RenewCMS/test/settings_http_test.go

package test

import (
	"RenewCMS/api/handlers/settings"
	"RenewCMS/api/middleware"
	"RenewCMS/api/pkg/apperr"
	validator "RenewCMS/api/pkg/validator"
	"RenewCMS/internal/domain/user"
	"RenewCMS/internal/infrastructure/useCases"
	"net/http"
	"strings"
	"testing"

	"github.com/go-chi/chi/v5"
	"github.com/go-chi/jwtauth/v5"
)

func newSettingsRouter(t *testing.T, userRepo *mockUserRepo, token *jwtauth.JWTAuth, version string) *chi.Mux {
	getUserUseCase := useCases.NewGetUserUseCase(userRepo)
	settingsHandler := settings.NewHandler(
		useCases.NewGetSettingsUseCase(version),
		useCases.NewGetActivityRetentionUseCase(newActivitySettingsFake(), newSizeEvents(t), settingsTestClock),
		useCases.NewUpdateActivityRetentionUseCase(newActivitySettingsFake(), newSizeEvents(t), discardRecorder, settingsTestClock),
	)

	r := chi.NewRouter()
	r.Route("/v1/settings", func(r chi.Router) {
		r.Use(jwtauth.Verifier(token))
		r.Use(jwtauth.Authenticator(token))
		r.Use(middleware.RequireCurrentToken(getUserUseCase))
		r.Use(middleware.RequireVerifiedUser(getUserUseCase))
		r.Get("/", settingsHandler.GetSettings)
	})
	return r
}

func settingsBody(version string) string {
	return `{"version":"` + version + `","activity_retention_days":90,"activity_retention_max_gb":0,"activity_log_size_bytes":0,"activity_last_cleanup_at":null,"activity_last_cleanup_removed":0,"activity_next_cleanup_at":"2026-10-07T03:00:00+02:00"}`
}

func TestSettingsHttp(t *testing.T) {
	validator.InitValidator()

	for _, version := range []string{"v2.2.0-beta", "dev"} {
		t.Run("A verified caller gets the running build's version: "+version, func(t *testing.T) {
			token := jwtauth.New("HS256", []byte("test-secret"), nil)
			userRepo := newMockUserRepo()
			userRepo.users[7] = user.User{ID: 7, Username: "alice", IsVerified: true, TokenVersion: 0}
			router := newSettingsRouter(t, userRepo, token, version)
			cookie := mintGetCurrentUserCookie(t, token, 7, 0)

			rec := sendGetCurrentUserRequest(router, http.MethodGet, "/v1/settings", cookie)

			if rec.Code != http.StatusOK {
				t.Fatalf("expected status 200, got %d: %s", rec.Code, rec.Body.String())
			}
			if rec.Body.String() != settingsBody(version) {
				t.Errorf("unexpected body: %q", rec.Body.String())
			}
		})
	}

	t.Run("The response does not depend on the environment at request time", func(t *testing.T) {
		token := jwtauth.New("HS256", []byte("test-secret"), nil)
		userRepo := newMockUserRepo()
		userRepo.users[7] = user.User{ID: 7, Username: "alice", IsVerified: true, TokenVersion: 0}
		router := newSettingsRouter(t, userRepo, token, "v2.2.0-beta")
		cookie := mintGetCurrentUserCookie(t, token, 7, 0)
		t.Setenv("ENVIRONMENT", "development")

		rec := sendGetCurrentUserRequest(router, http.MethodGet, "/v1/settings", cookie)

		if rec.Code != http.StatusOK {
			t.Fatalf("expected status 200, got %d: %s", rec.Code, rec.Body.String())
		}
		if rec.Body.String() != settingsBody("v2.2.0-beta") {
			t.Errorf("unexpected body: %q", rec.Body.String())
		}
	})

	t.Run("A request without a jwt cookie is refused", func(t *testing.T) {
		token := jwtauth.New("HS256", []byte("test-secret"), nil)
		router := newSettingsRouter(t, newMockUserRepo(), token, "v2.2.0-beta")

		rec := sendGetCurrentUserRequest(router, http.MethodGet, "/v1/settings", nil)

		if rec.Code != http.StatusUnauthorized {
			t.Fatalf("expected status 401, got %d: %s", rec.Code, rec.Body.String())
		}
		if strings.Contains(rec.Body.String(), "v2.2.0-beta") {
			t.Errorf("body leaks the version: %q", rec.Body.String())
		}
	})

	t.Run("A token whose version no longer matches the account is refused", func(t *testing.T) {
		token := jwtauth.New("HS256", []byte("test-secret"), nil)
		userRepo := newMockUserRepo()
		userRepo.users[7] = user.User{ID: 7, Username: "alice", IsVerified: true, TokenVersion: 1}
		router := newSettingsRouter(t, userRepo, token, "v2.2.0-beta")
		cookie := mintGetCurrentUserCookie(t, token, 7, 0)

		rec := sendGetCurrentUserRequest(router, http.MethodGet, "/v1/settings", cookie)

		if rec.Code != http.StatusUnauthorized {
			t.Fatalf("expected status 401, got %d: %s", rec.Code, rec.Body.String())
		}
		if rec.Body.String() != apperr.UnauthorizedErrorMessage+"\n" {
			t.Errorf("unexpected body: %q", rec.Body.String())
		}
	})

	t.Run("An unverified account is refused", func(t *testing.T) {
		token := jwtauth.New("HS256", []byte("test-secret"), nil)
		userRepo := newMockUserRepo()
		userRepo.users[8] = user.User{ID: 8, Username: "bob", IsVerified: false, TokenVersion: 0}
		router := newSettingsRouter(t, userRepo, token, "v2.2.0-beta")
		cookie := mintGetCurrentUserCookie(t, token, 8, 0)

		rec := sendGetCurrentUserRequest(router, http.MethodGet, "/v1/settings", cookie)

		if rec.Code != http.StatusForbidden {
			t.Fatalf("expected status 403, got %d: %s", rec.Code, rec.Body.String())
		}
		if rec.Body.String() != apperr.VerificationRequiredErrorMessage+"\n" {
			t.Errorf("unexpected body: %q", rec.Body.String())
		}
		if strings.Contains(rec.Body.String(), "v2.2.0-beta") {
			t.Errorf("body leaks the version: %q", rec.Body.String())
		}
	})
}