445 lines
15 KiB
Go
445 lines
15 KiB
Go
package httpserver
|
|
|
|
import (
|
|
"bytes"
|
|
"context"
|
|
"encoding/json"
|
|
"io"
|
|
"log/slog"
|
|
"mime/multipart"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"os"
|
|
"path/filepath"
|
|
"testing"
|
|
|
|
"github.com/tim/cairnquire/apps/server/internal/auth"
|
|
"github.com/tim/cairnquire/apps/server/internal/config"
|
|
"github.com/tim/cairnquire/apps/server/internal/database"
|
|
"github.com/tim/cairnquire/apps/server/internal/docs"
|
|
"github.com/tim/cairnquire/apps/server/internal/markdown"
|
|
"github.com/tim/cairnquire/apps/server/internal/realtime"
|
|
"github.com/tim/cairnquire/apps/server/internal/store"
|
|
"github.com/tim/cairnquire/apps/server/internal/sync"
|
|
)
|
|
|
|
type apiTestServer struct {
|
|
handler http.Handler
|
|
auth *auth.Service
|
|
docs *docs.Service
|
|
userID string
|
|
root string
|
|
}
|
|
|
|
func newAPITestServer(t *testing.T) *apiTestServer {
|
|
return newAPITestServerWithSetup(t, true)
|
|
}
|
|
|
|
func newAPITestServerWithSetup(t *testing.T, setupComplete bool) *apiTestServer {
|
|
t.Helper()
|
|
|
|
ctx := context.Background()
|
|
root := t.TempDir()
|
|
sourceDir := filepath.Join(root, "content")
|
|
storeDir := filepath.Join(root, "files")
|
|
if err := os.MkdirAll(sourceDir, 0o755); err != nil {
|
|
t.Fatalf("create source dir: %v", err)
|
|
}
|
|
if err := os.WriteFile(filepath.Join(sourceDir, "hello.md"), []byte("# Hello\n\nInitial"), 0o644); err != nil {
|
|
t.Fatalf("write source fixture: %v", err)
|
|
}
|
|
|
|
db, err := database.Open(ctx, config.DatabaseConfig{Path: filepath.Join(root, "db.sqlite")})
|
|
if err != nil {
|
|
t.Fatalf("open test database: %v", err)
|
|
}
|
|
t.Cleanup(func() { _ = db.Close() })
|
|
if err := database.ApplyMigrations(ctx, db.SQL()); err != nil {
|
|
t.Fatalf("apply migrations: %v", err)
|
|
}
|
|
|
|
logger := slog.New(slog.NewTextHandler(io.Discard, nil))
|
|
contentStore, err := store.New(storeDir)
|
|
if err != nil {
|
|
t.Fatalf("create content store: %v", err)
|
|
}
|
|
docRepo := docs.NewRepository(db.SQL())
|
|
docService := docs.NewService(sourceDir, contentStore, markdown.NewRenderer(), docRepo, logger)
|
|
if _, err := docService.SyncSourceDir(ctx); err != nil {
|
|
t.Fatalf("sync source fixture: %v", err)
|
|
}
|
|
|
|
authService, err := auth.NewService(auth.NewRepository(db.SQL()), "http://localhost:8080")
|
|
if err != nil {
|
|
t.Fatalf("create auth service: %v", err)
|
|
}
|
|
var user auth.User
|
|
if setupComplete {
|
|
user, err = authService.CompleteInitialSetup(ctx, "editor@example.com", "Editor", "very secure password", false)
|
|
if err != nil {
|
|
t.Fatalf("create test user: %v", err)
|
|
}
|
|
}
|
|
|
|
syncRepo := sync.NewRepository(db.SQL())
|
|
handler, err := New(Dependencies{
|
|
Config: config.Config{
|
|
Content: config.ContentConfig{
|
|
SourceDir: sourceDir,
|
|
StoreDir: storeDir,
|
|
},
|
|
Auth: config.AuthConfig{PublicOrigin: "http://localhost:8080"},
|
|
},
|
|
Logger: logger,
|
|
Documents: docService,
|
|
Repository: docRepo,
|
|
ContentStore: contentStore,
|
|
Hub: realtime.NewHub(logger),
|
|
SyncService: sync.NewService(syncRepo, docService, contentStore, sourceDir, logger),
|
|
SyncRepo: syncRepo,
|
|
Auth: authService,
|
|
})
|
|
if err != nil {
|
|
t.Fatalf("create http server: %v", err)
|
|
}
|
|
|
|
return &apiTestServer{
|
|
handler: handler,
|
|
auth: authService,
|
|
docs: docService,
|
|
userID: user.ID,
|
|
root: root,
|
|
}
|
|
}
|
|
|
|
func TestInitialSetupWizardCreatesAdminAndPersistsSignupPolicy(t *testing.T) {
|
|
server := newAPITestServerWithSetup(t, false)
|
|
|
|
index := httptest.NewRecorder()
|
|
server.handler.ServeHTTP(index, httptest.NewRequest(http.MethodGet, "/", nil))
|
|
if index.Code != http.StatusSeeOther || index.Header().Get("Location") != "/setup" {
|
|
t.Fatalf("initial index response = %d %q, want redirect to /setup", index.Code, index.Header().Get("Location"))
|
|
}
|
|
|
|
setupPage := httptest.NewRecorder()
|
|
server.handler.ServeHTTP(setupPage, httptest.NewRequest(http.MethodGet, "/setup", nil))
|
|
if setupPage.Code != http.StatusOK || !bytes.Contains(setupPage.Body.Bytes(), []byte("Initial setup")) {
|
|
t.Fatalf("setup page response = %d %q", setupPage.Code, setupPage.Body.String())
|
|
}
|
|
|
|
setup := httptest.NewRecorder()
|
|
server.handler.ServeHTTP(setup, jsonRequest(http.MethodPost, "/api/setup", map[string]any{
|
|
"email": "owner@example.com",
|
|
"displayName": "Owner",
|
|
"password": "correct horse battery staple",
|
|
"signupsEnabled": false,
|
|
}))
|
|
if setup.Code != http.StatusCreated {
|
|
t.Fatalf("setup status = %d, want %d; body=%s", setup.Code, http.StatusCreated, setup.Body.String())
|
|
}
|
|
if len(setup.Result().Cookies()) == 0 {
|
|
t.Fatal("expected setup to create a browser session")
|
|
}
|
|
|
|
settings, err := server.auth.GetInstanceSettings(context.Background())
|
|
if err != nil {
|
|
t.Fatalf("GetInstanceSettings() error = %v", err)
|
|
}
|
|
if !settings.SetupComplete || settings.SignupsEnabled {
|
|
t.Fatalf("settings = %#v, want setup complete with signups disabled", settings)
|
|
}
|
|
|
|
register := httptest.NewRecorder()
|
|
server.handler.ServeHTTP(register, jsonRequest(http.MethodPost, "/api/auth/register/password", map[string]any{
|
|
"email": "viewer@example.com",
|
|
"displayName": "Viewer",
|
|
"password": "correct horse battery staple",
|
|
}))
|
|
if register.Code != http.StatusBadRequest || !bytes.Contains(register.Body.Bytes(), []byte("signups are disabled")) {
|
|
t.Fatalf("register response = %d %q, want disabled signup error", register.Code, register.Body.String())
|
|
}
|
|
}
|
|
|
|
func (s *apiTestServer) token(t *testing.T, scopes ...auth.Scope) string {
|
|
t.Helper()
|
|
|
|
created, err := s.auth.CreateAPIKey(context.Background(), s.userID, "test token", scopes, nil)
|
|
if err != nil {
|
|
t.Fatalf("create api token: %v", err)
|
|
}
|
|
return created.Token
|
|
}
|
|
|
|
func TestAPIUploadStoresAndServesAttachment(t *testing.T) {
|
|
server := newAPITestServer(t)
|
|
token := server.token(t, auth.ScopeDocsWrite)
|
|
|
|
body, contentType := multipartBody(t, "file", `unsafe"name.txt`, []byte("plain attachment\n"))
|
|
request := httptest.NewRequest(http.MethodPost, "/api/uploads", body)
|
|
request.Header.Set("Content-Type", contentType)
|
|
request.Header.Set("Authorization", "Bearer "+token)
|
|
recorder := httptest.NewRecorder()
|
|
|
|
server.handler.ServeHTTP(recorder, request)
|
|
|
|
response := recorder.Result()
|
|
if response.StatusCode != http.StatusCreated {
|
|
t.Fatalf("upload status = %d, want %d; body=%s", response.StatusCode, http.StatusCreated, recorder.Body.String())
|
|
}
|
|
|
|
var payload struct {
|
|
Hash string `json:"hash"`
|
|
ContentType string `json:"contentType"`
|
|
AttachmentURL string `json:"attachmentUrl"`
|
|
}
|
|
if err := json.NewDecoder(response.Body).Decode(&payload); err != nil {
|
|
t.Fatalf("decode upload response: %v", err)
|
|
}
|
|
if payload.Hash == "" {
|
|
t.Fatal("expected upload response hash")
|
|
}
|
|
if payload.ContentType != "text/plain; charset=utf-8" {
|
|
t.Fatalf("contentType = %q, want text/plain; charset=utf-8", payload.ContentType)
|
|
}
|
|
if payload.AttachmentURL != "/attachments/"+payload.Hash {
|
|
t.Fatalf("attachmentUrl = %q, want /attachments/%s", payload.AttachmentURL, payload.Hash)
|
|
}
|
|
|
|
download := httptest.NewRequest(http.MethodGet, payload.AttachmentURL, nil)
|
|
downloadRecorder := httptest.NewRecorder()
|
|
server.handler.ServeHTTP(downloadRecorder, download)
|
|
|
|
downloadResponse := downloadRecorder.Result()
|
|
if downloadResponse.StatusCode != http.StatusOK {
|
|
t.Fatalf("download status = %d, want %d", downloadResponse.StatusCode, http.StatusOK)
|
|
}
|
|
if got := downloadResponse.Header.Get("Content-Type"); got != payload.ContentType {
|
|
t.Fatalf("download content-type = %q, want %q", got, payload.ContentType)
|
|
}
|
|
if got := downloadResponse.Header.Get("Content-Disposition"); got != `inline; filename="unsafename.txt"` {
|
|
t.Fatalf("content-disposition = %q, want sanitized filename", got)
|
|
}
|
|
if downloadRecorder.Body.String() != "plain attachment\n" {
|
|
t.Fatalf("download body = %q", downloadRecorder.Body.String())
|
|
}
|
|
}
|
|
|
|
func TestAPIUploadRejectsTokenWithoutDocsWriteScope(t *testing.T) {
|
|
server := newAPITestServer(t)
|
|
token := server.token(t, auth.ScopeSyncRead, auth.ScopeSyncWrite)
|
|
|
|
body, contentType := multipartBody(t, "file", "note.txt", []byte("plain attachment\n"))
|
|
request := httptest.NewRequest(http.MethodPost, "/api/uploads", body)
|
|
request.Header.Set("Content-Type", contentType)
|
|
request.Header.Set("Authorization", "Bearer "+token)
|
|
recorder := httptest.NewRecorder()
|
|
|
|
server.handler.ServeHTTP(recorder, request)
|
|
|
|
if recorder.Code != http.StatusForbidden {
|
|
t.Fatalf("status = %d, want %d", recorder.Code, http.StatusForbidden)
|
|
}
|
|
}
|
|
|
|
func TestAPISyncInitAndContentFetchUseBearerScopes(t *testing.T) {
|
|
server := newAPITestServer(t)
|
|
token := server.token(t, auth.ScopeSyncRead, auth.ScopeSyncWrite)
|
|
|
|
request := jsonRequest(http.MethodPost, "/api/sync/init", map[string]string{"deviceId": "device-1"})
|
|
request.Header.Set("Authorization", "Bearer "+token)
|
|
recorder := httptest.NewRecorder()
|
|
|
|
server.handler.ServeHTTP(recorder, request)
|
|
|
|
if recorder.Code != http.StatusOK {
|
|
t.Fatalf("sync init status = %d, want %d; body=%s", recorder.Code, http.StatusOK, recorder.Body.String())
|
|
}
|
|
|
|
var payload struct {
|
|
SnapshotID string `json:"snapshotId"`
|
|
ServerSnapshot []sync.FileEntry `json:"serverSnapshot"`
|
|
}
|
|
if err := json.Unmarshal(recorder.Body.Bytes(), &payload); err != nil {
|
|
t.Fatalf("decode sync init response: %v", err)
|
|
}
|
|
if payload.SnapshotID == "" {
|
|
t.Fatal("expected snapshot id")
|
|
}
|
|
if len(payload.ServerSnapshot) != 1 || payload.ServerSnapshot[0].Path != "hello.md" {
|
|
t.Fatalf("server snapshot = %#v, want hello.md entry", payload.ServerSnapshot)
|
|
}
|
|
|
|
fetch := httptest.NewRequest(http.MethodGet, "/api/content/"+payload.ServerSnapshot[0].Hash, nil)
|
|
fetch.Header.Set("Authorization", "Bearer "+token)
|
|
fetchRecorder := httptest.NewRecorder()
|
|
server.handler.ServeHTTP(fetchRecorder, fetch)
|
|
|
|
if fetchRecorder.Code != http.StatusOK {
|
|
t.Fatalf("content fetch status = %d, want %d", fetchRecorder.Code, http.StatusOK)
|
|
}
|
|
if fetchRecorder.Body.String() != "# Hello\n\nInitial" {
|
|
t.Fatalf("content fetch body = %q", fetchRecorder.Body.String())
|
|
}
|
|
}
|
|
|
|
func TestAPISyncInitRejectsTokenWithoutSyncWriteScope(t *testing.T) {
|
|
server := newAPITestServer(t)
|
|
token := server.token(t, auth.ScopeDocsRead, auth.ScopeDocsWrite)
|
|
|
|
request := jsonRequest(http.MethodPost, "/api/sync/init", map[string]string{"deviceId": "device-1"})
|
|
request.Header.Set("Authorization", "Bearer "+token)
|
|
recorder := httptest.NewRecorder()
|
|
|
|
server.handler.ServeHTTP(recorder, request)
|
|
|
|
if recorder.Code != http.StatusForbidden {
|
|
t.Fatalf("status = %d, want %d", recorder.Code, http.StatusForbidden)
|
|
}
|
|
}
|
|
|
|
func TestAPISyncDeltaReturnsServerChanges(t *testing.T) {
|
|
server := newAPITestServer(t)
|
|
token := server.token(t, auth.ScopeSyncRead, auth.ScopeSyncWrite)
|
|
|
|
initRequest := jsonRequest(http.MethodPost, "/api/sync/init", map[string]string{"deviceId": "device-1"})
|
|
initRequest.Header.Set("Authorization", "Bearer "+token)
|
|
initRecorder := httptest.NewRecorder()
|
|
server.handler.ServeHTTP(initRecorder, initRequest)
|
|
if initRecorder.Code != http.StatusOK {
|
|
t.Fatalf("sync init status = %d, want %d; body=%s", initRecorder.Code, http.StatusOK, initRecorder.Body.String())
|
|
}
|
|
|
|
var initPayload struct {
|
|
SnapshotID string `json:"snapshotId"`
|
|
}
|
|
if err := json.Unmarshal(initRecorder.Body.Bytes(), &initPayload); err != nil {
|
|
t.Fatalf("decode sync init response: %v", err)
|
|
}
|
|
|
|
if err := os.WriteFile(filepath.Join(server.root, "content", "hello.md"), []byte("# Hello\n\nServer update"), 0o644); err != nil {
|
|
t.Fatalf("write server update: %v", err)
|
|
}
|
|
|
|
deltaRequest := jsonRequest(http.MethodPost, "/api/sync/delta", map[string]any{
|
|
"snapshotId": initPayload.SnapshotID,
|
|
"clientDelta": []sync.Change{},
|
|
})
|
|
deltaRequest.Header.Set("Authorization", "Bearer "+token)
|
|
deltaRecorder := httptest.NewRecorder()
|
|
server.handler.ServeHTTP(deltaRecorder, deltaRequest)
|
|
|
|
if deltaRecorder.Code != http.StatusOK {
|
|
t.Fatalf("sync delta status = %d, want %d; body=%s", deltaRecorder.Code, http.StatusOK, deltaRecorder.Body.String())
|
|
}
|
|
|
|
var deltaPayload struct {
|
|
ServerDelta []sync.Change `json:"serverDelta"`
|
|
Conflicts []sync.Conflict `json:"conflicts"`
|
|
}
|
|
if err := json.Unmarshal(deltaRecorder.Body.Bytes(), &deltaPayload); err != nil {
|
|
t.Fatalf("decode sync delta response: %v", err)
|
|
}
|
|
if len(deltaPayload.ServerDelta) != 1 {
|
|
t.Fatalf("serverDelta = %#v, want one update", deltaPayload.ServerDelta)
|
|
}
|
|
change := deltaPayload.ServerDelta[0]
|
|
if change.Type != sync.ChangeUpdate || change.Path != "hello.md" || change.Hash == "" {
|
|
t.Fatalf("server delta change = %#v, want update for hello.md with hash", change)
|
|
}
|
|
if len(deltaPayload.Conflicts) != 0 {
|
|
t.Fatalf("conflicts = %#v, want none", deltaPayload.Conflicts)
|
|
}
|
|
}
|
|
|
|
func TestAPIDocumentSaveReturnsConflictForStaleBaseHash(t *testing.T) {
|
|
server := newAPITestServer(t)
|
|
token := server.token(t, auth.ScopeDocsWrite)
|
|
|
|
documents := httptest.NewRecorder()
|
|
server.handler.ServeHTTP(documents, httptest.NewRequest(http.MethodGet, "/api/documents", nil))
|
|
if documents.Code != http.StatusOK {
|
|
t.Fatalf("documents status = %d, want %d", documents.Code, http.StatusOK)
|
|
}
|
|
|
|
var list struct {
|
|
Documents []struct {
|
|
Path string `json:"path"`
|
|
Hash string `json:"hash"`
|
|
} `json:"documents"`
|
|
}
|
|
if err := json.Unmarshal(documents.Body.Bytes(), &list); err != nil {
|
|
t.Fatalf("decode documents: %v", err)
|
|
}
|
|
if len(list.Documents) != 1 {
|
|
t.Fatalf("documents = %#v, want one document", list.Documents)
|
|
}
|
|
|
|
if err := os.WriteFile(filepath.Join(server.root, "content", "hello.md"), []byte("# Hello\n\nServer edit"), 0o644); err != nil {
|
|
t.Fatalf("write server edit: %v", err)
|
|
}
|
|
|
|
save := jsonRequest(http.MethodPost, "/api/documents/hello", map[string]string{
|
|
"content": "# Hello\n\nClient edit",
|
|
"baseHash": list.Documents[0].Hash,
|
|
})
|
|
save.Header.Set("Authorization", "Bearer "+token)
|
|
saveRecorder := httptest.NewRecorder()
|
|
|
|
server.handler.ServeHTTP(saveRecorder, save)
|
|
|
|
if saveRecorder.Code != http.StatusConflict {
|
|
t.Fatalf("save status = %d, want %d; body=%s", saveRecorder.Code, http.StatusConflict, saveRecorder.Body.String())
|
|
}
|
|
|
|
var conflict struct {
|
|
Status string `json:"status"`
|
|
Path string `json:"path"`
|
|
BaseHash string `json:"baseHash"`
|
|
CurrentHash string `json:"currentHash"`
|
|
CurrentContent string `json:"currentContent"`
|
|
}
|
|
if err := json.Unmarshal(saveRecorder.Body.Bytes(), &conflict); err != nil {
|
|
t.Fatalf("decode conflict response: %v", err)
|
|
}
|
|
if conflict.Status != "conflict" || conflict.Path != "hello.md" {
|
|
t.Fatalf("conflict payload = %#v, want conflict for hello.md", conflict)
|
|
}
|
|
if conflict.BaseHash != list.Documents[0].Hash {
|
|
t.Fatalf("baseHash = %q, want %q", conflict.BaseHash, list.Documents[0].Hash)
|
|
}
|
|
if conflict.CurrentHash == "" || conflict.CurrentHash == conflict.BaseHash {
|
|
t.Fatalf("currentHash = %q, baseHash = %q", conflict.CurrentHash, conflict.BaseHash)
|
|
}
|
|
if conflict.CurrentContent != "# Hello\n\nServer edit" {
|
|
t.Fatalf("currentContent = %q", conflict.CurrentContent)
|
|
}
|
|
}
|
|
|
|
func multipartBody(t *testing.T, fieldName, filename string, content []byte) (*bytes.Buffer, string) {
|
|
t.Helper()
|
|
|
|
body := &bytes.Buffer{}
|
|
writer := multipart.NewWriter(body)
|
|
part, err := writer.CreateFormFile(fieldName, filename)
|
|
if err != nil {
|
|
t.Fatalf("create multipart file: %v", err)
|
|
}
|
|
if _, err := part.Write(content); err != nil {
|
|
t.Fatalf("write multipart file: %v", err)
|
|
}
|
|
if err := writer.Close(); err != nil {
|
|
t.Fatalf("close multipart writer: %v", err)
|
|
}
|
|
return body, writer.FormDataContentType()
|
|
}
|
|
|
|
func jsonRequest(method, path string, payload any) *http.Request {
|
|
body, err := json.Marshal(payload)
|
|
if err != nil {
|
|
panic(err)
|
|
}
|
|
request := httptest.NewRequest(method, path, bytes.NewReader(body))
|
|
request.Header.Set("Content-Type", "application/json")
|
|
return request
|
|
}
|