88 lines
2.9 KiB
Go
88 lines
2.9 KiB
Go
package api
|
|
|
|
import (
|
|
"bytes"
|
|
"encoding/json"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
|
|
"chfs-ng/internal/auth"
|
|
"chfs-ng/internal/storage"
|
|
)
|
|
|
|
func TestUserManagementAndPrivateHome(t *testing.T) {
|
|
root := t.TempDir()
|
|
usersFile := filepath.Join(t.TempDir(), "users.json")
|
|
mgr := &auth.Manager{
|
|
Accounts: map[string]*auth.Account{
|
|
"admin": {Username: "admin", Password: "secret", Admin: true, Mask: auth.Read | auth.Write | auth.Delete},
|
|
},
|
|
Guest: &auth.Account{Mask: auth.None},
|
|
}
|
|
s := &Server{Store: storage.Local{Root: root}, Auth: mgr, UserStore: &auth.UserStore{Path: usersFile}, UserHome: "users"}
|
|
h := s.Handler()
|
|
|
|
req := httptest.NewRequest(http.MethodPost, "/chfs/session", strings.NewReader("user=admin&pwd=secret"))
|
|
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
|
rr := httptest.NewRecorder()
|
|
h.ServeHTTP(rr, req)
|
|
if rr.Code != http.StatusCreated {
|
|
t.Fatalf("admin login: %d %s", rr.Code, rr.Body.String())
|
|
}
|
|
cookie := rr.Result().Cookies()[0]
|
|
|
|
body := []byte(`{"username":"alice","password":"alice-pass"}`)
|
|
req = httptest.NewRequest(http.MethodPost, "/chfs/users", bytes.NewReader(body))
|
|
req.Header.Set("Content-Type", "application/json")
|
|
req.AddCookie(cookie)
|
|
rr = httptest.NewRecorder()
|
|
h.ServeHTTP(rr, req)
|
|
if rr.Code != http.StatusOK {
|
|
t.Fatalf("create user: %d %s", rr.Code, rr.Body.String())
|
|
}
|
|
if _, err := os.Stat(filepath.Join(root, "users", "alice")); err != nil {
|
|
t.Fatalf("home not created: %v", err)
|
|
}
|
|
|
|
req = httptest.NewRequest(http.MethodPost, "/chfs/session", strings.NewReader("user=alice&pwd=alice-pass"))
|
|
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
|
rr = httptest.NewRecorder()
|
|
h.ServeHTTP(rr, req)
|
|
if rr.Code != http.StatusCreated {
|
|
t.Fatalf("dynamic user login: %d %s", rr.Code, rr.Body.String())
|
|
}
|
|
|
|
token, err := auth.NewToken("alice", 30)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
req = httptest.NewRequest(http.MethodGet, "/chfs/files?filepath=", nil)
|
|
req.AddCookie(&http.Cookie{Name: "JWT", Value: token})
|
|
rr = httptest.NewRecorder()
|
|
h.ServeHTTP(rr, req)
|
|
if rr.Code != http.StatusOK || !strings.Contains(rr.Body.String(), "currentMask") || !strings.Contains(rr.Body.String(), "\"currentMask\":\"\"") {
|
|
t.Fatalf("private root access: %d %s", rr.Code, rr.Body.String())
|
|
}
|
|
|
|
req = httptest.NewRequest(http.MethodGet, "/chfs/files?filepath=users/alice", nil)
|
|
req.AddCookie(&http.Cookie{Name: "JWT", Value: token})
|
|
rr = httptest.NewRecorder()
|
|
h.ServeHTTP(rr, req)
|
|
if rr.Code != http.StatusOK || !strings.Contains(rr.Body.String(), "\"currentMask\":\"RWD\"") {
|
|
t.Fatalf("private home access: %d %s", rr.Code, rr.Body.String())
|
|
}
|
|
|
|
var saved []map[string]any
|
|
data, err := os.ReadFile(usersFile)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := json.Unmarshal(data, &saved); err != nil || len(saved) != 1 {
|
|
t.Fatalf("user persistence: %v %#v", err, saved)
|
|
}
|
|
}
|