196 lines
8.4 KiB
Go
196 lines
8.4 KiB
Go
// Vikunja is a to-do list application to facilitate your life.
|
|
// Copyright 2018-present Vikunja and contributors. All rights reserved.
|
|
//
|
|
// This program is free software: you can redistribute it and/or modify
|
|
// it under the terms of the GNU Affero General Public License as published by
|
|
// the Free Software Foundation, either version 3 of the License, or
|
|
// (at your option) any later version.
|
|
//
|
|
// This program is distributed in the hope that it will be useful,
|
|
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
// GNU Affero General Public License for more details.
|
|
//
|
|
// You should have received a copy of the GNU Affero General Public License
|
|
// along with this program. If not, see <https://www.gnu.org/licenses/>.
|
|
|
|
package webtests
|
|
|
|
import (
|
|
"encoding/json"
|
|
"net/http"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
// All subtests in a Test* func share one env: setupTestEnv rotates the JWT
|
|
// secret per call, so a token must be issued from the same env it's used
|
|
// against. Where a subtest mutates the user, later subtests account for it.
|
|
|
|
func TestHumaUserShow(t *testing.T) {
|
|
e, err := setupTestEnv()
|
|
require.NoError(t, err)
|
|
token := humaTokenFor(t, &testuser1)
|
|
|
|
rec := humaRequest(t, e, http.MethodGet, "/api/v2/user", "", token, "")
|
|
require.Equal(t, http.StatusOK, rec.Code, "body: %s", rec.Body.String())
|
|
|
|
body := rec.Body.String()
|
|
assert.Contains(t, body, `"id":1`)
|
|
assert.Contains(t, body, `"username":"user1"`)
|
|
// Like v1, /user does not disclose the email (GetUserByID strips it); the
|
|
// json:"email,omitempty" tag then drops the field entirely.
|
|
assert.NotContains(t, body, `"email":""`)
|
|
// Computed account facts v1 returned alongside the user object.
|
|
assert.Contains(t, body, `"auth_provider":"local"`)
|
|
assert.Contains(t, body, `"is_local_user":true`)
|
|
assert.Contains(t, body, `"is_admin":false`)
|
|
// The nested settings use the shared models.UserGeneralSettings shape.
|
|
assert.Contains(t, body, `"settings":`)
|
|
assert.Contains(t, body, `"frontend_settings":`)
|
|
assert.Contains(t, body, `"extra_settings_links":`)
|
|
|
|
t.Run("Unauthenticated", func(t *testing.T) {
|
|
rec := humaRequest(t, e, http.MethodGet, "/api/v2/user", "", "", "")
|
|
assert.Equal(t, http.StatusUnauthorized, rec.Code)
|
|
})
|
|
}
|
|
|
|
func TestHumaUserChangePassword(t *testing.T) {
|
|
e, err := setupTestEnv()
|
|
require.NoError(t, err)
|
|
token := humaTokenFor(t, &testuser1)
|
|
|
|
t.Run("Wrong old password", func(t *testing.T) {
|
|
// CheckUserCredentials → ErrWrongUsernameOrPassword (403).
|
|
rec := humaRequest(t, e, http.MethodPost, "/api/v2/user/password",
|
|
`{"old_password":"invalid","new_password":"123456789"}`, token, "")
|
|
assert.Equal(t, http.StatusForbidden, rec.Code, "body: %s", rec.Body.String())
|
|
})
|
|
t.Run("Empty old password", func(t *testing.T) {
|
|
rec := humaRequest(t, e, http.MethodPost, "/api/v2/user/password",
|
|
`{"old_password":"","new_password":"123456789"}`, token, "")
|
|
assert.Equal(t, http.StatusPreconditionFailed, rec.Code, "body: %s", rec.Body.String())
|
|
})
|
|
t.Run("New password too short", func(t *testing.T) {
|
|
// v2 maps govalidator failures (bcrypt_password) to 422, not v1's 412.
|
|
rec := humaRequest(t, e, http.MethodPost, "/api/v2/user/password",
|
|
`{"old_password":"12345678","new_password":"1234567"}`, token, "")
|
|
assert.Equal(t, http.StatusUnprocessableEntity, rec.Code, "body: %s", rec.Body.String())
|
|
})
|
|
t.Run("Normal - run last, it changes the password", func(t *testing.T) {
|
|
rec := humaRequest(t, e, http.MethodPost, "/api/v2/user/password",
|
|
`{"old_password":"12345678","new_password":"123456789"}`, token, "")
|
|
require.Equal(t, http.StatusOK, rec.Code, "body: %s", rec.Body.String())
|
|
assert.Contains(t, rec.Body.String(), "The password was updated successfully.")
|
|
})
|
|
}
|
|
|
|
func TestHumaUserUpdateEmail(t *testing.T) {
|
|
e, err := setupTestEnv()
|
|
require.NoError(t, err)
|
|
token := humaTokenFor(t, &testuser1)
|
|
|
|
t.Run("Wrong password", func(t *testing.T) {
|
|
// CheckUserCredentials → ErrWrongUsernameOrPassword (403).
|
|
rec := humaRequest(t, e, http.MethodPut, "/api/v2/user/settings/email",
|
|
`{"new_email":"new@example.com","password":"invalid"}`, token, "")
|
|
assert.Equal(t, http.StatusForbidden, rec.Code, "body: %s", rec.Body.String())
|
|
})
|
|
t.Run("Missing new email", func(t *testing.T) {
|
|
// new_email carries valid:"...,required"; v2 maps the failure to 422.
|
|
rec := humaRequest(t, e, http.MethodPut, "/api/v2/user/settings/email",
|
|
`{"password":"12345678"}`, token, "")
|
|
assert.Equal(t, http.StatusUnprocessableEntity, rec.Code, "body: %s", rec.Body.String())
|
|
})
|
|
t.Run("Normal", func(t *testing.T) {
|
|
rec := humaRequest(t, e, http.MethodPut, "/api/v2/user/settings/email",
|
|
`{"new_email":"new@example.com","password":"12345678"}`, token, "")
|
|
require.Equal(t, http.StatusOK, rec.Code, "body: %s", rec.Body.String())
|
|
assert.Contains(t, rec.Body.String(), "confirm your email address")
|
|
})
|
|
}
|
|
|
|
func TestHumaUserUpdateSettings(t *testing.T) {
|
|
e, err := setupTestEnv()
|
|
require.NoError(t, err)
|
|
token := humaTokenFor(t, &testuser1)
|
|
|
|
t.Run("Normal", func(t *testing.T) {
|
|
rec := humaRequest(t, e, http.MethodPut, "/api/v2/user/settings/general",
|
|
`{"name":"New Name","week_start":1,"overdue_tasks_reminders_time":"10:00","timezone":"Europe/Berlin"}`, token, "")
|
|
require.Equal(t, http.StatusOK, rec.Code, "body: %s", rec.Body.String())
|
|
assert.Contains(t, rec.Body.String(), "The settings were updated successfully.")
|
|
|
|
// The change is observable through user-show.
|
|
show := humaRequest(t, e, http.MethodGet, "/api/v2/user", "", token, "")
|
|
require.Equal(t, http.StatusOK, show.Code)
|
|
assert.Contains(t, show.Body.String(), `"name":"New Name"`)
|
|
})
|
|
t.Run("Frontend settings round-trip as arbitrary JSON", func(t *testing.T) {
|
|
rec := humaRequest(t, e, http.MethodPut, "/api/v2/user/settings/general",
|
|
`{"overdue_tasks_reminders_time":"09:00","frontend_settings":{"color_schema":"dark","nested":{"a":1}}}`, token, "")
|
|
require.Equal(t, http.StatusOK, rec.Code, "body: %s", rec.Body.String())
|
|
|
|
show := humaRequest(t, e, http.MethodGet, "/api/v2/user", "", token, "")
|
|
require.Equal(t, http.StatusOK, show.Code)
|
|
var resp struct {
|
|
Settings struct {
|
|
FrontendSettings map[string]any `json:"frontend_settings"`
|
|
} `json:"settings"`
|
|
}
|
|
require.NoError(t, json.Unmarshal(show.Body.Bytes(), &resp))
|
|
assert.Equal(t, "dark", resp.Settings.FrontendSettings["color_schema"])
|
|
})
|
|
t.Run("Invalid week_start", func(t *testing.T) {
|
|
// week_start carries valid:"range(0|6)"; out of range maps to 422.
|
|
rec := humaRequest(t, e, http.MethodPut, "/api/v2/user/settings/general",
|
|
`{"week_start":9,"overdue_tasks_reminders_time":"09:00"}`, token, "")
|
|
assert.Equal(t, http.StatusUnprocessableEntity, rec.Code, "body: %s", rec.Body.String())
|
|
})
|
|
}
|
|
|
|
func TestHumaUserAvatarProvider(t *testing.T) {
|
|
e, err := setupTestEnv()
|
|
require.NoError(t, err)
|
|
token := humaTokenFor(t, &testuser1)
|
|
|
|
t.Run("Get", func(t *testing.T) {
|
|
rec := humaRequest(t, e, http.MethodGet, "/api/v2/user/settings/avatar/provider", "", token, "")
|
|
require.Equal(t, http.StatusOK, rec.Code, "body: %s", rec.Body.String())
|
|
assert.Contains(t, rec.Body.String(), `"avatar_provider":`)
|
|
})
|
|
t.Run("Set then get reflects the change", func(t *testing.T) {
|
|
rec := humaRequest(t, e, http.MethodPut, "/api/v2/user/settings/avatar/provider",
|
|
`{"avatar_provider":"initials"}`, token, "")
|
|
require.Equal(t, http.StatusOK, rec.Code, "body: %s", rec.Body.String())
|
|
assert.Contains(t, rec.Body.String(), `"avatar_provider":"initials"`)
|
|
|
|
get := humaRequest(t, e, http.MethodGet, "/api/v2/user/settings/avatar/provider", "", token, "")
|
|
require.Equal(t, http.StatusOK, get.Code)
|
|
assert.Contains(t, get.Body.String(), `"avatar_provider":"initials"`)
|
|
})
|
|
t.Run("Invalid provider", func(t *testing.T) {
|
|
// UpdateUser rejects unknown providers with ErrInvalidAvatarProvider (412).
|
|
rec := humaRequest(t, e, http.MethodPut, "/api/v2/user/settings/avatar/provider",
|
|
`{"avatar_provider":"nonsense"}`, token, "")
|
|
assert.Equal(t, http.StatusPreconditionFailed, rec.Code, "body: %s", rec.Body.String())
|
|
})
|
|
}
|
|
|
|
func TestHumaUserTimezones(t *testing.T) {
|
|
e, err := setupTestEnv()
|
|
require.NoError(t, err)
|
|
token := humaTokenFor(t, &testuser1)
|
|
|
|
rec := humaRequest(t, e, http.MethodGet, "/api/v2/user/timezones", "", token, "")
|
|
require.Equal(t, http.StatusOK, rec.Code, "body: %s", rec.Body.String())
|
|
|
|
var zones []string
|
|
require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &zones))
|
|
assert.NotEmpty(t, zones)
|
|
assert.Contains(t, zones, "Europe/Berlin")
|
|
}
|