iu/ds-galo
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 2 Wiki Activity

feat(auth): add user profile, phone login, and account deletion

Browse Source
This commit is contained in:
iu
2026-10-12 14:26:32 +03:00
parent 1cb9aaf198
commit 86aff695df
46 changed files with 2893 additions and 134 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/internal/e2e/auth_flow_test.go
+132
View File
@@ -0,0 +1,132 @@
package e2e
import (
"bytes"
"encoding/json"
"net/http"
"net/http/httptest"
"path/filepath"
"testing"
"github.com/gin-gonic/gin"
"galo/internal/app"
"galo/internal/config"
"galo/internal/models"
)
// TestAuthProfileFlowOverHTTP drives the whole account lifecycle through the
// real HTTP router: register phone-only, log in, add an email, change the
// password (revoking sessions), and delete the account.
func TestAuthProfileFlowOverHTTP(t *testing.T) {
st, closeDB := openStack(t, filepath.Join(t.TempDir(), "galo.db"), t.TempDir())
defer closeDB()
gin.SetMode(gin.TestMode)
srv := app.New(&config.Config{}, st.repos, st.db.PingContext, st.tm, st.storage, st.hub)
router := srv.Router()
do := func(method, path, token string, body any) *httptest.ResponseRecorder {
var buf bytes.Buffer
if body != nil {
_ = json.NewEncoder(&buf).Encode(body)
}
req := httptest.NewRequest(method, path, &buf)
req.Header.Set("Content-Type", "application/json")
if token != "" {
req.Header.Set("Authorization", "Bearer "+token)
}
rec := httptest.NewRecorder()
router.ServeHTTP(rec, req)
return rec
}
type tokens struct {
AccessToken string `json:"access_token"`
RefreshToken string `json:"refresh_token"`
}
type authBody struct {
User models.SelfUser `json:"user"`
Tokens tokens `json:"tokens"`
}
phone := "+15550007000"
// Register with a phone only — no email.
rec := do(http.MethodPost, "/api/auth/register", "", map[string]string{
"phone": phone, "password": "password123", "name": "Phone Only",
})
if rec.Code != http.StatusCreated {
t.Fatalf("register status = %d body = %s", rec.Code, rec.Body.String())
}
var registered authBody
if err := json.Unmarshal(rec.Body.Bytes(), &registered); err != nil {
t.Fatalf("decode register: %v", err)
}
if registered.User.Phone != phone || registered.User.Email != "" {
t.Fatalf("registered user = %+v", registered.User)
}
// Log in by phone.
rec = do(http.MethodPost, "/api/auth/login", "", map[string]string{
"identifier": phone, "password": "password123",
})
if rec.Code != http.StatusOK {
t.Fatalf("login status = %d body = %s", rec.Code, rec.Body.String())
}
var logged authBody
_ = json.Unmarshal(rec.Body.Bytes(), &logged)
access := logged.Tokens.AccessToken
// Add the missing email identifier.
rec = do(http.MethodPost, "/api/auth/me/identifiers", access, map[string]string{
"email": "phoneonly@test.local",
})
if rec.Code != http.StatusOK {
t.Fatalf("add identifier status = %d body = %s", rec.Code, rec.Body.String())
}
var added struct {
User models.SelfUser `json:"user"`
}
_ = json.Unmarshal(rec.Body.Bytes(), &added)
if added.User.Email != "phoneonly@test.local" {
t.Fatalf("email not added: %+v", added.User)
}
// Change the password, which revokes every refresh token.
rec = do(http.MethodPost, "/api/auth/me/password", access, map[string]string{
"current_password": "password123", "new_password": "newpassword",
})
if rec.Code != http.StatusNoContent {
t.Fatalf("change password status = %d body = %s", rec.Code, rec.Body.String())
}
rec = do(http.MethodPost, "/api/auth/refresh", "", map[string]string{
"refresh_token": logged.Tokens.RefreshToken,
})
if rec.Code != http.StatusUnauthorized {
t.Fatalf("refresh after password change status = %d, want 401", rec.Code)
}
// The new password works; login by the added email.
rec = do(http.MethodPost, "/api/auth/login", "", map[string]string{
"identifier": "phoneonly@test.local", "password": "newpassword",
})
if rec.Code != http.StatusOK {
t.Fatalf("login with new password status = %d body = %s", rec.Code, rec.Body.String())
}
var relogged authBody
_ = json.Unmarshal(rec.Body.Bytes(), &relogged)
// Delete the account: it disappears immediately.
rec = do(http.MethodDelete, "/api/auth/me", relogged.Tokens.AccessToken, map[string]string{
"password": "newpassword",
})
if rec.Code != http.StatusNoContent {
t.Fatalf("delete status = %d body = %s", rec.Code, rec.Body.String())
}
rec = do(http.MethodPost, "/api/auth/login", "", map[string]string{
"identifier": phone, "password": "newpassword",
})
if rec.Code != http.StatusUnauthorized {
t.Fatalf("login after delete status = %d, want 401", rec.Code)
}
}
backend/internal/e2e/sqlite_test.go
+110 -4
View File
@@ -4,6 +4,7 @@ import (
"bytes"
"context"
"database/sql"
"errors"
"image"
"image/color"
"image/png"
@@ -80,13 +81,118 @@ func openStack(t *testing.T, path, blobRoot string) (*stack, func()) {
return &stack{db: database, photos: photosSvc, albums: albumsSvc, auth: authSvc, hub: hub, tm: tm, repos: repos, storage: blob}, func() { database.Close() }
}
func TestUsersSchemaSupportsPhone(t *testing.T) {
ctx := context.Background()
path := filepath.Join(t.TempDir(), "galo.db")
st, closeDB := openStack(t, path, t.TempDir())
defer closeDB()
var emailNotNull int
if err := st.db.QueryRowContext(ctx,
`SELECT "notnull" FROM pragma_table_info('users') WHERE name='email'`).Scan(&emailNotNull); err != nil {
t.Fatalf("email column: %v", err)
}
if emailNotNull != 0 {
t.Fatalf("users.email is still NOT NULL")
}
var phoneCols int
if err := st.db.QueryRowContext(ctx,
`SELECT count(*) FROM pragma_table_info('users') WHERE name='phone'`).Scan(&phoneCols); err != nil {
t.Fatalf("phone column: %v", err)
}
if phoneCols != 1 {
t.Fatalf("users.phone column missing")
}
insert := func(id, email, phone string) error {
var e any
if email != "" {
e = email
}
var p any
if phone != "" {
p = phone
}
_, err := st.db.ExecContext(ctx,
`INSERT INTO users (id, email, phone, password_hash, name) VALUES ($1, $2, $3, 'x', 'U')`,
id, e, p)
return err
}
// A phone-only account is allowed (email NULL).
if err := insert("u-phone-only", "", "+15550000001"); err != nil {
t.Fatalf("insert phone-only user: %v", err)
}
// A second email-less account is allowed: NULL emails do not collide.
if err := insert("u-phone-only-2", "", "+15550000002"); err != nil {
t.Fatalf("insert second phone-only user: %v", err)
}
// Phone must be unique.
if err := insert("u-dup-phone", "dup@test.local", "+15550000001"); err == nil {
t.Fatalf("duplicate phone accepted")
}
// A phone-only insert without a phone must be rejected by application
// logic; the schema itself still permits it, which is by design.
if err := insert("u-email-1", "same@test.local", ""); err != nil {
t.Fatalf("insert email user: %v", err)
}
if err := insert("u-email-dup", "same@test.local", ""); err == nil {
t.Fatalf("duplicate email accepted")
}
}
func TestDeleteAccountRemovesSharedAlbum(t *testing.T) {
ctx := context.Background()
path := filepath.Join(t.TempDir(), "galo.db")
st, closeDB := openStack(t, path, t.TempDir())
defer closeDB()
owner, _, err := st.auth.Register(ctx, "ownerdel@test.local", "", "password123", "Owner")
if err != nil {
t.Fatalf("register owner: %v", err)
}
member, _, err := st.auth.Register(ctx, "memberdel@test.local", "", "password123", "Member")
if err != nil {
t.Fatalf("register member: %v", err)
}
album, err := st.albums.Create(ctx, owner.ID, albums.CreateInput{Title: "Shared"})
if err != nil {
t.Fatalf("create album: %v", err)
}
if _, err := st.db.ExecContext(ctx,
`INSERT INTO album_members (album_id, user_id, role) VALUES ($1, $2, 'member')`, album.ID, member.ID); err != nil {
t.Fatalf("add member: %v", err)
}
if list, err := st.repos.Albums.ListForUser(ctx, member.ID); err != nil || len(list) != 1 {
t.Fatalf("member albums before delete = %d err=%v", len(list), err)
}
if err := st.auth.DeleteAccount(ctx, owner.ID, "password123"); err != nil {
t.Fatalf("delete account: %v", err)
}
if list, err := st.repos.Albums.ListForUser(ctx, member.ID); err != nil || len(list) != 0 {
t.Fatalf("member albums after owner delete = %d err=%v, want 0", len(list), err)
}
if _, err := st.repos.Albums.GetByID(ctx, album.ID); !errors.Is(err, albums.ErrNotFound) {
t.Fatalf("album survived owner deletion: %v", err)
}
if role, _ := st.repos.Members.Role(ctx, album.ID, member.ID); role != "" {
t.Fatalf("membership survived: %q", role)
}
if _, err := st.repos.Auth.GetUserByID(ctx, member.ID); err != nil {
t.Fatalf("member account removed by cascade: %v", err)
}
}
func TestUploadSetsDefaultCover(t *testing.T) {
ctx := context.Background()
path := filepath.Join(t.TempDir(), "galo.db")
st, closeDB := openStack(t, path, t.TempDir())
defer closeDB()
user, _, err := st.auth.Register(ctx, "cover@test.local", "password123", "C")
user, _, err := st.auth.Register(ctx, "cover@test.local", "", "password123", "C")
if err != nil {
t.Fatalf("register: %v", err)
}
@@ -130,7 +236,7 @@ func TestCoverClearedWhenCoverPhotoLeaves(t *testing.T) {
st, closeDB := openStack(t, path, t.TempDir())
defer closeDB()
user, _, err := st.auth.Register(ctx, "clear@test.local", "password123", "C")
user, _, err := st.auth.Register(ctx, "clear@test.local", "", "password123", "C")
if err != nil {
t.Fatalf("register: %v", err)
}
@@ -190,7 +296,7 @@ func TestWorkerPublishesPhotoUpdated(t *testing.T) {
defer cancel()
go worker.Run(wctx)
user, _, err := st.auth.Register(ctx, "evt@test.local", "password123", "E")
user, _, err := st.auth.Register(ctx, "evt@test.local", "", "password123", "E")
if err != nil {
t.Fatalf("register: %v", err)
}
@@ -228,7 +334,7 @@ func TestSQLiteEndToEndWithRestart(t *testing.T) {
wctx, cancel := context.WithCancel(ctx)
go worker.Run(wctx)
user, _, err := st.auth.Register(ctx, "e2e@test.local", "password123", "E2E")
user, _, err := st.auth.Register(ctx, "e2e@test.local", "", "password123", "E2E")
if err != nil {
t.Fatalf("register: %v", err)
}
backend/internal/e2e/trash_test.go
+6 -6
View File
@@ -23,7 +23,7 @@ func TestPermanentDeleteAlbumlessPhoto(t *testing.T) {
st, closeDB := openStack(t, filepath.Join(t.TempDir(), "galo.db"), t.TempDir())
defer closeDB()
user, _, err := st.auth.Register(ctx, "albumless@test.local", "password123", "A")
user, _, err := st.auth.Register(ctx, "albumless@test.local", "", "password123", "A")
if err != nil {
t.Fatalf("register: %v", err)
}
@@ -78,11 +78,11 @@ func TestEmptyTrashSkipsForeignPhotos(t *testing.T) {
st, closeDB := openStack(t, filepath.Join(t.TempDir(), "galo.db"), t.TempDir())
defer closeDB()
owner, _, err := st.auth.Register(ctx, "owner@test.local", "password123", "O")
owner, _, err := st.auth.Register(ctx, "owner@test.local", "", "password123", "O")
if err != nil {
t.Fatalf("register owner: %v", err)
}
member, _, err := st.auth.Register(ctx, "member@test.local", "password123", "M")
member, _, err := st.auth.Register(ctx, "member@test.local", "", "password123", "M")
if err != nil {
t.Fatalf("register member: %v", err)
}
@@ -150,7 +150,7 @@ func TestListTrashIdentitiesNotCapped(t *testing.T) {
st, closeDB := openStack(t, filepath.Join(t.TempDir(), "galo.db"), t.TempDir())
defer closeDB()
user, _, err := st.auth.Register(ctx, "many@test.local", "password123", "M")
user, _, err := st.auth.Register(ctx, "many@test.local", "", "password123", "M")
if err != nil {
t.Fatalf("register: %v", err)
}
@@ -184,7 +184,7 @@ func TestEmptyTrashReturnsZeroWhenEmpty(t *testing.T) {
st, closeDB := openStack(t, filepath.Join(t.TempDir(), "galo.db"), t.TempDir())
defer closeDB()
user, _, err := st.auth.Register(ctx, "empty@test.local", "password123", "E")
user, _, err := st.auth.Register(ctx, "empty@test.local", "", "password123", "E")
if err != nil {
t.Fatalf("register: %v", err)
}
@@ -202,7 +202,7 @@ func TestEmptyTrashHTTP(t *testing.T) {
st, closeDB := openStack(t, filepath.Join(t.TempDir(), "galo.db"), t.TempDir())
defer closeDB()
user, pair, err := st.auth.Register(ctx, "http@test.local", "password123", "H")
user, pair, err := st.auth.Register(ctx, "http@test.local", "", "password123", "H")
if err != nil {
t.Fatalf("register: %v", err)
}
backend/internal/e2e/video_test.go
+1 -1
View File
@@ -50,7 +50,7 @@ func TestVideoUploadPreparedForPlayback(t *testing.T) {
st, closeDB := openStack(t, path, t.TempDir())
defer closeDB()
user, _, err := st.auth.Register(ctx, "video@test.local", "password123", "V")
user, _, err := st.auth.Register(ctx, "video@test.local", "", "password123", "V")
if err != nil {
t.Fatalf("register: %v", err)
}