Proxies for authorized security testing

package geocheck

import (
	"net/http"
	"net/url"
	"os"
	"testing"
	"time"
)

// Expected statuses are examples of your own rules: replace them with what your configuration specifies.
var cases = []struct {
	CC, Host string
	Want     int
}{
	{"US", "scale-us.netdash.io:2000", http.StatusOK},
	{"DE", "scale-eu.netdash.io:2000", http.StatusUnavailableForLegalReasons},
	{"GB", "scale-eu.netdash.io:2000", http.StatusOK},
}

const target = "https://app.yourcompany.example/geo-check" // a system you own or are authorized to test

func TestGeoRules(t *testing.T) {
	user, pass := os.Getenv("NETDASH_USERNAME"), os.Getenv("NETDASH_PASSWORD")
	testID := os.Getenv("AUTHORIZED_TEST_ID") // the reference agreed with the system owner
	if user == "" || pass == "" || testID == "" {
		t.Skip("set NETDASH_USERNAME, NETDASH_PASSWORD and AUTHORIZED_TEST_ID")
	}

	for _, c := range cases {
		t.Run(c.CC, func(t *testing.T) {
			proxyURL := &url.URL{Scheme: "http", User: url.UserPassword(user+"-cc-"+c.CC, pass), Host: c.Host}
			client := &http.Client{
				Transport: &http.Transport{Proxy: http.ProxyURL(proxyURL)},
				Timeout:   30 * time.Second,
			}

			req, err := http.NewRequest(http.MethodGet, target, nil)
			if err != nil {
				t.Fatal(err)
			}
			req.Header.Set("X-Authorized-Test", testID)

			resp, err := client.Do(req)
			if err != nil {
				// A 407 from the gateway (wrong username or password) also ends up here.
				t.Fatalf("exit %s via %s: %v", c.CC, c.Host, err)
			}
			defer resp.Body.Close()

			if resp.StatusCode != c.Want {
				t.Errorf("exit %s: got %d, want %d", c.CC, resp.StatusCode, c.Want)
			}
		})
	}
}