codegirl007
8e954d60d8
CI / test (pull_request) Successful in 6m18s
Add authenticated post creation and body-only editing routes with root participation, hidden-thread, homeowner ownership, and admin authorship checks.
294 lines
9.0 KiB
Go
294 lines
9.0 KiB
Go
package web
|
|
|
|
import (
|
|
"context"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"net/url"
|
|
"strings"
|
|
"testing"
|
|
|
|
"plumber/internal/pacific"
|
|
"plumber/internal/store"
|
|
)
|
|
|
|
func TestCreatePostRoutePermissions(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
srv, mem := newTestServer(t, Config{})
|
|
handler := srv.Handler()
|
|
homeowner := seedUser(t, mem, uniq("homeowner"), "hunter22", store.RoleUser)
|
|
other := seedUser(t, mem, uniq("other"), "hunter22", store.RoleUser)
|
|
admin := seedUser(t, mem, uniq("admin"), "hunter22", store.RoleAdmin)
|
|
homeownerCookies := loginUser(t, handler, homeowner.Username, "hunter22")
|
|
otherCookies := loginUser(t, handler, other.Username, "hunter22")
|
|
adminCookies := loginUser(t, handler, admin.Username, "hunter22")
|
|
homeownerCSRF := csrfForCookies(t, handler, homeownerCookies)
|
|
otherCSRF := csrfForCookies(t, handler, otherCookies)
|
|
adminCSRF := csrfForCookies(t, handler, adminCookies)
|
|
|
|
rec := postForm(handler, "/posts", url.Values{
|
|
"title": {"No CSRF"},
|
|
"body": {"Body"},
|
|
}, homeownerCookies)
|
|
if rec.Code != http.StatusForbidden {
|
|
t.Fatalf("missing CSRF status = %d, want 403", rec.Code)
|
|
}
|
|
|
|
anonRec := httptest.NewRecorder()
|
|
handler.ServeHTTP(anonRec, httptest.NewRequest(http.MethodGet, "/login", nil))
|
|
anonCookies := anonRec.Result().Cookies()
|
|
anonCSRF := csrfFrom(anonRec.Body.String())
|
|
rec = postForm(handler, "/posts", url.Values{
|
|
"_csrf": {anonCSRF},
|
|
"title": {"Anonymous"},
|
|
"body": {"Body"},
|
|
}, anonCookies)
|
|
if rec.Code != http.StatusUnauthorized {
|
|
t.Fatalf("anonymous create status = %d, want 401", rec.Code)
|
|
}
|
|
|
|
rec = postForm(handler, "/posts", url.Values{
|
|
"_csrf": {homeownerCSRF},
|
|
"title": {"Leaky sink"},
|
|
"body": {"It drips."},
|
|
"city": {"Oakland"},
|
|
}, homeownerCookies)
|
|
if rec.Code != http.StatusSeeOther {
|
|
t.Fatalf("root create status = %d: %s", rec.Code, rec.Body.String())
|
|
}
|
|
roots, err := mem.ListRootPosts(context.Background(), pacific.Today(), homeowner.ID)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if len(roots) != 1 ||
|
|
roots[0].AuthorID != homeowner.ID ||
|
|
roots[0].Title != "Leaky sink" ||
|
|
roots[0].PostState != store.PostStateVisible {
|
|
t.Fatalf("created root = %+v", roots)
|
|
}
|
|
root := roots[0]
|
|
if got := rec.Header().Get("Location"); got != "/questions/"+root.ID+"#post-"+root.ID {
|
|
t.Fatalf("root redirect = %q", got)
|
|
}
|
|
|
|
rec = postForm(handler, "/posts", url.Values{
|
|
"_csrf": {homeownerCSRF},
|
|
"parent_id": {root.ID},
|
|
"body": {"The model is 123."},
|
|
}, homeownerCookies)
|
|
if rec.Code != http.StatusSeeOther {
|
|
t.Fatalf("homeowner reply status = %d: %s", rec.Code, rec.Body.String())
|
|
}
|
|
thread, err := mem.GetPostThread(context.Background(), root.ID)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if len(thread.Replies) != 1 || thread.Replies[0].AuthorID != homeowner.ID {
|
|
t.Fatalf("homeowner reply missing: %+v", thread)
|
|
}
|
|
homeownerReply := thread.Replies[0]
|
|
|
|
rec = postForm(handler, "/posts", url.Values{
|
|
"_csrf": {adminCSRF},
|
|
"parent_id": {homeownerReply.ID},
|
|
"body": {"Replace the cartridge."},
|
|
}, adminCookies)
|
|
if rec.Code != http.StatusSeeOther {
|
|
t.Fatalf("admin nested reply status = %d: %s", rec.Code, rec.Body.String())
|
|
}
|
|
thread, err = mem.GetPostThread(context.Background(), root.ID)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if len(thread.Replies[0].Replies) != 1 ||
|
|
thread.Replies[0].Replies[0].AuthorID != admin.ID {
|
|
t.Fatalf("admin nested reply missing: %+v", thread)
|
|
}
|
|
|
|
rec = postForm(handler, "/posts", url.Values{
|
|
"_csrf": {otherCSRF},
|
|
"parent_id": {homeownerReply.ID},
|
|
"body": {"I should not be here."},
|
|
}, otherCookies)
|
|
if rec.Code != http.StatusForbidden {
|
|
t.Fatalf("unrelated reply status = %d, want 403", rec.Code)
|
|
}
|
|
|
|
rec = postForm(handler, "/posts", url.Values{
|
|
"_csrf": {homeownerCSRF},
|
|
"parent_id": {"missing"},
|
|
"body": {"Missing parent"},
|
|
}, homeownerCookies)
|
|
if rec.Code != http.StatusNotFound {
|
|
t.Fatalf("missing-parent reply status = %d, want 404", rec.Code)
|
|
}
|
|
|
|
hidden := &store.Post{
|
|
AuthorID: homeowner.ID,
|
|
Title: "Hidden thread",
|
|
Body: "Body",
|
|
PostDate: pacific.Today(),
|
|
PostState: store.PostStateHidden,
|
|
}
|
|
if err := mem.CreatePost(context.Background(), hidden); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
rec = postForm(handler, "/posts", url.Values{
|
|
"_csrf": {homeownerCSRF},
|
|
"parent_id": {hidden.ID},
|
|
"body": {"Hidden reply"},
|
|
}, homeownerCookies)
|
|
if rec.Code != http.StatusNotFound {
|
|
t.Fatalf("hidden-thread reply status = %d, want 404", rec.Code)
|
|
}
|
|
}
|
|
|
|
func TestEditPostRoutePermissions(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
srv, mem := newTestServer(t, Config{})
|
|
handler := srv.Handler()
|
|
homeowner := seedUser(t, mem, uniq("homeowner"), "hunter22", store.RoleUser)
|
|
other := seedUser(t, mem, uniq("other"), "hunter22", store.RoleUser)
|
|
admin := seedUser(t, mem, uniq("admin"), "hunter22", store.RoleAdmin)
|
|
secondAdmin := seedUser(t, mem, uniq("admin"), "hunter22", store.RoleAdmin)
|
|
if err := mem.SetUserRole(context.Background(), secondAdmin.ID, store.RoleAdmin); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
homeownerCookies := loginUser(t, handler, homeowner.Username, "hunter22")
|
|
otherCookies := loginUser(t, handler, other.Username, "hunter22")
|
|
adminCookies := loginUser(t, handler, admin.Username, "hunter22")
|
|
secondAdminCookies := loginUser(t, handler, secondAdmin.Username, "hunter22")
|
|
homeownerCSRF := csrfForCookies(t, handler, homeownerCookies)
|
|
otherCSRF := csrfForCookies(t, handler, otherCookies)
|
|
adminCSRF := csrfForCookies(t, handler, adminCookies)
|
|
secondAdminCSRF := csrfForCookies(t, handler, secondAdminCookies)
|
|
|
|
root := &store.Post{
|
|
AuthorID: homeowner.ID,
|
|
Title: "Leaky sink",
|
|
Body: "Original body",
|
|
PostDate: pacific.Today(),
|
|
}
|
|
if err := mem.CreatePost(context.Background(), root); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
rootID := root.ID
|
|
adminReply := &store.Post{
|
|
ParentID: &rootID,
|
|
AuthorID: admin.ID,
|
|
Body: "Original answer",
|
|
}
|
|
if err := mem.CreatePost(context.Background(), adminReply); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
anonRec := httptest.NewRecorder()
|
|
handler.ServeHTTP(anonRec, httptest.NewRequest(http.MethodGet, "/login", nil))
|
|
rec := postForm(handler, "/posts/"+root.ID+"/edit", url.Values{
|
|
"_csrf": {csrfFrom(anonRec.Body.String())},
|
|
"body": {"Anonymous edit"},
|
|
}, anonRec.Result().Cookies())
|
|
if rec.Code != http.StatusUnauthorized {
|
|
t.Fatalf("anonymous edit status = %d, want 401", rec.Code)
|
|
}
|
|
|
|
rec = postForm(handler, "/posts/"+root.ID+"/edit", url.Values{
|
|
"_csrf": {homeownerCSRF},
|
|
"body": {"Updated homeowner body"},
|
|
"parent_id": {adminReply.ID},
|
|
"author_id": {other.ID},
|
|
}, homeownerCookies)
|
|
if rec.Code != http.StatusSeeOther {
|
|
t.Fatalf("homeowner edit status = %d: %s", rec.Code, rec.Body.String())
|
|
}
|
|
saved, err := mem.GetPost(context.Background(), root.ID)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if saved.Body != "Updated homeowner body" ||
|
|
saved.ParentID != nil ||
|
|
saved.AuthorID != homeowner.ID {
|
|
t.Fatalf("homeowner edit changed immutable fields: %+v", saved)
|
|
}
|
|
|
|
for name, session := range map[string]struct {
|
|
cookies []*http.Cookie
|
|
csrf string
|
|
}{
|
|
"other homeowner": {otherCookies, otherCSRF},
|
|
"admin": {adminCookies, adminCSRF},
|
|
} {
|
|
t.Run(name+" cannot edit homeowner post", func(t *testing.T) {
|
|
rec := postForm(handler, "/posts/"+root.ID+"/edit", url.Values{
|
|
"_csrf": {session.csrf},
|
|
"body": {"Unauthorized edit"},
|
|
}, session.cookies)
|
|
if rec.Code != http.StatusForbidden {
|
|
t.Fatalf("status = %d, want 403", rec.Code)
|
|
}
|
|
})
|
|
}
|
|
|
|
rec = postForm(handler, "/posts/"+adminReply.ID+"/edit", url.Values{
|
|
"_csrf": {homeownerCSRF},
|
|
"body": {"Homeowner edit"},
|
|
}, homeownerCookies)
|
|
if rec.Code != http.StatusForbidden {
|
|
t.Fatalf("homeowner editing admin post status = %d, want 403", rec.Code)
|
|
}
|
|
|
|
rec = postForm(handler, "/posts/"+adminReply.ID+"/edit", url.Values{
|
|
"_csrf": {secondAdminCSRF},
|
|
"body": {"Updated admin answer"},
|
|
}, secondAdminCookies)
|
|
if rec.Code != http.StatusSeeOther {
|
|
t.Fatalf("admin edit status = %d: %s", rec.Code, rec.Body.String())
|
|
}
|
|
saved, err = mem.GetPost(context.Background(), adminReply.ID)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if saved.Body != "Updated admin answer" ||
|
|
saved.ParentID == nil ||
|
|
*saved.ParentID != root.ID ||
|
|
saved.AuthorID != admin.ID {
|
|
t.Fatalf("admin edit changed immutable fields: %+v", saved)
|
|
}
|
|
}
|
|
|
|
func csrfForCookies(t *testing.T, handler http.Handler, cookies []*http.Cookie) string {
|
|
t.Helper()
|
|
req := httptest.NewRequest(http.MethodGet, "/submit", nil)
|
|
for _, cookie := range cookies {
|
|
req.AddCookie(cookie)
|
|
}
|
|
rec := httptest.NewRecorder()
|
|
handler.ServeHTTP(rec, req)
|
|
if rec.Code != http.StatusOK {
|
|
t.Fatalf("load CSRF form status = %d", rec.Code)
|
|
}
|
|
csrf := csrfFrom(rec.Body.String())
|
|
if csrf == "" {
|
|
t.Fatal("CSRF token missing")
|
|
}
|
|
return csrf
|
|
}
|
|
|
|
func postForm(
|
|
handler http.Handler,
|
|
path string,
|
|
values url.Values,
|
|
cookies []*http.Cookie,
|
|
) *httptest.ResponseRecorder {
|
|
req := httptest.NewRequest(http.MethodPost, path, strings.NewReader(values.Encode()))
|
|
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
|
for _, cookie := range cookies {
|
|
req.AddCookie(cookie)
|
|
}
|
|
rec := httptest.NewRecorder()
|
|
handler.ServeHTTP(rec, req)
|
|
return rec
|
|
}
|