feat: add web ui and dynamic private users

2026-09-22 01:14:15 +08:00
parent 035c3600bf
commit 77572e610b
7 changed files with 418 additions and 7 deletions
@@ -0,0 +1,87 @@
+package api
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"chfs-ng/internal/auth"
+	"chfs-ng/internal/storage"
+)
+
+func TestUserManagementAndPrivateHome(t *testing.T) {
+	root := t.TempDir()
+	usersFile := filepath.Join(t.TempDir(), "users.json")
+	mgr := &auth.Manager{
+		Accounts: map[string]*auth.Account{
+			"admin": {Username: "admin", Password: "secret", Admin: true, Mask: auth.Read | auth.Write | auth.Delete},
+		},
+		Guest: &auth.Account{Mask: auth.None},
+	}
+	s := &Server{Store: storage.Local{Root: root}, Auth: mgr, UserStore: &auth.UserStore{Path: usersFile}, UserHome: "users"}
+	h := s.Handler()
+
+	req := httptest.NewRequest(http.MethodPost, "/chfs/session", strings.NewReader("user=admin&pwd=secret"))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, req)
+	if rr.Code != http.StatusCreated {
+		t.Fatalf("admin login: %d %s", rr.Code, rr.Body.String())
+	}
+	cookie := rr.Result().Cookies()[0]
+
+	body := []byte(`{"username":"alice","password":"alice-pass"}`)
+	req = httptest.NewRequest(http.MethodPost, "/chfs/users", bytes.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+	req.AddCookie(cookie)
+	rr = httptest.NewRecorder()
+	h.ServeHTTP(rr, req)
+	if rr.Code != http.StatusOK {
+		t.Fatalf("create user: %d %s", rr.Code, rr.Body.String())
+	}
+	if _, err := os.Stat(filepath.Join(root, "users", "alice")); err != nil {
+		t.Fatalf("home not created: %v", err)
+	}
+
+	req = httptest.NewRequest(http.MethodPost, "/chfs/session", strings.NewReader("user=alice&pwd=alice-pass"))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	rr = httptest.NewRecorder()
+	h.ServeHTTP(rr, req)
+	if rr.Code != http.StatusCreated {
+		t.Fatalf("dynamic user login: %d %s", rr.Code, rr.Body.String())
+	}
+
+	token, err := auth.NewToken("alice", 30)
+	if err != nil {
+		t.Fatal(err)
+	}
+	req = httptest.NewRequest(http.MethodGet, "/chfs/files?filepath=", nil)
+	req.AddCookie(&http.Cookie{Name: "JWT", Value: token})
+	rr = httptest.NewRecorder()
+	h.ServeHTTP(rr, req)
+	if rr.Code != http.StatusOK || !strings.Contains(rr.Body.String(), "currentMask") || !strings.Contains(rr.Body.String(), "\"currentMask\":\"\"") {
+		t.Fatalf("private root access: %d %s", rr.Code, rr.Body.String())
+	}
+
+	req = httptest.NewRequest(http.MethodGet, "/chfs/files?filepath=users/alice", nil)
+	req.AddCookie(&http.Cookie{Name: "JWT", Value: token})
+	rr = httptest.NewRecorder()
+	h.ServeHTTP(rr, req)
+	if rr.Code != http.StatusOK || !strings.Contains(rr.Body.String(), "\"currentMask\":\"RWD\"") {
+		t.Fatalf("private home access: %d %s", rr.Code, rr.Body.String())
+	}
+
+	var saved []map[string]any
+	data, err := os.ReadFile(usersFile)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := json.Unmarshal(data, &saved); err != nil || len(saved) != 1 {
+		t.Fatalf("user persistence: %v %#v", err, saved)
+	}
+}