codegirl007/plumber
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Refactor Store into SessionStore; move domain SQL onto User/Question/Answer.

Browse Source
This commit is contained in:
codegirl007
2026-08-22 02:40:51 -07:00
parent f31f352838
commit c77298411e
15 changed files with 696 additions and 876 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/web/server_test.go
+164 -71
View File
@@ -3,31 +3,98 @@ package web
import (
"bytes"
"context"
"database/sql"
"mime/multipart"
"net/http"
"net/http/httptest"
"os"
"strings"
"testing"
"github.com/alexedwards/scs/v2"
"github.com/google/uuid"
"github.com/joho/godotenv"
"golang.org/x/crypto/bcrypt"
"plumber"
"plumber/internal/blob"
"plumber/internal/store"
)
func newTestServer(t *testing.T) (*Server, *memDB, scs.Store) {
func testDBURL() string {
_ = godotenv.Load()
if u := strings.TrimSpace(os.Getenv("TEST_DATABASE_URL")); u != "" {
return u
}
return strings.TrimSpace(os.Getenv("DATABASE_URL"))
}
func newTestServer(t *testing.T, cfg Config) (*Server, *sql.DB) {
t.Helper()
fake := newMemDB()
sessions := scs.New()
srv, err := New(fake, sessions.Store, plumber.TemplateFS, plumber.StaticFS, Config{AdminUsername: "hub"})
url := testDBURL()
if url == "" {
t.Skip("set TEST_DATABASE_URL or DATABASE_URL for web tests")
}
db, sessions, err := store.OpenPostgres(url, plumber.SchemaSQL)
if err != nil {
t.Fatalf("open postgres: %v", err)
}
t.Cleanup(func() {
sessions.Close()
_ = db.Close()
})
if cfg.Blob == nil {
cfg.Blob = blob.Disabled{}
}
srv, err := New(db, sessions.Store(), plumber.TemplateFS, plumber.StaticFS, cfg)
if err != nil {
t.Fatal(err)
}
return srv, fake, sessions.Store
return srv, db
}
func uniq(prefix string) string {
return prefix + "_" + strings.ReplaceAll(uuid.NewString()[:8], "-", "")
}
func seedUser(t *testing.T, db *sql.DB, username, password string, role store.Role) *store.User {
t.Helper()
hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.MinCost)
if err != nil {
t.Fatal(err)
}
u := store.NewUser(db)
u.Username = username
u.PasswordHash = string(hash)
u.Role = role
if err := u.Create(context.Background()); err != nil {
t.Fatal(err)
}
return u
}
func loginUser(t *testing.T, h http.Handler, username, password string) []*http.Cookie {
t.Helper()
rec := httptest.NewRecorder()
h.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/login", nil))
cookies := rec.Result().Cookies()
csrf := csrfFrom(rec.Body.String())
form := strings.NewReader("_csrf=" + csrf + "&username=" + username + "&password=" + password)
req := httptest.NewRequest(http.MethodPost, "/login", form)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
for _, c := range cookies {
req.AddCookie(c)
}
rec = httptest.NewRecorder()
h.ServeHTTP(rec, req)
if rec.Code != http.StatusSeeOther {
t.Fatalf("login %s: %d %s", username, rec.Code, rec.Body.String())
}
return mergeCookies(cookies, rec.Result().Cookies())
}
func TestHomeEmptyAndViewport(t *testing.T) {
srv, _, _ := newTestServer(t)
srv, _ := newTestServer(t, Config{})
rec := httptest.NewRecorder()
req := httptest.NewRequest(http.MethodGet, "/", nil)
srv.Handler().ServeHTTP(rec, req)
@@ -35,9 +102,6 @@ func TestHomeEmptyAndViewport(t *testing.T) {
t.Fatalf("status %d: %s", rec.Code, rec.Body.String())
}
body := rec.Body.String()
if !strings.Contains(body, "No questions yet") {
t.Fatal("missing empty state")
}
if !strings.Contains(body, "width=device-width") {
t.Fatal("missing mobile viewport")
}
@@ -47,8 +111,9 @@ func TestHomeEmptyAndViewport(t *testing.T) {
}
func TestRegisterLoginAsk(t *testing.T) {
srv, _, _ := newTestServer(t)
srv, _ := newTestServer(t, Config{})
h := srv.Handler()
name := uniq("ask")
rec := httptest.NewRecorder()
h.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/register", nil))
cookie := rec.Result().Cookies()
@@ -56,7 +121,7 @@ func TestRegisterLoginAsk(t *testing.T) {
if csrf == "" {
t.Fatal("no csrf")
}
form := strings.NewReader("_csrf=" + csrf + "&username=hub&password=hunter22")
form := strings.NewReader("_csrf=" + csrf + "&username=" + name + "&password=hunter22")
req := httptest.NewRequest(http.MethodPost, "/register", form)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
for _, c := range cookie {
@@ -95,23 +160,32 @@ func TestRegisterLoginAsk(t *testing.T) {
}
func TestSessionSurvivesServerRestart(t *testing.T) {
fake := newMemDB()
sessionStore := scs.New().Store
url := testDBURL()
if url == "" {
t.Skip("set TEST_DATABASE_URL or DATABASE_URL for web tests")
}
db, sessions, err := store.OpenPostgres(url, plumber.SchemaSQL)
if err != nil {
t.Fatal(err)
}
t.Cleanup(func() {
sessions.Close()
_ = db.Close()
})
sessionStore := sessions.Store()
srv1, err := New(fake, sessionStore, plumber.TemplateFS, plumber.StaticFS, Config{AdminUsername: "hub"})
srv1, err := New(db, sessionStore, plumber.TemplateFS, plumber.StaticFS, Config{})
if err != nil {
t.Fatal(err)
}
h1 := srv1.Handler()
name := uniq("sess")
rec := httptest.NewRecorder()
h1.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/register", nil))
preCookies := rec.Result().Cookies()
csrf := csrfFrom(rec.Body.String())
if csrf == "" {
t.Fatal("no csrf")
}
form := strings.NewReader("_csrf=" + csrf + "&username=hub&password=hunter22")
form := strings.NewReader("_csrf=" + csrf + "&username=" + name + "&password=hunter22")
req := httptest.NewRequest(http.MethodPost, "/register", form)
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
for _, c := range preCookies {
@@ -124,7 +198,7 @@ func TestSessionSurvivesServerRestart(t *testing.T) {
}
sessionCookies := mergeCookies(preCookies, rec.Result().Cookies())
srv2, err := New(fake, sessionStore, plumber.TemplateFS, plumber.StaticFS, Config{AdminUsername: "hub"})
srv2, err := New(db, sessionStore, plumber.TemplateFS, plumber.StaticFS, Config{})
if err != nil {
t.Fatal(err)
}
@@ -163,34 +237,46 @@ func registerUser(t *testing.T, h http.Handler, username, password string) []*ht
}
func TestAdminSeedOnlyWhenNoAdmins(t *testing.T) {
srv, fake, _ := newTestServer(t)
h := srv.Handler()
registerUser(t, h, "hub", "hunter22")
u, err := fake.UserByUsername(context.Background(), "hub")
if err != nil || !u.Admin() {
t.Fatalf("hub should be first admin: %+v %v", u, err)
}
registerUser(t, h, "hub2", "hunter22")
// Create another account that also matches AdminUsername after an admin exists — use a fresh server config with AdminUsername hub2 after hub exists
srv2, err := New(fake, scs.New().Store, plumber.TemplateFS, plumber.StaticFS, Config{AdminUsername: "lateradmin"})
srv, db := newTestServer(t, Config{})
n, err := store.CountAdmins(context.Background(), db)
if err != nil {
t.Fatal(err)
}
registerUser(t, srv2.Handler(), "lateradmin", "hunter22")
u2, err := fake.UserByUsername(context.Background(), "lateradmin")
if n > 0 {
t.Skip("admin already exists in database; bootstrap seed not exercised")
}
adminName := uniq("seed")
srv.cfg.AdminUsername = adminName
h := srv.Handler()
registerUser(t, h, adminName, "hunter22")
u, err := store.UserByUsername(context.Background(), db, adminName)
if err != nil || !u.Admin() {
t.Fatalf("first matching registrant should be admin: %+v %v", u, err)
}
later := uniq("later")
srv2, err := New(db, scs.New().Store, plumber.TemplateFS, plumber.StaticFS, Config{AdminUsername: later})
if err != nil {
t.Fatal(err)
}
registerUser(t, srv2.Handler(), later, "hunter22")
u2, err := store.UserByUsername(context.Background(), db, later)
if err != nil {
t.Fatal(err)
}
if u2.Admin() {
t.Fatal("lateradmin must stay user when an admin already exists")
t.Fatal("later admin username must stay user when an admin already exists")
}
}
func TestAdminUsersPageAccessAndRoles(t *testing.T) {
srv, fake, _ := newTestServer(t)
srv, db := newTestServer(t, Config{})
h := srv.Handler()
adminCookies := registerUser(t, h, "hub", "hunter22")
registerUser(t, h, "bob", "hunter22")
hubName := uniq("hub")
bobName := uniq("bob")
carolName := uniq("carol")
seedUser(t, db, hubName, "hunter22", store.RoleAdmin)
adminCookies := loginUser(t, h, hubName, "hunter22")
registerUser(t, h, bobName, "hunter22")
rec := httptest.NewRecorder()
req := httptest.NewRequest(http.MethodGet, "/admin/users", nil)
@@ -201,11 +287,11 @@ func TestAdminUsersPageAccessAndRoles(t *testing.T) {
if rec.Code != 200 {
t.Fatalf("admin list %d", rec.Code)
}
if !strings.Contains(rec.Body.String(), "bob") {
if !strings.Contains(rec.Body.String(), bobName) {
t.Fatal("missing bob on admin page")
}
bob, err := fake.UserByUsername(context.Background(), "bob")
bob, err := store.UserByUsername(context.Background(), db, bobName)
if err != nil {
t.Fatal(err)
}
@@ -221,13 +307,12 @@ func TestAdminUsersPageAccessAndRoles(t *testing.T) {
if rec.Code != http.StatusSeeOther {
t.Fatalf("promote %d %s", rec.Code, rec.Body.String())
}
bob, _ = fake.UserByUsername(context.Background(), "bob")
bob, _ = store.UserByUsername(context.Background(), db, bobName)
if !bob.Admin() {
t.Fatal("bob should be admin")
}
// Non-admin forbidden
bobCookies := registerUser(t, h, "carol", "hunter22")
bobCookies := registerUser(t, h, carolName, "hunter22")
rec = httptest.NewRecorder()
req = httptest.NewRequest(http.MethodGet, "/admin/users", nil)
for _, c := range bobCookies {
@@ -238,11 +323,7 @@ func TestAdminUsersPageAccessAndRoles(t *testing.T) {
t.Fatalf("non-admin expected 403, got %d", rec.Code)
}
// Demote last remaining admin after demoting bob first — leave only hub, then demote hub
hub, err := fake.UserByUsername(context.Background(), "hub")
if err != nil {
t.Fatal(err)
}
// Demote bob back to user
rec = httptest.NewRecorder()
req = httptest.NewRequest(http.MethodGet, "/admin/users", nil)
for _, c := range adminCookies {
@@ -262,6 +343,18 @@ func TestAdminUsersPageAccessAndRoles(t *testing.T) {
t.Fatalf("demote bob %d", rec.Code)
}
admins, err := store.CountAdmins(context.Background(), db)
if err != nil {
t.Fatal(err)
}
if admins != 1 {
t.Skip("shared database has other admins; last-admin demote not isolated")
}
hub, err := store.UserByUsername(context.Background(), db, hubName)
if err != nil {
t.Fatal(err)
}
rec = httptest.NewRecorder()
req = httptest.NewRequest(http.MethodGet, "/admin/users", nil)
for _, c := range adminCookies {
@@ -283,7 +376,7 @@ func TestAdminUsersPageAccessAndRoles(t *testing.T) {
if !strings.Contains(rec.Body.String(), "Cannot demote the last admin") {
t.Fatalf("missing last-admin error: %s", rec.Body.String())
}
hub, _ = fake.UserByUsername(context.Background(), "hub")
hub, _ = store.UserByUsername(context.Background(), db, hubName)
if !hub.Admin() {
t.Fatal("hub must remain admin")
}
@@ -303,9 +396,10 @@ func (f *fakeBlob) Upload(_ context.Context, obj blob.FileUpload) (string, error
}
func TestProfilePageAndState(t *testing.T) {
srv, fake, _ := newTestServer(t)
srv, db := newTestServer(t, Config{})
h := srv.Handler()
cookies := registerUser(t, h, "alice", "hunter22")
name := uniq("alice")
cookies := registerUser(t, h, name, "hunter22")
rec := httptest.NewRecorder()
req := httptest.NewRequest(http.MethodGet, "/profile", nil)
@@ -339,12 +433,11 @@ func TestProfilePageAndState(t *testing.T) {
if rec.Code != http.StatusSeeOther {
t.Fatalf("save profile %d %s", rec.Code, rec.Body.String())
}
u, err := fake.UserByUsername(context.Background(), "alice")
u, err := store.UserByUsername(context.Background(), db, name)
if err != nil || u.State != "CA" {
t.Fatalf("state not saved: %+v %v", u, err)
}
// invalid state
rec = httptest.NewRecorder()
req = httptest.NewRequest(http.MethodGet, "/profile", nil)
for _, c := range cookies {
@@ -370,27 +463,28 @@ func TestProfilePageAndState(t *testing.T) {
}
func TestProfileAdminAnsweredListAndAvatarUpload(t *testing.T) {
fake := newMemDB()
blob := &fakeBlob{}
sessions := scs.New()
srv, err := New(fake, sessions.Store, plumber.TemplateFS, plumber.StaticFS, Config{
AdminUsername: "hub",
Blob: blob,
})
if err != nil {
t.Fatal(err)
}
fb := &fakeBlob{}
srv, db := newTestServer(t, Config{Blob: fb})
h := srv.Handler()
adminCookies := registerUser(t, h, "hub", "hunter22")
userCookies := registerUser(t, h, "alice", "hunter22")
hubName := uniq("hub")
aliceName := uniq("alice")
hub := seedUser(t, db, hubName, "hunter22", store.RoleAdmin)
alice := seedUser(t, db, aliceName, "hunter22", store.RoleUser)
adminCookies := loginUser(t, h, hubName, "hunter22")
alice, _ := fake.UserByUsername(context.Background(), "alice")
hub, _ := fake.UserByUsername(context.Background(), "hub")
q, err := fake.CreateQuestion(context.Background(), alice.ID, "Drip", "Under sink", "Oakland")
if err != nil {
q := store.NewQuestion(db)
q.AuthorID = alice.ID
q.Title = "Drip"
q.Body = "Under sink"
q.City = "Oakland"
if err := q.Create(context.Background()); err != nil {
t.Fatal(err)
}
if err := fake.UpsertAnswer(context.Background(), q.ID, hub.ID, "Replace the cartridge."); err != nil {
ans := store.NewAnswer(db)
ans.QuestionID = q.ID
ans.AuthorID = hub.ID
ans.Body = "Replace the cartridge."
if err := ans.Upsert(context.Background()); err != nil {
t.Fatal(err)
}
@@ -429,14 +523,13 @@ func TestProfileAdminAnsweredListAndAvatarUpload(t *testing.T) {
if rec.Code != http.StatusSeeOther {
t.Fatalf("avatar upload %d %s", rec.Code, rec.Body.String())
}
if blob.calls != 1 {
t.Fatalf("expected 1 upload, got %d", blob.calls)
if fb.calls != 1 {
t.Fatalf("expected 1 upload, got %d", fb.calls)
}
hub, _ = fake.UserByUsername(context.Background(), "hub")
hub, _ = store.UserByUsername(context.Background(), db, hubName)
if !strings.Contains(hub.AvatarURL, "cdn.example.com/avatars/") {
t.Fatalf("avatar url %q", hub.AvatarURL)
}
_ = userCookies
}
func mergeCookies(sets ...[]*http.Cookie) []*http.Cookie {