CHFS-NG/chfs-ng/internal/api/user_management_test.go

package api

import (
	"bytes"
	"encoding/json"
	"net/http"
	"net/http/httptest"
	"os"
	"path/filepath"
	"strings"
	"testing"

	"chfs-ng/internal/auth"
	"chfs-ng/internal/storage"
)

func TestUserManagementAndPrivateHome(t *testing.T) {
	root := t.TempDir()
	usersFile := filepath.Join(t.TempDir(), "users.json")
	mgr := &auth.Manager{
		Accounts: map[string]*auth.Account{
			"admin": {Username: "admin", Password: "secret", Admin: true, Mask: auth.Read | auth.Write | auth.Delete},
		},
		Guest: &auth.Account{Mask: auth.None},
	}
	s := &Server{Store: storage.Local{Root: root}, Auth: mgr, UserStore: &auth.UserStore{Path: usersFile}, UserHome: "users"}
	h := s.Handler()

	req := httptest.NewRequest(http.MethodPost, "/chfs/session", strings.NewReader("user=admin&pwd=secret"))
	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
	rr := httptest.NewRecorder()
	h.ServeHTTP(rr, req)
	if rr.Code != http.StatusCreated {
		t.Fatalf("admin login: %d %s", rr.Code, rr.Body.String())
	}
	cookie := rr.Result().Cookies()[0]

	body := []byte(`{"username":"alice","password":"alice-pass"}`)
	req = httptest.NewRequest(http.MethodPost, "/chfs/users", bytes.NewReader(body))
	req.Header.Set("Content-Type", "application/json")
	req.AddCookie(cookie)
	rr = httptest.NewRecorder()
	h.ServeHTTP(rr, req)
	if rr.Code != http.StatusOK {
		t.Fatalf("create user: %d %s", rr.Code, rr.Body.String())
	}
	if _, err := os.Stat(filepath.Join(root, "users", "alice")); err != nil {
		t.Fatalf("home not created: %v", err)
	}

	req = httptest.NewRequest(http.MethodPost, "/chfs/session", strings.NewReader("user=alice&pwd=alice-pass"))
	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
	rr = httptest.NewRecorder()
	h.ServeHTTP(rr, req)
	if rr.Code != http.StatusCreated {
		t.Fatalf("dynamic user login: %d %s", rr.Code, rr.Body.String())
	}

	token, err := auth.NewToken("alice", 30)
	if err != nil {
		t.Fatal(err)
	}
	req = httptest.NewRequest(http.MethodGet, "/chfs/files?filepath=", nil)
	req.AddCookie(&http.Cookie{Name: "JWT", Value: token})
	rr = httptest.NewRecorder()
	h.ServeHTTP(rr, req)
	if rr.Code != http.StatusOK || !strings.Contains(rr.Body.String(), "currentMask") || !strings.Contains(rr.Body.String(), "\"currentMask\":\"\"") {
		t.Fatalf("private root access: %d %s", rr.Code, rr.Body.String())
	}

	req = httptest.NewRequest(http.MethodGet, "/chfs/files?filepath=users/alice", nil)
	req.AddCookie(&http.Cookie{Name: "JWT", Value: token})
	rr = httptest.NewRecorder()
	h.ServeHTTP(rr, req)
	if rr.Code != http.StatusOK || !strings.Contains(rr.Body.String(), "\"currentMask\":\"RWD\"") {
		t.Fatalf("private home access: %d %s", rr.Code, rr.Body.String())
	}

	// Admin can disable a managed user, which immediately invalidates token-based access.
	updateBody, _ := json.Marshal(map[string]any{"username": "alice", "enabled": false})
	req = httptest.NewRequest(http.MethodPut, "/chfs/users", bytes.NewReader(updateBody))
	req.Header.Set("Content-Type", "application/json")
	req.AddCookie(cookie)
	rr = httptest.NewRecorder()
	h.ServeHTTP(rr, req)
	if rr.Code != http.StatusOK {
		t.Fatalf("disable user: %d %s", rr.Code, rr.Body.String())
	}
	req = httptest.NewRequest(http.MethodPost, "/chfs/session", strings.NewReader("user=alice&pwd=alice-pass"))
	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
	rr = httptest.NewRecorder()
	h.ServeHTTP(rr, req)
	if rr.Code == http.StatusCreated {
		t.Fatal("disabled user was allowed to login")
	}

	// Re-enable and grant read-only access to a shared directory.
	rules := []map[string]any{
		{"dir": "public", "mask": "r"},
		{"dir": "public/private", "mask": "r", "deny": true, "childrenOnly": true},
	}
	updateBody, _ = json.Marshal(map[string]any{"username": "alice", "enabled": true, "rules": rules})
	req = httptest.NewRequest(http.MethodPut, "/chfs/users", bytes.NewReader(updateBody))
	req.Header.Set("Content-Type", "application/json")
	req.AddCookie(cookie)
	rr = httptest.NewRecorder()
	h.ServeHTTP(rr, req)
	if rr.Code != http.StatusOK {
		t.Fatalf("update rules: %d %s", rr.Code, rr.Body.String())
	}
	if err := os.MkdirAll(filepath.Join(root, "public"), 0755); err != nil {
		t.Fatal(err)
	}
	if err := os.WriteFile(filepath.Join(root, "public", "readme.txt"), []byte("ok"), 0644); err != nil {
		t.Fatal(err)
	}
	if got := mgr.Accounts["alice"].MaskFor("users/alice"); got != auth.Read|auth.Write|auth.Delete {
		t.Fatalf("home permission was not preserved: %v", got)
	}
	if got := mgr.Accounts["alice"].MaskFor("public/private/file.txt"); got != auth.None {
		t.Fatalf("deny rule was not applied: %v", got)
	}
	token, err = auth.NewToken("alice", 30)
	if err != nil {
		t.Fatal(err)
	}
	req = httptest.NewRequest(http.MethodGet, "/chfs/files?filepath=public", nil)
	req.AddCookie(&http.Cookie{Name: "JWT", Value: token})
	rr = httptest.NewRecorder()
	h.ServeHTTP(rr, req)
	if rr.Code != http.StatusOK || !strings.Contains(rr.Body.String(), "\"currentMask\":\"R\"") {
		t.Fatalf("shared read rule: %d %s", rr.Code, rr.Body.String())
	}
	var saved []map[string]any
	data, err := os.ReadFile(usersFile)
	if err != nil {
		t.Fatal(err)
	}
	if err := json.Unmarshal(data, &saved); err != nil || len(saved) != 1 {
		t.Fatalf("user persistence: %v %#v", err, saved)
	}
}