feat: settings page, sidebar and drawer destination "Settings" (icon settings, after Integration), route /settings (verified), showing only the running build's Version

test/settings_http_test.go

@@ -0,0 +1,123 @@
+package test
+
+import (
+	"RenewCMS/api/handlers/settings"
+	"RenewCMS/api/middleware"
+	"RenewCMS/api/pkg/apperr"
+	validator "RenewCMS/api/pkg/validator"
+	"RenewCMS/internal/domain/user"
+	"RenewCMS/internal/infrastructure/useCases"
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/go-chi/jwtauth/v5"
+)
+
+func newSettingsRouter(userRepo *mockUserRepo, token *jwtauth.JWTAuth, version string) *chi.Mux {
+	getUserUseCase := useCases.NewGetUserUseCase(userRepo)
+	settingsHandler := settings.NewHandler(useCases.NewGetSettingsUseCase(version))
+
+	r := chi.NewRouter()
+	r.Route("/v1/settings", func(r chi.Router) {
+		r.Use(jwtauth.Verifier(token))
+		r.Use(jwtauth.Authenticator(token))
+		r.Use(middleware.RequireCurrentToken(getUserUseCase))
+		r.Use(middleware.RequireVerifiedUser(getUserUseCase))
+		r.Get("/", settingsHandler.GetSettings)
+	})
+	return r
+}
+
+func TestSettingsHttp(t *testing.T) {
+	validator.InitValidator()
+
+	for _, version := range []string{"v2.2.0-beta", "dev"} {
+		t.Run("A verified caller gets the running build's version: "+version, func(t *testing.T) {
+			token := jwtauth.New("HS256", []byte("test-secret"), nil)
+			userRepo := newMockUserRepo()
+			userRepo.users[7] = user.User{ID: 7, Username: "alice", IsVerified: true, TokenVersion: 0}
+			router := newSettingsRouter(userRepo, token, version)
+			cookie := mintGetCurrentUserCookie(t, token, 7, 0)
+
+			rec := sendGetCurrentUserRequest(router, http.MethodGet, "/v1/settings", cookie)
+
+			if rec.Code != http.StatusOK {
+				t.Fatalf("expected status 200, got %d: %s", rec.Code, rec.Body.String())
+			}
+			if rec.Body.String() != `{"version":"`+version+`"}` {
+				t.Errorf("unexpected body: %q", rec.Body.String())
+			}
+		})
+	}
+
+	t.Run("The response does not depend on the environment at request time", func(t *testing.T) {
+		token := jwtauth.New("HS256", []byte("test-secret"), nil)
+		userRepo := newMockUserRepo()
+		userRepo.users[7] = user.User{ID: 7, Username: "alice", IsVerified: true, TokenVersion: 0}
+		router := newSettingsRouter(userRepo, token, "v2.2.0-beta")
+		cookie := mintGetCurrentUserCookie(t, token, 7, 0)
+		t.Setenv("ENVIRONMENT", "development")
+
+		rec := sendGetCurrentUserRequest(router, http.MethodGet, "/v1/settings", cookie)
+
+		if rec.Code != http.StatusOK {
+			t.Fatalf("expected status 200, got %d: %s", rec.Code, rec.Body.String())
+		}
+		if rec.Body.String() != `{"version":"v2.2.0-beta"}` {
+			t.Errorf("unexpected body: %q", rec.Body.String())
+		}
+	})
+
+	t.Run("A request without a jwt cookie is refused", func(t *testing.T) {
+		token := jwtauth.New("HS256", []byte("test-secret"), nil)
+		router := newSettingsRouter(newMockUserRepo(), token, "v2.2.0-beta")
+
+		rec := sendGetCurrentUserRequest(router, http.MethodGet, "/v1/settings", nil)
+
+		if rec.Code != http.StatusUnauthorized {
+			t.Fatalf("expected status 401, got %d: %s", rec.Code, rec.Body.String())
+		}
+		if strings.Contains(rec.Body.String(), "v2.2.0-beta") {
+			t.Errorf("body leaks the version: %q", rec.Body.String())
+		}
+	})
+
+	t.Run("A token whose version no longer matches the account is refused", func(t *testing.T) {
+		token := jwtauth.New("HS256", []byte("test-secret"), nil)
+		userRepo := newMockUserRepo()
+		userRepo.users[7] = user.User{ID: 7, Username: "alice", IsVerified: true, TokenVersion: 1}
+		router := newSettingsRouter(userRepo, token, "v2.2.0-beta")
+		cookie := mintGetCurrentUserCookie(t, token, 7, 0)
+
+		rec := sendGetCurrentUserRequest(router, http.MethodGet, "/v1/settings", cookie)
+
+		if rec.Code != http.StatusUnauthorized {
+			t.Fatalf("expected status 401, got %d: %s", rec.Code, rec.Body.String())
+		}
+		if rec.Body.String() != apperr.UnauthorizedErrorMessage+"\n" {
+			t.Errorf("unexpected body: %q", rec.Body.String())
+		}
+	})
+
+	t.Run("An unverified account is refused", func(t *testing.T) {
+		token := jwtauth.New("HS256", []byte("test-secret"), nil)
+		userRepo := newMockUserRepo()
+		userRepo.users[8] = user.User{ID: 8, Username: "bob", IsVerified: false, TokenVersion: 0}
+		router := newSettingsRouter(userRepo, token, "v2.2.0-beta")
+		cookie := mintGetCurrentUserCookie(t, token, 8, 0)
+
+		rec := sendGetCurrentUserRequest(router, http.MethodGet, "/v1/settings", cookie)
+
+		if rec.Code != http.StatusForbidden {
+			t.Fatalf("expected status 403, got %d: %s", rec.Code, rec.Body.String())
+		}
+		if rec.Body.String() != apperr.VerificationRequiredErrorMessage+"\n" {
+			t.Errorf("unexpected body: %q", rec.Body.String())
+		}
+		if strings.Contains(rec.Body.String(), "v2.2.0-beta") {
+			t.Errorf("body leaks the version: %q", rec.Body.String())
+		}
+	})
+}