suite: plugin-bouncer middleware test
templates:
  - common.yaml
release:
  name: test-release-name
  namespace: test-release-namespace
tests:
  - it: should pass with all set
    set:
      ingressMiddlewares:
        traefik:
          my-middleware1:
            enabled: true
            type: plugin-bouncer
            data:
              enabled: true
              logLevel: DEBUG
              updateIntervalSeconds: 60
              updateMaxFailure: 0
              defaultDecisionSeconds: 60
              httpTimeoutSeconds: 10
              crowdsecMode: live
              crowdsecAppsecEnabled: false
              crowdsecAppsecHost: crowdsec:7422
              crowdsecAppsecFailureBlock: true
              crowdsecAppsecUnreachableBlock: true
              crowdsecLapiKey: privateKey-foo
              crowdsecLapiHost: crowdsec:8080
              crowdsecLapiScheme: http
              crowdsecLapiTLSInsecureVerify: false
              crowdsecCapiMachineId: login
              crowdsecCapiPassword: password
              crowdsecCapiScenarios:
                - crowdsecurity/http-path-traversal-probing
                - crowdsecurity/http-xss-probing
                - crowdsecurity/http-generic-bf
              forwardedHeadersTrustedIPs:
                - 10.0.10.23/32
                - 10.0.20.0/24
              clientTrustedIPs:
                - 192.168.1.0/24
              forwardedHeadersCustomName: X-Custom-Header
              remediationHeadersCustomName: cs-remediation
              redisCacheEnabled: false
              redisCacheHost: "redis:6379"
              redisCachePassword: password
              redisCacheDatabase: "5"
              crowdsecLapiTLSCertificateAuthority: |-
                -----BEGIN TOTALY NOT A CERT-----
                MIIEBzCCAu+gAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwgZQxCzAJBgNVBAYTAlVT
                ...
                Q0veeNzBQXg1f/JxfeA39IDIX1kiCf71tGlT
                -----END TOTALY NOT A CERT-----
              crowdsecLapiTLSCertificateBouncer: |-
                -----BEGIN TOTALY NOT A CERT-----
                MIIEHjCCAwagAwIBAgIUOBTs1eqkaAUcPplztUr2xRapvNAwDQYJKoZIhvcNAQEL
                ...
                RaXAnYYUVRblS1jmePemh388hFxbmrpG2pITx8B5FMULqHoj11o2Rl0gSV6tHIHz
                N2U=
                -----END TOTALY NOT A CERT-----
              crowdsecLapiTLSCertificateBouncerKey: |-
                -----BEGIN TOTALY NOT A SECRET-----
                MIIEogIBAAKCAQEAtYQnbJqifH+ZymePylDxGGLIuxzcAUU4/ajNj+qRAdI/Ux3d
                ...
                ic5cDRo6/VD3CS3MYzyBcibaGaV34nr0G/pI+KEqkYChzk/PZRA=
                -----END TOTALY NOT A SECRET-----
              captchaProvider: hcaptcha
              captchaSiteKey: FIXME
              captchaSecretKey: FIXME
              captchaGracePeriodSeconds: 1800
              captchaHTMLFilePath: /captcha.html
              banHTMLFilePath: /ban.html
    asserts:
      - documentIndex: &middlewareDoc 0
        equal:
          path: spec
          value:
            plugin:
              bouncer:
                enabled: true
                logLevel: DEBUG
                updateIntervalSeconds: 60
                updateMaxFailure: 0
                defaultDecisionSeconds: 60
                httpTimeoutSeconds: 10
                crowdsecMode: live
                crowdsecAppsecEnabled: false
                crowdsecAppsecHost: crowdsec:7422
                crowdsecAppsecFailureBlock: true
                crowdsecAppsecUnreachableBlock: true
                crowdsecLapiKey: privateKey-foo
                crowdsecLapiHost: crowdsec:8080
                crowdsecLapiScheme: http
                crowdsecLapiTLSInsecureVerify: false
                crowdsecCapiMachineId: login
                crowdsecCapiPassword: password
                crowdsecCapiScenarios:
                  - crowdsecurity/http-path-traversal-probing
                  - crowdsecurity/http-xss-probing
                  - crowdsecurity/http-generic-bf
                forwardedHeadersTrustedIPs:
                  - 10.0.10.23/32
                  - 10.0.20.0/24
                clientTrustedIPs:
                  - 192.168.1.0/24
                forwardedHeadersCustomName: X-Custom-Header
                remediationHeadersCustomName: cs-remediation
                redisCacheEnabled: false
                redisCacheHost: "redis:6379"
                redisCachePassword: password
                redisCacheDatabase: "5"
                crowdsecLapiTLSCertificateAuthority: |-
                  -----BEGIN TOTALY NOT A CERT-----
                  MIIEBzCCAu+gAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwgZQxCzAJBgNVBAYTAlVT
                  ...
                  Q0veeNzBQXg1f/JxfeA39IDIX1kiCf71tGlT
                  -----END TOTALY NOT A CERT-----
                crowdsecLapiTLSCertificateBouncer: |-
                  -----BEGIN TOTALY NOT A CERT-----
                  MIIEHjCCAwagAwIBAgIUOBTs1eqkaAUcPplztUr2xRapvNAwDQYJKoZIhvcNAQEL
                  ...
                  RaXAnYYUVRblS1jmePemh388hFxbmrpG2pITx8B5FMULqHoj11o2Rl0gSV6tHIHz
                  N2U=
                  -----END TOTALY NOT A CERT-----
                crowdsecLapiTLSCertificateBouncerKey: |-
                  -----BEGIN TOTALY NOT A SECRET-----
                  MIIEogIBAAKCAQEAtYQnbJqifH+ZymePylDxGGLIuxzcAUU4/ajNj+qRAdI/Ux3d
                  ...
                  ic5cDRo6/VD3CS3MYzyBcibaGaV34nr0G/pI+KEqkYChzk/PZRA=
                  -----END TOTALY NOT A SECRET-----
                captchaProvider: hcaptcha
                captchaSiteKey: FIXME
                captchaSecretKey: FIXME
                captchaGracePeriodSeconds: 1800
                captchaHTMLFilePath: /captcha.html
                banHTMLFilePath: /ban.html

  - it: should pass with pluginName set
    set:
      ingressMiddlewares:
        traefik:
          my-middleware1:
            enabled: true
            type: plugin-bouncer
            data:
              pluginName: traefik-bouncer-test
              enabled: true
    asserts:
      - documentIndex: *middlewareDoc
        equal:
          path: spec
          value:
            plugin:
              traefik-bouncer-test:
                enabled: true

  - it: should fail with missing enabled
    set:
      ingressMiddlewares:
        traefik:
          my-middleware1:
            enabled: true
            type: plugin-bouncer
            data:
              foo: bar
    asserts:
      - failedTemplate:
          errorMessage: Middleware (plugin-bouncer) - Expected [enabled] to be set

  - it: should fail with invalid enabled
    set:
      ingressMiddlewares:
        traefik:
          my-middleware1:
            enabled: true
            type: plugin-bouncer
            data:
              enabled: some-value
    asserts:
      - failedTemplate:
          errorMessage: Middleware (plugin-bouncer) - Expected [enabled] to be a boolean, but got [string]
