refac: reamaining auth surface rewrite, T0
This commit is contained in:
fsylvain committed
1 parent
6d510d2805
commit
aa865af2e9
50 files changed
+3723
-149
No files matched your search
@@ -0,0 +1,244 @@
|
||||
package test
|
||||
|
||||
import (
|
||||
"RenewCMS/api/handlers/auth"
|
||||
"RenewCMS/api/pkg/apperr"
|
||||
validator "RenewCMS/api/pkg/validator"
|
||||
"RenewCMS/internal/domain/user"
|
||||
"RenewCMS/internal/infrastructure/useCases"
|
||||
"bytes"
|
||||
"encoding/json"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/go-chi/chi/v5"
|
||||
"github.com/go-chi/jwtauth/v5"
|
||||
)
|
||||
|
||||
func newAccountVerificationRouter(userRepo *mockUserRepo, mailRepo *mockMailRepo, token *jwtauth.JWTAuth) *chi.Mux {
|
||||
hasher := &stubHasher{}
|
||||
authHandler := auth.NewHandler(
|
||||
token,
|
||||
useCases.NewGetUserUseCase(userRepo),
|
||||
useCases.NewListUsersUseCase(userRepo),
|
||||
useCases.NewCreateUserUseCase(userRepo, hasher, mailRepo, "https://cms.example.com"),
|
||||
useCases.NewAuthenticateUserUseCase(userRepo, hasher),
|
||||
useCases.NewVerifyUserUseCase(userRepo, hasher),
|
||||
useCases.NewCancelRegistrationUseCase(userRepo),
|
||||
useCases.NewRequestPasswordResetUseCase(userRepo, hasher, mailRepo, "https://cms.example.com"),
|
||||
useCases.NewResetPasswordUseCase(userRepo, hasher),
|
||||
true,
|
||||
)
|
||||
|
||||
r := chi.NewRouter()
|
||||
r.Route("/v1", func(r chi.Router) {
|
||||
r.Route("/auth", func(r chi.Router) {
|
||||
r.Group(func(r chi.Router) {
|
||||
r.Use(jwtauth.Verifier(token))
|
||||
r.Use(jwtauth.Authenticator(token))
|
||||
r.Post("/verify", authHandler.Verify)
|
||||
})
|
||||
})
|
||||
})
|
||||
return r
|
||||
}
|
||||
|
||||
func newAccountVerificationTestUserRepo() *mockUserRepo {
|
||||
repo := newMockUserRepo()
|
||||
repo.users[7] = user.User{
|
||||
ID: 7,
|
||||
Username: "alice",
|
||||
IsVerified: false,
|
||||
VerificationCode: "hashed:abc123",
|
||||
VerificationExpiration: time.Now().Add(time.Hour),
|
||||
}
|
||||
repo.nextID = 7
|
||||
return repo
|
||||
}
|
||||
|
||||
func sendVerifyRequest(router *chi.Mux, token *jwtauth.JWTAuth, claims map[string]any, code string) *httptest.ResponseRecorder {
|
||||
body, _ := json.Marshal(map[string]string{"code": code})
|
||||
req := httptest.NewRequest(http.MethodPost, "/v1/auth/verify", bytes.NewReader(body))
|
||||
if claims != nil {
|
||||
_, tokenString, _ := token.Encode(claims)
|
||||
req.AddCookie(&http.Cookie{Name: "jwt", Value: tokenString})
|
||||
}
|
||||
rec := httptest.NewRecorder()
|
||||
router.ServeHTTP(rec, req)
|
||||
return rec
|
||||
}
|
||||
|
||||
func TestAccountVerificationHttp(t *testing.T) {
|
||||
validator.InitValidator()
|
||||
token := jwtauth.New("HS256", []byte("test-secret"), nil)
|
||||
|
||||
t.Run("A logged-in user verifies their account with the correct emailed code", func(t *testing.T) {
|
||||
repo := newAccountVerificationTestUserRepo()
|
||||
router := newAccountVerificationRouter(repo, newMockMailRepo(), token)
|
||||
|
||||
rec := sendVerifyRequest(router, token, map[string]any{"user_id": uint32(7)}, "abc123")
|
||||
|
||||
if rec.Code != http.StatusOK {
|
||||
t.Fatalf("expected status 200, got %d: %s", rec.Code, rec.Body.String())
|
||||
}
|
||||
var got user.User
|
||||
if err := json.Unmarshal(rec.Body.Bytes(), &got); err != nil {
|
||||
t.Fatalf("failed to decode response: %v", err)
|
||||
}
|
||||
if !got.IsVerified {
|
||||
t.Errorf("expected is_verified true")
|
||||
}
|
||||
if got.VerificationCode != "" {
|
||||
t.Errorf("expected verification_code empty, got %q", got.VerificationCode)
|
||||
}
|
||||
stored := repo.users[7]
|
||||
if !stored.IsVerified || stored.VerificationCode != "" {
|
||||
t.Errorf("expected stored record updated, got %+v", stored)
|
||||
}
|
||||
})
|
||||
|
||||
t.Run("A wrong code is refused and nothing changes", func(t *testing.T) {
|
||||
repo := newAccountVerificationTestUserRepo()
|
||||
router := newAccountVerificationRouter(repo, newMockMailRepo(), token)
|
||||
|
||||
rec := sendVerifyRequest(router, token, map[string]any{"user_id": uint32(7)}, "wrong-code")
|
||||
|
||||
if rec.Code != http.StatusForbidden {
|
||||
t.Fatalf("expected status 403, got %d: %s", rec.Code, rec.Body.String())
|
||||
}
|
||||
if rec.Body.String() != apperr.VerificationFailedErrorMessage+"\n" {
|
||||
t.Errorf("unexpected body: %q", rec.Body.String())
|
||||
}
|
||||
stored := repo.users[7]
|
||||
if stored.IsVerified || stored.VerificationCode != "hashed:abc123" {
|
||||
t.Errorf("expected stored record unchanged, got %+v", stored)
|
||||
}
|
||||
})
|
||||
|
||||
t.Run("An expired code is refused and nothing changes", func(t *testing.T) {
|
||||
repo := newAccountVerificationTestUserRepo()
|
||||
expired := repo.users[7]
|
||||
expired.VerificationExpiration = time.Now().Add(-time.Hour)
|
||||
repo.users[7] = expired
|
||||
router := newAccountVerificationRouter(repo, newMockMailRepo(), token)
|
||||
|
||||
rec := sendVerifyRequest(router, token, map[string]any{"user_id": uint32(7)}, "abc123")
|
||||
|
||||
if rec.Code != http.StatusForbidden {
|
||||
t.Fatalf("expected status 403, got %d: %s", rec.Code, rec.Body.String())
|
||||
}
|
||||
if rec.Body.String() != apperr.VerificationFailedErrorMessage+"\n" {
|
||||
t.Errorf("unexpected body: %q", rec.Body.String())
|
||||
}
|
||||
stored := repo.users[7]
|
||||
if stored.IsVerified || stored.VerificationCode != "hashed:abc123" {
|
||||
t.Errorf("expected stored record unchanged, got %+v", stored)
|
||||
}
|
||||
})
|
||||
|
||||
t.Run("The code is cleared once used, so it cannot be replayed", func(t *testing.T) {
|
||||
repo := newAccountVerificationTestUserRepo()
|
||||
router := newAccountVerificationRouter(repo, newMockMailRepo(), token)
|
||||
|
||||
first := sendVerifyRequest(router, token, map[string]any{"user_id": uint32(7)}, "abc123")
|
||||
if first.Code != http.StatusOK {
|
||||
t.Fatalf("expected first status 200, got %d: %s", first.Code, first.Body.String())
|
||||
}
|
||||
|
||||
second := sendVerifyRequest(router, token, map[string]any{"user_id": uint32(7)}, "abc123")
|
||||
if second.Code != http.StatusForbidden {
|
||||
t.Fatalf("expected second status 403, got %d: %s", second.Code, second.Body.String())
|
||||
}
|
||||
if second.Body.String() != apperr.VerificationFailedErrorMessage+"\n" {
|
||||
t.Errorf("unexpected body: %q", second.Body.String())
|
||||
}
|
||||
})
|
||||
|
||||
t.Run("A token without a valid user_id returns 401 instead of crashing", func(t *testing.T) {
|
||||
cases := []struct {
|
||||
name string
|
||||
claims map[string]any
|
||||
}{
|
||||
{"no user_id key at all", map[string]any{"role": "user"}},
|
||||
{"user_id is a string", map[string]any{"user_id": "seven"}},
|
||||
{"user_id does not match any user", map[string]any{"user_id": uint32(999)}},
|
||||
}
|
||||
|
||||
for _, tc := range cases {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
repo := newAccountVerificationTestUserRepo()
|
||||
router := newAccountVerificationRouter(repo, newMockMailRepo(), token)
|
||||
|
||||
rec := sendVerifyRequest(router, token, tc.claims, "abc123")
|
||||
|
||||
if rec.Code != http.StatusUnauthorized {
|
||||
t.Fatalf("expected status 401, got %d: %s", rec.Code, rec.Body.String())
|
||||
}
|
||||
if rec.Body.String() != apperr.UnauthorizedErrorMessage+"\n" {
|
||||
t.Errorf("unexpected body: %q", rec.Body.String())
|
||||
}
|
||||
stored := repo.users[7]
|
||||
if stored.IsVerified {
|
||||
t.Errorf("expected stored record unchanged, got %+v", stored)
|
||||
}
|
||||
})
|
||||
}
|
||||
})
|
||||
|
||||
t.Run("A repository failure unrelated to the code returns 500", func(t *testing.T) {
|
||||
repo := newAccountVerificationTestUserRepo()
|
||||
repo.fail.failNext("ClearVerificationCode")
|
||||
router := newAccountVerificationRouter(repo, newMockMailRepo(), token)
|
||||
|
||||
rec := sendVerifyRequest(router, token, map[string]any{"user_id": uint32(7)}, "abc123")
|
||||
|
||||
if rec.Code != http.StatusInternalServerError {
|
||||
t.Fatalf("expected status 500, got %d: %s", rec.Code, rec.Body.String())
|
||||
}
|
||||
if rec.Body.String() != "Internal server error\n" {
|
||||
t.Errorf("unexpected body: %q", rec.Body.String())
|
||||
}
|
||||
})
|
||||
|
||||
t.Run("A malformed request body returns 400", func(t *testing.T) {
|
||||
repo := newAccountVerificationTestUserRepo()
|
||||
router := newAccountVerificationRouter(repo, newMockMailRepo(), token)
|
||||
|
||||
req := httptest.NewRequest(http.MethodPost, "/v1/auth/verify", bytes.NewReader([]byte("not-json")))
|
||||
_, tokenString, _ := token.Encode(map[string]any{"user_id": uint32(7)})
|
||||
req.AddCookie(&http.Cookie{Name: "jwt", Value: tokenString})
|
||||
rec := httptest.NewRecorder()
|
||||
router.ServeHTTP(rec, req)
|
||||
|
||||
if rec.Code != http.StatusBadRequest {
|
||||
t.Fatalf("expected status 400, got %d: %s", rec.Code, rec.Body.String())
|
||||
}
|
||||
if rec.Body.String() != apperr.BodyErrorMessage+"\n" {
|
||||
t.Errorf("unexpected body: %q", rec.Body.String())
|
||||
}
|
||||
})
|
||||
|
||||
t.Run("A missing code fails validation and returns 400", func(t *testing.T) {
|
||||
repo := newAccountVerificationTestUserRepo()
|
||||
router := newAccountVerificationRouter(repo, newMockMailRepo(), token)
|
||||
|
||||
rec := sendVerifyRequest(router, token, map[string]any{"user_id": uint32(7)}, "")
|
||||
|
||||
if rec.Code != http.StatusBadRequest {
|
||||
t.Fatalf("expected status 400, got %d: %s", rec.Code, rec.Body.String())
|
||||
}
|
||||
})
|
||||
|
||||
t.Run("A request with no jwt cookie is answered 401 by jwtauth itself", func(t *testing.T) {
|
||||
repo := newAccountVerificationTestUserRepo()
|
||||
router := newAccountVerificationRouter(repo, newMockMailRepo(), token)
|
||||
|
||||
rec := sendVerifyRequest(router, token, nil, "abc123")
|
||||
|
||||
if rec.Code != http.StatusUnauthorized {
|
||||
t.Fatalf("expected status 401, got %d: %s", rec.Code, rec.Body.String())
|
||||
}
|
||||
})
|
||||
}
|
||||
Reference in new issue
Block a user