294 lines
6.9 KiB
Go
294 lines
6.9 KiB
Go
package handlers_test
|
|
|
|
import (
|
|
"context"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"net/url"
|
|
"strings"
|
|
"testing"
|
|
|
|
"github.com/go-chi/chi"
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
"sneak.berlin/go/webhooker/internal/config"
|
|
"sneak.berlin/go/webhooker/internal/database"
|
|
"sneak.berlin/go/webhooker/internal/handlers"
|
|
"sneak.berlin/go/webhooker/internal/logger"
|
|
"sneak.berlin/go/webhooker/internal/middleware"
|
|
"sneak.berlin/go/webhooker/internal/session"
|
|
)
|
|
|
|
// authenticatedCookies creates an authenticated session for the given
|
|
// user and returns the resulting cookies for use on a later request.
|
|
func authenticatedCookies(
|
|
t *testing.T,
|
|
sess *session.Session,
|
|
userID, username string,
|
|
) []*http.Cookie {
|
|
t.Helper()
|
|
|
|
setupReq := httptest.NewRequestWithContext(
|
|
context.Background(), http.MethodGet, "/setup", nil,
|
|
)
|
|
setupW := httptest.NewRecorder()
|
|
|
|
s, err := sess.Get(setupReq)
|
|
require.NoError(t, err)
|
|
|
|
sess.SetUser(s, userID, username)
|
|
require.NoError(t, sess.Save(setupReq, setupW, s))
|
|
|
|
cookies := setupW.Result().Cookies()
|
|
require.NotEmpty(t, cookies, "session cookie should be set")
|
|
|
|
return cookies
|
|
}
|
|
|
|
// profileRequest builds a GET request for the given profile username,
|
|
// attaching the supplied cookies and the chi URL parameter that the
|
|
// handler reads via chi.URLParam.
|
|
func profileRequest(
|
|
username string,
|
|
cookies []*http.Cookie,
|
|
) *http.Request {
|
|
req := httptest.NewRequestWithContext(
|
|
context.Background(), http.MethodGet, "/user/"+username, nil,
|
|
)
|
|
|
|
for _, c := range cookies {
|
|
req.AddCookie(c)
|
|
}
|
|
|
|
rctx := chi.NewRouteContext()
|
|
rctx.URLParams.Add("username", username)
|
|
|
|
return req.WithContext(
|
|
context.WithValue(req.Context(), chi.RouteCtxKey, rctx),
|
|
)
|
|
}
|
|
|
|
func TestHandleProfile_OwnProfile_OK(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
var h *handlers.Handlers
|
|
|
|
var sess *session.Session
|
|
|
|
app := newTestApp(t, &h, &sess)
|
|
app.RequireStart()
|
|
|
|
t.Cleanup(app.RequireStop)
|
|
|
|
cookies := authenticatedCookies(t, sess, "test-user-id", "testuser")
|
|
|
|
req := profileRequest("testuser", cookies)
|
|
w := httptest.NewRecorder()
|
|
|
|
h.HandleProfile().ServeHTTP(w, req)
|
|
|
|
assert.Equal(t, http.StatusOK, w.Code)
|
|
}
|
|
|
|
func TestHandleProfile_OtherProfile_Forbidden(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
var h *handlers.Handlers
|
|
|
|
var sess *session.Session
|
|
|
|
app := newTestApp(t, &h, &sess)
|
|
app.RequireStart()
|
|
|
|
t.Cleanup(app.RequireStop)
|
|
|
|
cookies := authenticatedCookies(t, sess, "test-user-id", "testuser")
|
|
|
|
req := profileRequest("otheruser", cookies)
|
|
w := httptest.NewRecorder()
|
|
|
|
h.HandleProfile().ServeHTTP(w, req)
|
|
|
|
assert.Equal(t, http.StatusForbidden, w.Code)
|
|
}
|
|
|
|
// TestUserRoute_Unauthenticated_RedirectedByMiddleware exercises the
|
|
// /user/{username} route group's middleware chain (CSRF then
|
|
// RequireAuth, matching setupUserRoutes) and proves that an
|
|
// unauthenticated request is redirected to /pages/login at the
|
|
// middleware layer, never reaching the endpoint handler.
|
|
func TestUserRoute_Unauthenticated_RedirectedByMiddleware(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
var log *logger.Logger
|
|
|
|
var cfg *config.Config
|
|
|
|
var sess *session.Session
|
|
|
|
app := newTestApp(t, &log, &cfg, &sess)
|
|
app.RequireStart()
|
|
|
|
t.Cleanup(app.RequireStop)
|
|
|
|
mw := middleware.NewForTest(log.Get(), cfg, sess)
|
|
|
|
var handlerReached bool
|
|
|
|
router := chi.NewRouter()
|
|
router.Route("/user/{username}", func(r chi.Router) {
|
|
r.Use(mw.CSRF())
|
|
r.Use(mw.RequireAuth())
|
|
r.Get("/", func(w http.ResponseWriter, _ *http.Request) {
|
|
handlerReached = true
|
|
|
|
w.WriteHeader(http.StatusOK)
|
|
})
|
|
})
|
|
|
|
req := httptest.NewRequestWithContext(
|
|
context.Background(), http.MethodGet, "/user/testuser", nil,
|
|
)
|
|
w := httptest.NewRecorder()
|
|
|
|
router.ServeHTTP(w, req)
|
|
|
|
assert.False(
|
|
t, handlerReached,
|
|
"handler must not be reached for unauthenticated request",
|
|
)
|
|
assert.Equal(t, http.StatusSeeOther, w.Code)
|
|
assert.Equal(t, "/pages/login", w.Header().Get("Location"))
|
|
}
|
|
|
|
// passwordChangeRequest builds a POST request to the password-change
|
|
// endpoint for the given username, attaching the supplied cookies, an
|
|
// urlencoded form body, and the chi URL parameter the handler reads.
|
|
func passwordChangeRequest(
|
|
username string,
|
|
cookies []*http.Cookie,
|
|
form url.Values,
|
|
) *http.Request {
|
|
req := httptest.NewRequestWithContext(
|
|
context.Background(),
|
|
http.MethodPost,
|
|
"/user/"+username+"/password",
|
|
strings.NewReader(form.Encode()),
|
|
)
|
|
req.Header.Set(
|
|
"Content-Type", "application/x-www-form-urlencoded",
|
|
)
|
|
|
|
for _, c := range cookies {
|
|
req.AddCookie(c)
|
|
}
|
|
|
|
rctx := chi.NewRouteContext()
|
|
rctx.URLParams.Add("username", username)
|
|
|
|
return req.WithContext(
|
|
context.WithValue(req.Context(), chi.RouteCtxKey, rctx),
|
|
)
|
|
}
|
|
|
|
func TestHandlePasswordChange_Success(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
var h *handlers.Handlers
|
|
|
|
var sess *session.Session
|
|
|
|
var db *database.Database
|
|
|
|
app := newTestApp(t, &h, &sess, &db)
|
|
app.RequireStart()
|
|
|
|
t.Cleanup(app.RequireStop)
|
|
|
|
oldHash, err := database.HashPassword("oldpassword")
|
|
require.NoError(t, err)
|
|
|
|
user := &database.User{Username: "pwuser", Password: oldHash}
|
|
require.NoError(t, db.DB().Create(user).Error)
|
|
|
|
cookies := authenticatedCookies(t, sess, user.ID, "pwuser")
|
|
|
|
form := url.Values{}
|
|
form.Set("current_password", "oldpassword")
|
|
form.Set("new_password", "newpassword")
|
|
form.Set("confirm_password", "newpassword")
|
|
|
|
req := passwordChangeRequest("pwuser", cookies, form)
|
|
w := httptest.NewRecorder()
|
|
|
|
h.HandlePasswordChange().ServeHTTP(w, req)
|
|
|
|
assert.Equal(t, http.StatusOK, w.Code)
|
|
assert.Contains(
|
|
t, w.Body.String(), "Password changed successfully.",
|
|
)
|
|
|
|
var updated database.User
|
|
|
|
require.NoError(t,
|
|
db.DB().Where("username = ?", "pwuser").First(&updated).Error,
|
|
)
|
|
assert.NotEqual(t, oldHash, updated.Password)
|
|
|
|
valid, err := database.VerifyPassword(
|
|
"newpassword", updated.Password,
|
|
)
|
|
require.NoError(t, err)
|
|
assert.True(t, valid, "new password should verify against new hash")
|
|
}
|
|
|
|
func TestHandlePasswordChange_WrongCurrentPassword(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
var h *handlers.Handlers
|
|
|
|
var sess *session.Session
|
|
|
|
var db *database.Database
|
|
|
|
app := newTestApp(t, &h, &sess, &db)
|
|
app.RequireStart()
|
|
|
|
t.Cleanup(app.RequireStop)
|
|
|
|
oldHash, err := database.HashPassword("oldpassword")
|
|
require.NoError(t, err)
|
|
|
|
user := &database.User{Username: "pwuser2", Password: oldHash}
|
|
require.NoError(t, db.DB().Create(user).Error)
|
|
|
|
cookies := authenticatedCookies(t, sess, user.ID, "pwuser2")
|
|
|
|
form := url.Values{}
|
|
form.Set("current_password", "wrongpassword")
|
|
form.Set("new_password", "newpassword")
|
|
form.Set("confirm_password", "newpassword")
|
|
|
|
req := passwordChangeRequest("pwuser2", cookies, form)
|
|
w := httptest.NewRecorder()
|
|
|
|
h.HandlePasswordChange().ServeHTTP(w, req)
|
|
|
|
assert.Equal(t, http.StatusOK, w.Code)
|
|
assert.Contains(
|
|
t, w.Body.String(), "Current password is incorrect.",
|
|
)
|
|
|
|
var unchanged database.User
|
|
|
|
require.NoError(t,
|
|
db.DB().Where(
|
|
"username = ?", "pwuser2",
|
|
).First(&unchanged).Error,
|
|
)
|
|
assert.Equal(
|
|
t, oldHash, unchanged.Password,
|
|
"stored hash must be unchanged after a rejected change",
|
|
)
|
|
}
|