feat: Users API, ownership transfer and removal of the legacy role string

test/users_api_qa_test.go

@@ -0,0 +1,39 @@
+package test
+
+import (
+	"RenewCMS/api/pkg/apperr"
+	"net/http"
+	"testing"
+)
+
+func TestUsersAPIQAGaps(t *testing.T) {
+	t.Run("renewing mails a new code and the old code no longer works", func(t *testing.T) {
+		w := newUsersAPIWorld(t)
+		before := w.invites.invites[2].HashedCode
+		if rec := w.do(t, uaAdmin, http.MethodPost, "/v1/user/invite/2/renew", ""); rec.Code != http.StatusOK {
+			t.Fatalf("unexpected %d %q", rec.Code, rec.Body.String())
+		}
+		if w.invites.invites[2].HashedCode == before || len(w.mail.SentEmails) != 1 {
+			t.Fatalf("the code must change and be mailed")
+		}
+		rec := w.anonymous(t, http.MethodPost, "/v1/auth/invite/accept", `{"code": "code2", "username": "kim", "password": "password1"}`)
+		if rec.Code == http.StatusOK {
+			t.Errorf("the old code must not accept, got %d", rec.Code)
+		}
+	})
+
+	t.Run("accepting an invite whose role was deleted is invalid and creates no user", func(t *testing.T) {
+		w := newUsersAPIWorld(t)
+		temp := w.createTemp("content.read=own")
+		pending := w.invites.invites[3]
+		pending.RoleID = temp
+		w.invites.invites[3] = pending
+		delete(w.roles.roles, temp)
+		users := len(w.users.users)
+		rec := w.anonymous(t, http.MethodPost, "/v1/auth/invite/accept", `{"code": "code3", "username": "kim", "password": "password1"}`)
+		usersAPIAssertPlain(t, rec, http.StatusNotFound, apperr.InviteInvalidErrorMessage)
+		if len(w.users.users) != users {
+			t.Errorf("no user may be created")
+		}
+	})
+}