Repository: envoyproxy/envoy
File: test/extensions/filters/http/common/jwks_fetcher_test.cc (C++)

Code before:
              send_(_, _, _))
      .WillOnce(Invoke(
          [](Http::RequestMessagePtr&, Http::AsyncClient::Callbacks&,
             const Http::AsyncClient::RequestOptions& options) -> Http::AsyncClient::Request* {
            RetryingParameters const& rp = GetParam();

            EXPECT_TRUE(options.parsed_retry_policy != nullptr);
            EXPECT_TRUE(options.buffer_body_for_retry);
            EXPECT_EQ(options.parsed_retry_policy->numRetries(), rp.expected_num_retries_);

            EXPECT_TRUE(options.parsed_retry_policy->baseInterval().has_value());
            EXPECT_EQ(options.parsed_retry_policy->baseInterval()->count(),
                      rp.expected_backoff_base_interval_ms_);
            EXPECT_TRUE(options.parsed_retry_policy->maxInterval().has_value());
            EXPECT_EQ(options.parsed_retry_policy->maxInterval()->count(),
                      rp.expected_backoff_max_interval_ms_);

            EXPECT_LE(options.parsed_retry_policy->maxInterval()->count(),
                      options.parsed_retry_policy->perTryTimeout().count());

            const auto retry_on = options.parsed_retry_policy->retryOn();

            EXPECT_TRUE(retry_on | Router::RetryPolicy::RETRY_ON_5XX);
            EXPECT_TRUE(retry_on | Router::RetryPolicy::RETRY_ON_GATEWAY_ERROR);
            EXPECT_TRUE(retry_on | Router::RetryPolicy::RETRY_ON_CONNECT_FAILURE);
            EXPECT_TRUE(retry_on | Router::RetryPolicy::RETRY_ON_RESET);

            return nullptr;
          }));

  // Act
  fetcher_->fetch(parent_span_, receiver);
}

TEST_F(JwksFetcherTest, TestSchemeHeaderHttps) {
  // Setup
  setupFetcher(R"(
    http_uri:
      uri: https://pubkey_server/pubkey_path
      cluster: pubkey_cluster
    )");
  auto& cm = mock_factory_ctx_.server_factory_context_.cluster_manager_;
  Http::MockAsyncClientRequest request(&cm.thread_local_cluster_.async_client_);

  // Expect the :scheme header to be 'https' according to the configured uri.
  EXPECT_CALL(cm.thread_local_cluster_.async_client_, send_(_, _, _))
      .WillOnce(testing::Invoke(
          [](Http::RequestMessagePtr& message, Http::AsyncClient::Callbacks&,
             const Http::AsyncClient::RequestOptions&) -> Http::AsyncClient::Request* {
            EXPECT_THAT(message->headers(), ContainsHeader(Http::Headers::get().Scheme, "https"));
            return nullptr;

Review comment (security):
Same as the OAuth PR, I think this should be AND(`&`) and not OR(`|`).

Code after:

            EXPECT_TRUE(options.parsed_retry_policy->baseInterval().has_value());
            EXPECT_EQ(options.parsed_retry_policy->baseInterval()->count(),
                      rp.expected_backoff_base_interval_ms_);
            EXPECT_TRUE(options.parsed_retry_policy->maxInterval().has_value());
            EXPECT_EQ(options.parsed_retry_policy->maxInterval()->count(),
                      rp.expected_backoff_max_interval_ms_);

            EXPECT_LE(options.parsed_retry_policy->maxInterval()->count(),
                      options.parsed_retry_policy->perTryTimeout().count());

            const auto retry_on = options.parsed_retry_policy->retryOn();

            EXPECT_TRUE(retry_on & Router::RetryPolicy::RETRY_ON_5XX);
            EXPECT_TRUE(retry_on & Router::RetryPolicy::RETRY_ON_GATEWAY_ERROR);
            EXPECT_TRUE(retry_on & Router::RetryPolicy::RETRY_ON_CONNECT_FAILURE);
            EXPECT_TRUE(retry_on & Router::RetryPolicy::RETRY_ON_RESET);

            return nullptr;
          }));

  // Act
  fetcher_->fetch(parent_span_, receiver);
}

TEST_F(JwksFetcherTest, TestSchemeHeaderHttps) {
  // Setup
  setupFetcher(R"(
    http_uri:
      uri: https://pubkey_server/pubkey_path
      cluster: pubkey_cluster
    )");
  auto& cm = mock_factory_ctx_.server_factory_context_.cluster_manager_;
  Http::MockAsyncClientRequest request(&cm.thread_local_cluster_.async_client_);

  // Expect the :scheme header to be 'https' according to the configured uri.
  EXPECT_CALL(cm.thread_local_cluster_.async_client_, send_(_, _, _))
      .WillOnce(testing::Invoke(
          [](Http::RequestMessagePtr& message, Http::AsyncClient::Callbacks&,
             const Http::AsyncClient::RequestOptions&) -> Http::AsyncClient::Request* {
            EXPECT_THAT(message->headers(), ContainsHeader(Http::Headers::get().Scheme, "https"));
            return nullptr;
          }));

  MockJwksReceiver receiver;

  // Act
  fetcher_->fetch(parent_span_, receiver);
}

TEST_F(JwksFetcherTest, TestSchemeHeaderHttp) {