319 lines
10 KiB
Go
319 lines
10 KiB
Go
package web
|
|
|
|
import (
|
|
"io"
|
|
"log/slog"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"net/url"
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
|
|
"git.arnef.de/arnef/nidus/internal/config"
|
|
"git.arnef.de/arnef/nidus/internal/db"
|
|
"git.arnef.de/arnef/nidus/internal/store"
|
|
)
|
|
|
|
func newTestServer(t *testing.T) *Server {
|
|
t.Helper()
|
|
dir := t.TempDir()
|
|
|
|
st, err := store.NewStore(filepath.Join(dir, "data"))
|
|
if err != nil {
|
|
t.Fatalf("NewStore: %v", err)
|
|
}
|
|
dbase, err := db.Open(filepath.Join(dir, "test.db"))
|
|
if err != nil {
|
|
t.Fatalf("db.Open: %v", err)
|
|
}
|
|
t.Cleanup(func() { dbase.Close() })
|
|
|
|
cfg := &config.Config{}
|
|
if err := dbase.CreateUser("alice", "password", "", ""); err != nil {
|
|
t.Fatalf("CreateUser alice: %v", err)
|
|
}
|
|
if err := dbase.CreateUser("bob", "password", "", ""); err != nil {
|
|
t.Fatalf("CreateUser bob: %v", err)
|
|
}
|
|
if err := dbase.CreateCalendar("alice", "work"); err != nil {
|
|
t.Fatalf("CreateCalendar alice/work: %v", err)
|
|
}
|
|
if err := dbase.CreateAddressBook("alice", "contacts"); err != nil {
|
|
t.Fatalf("CreateAddressBook alice/contacts: %v", err)
|
|
}
|
|
if err := dbase.CreateCalendar("bob", "personal"); err != nil {
|
|
t.Fatalf("CreateCalendar bob/personal: %v", err)
|
|
}
|
|
logger := slog.New(slog.NewTextHandler(io.Discard, nil))
|
|
return NewServer(cfg, st, dbase, logger, nil)
|
|
}
|
|
|
|
// loginAs performs a login request against handler and returns the
|
|
// resulting session cookie.
|
|
func loginAs(t *testing.T, handler http.Handler, username, password string) *http.Cookie {
|
|
t.Helper()
|
|
form := url.Values{"username": {username}, "password": {password}}
|
|
req := httptest.NewRequest(http.MethodPost, "/login", strings.NewReader(form.Encode()))
|
|
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
|
rr := httptest.NewRecorder()
|
|
handler.ServeHTTP(rr, req)
|
|
|
|
if rr.Code != http.StatusSeeOther {
|
|
t.Fatalf("login: expected 303, got %d: %s", rr.Code, rr.Body.String())
|
|
}
|
|
res := rr.Result()
|
|
for _, c := range res.Cookies() {
|
|
if c.Name == sessionCookieName {
|
|
return c
|
|
}
|
|
}
|
|
t.Fatal("login: no session cookie set")
|
|
return nil
|
|
}
|
|
|
|
func TestLoginSuccessAndFailure(t *testing.T) {
|
|
s := newTestServer(t)
|
|
handler := s.Handler(emptyStaticFS{})
|
|
|
|
cookie := loginAs(t, handler, "alice", "password")
|
|
if cookie.Value == "" {
|
|
t.Fatal("expected non-empty session token")
|
|
}
|
|
|
|
// Wrong password.
|
|
form := url.Values{"username": {"alice"}, "password": {"wrong"}}
|
|
req := httptest.NewRequest(http.MethodPost, "/login", strings.NewReader(form.Encode()))
|
|
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
|
rr := httptest.NewRecorder()
|
|
handler.ServeHTTP(rr, req)
|
|
if rr.Code != http.StatusOK {
|
|
t.Fatalf("expected 200 (re-rendered login form) on bad password, got %d", rr.Code)
|
|
}
|
|
if !strings.Contains(rr.Body.String(), "invalid username or password") {
|
|
t.Fatalf("expected error message in body, got: %s", rr.Body.String())
|
|
}
|
|
}
|
|
|
|
func TestDashboardRequiresLogin(t *testing.T) {
|
|
s := newTestServer(t)
|
|
handler := s.Handler(emptyStaticFS{})
|
|
|
|
req := httptest.NewRequest(http.MethodGet, "/", nil)
|
|
rr := httptest.NewRecorder()
|
|
handler.ServeHTTP(rr, req)
|
|
|
|
if rr.Code != http.StatusSeeOther {
|
|
t.Fatalf("expected redirect to login, got %d", rr.Code)
|
|
}
|
|
if loc := rr.Result().Header.Get("Location"); loc != "/web/login" {
|
|
t.Fatalf("expected redirect to /web/login, got %q", loc)
|
|
}
|
|
}
|
|
|
|
func TestDashboardShowsOwnResources(t *testing.T) {
|
|
s := newTestServer(t)
|
|
handler := s.Handler(emptyStaticFS{})
|
|
cookie := loginAs(t, handler, "alice", "password")
|
|
|
|
req := httptest.NewRequest(http.MethodGet, "/", nil)
|
|
req.AddCookie(cookie)
|
|
rr := httptest.NewRecorder()
|
|
handler.ServeHTTP(rr, req)
|
|
|
|
if rr.Code != http.StatusOK {
|
|
t.Fatalf("expected 200, got %d", rr.Code)
|
|
}
|
|
body := rr.Body.String()
|
|
if !strings.Contains(body, "work") || !strings.Contains(body, "contacts") {
|
|
t.Fatalf("expected dashboard to list alice's calendar/address book, got: %s", body)
|
|
}
|
|
}
|
|
|
|
func TestShareUnshareCalendarFlow(t *testing.T) {
|
|
s := newTestServer(t)
|
|
handler := s.Handler(emptyStaticFS{})
|
|
cookie := loginAs(t, handler, "alice", "password")
|
|
|
|
// Share alice's "work" calendar with bob, write access.
|
|
form := url.Values{"resource": {"work"}, "shared_with": {"bob"}, "permission": {"write"}}
|
|
req := httptest.NewRequest(http.MethodPost, "/shares/calendar", strings.NewReader(form.Encode()))
|
|
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
|
req.AddCookie(cookie)
|
|
rr := httptest.NewRecorder()
|
|
handler.ServeHTTP(rr, req)
|
|
if rr.Code != http.StatusOK {
|
|
t.Fatalf("share: expected 200, got %d: %s", rr.Code, rr.Body.String())
|
|
}
|
|
if !strings.Contains(rr.Body.String(), "bob") {
|
|
t.Fatalf("expected updated card to mention bob, got: %s", rr.Body.String())
|
|
}
|
|
|
|
shares, err := s.dbase.SharesOfCalendar("alice", "work")
|
|
if err != nil {
|
|
t.Fatalf("SharesOfCalendar: %v", err)
|
|
}
|
|
if len(shares) != 1 || shares[0].SharedWith != "bob" {
|
|
t.Fatalf("expected one share for bob, got %+v", shares)
|
|
}
|
|
|
|
// Unshare — htmx v2 sends DELETE params as a URL query string.
|
|
req = httptest.NewRequest(http.MethodDelete, "/shares/calendar?resource=work&shared_with=bob", nil)
|
|
req.AddCookie(cookie)
|
|
rr = httptest.NewRecorder()
|
|
handler.ServeHTTP(rr, req)
|
|
if rr.Code != http.StatusOK {
|
|
t.Fatalf("unshare: expected 200, got %d: %s", rr.Code, rr.Body.String())
|
|
}
|
|
if !strings.Contains(rr.Body.String(), "Not shared with anyone") {
|
|
t.Fatalf("expected card to show no shares, got: %s", rr.Body.String())
|
|
}
|
|
|
|
shares, err = s.dbase.SharesOfCalendar("alice", "work")
|
|
if err != nil {
|
|
t.Fatalf("SharesOfCalendar: %v", err)
|
|
}
|
|
if len(shares) != 0 {
|
|
t.Fatalf("expected no shares after unshare, got %+v", shares)
|
|
}
|
|
}
|
|
|
|
func TestCannotShareResourceNotOwned(t *testing.T) {
|
|
s := newTestServer(t)
|
|
handler := s.Handler(emptyStaticFS{})
|
|
cookie := loginAs(t, handler, "alice", "password")
|
|
|
|
// alice doesn't own "personal" (that's bob's calendar).
|
|
form := url.Values{"resource": {"personal"}, "shared_with": {"bob"}, "permission": {"write"}}
|
|
req := httptest.NewRequest(http.MethodPost, "/shares/calendar", strings.NewReader(form.Encode()))
|
|
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
|
req.AddCookie(cookie)
|
|
rr := httptest.NewRecorder()
|
|
handler.ServeHTTP(rr, req)
|
|
|
|
if rr.Code != http.StatusNotFound {
|
|
t.Fatalf("expected 404 for unowned resource, got %d", rr.Code)
|
|
}
|
|
}
|
|
|
|
func TestLogoutClearsSession(t *testing.T) {
|
|
s := newTestServer(t)
|
|
handler := s.Handler(emptyStaticFS{})
|
|
cookie := loginAs(t, handler, "alice", "password")
|
|
|
|
req := httptest.NewRequest(http.MethodGet, "/logout", nil)
|
|
req.AddCookie(cookie)
|
|
rr := httptest.NewRecorder()
|
|
handler.ServeHTTP(rr, req)
|
|
if rr.Code != http.StatusSeeOther {
|
|
t.Fatalf("expected redirect on logout, got %d", rr.Code)
|
|
}
|
|
|
|
// Session should no longer be valid.
|
|
if _, err := s.dbase.SessionUser(cookie.Value); err == nil {
|
|
t.Fatal("expected session to be deleted after logout")
|
|
}
|
|
}
|
|
|
|
// emptyStaticFS is a no-op http.FileSystem for tests that don't exercise
|
|
// static asset serving.
|
|
type emptyStaticFS struct{}
|
|
|
|
func (emptyStaticFS) Open(name string) (http.File, error) {
|
|
return nil, os.ErrNotExist
|
|
}
|
|
|
|
func TestAccountRequiresLogin(t *testing.T) {
|
|
s := newTestServer(t)
|
|
handler := s.Handler(emptyStaticFS{})
|
|
|
|
req := httptest.NewRequest(http.MethodGet, "/account", nil)
|
|
rr := httptest.NewRecorder()
|
|
handler.ServeHTTP(rr, req)
|
|
|
|
if rr.Code != http.StatusSeeOther {
|
|
t.Fatalf("expected redirect to login, got %d", rr.Code)
|
|
}
|
|
}
|
|
|
|
func TestAccountShowsOwnProfile(t *testing.T) {
|
|
s := newTestServer(t)
|
|
handler := s.Handler(emptyStaticFS{})
|
|
cookie := loginAs(t, handler, "alice", "password")
|
|
|
|
req := httptest.NewRequest(http.MethodGet, "/account", nil)
|
|
req.AddCookie(cookie)
|
|
rr := httptest.NewRecorder()
|
|
handler.ServeHTTP(rr, req)
|
|
|
|
if rr.Code != http.StatusOK {
|
|
t.Fatalf("expected 200, got %d", rr.Code)
|
|
}
|
|
if !strings.Contains(rr.Body.String(), "alice") {
|
|
t.Fatalf("expected account page to show username, got: %s", rr.Body.String())
|
|
}
|
|
}
|
|
|
|
func TestAccountUpdateProfile(t *testing.T) {
|
|
s := newTestServer(t)
|
|
handler := s.Handler(emptyStaticFS{})
|
|
cookie := loginAs(t, handler, "alice", "password")
|
|
|
|
form := url.Values{"display_name": {"Alice Example"}, "email": {"alice@example.com"}}
|
|
req := httptest.NewRequest(http.MethodPost, "/account/profile", strings.NewReader(form.Encode()))
|
|
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
|
req.AddCookie(cookie)
|
|
rr := httptest.NewRecorder()
|
|
handler.ServeHTTP(rr, req)
|
|
|
|
if rr.Code != http.StatusOK {
|
|
t.Fatalf("expected 200, got %d", rr.Code)
|
|
}
|
|
if !strings.Contains(rr.Body.String(), "Profile updated.") {
|
|
t.Fatalf("expected success message, got: %s", rr.Body.String())
|
|
}
|
|
|
|
u, err := s.dbase.GetUser("alice")
|
|
if err != nil {
|
|
t.Fatalf("GetUser: %v", err)
|
|
}
|
|
if u.DisplayName != "Alice Example" || u.Email != "alice@example.com" {
|
|
t.Fatalf("expected profile to be persisted, got %+v", u)
|
|
}
|
|
}
|
|
|
|
func TestAccountChangePassword(t *testing.T) {
|
|
s := newTestServer(t)
|
|
handler := s.Handler(emptyStaticFS{})
|
|
cookie := loginAs(t, handler, "alice", "password")
|
|
|
|
// Wrong current password is rejected.
|
|
form := url.Values{"current_password": {"wrong"}, "new_password": {"newpassword123"}, "confirm_password": {"newpassword123"}}
|
|
req := httptest.NewRequest(http.MethodPost, "/account/password", strings.NewReader(form.Encode()))
|
|
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
|
req.AddCookie(cookie)
|
|
rr := httptest.NewRecorder()
|
|
handler.ServeHTTP(rr, req)
|
|
if !strings.Contains(rr.Body.String(), "current password is incorrect") {
|
|
t.Fatalf("expected error for wrong current password, got: %s", rr.Body.String())
|
|
}
|
|
if s.dbase.VerifyPassword("alice", "newpassword123") {
|
|
t.Fatal("password should not have changed")
|
|
}
|
|
|
|
// Correct current password succeeds.
|
|
form = url.Values{"current_password": {"password"}, "new_password": {"newpassword123"}, "confirm_password": {"newpassword123"}}
|
|
req = httptest.NewRequest(http.MethodPost, "/account/password", strings.NewReader(form.Encode()))
|
|
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
|
req.AddCookie(cookie)
|
|
rr = httptest.NewRecorder()
|
|
handler.ServeHTTP(rr, req)
|
|
if !strings.Contains(rr.Body.String(), "Password changed.") {
|
|
t.Fatalf("expected success message, got: %s", rr.Body.String())
|
|
}
|
|
if !s.dbase.VerifyPassword("alice", "newpassword123") {
|
|
t.Fatal("expected password to have changed")
|
|
}
|
|
}
|