113 lines
3.1 KiB
Go
113 lines
3.1 KiB
Go
package auth
|
|
|
|
import (
|
|
"database/sql"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"path/filepath"
|
|
"testing"
|
|
|
|
"git.noroutes.net/NoRoutes/vibetunes/internal/database"
|
|
)
|
|
|
|
func openTestDB(t *testing.T) *sql.DB {
|
|
t.Helper()
|
|
db, err := database.Open(filepath.Join(t.TempDir(), "test.db"))
|
|
if err != nil {
|
|
t.Fatalf("database.Open: %v", err)
|
|
}
|
|
t.Cleanup(func() { db.Close() })
|
|
return db
|
|
}
|
|
|
|
func TestSessionIssueAndCurrentUser(t *testing.T) {
|
|
db := openTestDB(t)
|
|
user, err := database.CreateUser(db, "alice", "alice@example.com", "", false)
|
|
if err != nil {
|
|
t.Fatalf("CreateUser: %v", err)
|
|
}
|
|
|
|
sessions := &Sessions{DB: db, CookieSecure: false}
|
|
rec := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodGet, "/", nil)
|
|
if err := sessions.Issue(rec, req, user.ID); err != nil {
|
|
t.Fatalf("Issue: %v", err)
|
|
}
|
|
|
|
req2 := httptest.NewRequest(http.MethodGet, "/", nil)
|
|
for _, c := range rec.Result().Cookies() {
|
|
req2.AddCookie(c)
|
|
}
|
|
got := sessions.CurrentUser(req2)
|
|
if got == nil || got.ID != user.ID {
|
|
t.Fatalf("CurrentUser = %v, want %s", got, user.ID)
|
|
}
|
|
}
|
|
|
|
func TestSessionClearRevokesCookie(t *testing.T) {
|
|
db := openTestDB(t)
|
|
user, err := database.CreateUser(db, "bob", "", "", false)
|
|
if err != nil {
|
|
t.Fatalf("CreateUser: %v", err)
|
|
}
|
|
sessions := &Sessions{DB: db, CookieSecure: false}
|
|
rec := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodGet, "/", nil)
|
|
if err := sessions.Issue(rec, req, user.ID); err != nil {
|
|
t.Fatalf("Issue: %v", err)
|
|
}
|
|
var cookies []*http.Cookie
|
|
for _, c := range rec.Result().Cookies() {
|
|
cookies = append(cookies, c)
|
|
}
|
|
|
|
logoutReq := httptest.NewRequest(http.MethodPost, "/logout", nil)
|
|
for _, c := range cookies {
|
|
logoutReq.AddCookie(c)
|
|
}
|
|
logoutRec := httptest.NewRecorder()
|
|
sessions.Clear(logoutRec, logoutReq)
|
|
|
|
req2 := httptest.NewRequest(http.MethodGet, "/", nil)
|
|
for _, c := range cookies {
|
|
req2.AddCookie(c)
|
|
}
|
|
if got := sessions.CurrentUser(req2); got != nil {
|
|
t.Fatalf("CurrentUser after Clear = %v, want nil", got)
|
|
}
|
|
}
|
|
|
|
func TestSessionRejectsUnknownCookie(t *testing.T) {
|
|
db := openTestDB(t)
|
|
sessions := &Sessions{DB: db, CookieSecure: false}
|
|
req := httptest.NewRequest(http.MethodGet, "/", nil)
|
|
req.AddCookie(&http.Cookie{Name: SessionCookieName, Value: "does-not-exist"})
|
|
if got := sessions.CurrentUser(req); got != nil {
|
|
t.Fatalf("CurrentUser = %v, want nil for unknown session", got)
|
|
}
|
|
}
|
|
|
|
func TestSessionRejectsDisabledUser(t *testing.T) {
|
|
db := openTestDB(t)
|
|
user, err := database.CreateUser(db, "carol", "", "", false)
|
|
if err != nil {
|
|
t.Fatalf("CreateUser: %v", err)
|
|
}
|
|
if err := database.SetUserDisabled(db, user.ID, true); err != nil {
|
|
t.Fatalf("SetUserDisabled: %v", err)
|
|
}
|
|
sessions := &Sessions{DB: db, CookieSecure: false}
|
|
rec := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodGet, "/", nil)
|
|
if err := sessions.Issue(rec, req, user.ID); err != nil {
|
|
t.Fatalf("Issue: %v", err)
|
|
}
|
|
req2 := httptest.NewRequest(http.MethodGet, "/", nil)
|
|
for _, c := range rec.Result().Cookies() {
|
|
req2.AddCookie(c)
|
|
}
|
|
if got := sessions.CurrentUser(req2); got != nil {
|
|
t.Fatalf("CurrentUser = %v, want nil for disabled user", got)
|
|
}
|
|
}
|