admin" )
1040-
1041- // Setup role permissions
1042- config .rolePermissionsMap = map [string ][]string {
1043- "admin" : {"admin:read" },
1044- }
1045-
1046- wrapped .ServeHTTP (w , req )
1047-
1048- assert .Equal (t , http .StatusOK , w .Code )
1049- // Verify metrics were recorded
1050- assert .True (t , mockMetrics .counterIncremented ["rbac_authorization_decisions" ])
1051- // Verify role is NOT in labels (only status should be present)
1052- labels := mockMetrics .counterLabels ["rbac_authorization_decisions" ]
1053- assert .Contains (t , labels , "status" , "status label should be present" )
1054- assert .Contains (t , labels , "allowed" , "allowed status should be present" )
1055- // Verify role is NOT in labels
1056- assert .NotContains (t , labels , "role" , "role should not be in metric labels" )
1057- assert .NotContains (t , labels , "admin" , "role value should not be in metric labels" )
1058- })
1059-
1060- t .Run ("role is not included in metric labels for denied requests" , func (t * testing.T ) {
1061- mockMetrics := & mockMetrics {
1062- counterIncremented : make (map [string ]bool ),
1063- counterLabels : make (map [string ][]string ),
1064- }
1065-
1066- config := & Config {
1067- Endpoints : []EndpointMapping {
1068- {Path : "/api" , Methods : []string {"GET" }, RequiredPermissions : []string {"admin:read" }},
1069- },
1070- RoleHeader : "X-User-Role" ,
1071- Metrics : mockMetrics ,
1072- }
1073- err := config .processUnifiedConfig ()
1074- require .NoError (t , err )
1075-
1076- middlewareFunc := Middleware (config )
1077- handler := http .HandlerFunc (func (w http.ResponseWriter , _ * http.Request ) {
1078- w .WriteHeader (http .StatusOK )
1079- })
1080-
1081- wrapped := middlewareFunc (handler )
1082- w := httptest .NewRecorder ()
1083- req := httptest .NewRequest (http .MethodGet , "/api" , http .NoBody )
1084- req .Header .Set ("X-User-Role" , "viewer" ) // Role without permission
1085-
1086- // Setup role permissions
1087- config .rolePermissionsMap = map [string ][]string {
1088- "viewer" : {"viewer:read" }, // Different permission
1089- }
1090-
1091- wrapped .ServeHTTP (w , req )
1092-
1093- assert .Equal (t , http .StatusForbidden , w .Code )
1094- // Verify metrics were recorded
1095- assert .True (t , mockMetrics .counterIncremented ["rbac_authorization_decisions" ])
1096- // Verify role is NOT in labels (only status should be present)
1097- labels := mockMetrics .counterLabels ["rbac_authorization_decisions" ]
1098- assert .Contains (t , labels , "status" , "status label should be present" )
1099- assert .Contains (t , labels , "denied" , "denied status should be present" )
1100- // Verify role is NOT in labels
1101- assert .NotContains (t , labels , "role" , "role should not be in metric labels" )
1102- assert .NotContains (t , labels , "viewer" , "role value should not be in metric labels" )
1103- })
1104- }
1105-
1106926func TestMiddleware_RoleInAuditLogs (t * testing.T ) {
1107927 t .Run ("role is included in audit logs" , func (t * testing.T ) {
1108928 mockLog := & mockLogger {
0 commit comments