Lots more changes

internal/http/middleware_test.go

@@ -1,6 +1,7 @@
 package httpapi
 
 import (
+	"bytes"
 	"encoding/json"
 	"io"
 	"log"
@@ -228,3 +229,95 @@ func TestExtractClientIPIgnoresHeadersFromUntrustedProxy(t *testing.T) {
 		t.Fatalf("extractClientIP() = (%v,%v), want (203.0.113.10,true)", ip, ok)
 	}
 }
+
+func TestAccessLogMiddlewareWritesStructuredLog(t *testing.T) {
+	t.Parallel()
+
+	var buf bytes.Buffer
+	logger := log.New(&buf, "", 0)
+	handler := AccessLogMiddleware(logger, false, nil)(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusCreated)
+		_, _ = w.Write([]byte("ok"))
+	}))
+
+	req := httptest.NewRequest(http.MethodPost, "/api/scratch?ttl=1h", nil)
+	req.RemoteAddr = "198.51.100.12:4444"
+	req.Header.Set("User-Agent", "middleware-test")
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+
+	got := buf.String()
+	if !strings.Contains(got, "method=POST") {
+		t.Fatalf("missing method field in log: %q", got)
+	}
+	if !strings.Contains(got, "path=/api/scratch?ttl=1h") {
+		t.Fatalf("missing path field in log: %q", got)
+	}
+	if !strings.Contains(got, "status=201") {
+		t.Fatalf("missing status field in log: %q", got)
+	}
+	if !strings.Contains(got, "bytes=2") {
+		t.Fatalf("missing bytes field in log: %q", got)
+	}
+	if !strings.Contains(got, "ip=198.51.100.12") {
+		t.Fatalf("missing ip field in log: %q", got)
+	}
+}
+
+func TestAccessLogMiddlewareSkipsConfigAndStaticPaths(t *testing.T) {
+	t.Parallel()
+
+	var buf bytes.Buffer
+	logger := log.New(&buf, "", 0)
+	handler := AccessLogMiddleware(logger, false, nil)(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
+
+	reqConfig := httptest.NewRequest(http.MethodGet, "/api/config", nil)
+	reqConfig.RemoteAddr = "198.51.100.12:4444"
+	handler.ServeHTTP(httptest.NewRecorder(), reqConfig)
+
+	reqStatic := httptest.NewRequest(http.MethodGet, "/static/app.js", nil)
+	reqStatic.RemoteAddr = "198.51.100.12:4444"
+	handler.ServeHTTP(httptest.NewRecorder(), reqStatic)
+
+	reqAsset := httptest.NewRequest(http.MethodGet, "/assets/logo.svg", nil)
+	reqAsset.RemoteAddr = "198.51.100.12:4444"
+	handler.ServeHTTP(httptest.NewRecorder(), reqAsset)
+
+	reqScratchView := httptest.NewRequest(http.MethodGet, "/s/abc123", nil)
+	reqScratchView.RemoteAddr = "198.51.100.12:4444"
+	handler.ServeHTTP(httptest.NewRecorder(), reqScratchView)
+
+	reqUpload := httptest.NewRequest(http.MethodGet, "/u", nil)
+	reqUpload.RemoteAddr = "198.51.100.12:4444"
+	handler.ServeHTTP(httptest.NewRecorder(), reqUpload)
+
+	if buf.Len() != 0 {
+		t.Fatalf("expected no access logs for skipped paths, got %q", buf.String())
+	}
+}
+
+func TestAccessLogMiddlewareOnlyAllowsConfiguredRoutes(t *testing.T) {
+	t.Parallel()
+
+	var buf bytes.Buffer
+	logger := log.New(&buf, "", 0)
+	handler := AccessLogMiddleware(logger, false, nil)(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
+
+	disallowed := httptest.NewRequest(http.MethodGet, "/api/scratch/some-id", nil)
+	disallowed.RemoteAddr = "198.51.100.12:4444"
+	handler.ServeHTTP(httptest.NewRecorder(), disallowed)
+	if buf.Len() != 0 {
+		t.Fatalf("expected no access log for disallowed route, got %q", buf.String())
+	}
+
+	allowed := httptest.NewRequest(http.MethodGet, "/api/raw/some-id", nil)
+	allowed.RemoteAddr = "198.51.100.12:4444"
+	handler.ServeHTTP(httptest.NewRecorder(), allowed)
+	if !strings.Contains(buf.String(), "method=GET path=/api/raw/some-id") {
+		t.Fatalf("expected access log for allowed route, got %q", buf.String())
+	}
+}