Jungfraujoch/tests/BearerTokensTest.cpp

// SPDX-FileCopyrightText: 2026 Filip Leonarski, Paul Scherrer Institute <filip.leonarski@psi.ch>
// SPDX-License-Identifier: GPL-3.0-only

#include <catch2/catch_all.hpp>
#include "../broker/BearerTokens.h"

TEST_CASE("BearerTokens_Empty_Accepts_Everything", "[broker]") {
    BearerTokens tokens;
    REQUIRE(tokens.Accept(std::nullopt));
    REQUIRE(tokens.Accept("Bearer anything"));
    REQUIRE(tokens.Accept("garbage"));
}

TEST_CASE("BearerTokens_Match", "[broker]") {
    BearerTokens tokens;
    tokens.Replace({"alpha", "beta"});

    REQUIRE(tokens.Accept("Bearer alpha"));
    REQUIRE(tokens.Accept("bearer beta"));            // scheme is case-insensitive
    REQUIRE(tokens.Accept("Bearer   alpha"));         // one or more spaces
    REQUIRE(tokens.Accept("Bearer alpha\r\n"));       // trailing line end trimmed

    REQUIRE_FALSE(tokens.Accept(std::nullopt));
    REQUIRE_FALSE(tokens.Accept("Bearer gamma"));
    REQUIRE_FALSE(tokens.Accept("Bearer alph"));
    REQUIRE_FALSE(tokens.Accept("Bearer alphabet"));
    REQUIRE_FALSE(tokens.Accept("Basic alpha"));
    REQUIRE_FALSE(tokens.Accept("alpha"));
    REQUIRE_FALSE(tokens.Accept("Bearer"));
    REQUIRE_FALSE(tokens.Accept("Bearer "));
    REQUIRE_FALSE(tokens.Accept(""));
}

TEST_CASE("BearerTokens_Replace", "[broker]") {
    BearerTokens tokens;
    tokens.Replace({"alpha"});
    REQUIRE(tokens.Accept("Bearer alpha"));

    // The next dataset's tokens replace the previous ones entirely.
    tokens.Replace({"beta"});
    REQUIRE_FALSE(tokens.Accept("Bearer alpha"));
    REQUIRE(tokens.Accept("Bearer beta"));

    // No tokens lifts the protection.
    tokens.Replace({});
    REQUIRE(tokens.Accept(std::nullopt));

    // An empty string is not a token: it must not accept a bare "Bearer " header.
    tokens.Replace({""});
    REQUIRE(tokens.Accept(std::nullopt));
    tokens.Replace({"", "delta"});
    REQUIRE_FALSE(tokens.Accept("Bearer "));
    REQUIRE(tokens.Accept("Bearer delta"));
}