vulcainjs / vulcain-corejs

Microservice framework for nodejs
https://vulcainjs.github.io
Apache License 2.0
11 stars 3 forks source link

Testing scope security #22

Closed workfel closed 7 years ago

workfel commented 7 years ago

Hi, I read you article about security, http://www.vulcainjs.org/reference/security/#scope-rule. So, i'm changed thoose ENV VAR :

  "VULCAIN_ENV": "prod",
  "VULCAIN_ENV_MODE": "production",             

The Handler it's secured. But now the my Command who extend AbstractHttpCommand doesn't make any REQUEST.

    // Execute command
    async runAsync(userId: string): Promise<User> {
        let response = await this.getAsync(`${this.hostUserService.value}/api/user.get/${userId}`);
        return response.body.value;
    }

The response.body is alway false and, with a Fiddler i see no request.. And if i change the ENV VAR VULAIN with local, the request pass.

Thx

workfel commented 7 years ago

I found the error. It's on AbsctractHttpCommand

     let result = System.isDevelopment && mocks.enabled && await mocks.applyMockHttpAsync(url, verb);
        if (result !== undefined) {
            System.log.info(this.requestContext, ()=>`Using mock output for (${verb}) ${System.removePasswordFromUrl(url)}`);
            return result;
        }

In this test result it's a boolean (false) . So he make no request.

The test should be if(result) instead ?

I made a PR : #23