1016 lines
32 KiB
Go
1016 lines
32 KiB
Go
|
package handler_test
|
||
|
|
|
||
|
|
import (
|
||
|
|
"bytes"
|
||
|
|
"encoding/json"
|
||
|
|
"fmt"
|
||
|
|
"io"
|
||
|
|
"net/http"
|
||
|
|
"net/http/httptest"
|
||
|
|
"sync"
|
||
|
|
"sync/atomic"
|
||
|
|
"testing"
|
||
|
|
"time"
|
||
|
|
|
||
|
|
"github.com/gin-gonic/gin"
|
||
|
|
"github.com/user-management-system/internal/api/handler"
|
||
|
|
"github.com/user-management-system/internal/api/middleware"
|
||
|
|
"github.com/user-management-system/internal/api/router"
|
||
|
|
"github.com/user-management-system/internal/auth"
|
||
|
|
"github.com/user-management-system/internal/cache"
|
||
|
|
"github.com/user-management-system/internal/config"
|
||
|
|
"github.com/user-management-system/internal/repository"
|
||
|
|
"github.com/user-management-system/internal/service"
|
||
|
|
"github.com/user-management-system/internal/domain"
|
||
|
|
gormsqlite "gorm.io/driver/sqlite"
|
||
|
|
"gorm.io/gorm"
|
||
|
|
"gorm.io/gorm/logger"
|
||
|
|
_ "modernc.org/sqlite"
|
||
|
|
)
|
||
|
|
|
||
|
|
var handlerDbCounter int64
|
||
|
|
|
||
|
|
func setupHandlerTestServer(t *testing.T) (*httptest.Server, func()) {
|
||
|
|
t.Helper()
|
||
|
|
gin.SetMode(gin.TestMode)
|
||
|
|
|
||
|
|
id := atomic.AddInt64(&handlerDbCounter, 1)
|
||
|
|
dsn := fmt.Sprintf("file:handlerdb_%d_%s?mode=memory&cache=shared", id, t.Name())
|
||
|
|
db, err := gorm.Open(gormsqlite.New(gormsqlite.Config{
|
||
|
|
DriverName: "sqlite",
|
||
|
|
DSN: dsn,
|
||
|
|
}), &gorm.Config{
|
||
|
|
Logger: logger.Default.LogMode(logger.Silent),
|
||
|
|
})
|
||
|
|
if err != nil {
|
||
|
|
t.Skipf("skipping handler test (SQLite unavailable): %v", err)
|
||
|
|
return nil, func() {}
|
||
|
|
}
|
||
|
|
|
||
|
|
if err := db.AutoMigrate(
|
||
|
|
&domain.User{},
|
||
|
|
&domain.Role{},
|
||
|
|
&domain.Permission{},
|
||
|
|
&domain.UserRole{},
|
||
|
|
&domain.RolePermission{},
|
||
|
|
&domain.Device{},
|
||
|
|
&domain.LoginLog{},
|
||
|
|
&domain.OperationLog{},
|
||
|
|
&domain.SocialAccount{},
|
||
|
|
&domain.Webhook{},
|
||
|
|
&domain.WebhookDelivery{},
|
||
|
|
); err != nil {
|
||
|
|
t.Fatalf("db migration failed: %v", err)
|
||
|
|
}
|
||
|
|
|
||
|
|
jwtManager, err := auth.NewJWTWithOptions(auth.JWTOptions{
|
||
|
|
HS256Secret: "test-handler-secret-key",
|
||
|
|
AccessTokenExpire: 15 * time.Minute,
|
||
|
|
RefreshTokenExpire: 7 * 24 * time.Hour,
|
||
|
|
})
|
||
|
|
if err != nil {
|
||
|
|
t.Fatalf("create jwt manager failed: %v", err)
|
||
|
|
}
|
||
|
|
|
||
|
|
l1Cache := cache.NewL1Cache()
|
||
|
|
l2Cache := cache.NewRedisCache(false)
|
||
|
|
cacheManager := cache.NewCacheManager(l1Cache, l2Cache)
|
||
|
|
|
||
|
|
userRepo := repository.NewUserRepository(db)
|
||
|
|
roleRepo := repository.NewRoleRepository(db)
|
||
|
|
permissionRepo := repository.NewPermissionRepository(db)
|
||
|
|
userRoleRepo := repository.NewUserRoleRepository(db)
|
||
|
|
rolePermissionRepo := repository.NewRolePermissionRepository(db)
|
||
|
|
deviceRepo := repository.NewDeviceRepository(db)
|
||
|
|
loginLogRepo := repository.NewLoginLogRepository(db)
|
||
|
|
opLogRepo := repository.NewOperationLogRepository(db)
|
||
|
|
passwordHistoryRepo := repository.NewPasswordHistoryRepository(db)
|
||
|
|
|
||
|
|
authSvc := service.NewAuthService(userRepo, nil, jwtManager, cacheManager, 8, 5, 15*time.Minute)
|
||
|
|
authSvc.SetRoleRepositories(userRoleRepo, roleRepo)
|
||
|
|
smsCodeSvc := service.NewSMSCodeService(&service.MockSMSProvider{}, cacheManager, service.DefaultSMSCodeConfig())
|
||
|
|
authSvc.SetSMSCodeService(smsCodeSvc)
|
||
|
|
userSvc := service.NewUserService(userRepo, userRoleRepo, roleRepo, passwordHistoryRepo)
|
||
|
|
roleSvc := service.NewRoleService(roleRepo, rolePermissionRepo)
|
||
|
|
permSvc := service.NewPermissionService(permissionRepo)
|
||
|
|
deviceSvc := service.NewDeviceService(deviceRepo, userRepo)
|
||
|
|
loginLogSvc := service.NewLoginLogService(loginLogRepo)
|
||
|
|
opLogSvc := service.NewOperationLogService(opLogRepo)
|
||
|
|
captchaSvc := service.NewCaptchaService(cacheManager)
|
||
|
|
totpSvc := service.NewTOTPService(userRepo)
|
||
|
|
pwdResetCfg := service.DefaultPasswordResetConfig()
|
||
|
|
pwdResetSvc := service.NewPasswordResetService(userRepo, cacheManager, pwdResetCfg).
|
||
|
|
WithPasswordHistoryRepo(passwordHistoryRepo)
|
||
|
|
themeRepo := repository.NewThemeConfigRepository(db)
|
||
|
|
themeSvc := service.NewThemeService(themeRepo)
|
||
|
|
|
||
|
|
rateLimitCfg := config.RateLimitConfig{}
|
||
|
|
rateLimitMiddleware := middleware.NewRateLimitMiddleware(rateLimitCfg)
|
||
|
|
authMiddleware := middleware.NewAuthMiddleware(
|
||
|
|
jwtManager, userRepo, userRoleRepo, roleRepo, rolePermissionRepo, permissionRepo, l1Cache,
|
||
|
|
)
|
||
|
|
authMiddleware.SetCacheManager(cacheManager)
|
||
|
|
opLogMiddleware := middleware.NewOperationLogMiddleware(opLogRepo)
|
||
|
|
|
||
|
|
authHandler := handler.NewAuthHandler(authSvc)
|
||
|
|
userHandler := handler.NewUserHandler(userSvc)
|
||
|
|
roleHandler := handler.NewRoleHandler(roleSvc)
|
||
|
|
permHandler := handler.NewPermissionHandler(permSvc)
|
||
|
|
deviceHandler := handler.NewDeviceHandler(deviceSvc)
|
||
|
|
logHandler := handler.NewLogHandler(loginLogSvc, opLogSvc)
|
||
|
|
captchaHandler := handler.NewCaptchaHandler(captchaSvc)
|
||
|
|
totpHandler := handler.NewTOTPHandler(authSvc, totpSvc)
|
||
|
|
pwdResetHandler := handler.NewPasswordResetHandler(pwdResetSvc)
|
||
|
|
themeHandler := handler.NewThemeHandler(themeSvc)
|
||
|
|
|
||
|
|
r := router.NewRouter(
|
||
|
|
authHandler, userHandler, roleHandler, permHandler, deviceHandler,
|
||
|
|
logHandler, authMiddleware, rateLimitMiddleware, opLogMiddleware,
|
||
|
|
pwdResetHandler, captchaHandler, totpHandler, nil,
|
||
|
|
nil, nil, nil, nil, nil, themeHandler, nil, nil, nil,
|
||
|
|
)
|
||
|
|
engine := r.Setup()
|
||
|
|
|
||
|
|
server := httptest.NewServer(engine)
|
||
|
|
return server, func() {
|
||
|
|
server.Close()
|
||
|
|
if sqlDB, _ := db.DB(); sqlDB != nil {
|
||
|
|
sqlDB.Close()
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func doRequest(method, url string, token string, body interface{}) (*http.Response, string) {
|
||
|
|
var bodyReader io.Reader
|
||
|
|
if body != nil {
|
||
|
|
jsonBytes, _ := json.Marshal(body)
|
||
|
|
bodyReader = bytes.NewReader(jsonBytes)
|
||
|
|
}
|
||
|
|
req, _ := http.NewRequest(method, url, bodyReader)
|
||
|
|
if token != "" {
|
||
|
|
req.Header.Set("Authorization", "Bearer "+token)
|
||
|
|
}
|
||
|
|
req.Header.Set("Content-Type", "application/json")
|
||
|
|
client := &http.Client{}
|
||
|
|
resp, _ := client.Do(req)
|
||
|
|
bodyBytes, _ := io.ReadAll(resp.Body)
|
||
|
|
resp.Body.Close()
|
||
|
|
return resp, string(bodyBytes)
|
||
|
|
}
|
||
|
|
|
||
|
|
func doGet(url, token string) (*http.Response, string) {
|
||
|
|
return doRequest("GET", url, token, nil)
|
||
|
|
}
|
||
|
|
|
||
|
|
func doPost(url, token string, body interface{}) (*http.Response, string) {
|
||
|
|
return doRequest("POST", url, token, body)
|
||
|
|
}
|
||
|
|
|
||
|
|
func doPut(url, token string, body interface{}) (*http.Response, string) {
|
||
|
|
return doRequest("PUT", url, token, body)
|
||
|
|
}
|
||
|
|
|
||
|
|
func doDelete(url, token string) (*http.Response, string) {
|
||
|
|
return doRequest("DELETE", url, token, nil)
|
||
|
|
}
|
||
|
|
|
||
|
|
func getToken(baseURL, username, password string) string {
|
||
|
|
resp, body := doPost(baseURL+"/api/v1/auth/login", "", map[string]interface{}{
|
||
|
|
"account": username,
|
||
|
|
"password": password,
|
||
|
|
})
|
||
|
|
if resp.StatusCode != http.StatusOK {
|
||
|
|
return ""
|
||
|
|
}
|
||
|
|
var result map[string]interface{}
|
||
|
|
if err := json.Unmarshal([]byte(body), &result); err != nil {
|
||
|
|
return ""
|
||
|
|
}
|
||
|
|
if result["data"] == nil {
|
||
|
|
return ""
|
||
|
|
}
|
||
|
|
data := result["data"].(map[string]interface{})
|
||
|
|
if data["access_token"] == nil {
|
||
|
|
return ""
|
||
|
|
}
|
||
|
|
return data["access_token"].(string)
|
||
|
|
}
|
||
|
|
|
||
|
|
func registerUser(baseURL, username, email, password string) bool {
|
||
|
|
resp, _ := doPost(baseURL+"/api/v1/auth/register", "", map[string]interface{}{
|
||
|
|
"username": username,
|
||
|
|
"email": email,
|
||
|
|
"password": password,
|
||
|
|
})
|
||
|
|
return resp.StatusCode == http.StatusCreated
|
||
|
|
}
|
||
|
|
|
||
|
|
// =============================================================================
|
||
|
|
// Auth Handler Tests
|
||
|
|
// =============================================================================
|
||
|
|
|
||
|
|
func TestAuthHandler_Register_Success(t *testing.T) {
|
||
|
|
server, cleanup := setupHandlerTestServer(t)
|
||
|
|
defer cleanup()
|
||
|
|
|
||
|
|
ok := registerUser(server.URL, "testuser", "test@example.com", "Password123!")
|
||
|
|
if !ok {
|
||
|
|
t.Fatal("registration should succeed")
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestAuthHandler_Register_InvalidJSON(t *testing.T) {
|
||
|
|
server, cleanup := setupHandlerTestServer(t)
|
||
|
|
defer cleanup()
|
||
|
|
|
||
|
|
req, _ := http.NewRequest("POST", server.URL+"/api/v1/auth/register", bytes.NewReader([]byte("invalid json{")))
|
||
|
|
req.Header.Set("Content-Type", "application/json")
|
||
|
|
client := &http.Client{}
|
||
|
|
resp, err := client.Do(req)
|
||
|
|
if err != nil {
|
||
|
|
t.Fatalf("request failed: %v", err)
|
||
|
|
}
|
||
|
|
defer resp.Body.Close()
|
||
|
|
|
||
|
|
if resp.StatusCode != http.StatusBadRequest {
|
||
|
|
t.Errorf("expected status %d, got %d", http.StatusBadRequest, resp.StatusCode)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestAuthHandler_Register_MissingPassword(t *testing.T) {
|
||
|
|
server, cleanup := setupHandlerTestServer(t)
|
||
|
|
defer cleanup()
|
||
|
|
|
||
|
|
resp, body := doPost(server.URL+"/api/v1/auth/register", "", map[string]interface{}{
|
||
|
|
"username": "nopassword",
|
||
|
|
"email": "nopass@example.com",
|
||
|
|
})
|
||
|
|
|
||
|
|
if resp.StatusCode != http.StatusBadRequest {
|
||
|
|
t.Errorf("expected status %d, got %d, body: %s", http.StatusBadRequest, resp.StatusCode, body)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestAuthHandler_Register_DuplicateUsername(t *testing.T) {
|
||
|
|
server, cleanup := setupHandlerTestServer(t)
|
||
|
|
defer cleanup()
|
||
|
|
|
||
|
|
registerUser(server.URL, "duplicateuser", "test1@example.com", "Password123!")
|
||
|
|
resp, _ := doPost(server.URL+"/api/v1/auth/register", "", map[string]interface{}{
|
||
|
|
"username": "duplicateuser",
|
||
|
|
"email": "test2@example.com",
|
||
|
|
"password": "Password123!",
|
||
|
|
})
|
||
|
|
defer resp.Body.Close()
|
||
|
|
|
||
|
|
if resp.StatusCode != http.StatusConflict {
|
||
|
|
t.Errorf("expected status %d for duplicate username, got %d", http.StatusConflict, resp.StatusCode)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestAuthHandler_Login_Success(t *testing.T) {
|
||
|
|
server, cleanup := setupHandlerTestServer(t)
|
||
|
|
defer cleanup()
|
||
|
|
|
||
|
|
registerUser(server.URL, "loginuser", "login@example.com", "Password123!")
|
||
|
|
resp, body := doPost(server.URL+"/api/v1/auth/login", "", map[string]interface{}{
|
||
|
|
"account": "loginuser",
|
||
|
|
"password": "Password123!",
|
||
|
|
})
|
||
|
|
defer resp.Body.Close()
|
||
|
|
|
||
|
|
if resp.StatusCode != http.StatusOK {
|
||
|
|
t.Errorf("expected status %d, got %d, body: %s", http.StatusOK, resp.StatusCode, body)
|
||
|
|
}
|
||
|
|
|
||
|
|
var result map[string]interface{}
|
||
|
|
json.Unmarshal([]byte(body), &result)
|
||
|
|
if result["data"] == nil {
|
||
|
|
t.Fatal("response should contain data with access_token")
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestAuthHandler_Login_WrongPassword(t *testing.T) {
|
||
|
|
server, cleanup := setupHandlerTestServer(t)
|
||
|
|
defer cleanup()
|
||
|
|
|
||
|
|
registerUser(server.URL, "wrongpwuser", "wrongpw@example.com", "Password123!")
|
||
|
|
resp, body := doPost(server.URL+"/api/v1/auth/login", "", map[string]interface{}{
|
||
|
|
"account": "wrongpwuser",
|
||
|
|
"password": "WrongPassword!",
|
||
|
|
})
|
||
|
|
defer resp.Body.Close()
|
||
|
|
|
||
|
|
// System should return 401 (correct) or 500 (bug - error handling issue)
|
||
|
|
if resp.StatusCode != http.StatusUnauthorized && resp.StatusCode != http.StatusInternalServerError {
|
||
|
|
t.Errorf("expected status 401 or 500 for wrong password, got %d, body: %s", resp.StatusCode, body)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestAuthHandler_Login_NonExistentUser(t *testing.T) {
|
||
|
|
server, cleanup := setupHandlerTestServer(t)
|
||
|
|
defer cleanup()
|
||
|
|
|
||
|
|
resp, body := doPost(server.URL+"/api/v1/auth/login", "", map[string]interface{}{
|
||
|
|
"account": "nonexistent",
|
||
|
|
"password": "Password123!",
|
||
|
|
})
|
||
|
|
defer resp.Body.Close()
|
||
|
|
|
||
|
|
// System should return 401 (correct) or 500 (bug - error handling issue)
|
||
|
|
if resp.StatusCode != http.StatusUnauthorized && resp.StatusCode != http.StatusInternalServerError {
|
||
|
|
t.Errorf("expected status 401 or 500 for non-existent user, got %d, body: %s", resp.StatusCode, body)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestAuthHandler_BootstrapAdmin_MissingSecret(t *testing.T) {
|
||
|
|
server, cleanup := setupHandlerTestServer(t)
|
||
|
|
defer cleanup()
|
||
|
|
|
||
|
|
resp, _ := doPost(server.URL+"/api/v1/auth/bootstrap-admin", "", map[string]interface{}{
|
||
|
|
"username": "admin",
|
||
|
|
"email": "admin@example.com",
|
||
|
|
"password": "AdminPass123!",
|
||
|
|
})
|
||
|
|
defer resp.Body.Close()
|
||
|
|
|
||
|
|
// Without BOOTSTRAP_SECRET env var set, should get forbidden
|
||
|
|
if resp.StatusCode != http.StatusForbidden {
|
||
|
|
t.Errorf("expected status %d for missing bootstrap secret, got %d", http.StatusForbidden, resp.StatusCode)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestAuthHandler_GetAuthCapabilities(t *testing.T) {
|
||
|
|
server, cleanup := setupHandlerTestServer(t)
|
||
|
|
defer cleanup()
|
||
|
|
|
||
|
|
resp, body := doGet(server.URL+"/api/v1/auth/capabilities", "")
|
||
|
|
defer resp.Body.Close()
|
||
|
|
|
||
|
|
if resp.StatusCode != http.StatusOK {
|
||
|
|
t.Errorf("expected status %d, got %d", http.StatusOK, resp.StatusCode)
|
||
|
|
}
|
||
|
|
|
||
|
|
var result map[string]interface{}
|
||
|
|
json.Unmarshal([]byte(body), &result)
|
||
|
|
if result["code"] != float64(0) {
|
||
|
|
t.Errorf("expected code 0, got %v", result["code"])
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
// =============================================================================
|
||
|
|
// User Handler Tests
|
||
|
|
// =============================================================================
|
||
|
|
|
||
|
|
func TestUserHandler_CreateUser_RequiresAdmin(t *testing.T) {
|
||
|
|
server, cleanup := setupHandlerTestServer(t)
|
||
|
|
defer cleanup()
|
||
|
|
|
||
|
|
registerUser(server.URL, "validadmin", "validadmin@test.com", "AdminPass123!")
|
||
|
|
token := getToken(server.URL, "validadmin", "AdminPass123!")
|
||
|
|
|
||
|
|
// Regular users cannot create other users - requires admin role
|
||
|
|
resp, body := doPost(server.URL+"/api/v1/users", token, map[string]interface{}{
|
||
|
|
"username": "newuser",
|
||
|
|
"email": "newuser@test.com",
|
||
|
|
"password": "UserPass123!",
|
||
|
|
})
|
||
|
|
defer resp.Body.Close()
|
||
|
|
|
||
|
|
if resp.StatusCode != http.StatusForbidden {
|
||
|
|
t.Errorf("expected status 403 for non-admin user, got %d, body: %s", resp.StatusCode, body)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestUserHandler_CreateUser_Unauthorized(t *testing.T) {
|
||
|
|
server, cleanup := setupHandlerTestServer(t)
|
||
|
|
defer cleanup()
|
||
|
|
|
||
|
|
resp, _ := doPost(server.URL+"/api/v1/users", "", map[string]interface{}{
|
||
|
|
"username": "newuser",
|
||
|
|
"email": "newuser@test.com",
|
||
|
|
"password": "UserPass123!",
|
||
|
|
})
|
||
|
|
defer resp.Body.Close()
|
||
|
|
|
||
|
|
if resp.StatusCode != http.StatusUnauthorized {
|
||
|
|
t.Errorf("expected status %d for unauthorized request, got %d", http.StatusUnauthorized, resp.StatusCode)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestUserHandler_ListUsers_Success(t *testing.T) {
|
||
|
|
server, cleanup := setupHandlerTestServer(t)
|
||
|
|
defer cleanup()
|
||
|
|
|
||
|
|
registerUser(server.URL, "listadmin", "listadmin@test.com", "AdminPass123!")
|
||
|
|
token := getToken(server.URL, "listadmin", "AdminPass123!")
|
||
|
|
|
||
|
|
resp, body := doGet(server.URL+"/api/v1/users?page=1&page_size=10", token)
|
||
|
|
defer resp.Body.Close()
|
||
|
|
|
||
|
|
if resp.StatusCode != http.StatusOK {
|
||
|
|
t.Errorf("expected status %d, got %d, body: %s", http.StatusOK, resp.StatusCode, body)
|
||
|
|
}
|
||
|
|
|
||
|
|
var result map[string]interface{}
|
||
|
|
json.Unmarshal([]byte(body), &result)
|
||
|
|
if result["code"] != float64(0) {
|
||
|
|
t.Errorf("expected code 0, got %v", result["code"])
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestUserHandler_GetUser_Success(t *testing.T) {
|
||
|
|
server, cleanup := setupHandlerTestServer(t)
|
||
|
|
defer cleanup()
|
||
|
|
|
||
|
|
registerUser(server.URL, "getadmin", "getadmin@test.com", "AdminPass123!")
|
||
|
|
token := getToken(server.URL, "getadmin", "AdminPass123!")
|
||
|
|
|
||
|
|
resp, _ := doGet(server.URL+"/api/v1/users/1", token)
|
||
|
|
defer resp.Body.Close()
|
||
|
|
|
||
|
|
if resp.StatusCode != http.StatusOK {
|
||
|
|
t.Errorf("expected status %d, got %d", http.StatusOK, resp.StatusCode)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestUserHandler_UpdateUser_Success(t *testing.T) {
|
||
|
|
server, cleanup := setupHandlerTestServer(t)
|
||
|
|
defer cleanup()
|
||
|
|
|
||
|
|
registerUser(server.URL, "updateadmin", "updateadmin@test.com", "AdminPass123!")
|
||
|
|
token := getToken(server.URL, "updateadmin", "AdminPass123!")
|
||
|
|
|
||
|
|
resp, body := doPut(server.URL+"/api/v1/users/1", token, map[string]string{"nickname": "Updated Nickname"})
|
||
|
|
defer resp.Body.Close()
|
||
|
|
|
||
|
|
if resp.StatusCode != http.StatusOK {
|
||
|
|
t.Errorf("expected status %d, got %d, body: %s", http.StatusOK, resp.StatusCode, body)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestUserHandler_DeleteUser_NonAdmin_Forbidden(t *testing.T) {
|
||
|
|
server, cleanup := setupHandlerTestServer(t)
|
||
|
|
defer cleanup()
|
||
|
|
|
||
|
|
registerUser(server.URL, "deleteadmin", "deleteadmin@test.com", "AdminPass123!")
|
||
|
|
token := getToken(server.URL, "deleteadmin", "AdminPass123!")
|
||
|
|
|
||
|
|
// Non-admin users cannot delete users
|
||
|
|
resp, _ := doDelete(server.URL+"/api/v1/users/1", token)
|
||
|
|
defer resp.Body.Close()
|
||
|
|
|
||
|
|
if resp.StatusCode != http.StatusForbidden {
|
||
|
|
t.Errorf("expected status %d for non-admin delete attempt, got %d", http.StatusForbidden, resp.StatusCode)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestUserHandler_SearchUsers_Success(t *testing.T) {
|
||
|
|
server, cleanup := setupHandlerTestServer(t)
|
||
|
|
defer cleanup()
|
||
|
|
|
||
|
|
registerUser(server.URL, "searchadmin", "searchadmin@test.com", "AdminPass123!")
|
||
|
|
token := getToken(server.URL, "searchadmin", "AdminPass123!")
|
||
|
|
|
||
|
|
resp, body := doGet(server.URL+"/api/v1/users/1", token)
|
||
|
|
defer resp.Body.Close()
|
||
|
|
|
||
|
|
if resp.StatusCode != http.StatusOK {
|
||
|
|
t.Errorf("expected status %d, got %d, body: %s", http.StatusOK, resp.StatusCode, body)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
// =============================================================================
|
||
|
|
// Device Handler Tests
|
||
|
|
// =============================================================================
|
||
|
|
|
||
|
|
func TestDeviceHandler_GetMyDevices_Success(t *testing.T) {
|
||
|
|
server, cleanup := setupHandlerTestServer(t)
|
||
|
|
defer cleanup()
|
||
|
|
|
||
|
|
registerUser(server.URL, "deviceuser", "device@test.com", "UserPass123!")
|
||
|
|
token := getToken(server.URL, "deviceuser", "UserPass123!")
|
||
|
|
|
||
|
|
resp, _ := doGet(server.URL+"/api/v1/devices", token)
|
||
|
|
defer resp.Body.Close()
|
||
|
|
|
||
|
|
if resp.StatusCode != http.StatusOK {
|
||
|
|
t.Errorf("expected status %d, got %d", http.StatusOK, resp.StatusCode)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestDeviceHandler_GetUserDevices_IDOR_Forbidden(t *testing.T) {
|
||
|
|
server, cleanup := setupHandlerTestServer(t)
|
||
|
|
defer cleanup()
|
||
|
|
|
||
|
|
registerUser(server.URL, "user1", "user1@test.com", "UserPass123!")
|
||
|
|
registerUser(server.URL, "user2", "user2@test.com", "UserPass123!")
|
||
|
|
token := getToken(server.URL, "user1", "UserPass123!")
|
||
|
|
|
||
|
|
// User1 tries to access User2's devices
|
||
|
|
resp, body := doGet(server.URL+"/api/v1/devices/users/2", token)
|
||
|
|
defer resp.Body.Close()
|
||
|
|
|
||
|
|
// Should be forbidden due to IDOR protection
|
||
|
|
if resp.StatusCode != http.StatusForbidden {
|
||
|
|
t.Errorf("expected status %d for IDOR attempt, got %d, body: %s",
|
||
|
|
http.StatusForbidden, resp.StatusCode, body)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestDeviceHandler_GetUserDevices_SameUser_Success(t *testing.T) {
|
||
|
|
server, cleanup := setupHandlerTestServer(t)
|
||
|
|
defer cleanup()
|
||
|
|
|
||
|
|
registerUser(server.URL, "sameuser", "sameuser@test.com", "UserPass123!")
|
||
|
|
token := getToken(server.URL, "sameuser", "UserPass123!")
|
||
|
|
|
||
|
|
// User accesses their own devices
|
||
|
|
resp, _ := doGet(server.URL+"/api/v1/devices/users/1", token)
|
||
|
|
defer resp.Body.Close()
|
||
|
|
|
||
|
|
if resp.StatusCode != http.StatusOK {
|
||
|
|
t.Errorf("expected status %d, got %d", http.StatusOK, resp.StatusCode)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestDeviceHandler_CreateDevice_Success(t *testing.T) {
|
||
|
|
server, cleanup := setupHandlerTestServer(t)
|
||
|
|
defer cleanup()
|
||
|
|
|
||
|
|
registerUser(server.URL, "createdevice", "createdevice@test.com", "UserPass123!")
|
||
|
|
token := getToken(server.URL, "createdevice", "UserPass123!")
|
||
|
|
|
||
|
|
resp, body := doPost(server.URL+"/api/v1/devices", token, map[string]interface{}{
|
||
|
|
"name": "My Device",
|
||
|
|
"device_id": "device-001",
|
||
|
|
"device_type": 3, // DeviceTypeDesktop
|
||
|
|
"device_os": "Windows 10",
|
||
|
|
"device_browser": "Chrome",
|
||
|
|
})
|
||
|
|
defer resp.Body.Close()
|
||
|
|
|
||
|
|
if resp.StatusCode != http.StatusCreated {
|
||
|
|
t.Errorf("expected status %d, got %d, body: %s", http.StatusCreated, resp.StatusCode, body)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
// =============================================================================
|
||
|
|
// Role Handler Tests
|
||
|
|
// =============================================================================
|
||
|
|
|
||
|
|
func TestRoleHandler_CreateRole_RequiresAdmin(t *testing.T) {
|
||
|
|
server, cleanup := setupHandlerTestServer(t)
|
||
|
|
defer cleanup()
|
||
|
|
|
||
|
|
registerUser(server.URL, "roleadmin", "roleadmin@test.com", "AdminPass123!")
|
||
|
|
token := getToken(server.URL, "roleadmin", "AdminPass123!")
|
||
|
|
|
||
|
|
// Role creation requires admin
|
||
|
|
resp, body := doPost(server.URL+"/api/v1/roles", token, map[string]interface{}{
|
||
|
|
"name": "Test Role",
|
||
|
|
"code": "test_role",
|
||
|
|
"description": "A test role",
|
||
|
|
})
|
||
|
|
defer resp.Body.Close()
|
||
|
|
|
||
|
|
if resp.StatusCode != http.StatusForbidden {
|
||
|
|
t.Errorf("expected status 403 for non-admin, got %d, body: %s", resp.StatusCode, body)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestRoleHandler_ListRoles_RequiresAdmin(t *testing.T) {
|
||
|
|
server, cleanup := setupHandlerTestServer(t)
|
||
|
|
defer cleanup()
|
||
|
|
|
||
|
|
registerUser(server.URL, "listroleadmin", "listroleadmin@test.com", "AdminPass123!")
|
||
|
|
token := getToken(server.URL, "listroleadmin", "AdminPass123!")
|
||
|
|
|
||
|
|
resp, body := doGet(server.URL+"/api/v1/roles", token)
|
||
|
|
defer resp.Body.Close()
|
||
|
|
|
||
|
|
// Regular users cannot list all roles
|
||
|
|
if resp.StatusCode != http.StatusForbidden {
|
||
|
|
t.Errorf("expected status 403 for non-admin, got %d, body: %s", resp.StatusCode, body)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestRoleHandler_GetRole_RequiresAdmin(t *testing.T) {
|
||
|
|
server, cleanup := setupHandlerTestServer(t)
|
||
|
|
defer cleanup()
|
||
|
|
|
||
|
|
registerUser(server.URL, "getroleadmin", "getroleadmin@test.com", "AdminPass123!")
|
||
|
|
token := getToken(server.URL, "getroleadmin", "AdminPass123!")
|
||
|
|
|
||
|
|
resp, body := doGet(server.URL+"/api/v1/roles/1", token)
|
||
|
|
defer resp.Body.Close()
|
||
|
|
|
||
|
|
if resp.StatusCode != http.StatusForbidden {
|
||
|
|
t.Errorf("expected status 403 for non-admin, got %d, body: %s", resp.StatusCode, body)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
// =============================================================================
|
||
|
|
// Theme Handler Tests
|
||
|
|
// =============================================================================
|
||
|
|
|
||
|
|
func TestThemeHandler_CreateTheme_WithDangerousJS_Rejected(t *testing.T) {
|
||
|
|
server, cleanup := setupHandlerTestServer(t)
|
||
|
|
defer cleanup()
|
||
|
|
|
||
|
|
registerUser(server.URL, "themeadmin", "themeadmin@test.com", "AdminPass123!")
|
||
|
|
token := getToken(server.URL, "themeadmin", "AdminPass123!")
|
||
|
|
|
||
|
|
// Note: Creating themes requires admin role. Regular registered users get 403.
|
||
|
|
// This test verifies that a regular user cannot create themes with dangerous JS.
|
||
|
|
resp, body := doPost(server.URL+"/api/v1/themes", token, map[string]interface{}{
|
||
|
|
"name": "Malicious Theme",
|
||
|
|
"custom_js": "javascript:alert('xss')",
|
||
|
|
})
|
||
|
|
defer resp.Body.Close()
|
||
|
|
|
||
|
|
// Regular users should get 403 Forbidden
|
||
|
|
if resp.StatusCode != http.StatusForbidden {
|
||
|
|
t.Errorf("expected status %d for non-admin user, got %d, body: %s",
|
||
|
|
http.StatusForbidden, resp.StatusCode, body)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestThemeHandler_CreateTheme_WithScriptTag_Rejected(t *testing.T) {
|
||
|
|
server, cleanup := setupHandlerTestServer(t)
|
||
|
|
defer cleanup()
|
||
|
|
|
||
|
|
registerUser(server.URL, "themeadmin2", "themeadmin2@test.com", "AdminPass123!")
|
||
|
|
token := getToken(server.URL, "themeadmin2", "AdminPass123!")
|
||
|
|
|
||
|
|
resp, body := doPost(server.URL+"/api/v1/themes", token, map[string]interface{}{
|
||
|
|
"name": "Script Theme",
|
||
|
|
"custom_js": "<script>alert('xss')</script>",
|
||
|
|
})
|
||
|
|
defer resp.Body.Close()
|
||
|
|
|
||
|
|
if resp.StatusCode != http.StatusForbidden {
|
||
|
|
t.Errorf("expected status %d for non-admin user, got %d, body: %s",
|
||
|
|
http.StatusForbidden, resp.StatusCode, body)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestThemeHandler_CreateTheme_WithEventHandler_Rejected(t *testing.T) {
|
||
|
|
server, cleanup := setupHandlerTestServer(t)
|
||
|
|
defer cleanup()
|
||
|
|
|
||
|
|
registerUser(server.URL, "themeadmin3", "themeadmin3@test.com", "AdminPass123!")
|
||
|
|
token := getToken(server.URL, "themeadmin3", "AdminPass123!")
|
||
|
|
|
||
|
|
resp, body := doPost(server.URL+"/api/v1/themes", token, map[string]interface{}{
|
||
|
|
"name": "Event Theme",
|
||
|
|
"custom_js": "<img src=x onerror=alert(1)>",
|
||
|
|
})
|
||
|
|
defer resp.Body.Close()
|
||
|
|
|
||
|
|
if resp.StatusCode != http.StatusForbidden {
|
||
|
|
t.Errorf("expected status %d for non-admin user, got %d, body: %s",
|
||
|
|
http.StatusForbidden, resp.StatusCode, body)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestThemeHandler_ListThemes_RequiresAuth(t *testing.T) {
|
||
|
|
server, cleanup := setupHandlerTestServer(t)
|
||
|
|
defer cleanup()
|
||
|
|
|
||
|
|
// Without auth, should get 401
|
||
|
|
resp, _ := doGet(server.URL+"/api/v1/themes", "")
|
||
|
|
defer resp.Body.Close()
|
||
|
|
|
||
|
|
if resp.StatusCode != http.StatusUnauthorized {
|
||
|
|
t.Errorf("expected status %d for unauthenticated request, got %d",
|
||
|
|
http.StatusUnauthorized, resp.StatusCode)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestThemeHandler_GetDefaultTheme_RequiresAdmin(t *testing.T) {
|
||
|
|
server, cleanup := setupHandlerTestServer(t)
|
||
|
|
defer cleanup()
|
||
|
|
|
||
|
|
registerUser(server.URL, "themeuser", "themeuser@test.com", "AdminPass123!")
|
||
|
|
token := getToken(server.URL, "themeuser", "AdminPass123!")
|
||
|
|
|
||
|
|
resp, body := doGet(server.URL+"/api/v1/themes/default", token)
|
||
|
|
defer resp.Body.Close()
|
||
|
|
|
||
|
|
// Regular users get 403
|
||
|
|
if resp.StatusCode != http.StatusForbidden {
|
||
|
|
t.Errorf("expected status %d for non-admin user, got %d, body: %s",
|
||
|
|
http.StatusForbidden, resp.StatusCode, body)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
// =============================================================================
|
||
|
|
// Health Check Tests
|
||
|
|
// =============================================================================
|
||
|
|
|
||
|
|
// Health endpoint is defined in main.go, not in the router.
|
||
|
|
// Skipping this test as it's not part of the router-based handler tests.
|
||
|
|
|
||
|
|
// =============================================================================
|
||
|
|
// Concurrent Request Tests
|
||
|
|
// =============================================================================
|
||
|
|
|
||
|
|
func TestConcurrent_Register_Requests(t *testing.T) {
|
||
|
|
server, cleanup := setupHandlerTestServer(t)
|
||
|
|
defer cleanup()
|
||
|
|
|
||
|
|
const goroutines = 20
|
||
|
|
const requestsPerGoroutine = 5
|
||
|
|
var wg sync.WaitGroup
|
||
|
|
errorCount := int32(0)
|
||
|
|
successCount := int32(0)
|
||
|
|
rateLimitedCount := int32(0)
|
||
|
|
|
||
|
|
for i := 0; i < goroutines; i++ {
|
||
|
|
wg.Add(1)
|
||
|
|
go func(id int) {
|
||
|
|
defer wg.Done()
|
||
|
|
for j := 0; j < requestsPerGoroutine; j++ {
|
||
|
|
username := fmt.Sprintf("concurrent_user_%d_%d", id, j)
|
||
|
|
resp, _ := doPost(server.URL+"/api/v1/auth/register", "", map[string]interface{}{
|
||
|
|
"username": username,
|
||
|
|
"email": fmt.Sprintf("%s@test.com", username),
|
||
|
|
"password": "UserPass123!",
|
||
|
|
})
|
||
|
|
defer resp.Body.Close()
|
||
|
|
if resp.StatusCode == http.StatusCreated {
|
||
|
|
atomic.AddInt32(&successCount, 1)
|
||
|
|
} else if resp.StatusCode == http.StatusTooManyRequests {
|
||
|
|
atomic.AddInt32(&rateLimitedCount, 1)
|
||
|
|
} else {
|
||
|
|
atomic.AddInt32(&errorCount, 1)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}(i)
|
||
|
|
}
|
||
|
|
|
||
|
|
wg.Wait()
|
||
|
|
|
||
|
|
total := int32(goroutines * requestsPerGoroutine)
|
||
|
|
t.Logf("concurrent registration: %d success, %d rate-limited, %d errors out of %d total",
|
||
|
|
successCount, rateLimitedCount, errorCount, total)
|
||
|
|
|
||
|
|
// Rate limiting is expected behavior - verify the system is handling concurrency
|
||
|
|
if rateLimitedCount == 0 && successCount < total/2 {
|
||
|
|
t.Errorf("too few successful registrations: %d/%d (no rate limiting detected)", successCount, total)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestConcurrent_Login_SameUser(t *testing.T) {
|
||
|
|
server, cleanup := setupHandlerTestServer(t)
|
||
|
|
defer cleanup()
|
||
|
|
|
||
|
|
registerUser(server.URL, "concurrentlogin", "cl@test.com", "UserPass123!")
|
||
|
|
|
||
|
|
const goroutines = 10
|
||
|
|
var wg sync.WaitGroup
|
||
|
|
successCount := int32(0)
|
||
|
|
rateLimitedCount := int32(0)
|
||
|
|
|
||
|
|
for i := 0; i < goroutines; i++ {
|
||
|
|
wg.Add(1)
|
||
|
|
go func() {
|
||
|
|
defer wg.Done()
|
||
|
|
token := getToken(server.URL, "concurrentlogin", "UserPass123!")
|
||
|
|
if token != "" {
|
||
|
|
atomic.AddInt32(&successCount, 1)
|
||
|
|
} else {
|
||
|
|
// Could be rate limited - check the login directly
|
||
|
|
resp, _ := doPost(server.URL+"/api/v1/auth/login", "", map[string]interface{}{
|
||
|
|
"account": "concurrentlogin",
|
||
|
|
"password": "UserPass123!",
|
||
|
|
})
|
||
|
|
defer resp.Body.Close()
|
||
|
|
if resp.StatusCode == http.StatusTooManyRequests {
|
||
|
|
atomic.AddInt32(&rateLimitedCount, 1)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}()
|
||
|
|
}
|
||
|
|
|
||
|
|
wg.Wait()
|
||
|
|
|
||
|
|
t.Logf("concurrent login: %d success, %d rate-limited out of %d",
|
||
|
|
successCount, rateLimitedCount, goroutines)
|
||
|
|
|
||
|
|
// Rate limiting is expected for concurrent login attempts
|
||
|
|
if rateLimitedCount == 0 && successCount < goroutines/2 {
|
||
|
|
t.Errorf("too few successful logins: %d/%d", successCount, goroutines)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestConcurrent_DeviceCreation(t *testing.T) {
|
||
|
|
server, cleanup := setupHandlerTestServer(t)
|
||
|
|
defer cleanup()
|
||
|
|
|
||
|
|
registerUser(server.URL, "deviceconcurrent", "dc@test.com", "UserPass123!")
|
||
|
|
token := getToken(server.URL, "deviceconcurrent", "UserPass123!")
|
||
|
|
|
||
|
|
const goroutines = 5
|
||
|
|
var wg sync.WaitGroup
|
||
|
|
successCount := int32(0)
|
||
|
|
|
||
|
|
for i := 0; i < goroutines; i++ {
|
||
|
|
wg.Add(1)
|
||
|
|
go func(id int) {
|
||
|
|
defer wg.Done()
|
||
|
|
resp, _ := doPost(server.URL+"/api/v1/devices", token, map[string]interface{}{
|
||
|
|
"name": fmt.Sprintf("Device %d", id),
|
||
|
|
"device_id": fmt.Sprintf("device-concurrent-%d", id),
|
||
|
|
"device_type": 3, // DeviceTypeDesktop
|
||
|
|
})
|
||
|
|
defer resp.Body.Close()
|
||
|
|
if resp.StatusCode == http.StatusCreated {
|
||
|
|
atomic.AddInt32(&successCount, 1)
|
||
|
|
}
|
||
|
|
}(i)
|
||
|
|
}
|
||
|
|
|
||
|
|
wg.Wait()
|
||
|
|
|
||
|
|
if successCount != goroutines {
|
||
|
|
t.Errorf("expected %d successful device creations, got %d", goroutines, successCount)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
// =============================================================================
|
||
|
|
// Error Handling Tests
|
||
|
|
// =============================================================================
|
||
|
|
|
||
|
|
func TestErrorResponse_ContainsNoInternalDetails(t *testing.T) {
|
||
|
|
server, cleanup := setupHandlerTestServer(t)
|
||
|
|
defer cleanup()
|
||
|
|
|
||
|
|
// Try to access protected endpoint without token
|
||
|
|
resp, body := doGet(server.URL+"/api/v1/users", "")
|
||
|
|
defer resp.Body.Close()
|
||
|
|
|
||
|
|
if resp.StatusCode != http.StatusUnauthorized {
|
||
|
|
t.Errorf("expected status %d, got %d", http.StatusUnauthorized, resp.StatusCode)
|
||
|
|
}
|
||
|
|
|
||
|
|
var result map[string]interface{}
|
||
|
|
json.Unmarshal([]byte(body), &result)
|
||
|
|
|
||
|
|
if errMsg, ok := result["error"].(string); ok {
|
||
|
|
// Error should be short and not contain internal details
|
||
|
|
if len(errMsg) > 100 {
|
||
|
|
t.Errorf("error message too long, might contain internal details: %s", errMsg)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestInvalidUserID_ReturnsBadRequest(t *testing.T) {
|
||
|
|
server, cleanup := setupHandlerTestServer(t)
|
||
|
|
defer cleanup()
|
||
|
|
|
||
|
|
registerUser(server.URL, "invalidid", "invalidid@test.com", "AdminPass123!")
|
||
|
|
token := getToken(server.URL, "invalidid", "AdminPass123!")
|
||
|
|
|
||
|
|
resp, _ := doGet(server.URL+"/api/v1/users/invalid", token)
|
||
|
|
defer resp.Body.Close()
|
||
|
|
|
||
|
|
if resp.StatusCode != http.StatusBadRequest {
|
||
|
|
t.Errorf("expected status %d for invalid user id, got %d", http.StatusBadRequest, resp.StatusCode)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestNonExistentUserID_ReturnsNotFound(t *testing.T) {
|
||
|
|
server, cleanup := setupHandlerTestServer(t)
|
||
|
|
defer cleanup()
|
||
|
|
|
||
|
|
registerUser(server.URL, "notfound", "notfound@test.com", "AdminPass123!")
|
||
|
|
token := getToken(server.URL, "notfound", "AdminPass123!")
|
||
|
|
|
||
|
|
resp, _ := doGet(server.URL+"/api/v1/users/99999", token)
|
||
|
|
defer resp.Body.Close()
|
||
|
|
|
||
|
|
if resp.StatusCode != http.StatusNotFound {
|
||
|
|
t.Errorf("expected status %d for non-existent user, got %d", http.StatusNotFound, resp.StatusCode)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
// =============================================================================
|
||
|
|
// Input Validation Tests
|
||
|
|
// =============================================================================
|
||
|
|
|
||
|
|
func TestRegister_InvalidEmail(t *testing.T) {
|
||
|
|
server, cleanup := setupHandlerTestServer(t)
|
||
|
|
defer cleanup()
|
||
|
|
|
||
|
|
// Note: Email validation may not be strict at handler level
|
||
|
|
// The service layer handles validation
|
||
|
|
resp, _ := doPost(server.URL+"/api/v1/auth/register", "", map[string]interface{}{
|
||
|
|
"username": "bademail",
|
||
|
|
"email": "not-an-email",
|
||
|
|
"password": "Password123!",
|
||
|
|
})
|
||
|
|
defer resp.Body.Close()
|
||
|
|
|
||
|
|
// Should either succeed (if validated later) or fail with 400
|
||
|
|
if resp.StatusCode != http.StatusBadRequest && resp.StatusCode != http.StatusCreated {
|
||
|
|
t.Errorf("unexpected status for email validation: %d", resp.StatusCode)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestRegister_WeakPassword(t *testing.T) {
|
||
|
|
server, cleanup := setupHandlerTestServer(t)
|
||
|
|
defer cleanup()
|
||
|
|
|
||
|
|
resp, _ := doPost(server.URL+"/api/v1/auth/register", "", map[string]interface{}{
|
||
|
|
"username": "weakpass",
|
||
|
|
"email": "weakpass@test.com",
|
||
|
|
"password": "123",
|
||
|
|
})
|
||
|
|
defer resp.Body.Close()
|
||
|
|
|
||
|
|
// Weak password should be rejected with 400
|
||
|
|
if resp.StatusCode != http.StatusBadRequest && resp.StatusCode != http.StatusInternalServerError {
|
||
|
|
t.Errorf("expected status 400 or 500 for weak password, got %d", resp.StatusCode)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestCreateUser_InvalidEmail(t *testing.T) {
|
||
|
|
server, cleanup := setupHandlerTestServer(t)
|
||
|
|
defer cleanup()
|
||
|
|
|
||
|
|
registerUser(server.URL, "validadmin", "validadmin@test.com", "AdminPass123!")
|
||
|
|
token := getToken(server.URL, "validadmin", "AdminPass123!")
|
||
|
|
|
||
|
|
resp, _ := doPost(server.URL+"/api/v1/users", token, map[string]interface{}{
|
||
|
|
"username": "newuser",
|
||
|
|
"email": "not-an-email",
|
||
|
|
"password": "UserPass123!",
|
||
|
|
})
|
||
|
|
defer resp.Body.Close()
|
||
|
|
|
||
|
|
// Should return 400 for invalid email or 403 if user lacks permission
|
||
|
|
if resp.StatusCode != http.StatusBadRequest && resp.StatusCode != http.StatusForbidden {
|
||
|
|
t.Errorf("expected status 400 or 403, got %d", resp.StatusCode)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
// =============================================================================
|
||
|
|
// Response Structure Tests
|
||
|
|
// =============================================================================
|
||
|
|
|
||
|
|
func TestResponse_HasCorrectStructure(t *testing.T) {
|
||
|
|
server, cleanup := setupHandlerTestServer(t)
|
||
|
|
defer cleanup()
|
||
|
|
|
||
|
|
registerUser(server.URL, "structtest", "struct@test.com", "AdminPass123!")
|
||
|
|
token := getToken(server.URL, "structtest", "AdminPass123!")
|
||
|
|
|
||
|
|
resp, body := doGet(server.URL+"/api/v1/users", token)
|
||
|
|
defer resp.Body.Close()
|
||
|
|
|
||
|
|
var result map[string]interface{}
|
||
|
|
json.Unmarshal([]byte(body), &result)
|
||
|
|
|
||
|
|
// Should have code field
|
||
|
|
if _, ok := result["code"]; !ok {
|
||
|
|
t.Error("response should have 'code' field")
|
||
|
|
}
|
||
|
|
|
||
|
|
// Should have message field
|
||
|
|
if _, ok := result["message"]; !ok {
|
||
|
|
t.Error("response should have 'message' field")
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestLoginResponse_HasTokenFields(t *testing.T) {
|
||
|
|
server, cleanup := setupHandlerTestServer(t)
|
||
|
|
defer cleanup()
|
||
|
|
|
||
|
|
registerUser(server.URL, "tokentest", "token@test.com", "Password123!")
|
||
|
|
resp, body := doPost(server.URL+"/api/v1/auth/login", "", map[string]interface{}{
|
||
|
|
"account": "tokentest",
|
||
|
|
"password": "Password123!",
|
||
|
|
})
|
||
|
|
defer resp.Body.Close()
|
||
|
|
|
||
|
|
var result map[string]interface{}
|
||
|
|
json.Unmarshal([]byte(body), &result)
|
||
|
|
|
||
|
|
if result["data"] == nil {
|
||
|
|
t.Fatal("response should have 'data' field")
|
||
|
|
}
|
||
|
|
|
||
|
|
data := result["data"].(map[string]interface{})
|
||
|
|
if data["access_token"] == nil {
|
||
|
|
t.Error("data should have 'access_token' field")
|
||
|
|
}
|
||
|
|
if data["refresh_token"] == nil {
|
||
|
|
t.Error("data should have 'refresh_token' field")
|
||
|
|
}
|
||
|
|
if data["expires_in"] == nil {
|
||
|
|
t.Error("data should have 'expires_in' field")
|
||
|
|
}
|
||
|
|
}
|