133 lines
4.2 KiB
Go
133 lines
4.2 KiB
Go
package e2e
|
|
|
|
import (
|
|
"bytes"
|
|
"encoding/json"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"path/filepath"
|
|
"testing"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
|
|
"galo/internal/app"
|
|
"galo/internal/config"
|
|
"galo/internal/models"
|
|
)
|
|
|
|
// TestAuthProfileFlowOverHTTP drives the whole account lifecycle through the
|
|
// real HTTP router: register phone-only, log in, add an email, change the
|
|
// password (revoking sessions), and delete the account.
|
|
func TestAuthProfileFlowOverHTTP(t *testing.T) {
|
|
st, closeDB := openStack(t, filepath.Join(t.TempDir(), "galo.db"), t.TempDir())
|
|
defer closeDB()
|
|
|
|
gin.SetMode(gin.TestMode)
|
|
srv := app.New(&config.Config{}, st.repos, st.db.PingContext, st.tm, st.storage, st.hub)
|
|
router := srv.Router()
|
|
|
|
do := func(method, path, token string, body any) *httptest.ResponseRecorder {
|
|
var buf bytes.Buffer
|
|
if body != nil {
|
|
_ = json.NewEncoder(&buf).Encode(body)
|
|
}
|
|
req := httptest.NewRequest(method, path, &buf)
|
|
req.Header.Set("Content-Type", "application/json")
|
|
if token != "" {
|
|
req.Header.Set("Authorization", "Bearer "+token)
|
|
}
|
|
rec := httptest.NewRecorder()
|
|
router.ServeHTTP(rec, req)
|
|
return rec
|
|
}
|
|
|
|
type tokens struct {
|
|
AccessToken string `json:"access_token"`
|
|
RefreshToken string `json:"refresh_token"`
|
|
}
|
|
type authBody struct {
|
|
User models.SelfUser `json:"user"`
|
|
Tokens tokens `json:"tokens"`
|
|
}
|
|
|
|
phone := "+15550007000"
|
|
// Register with a phone only — no email.
|
|
rec := do(http.MethodPost, "/api/auth/register", "", map[string]string{
|
|
"phone": phone, "password": "password123", "name": "Phone Only",
|
|
})
|
|
if rec.Code != http.StatusCreated {
|
|
t.Fatalf("register status = %d body = %s", rec.Code, rec.Body.String())
|
|
}
|
|
var registered authBody
|
|
if err := json.Unmarshal(rec.Body.Bytes(), ®istered); err != nil {
|
|
t.Fatalf("decode register: %v", err)
|
|
}
|
|
if registered.User.Phone != phone || registered.User.Email != "" {
|
|
t.Fatalf("registered user = %+v", registered.User)
|
|
}
|
|
|
|
// Log in by phone.
|
|
rec = do(http.MethodPost, "/api/auth/login", "", map[string]string{
|
|
"identifier": phone, "password": "password123",
|
|
})
|
|
if rec.Code != http.StatusOK {
|
|
t.Fatalf("login status = %d body = %s", rec.Code, rec.Body.String())
|
|
}
|
|
var logged authBody
|
|
_ = json.Unmarshal(rec.Body.Bytes(), &logged)
|
|
access := logged.Tokens.AccessToken
|
|
|
|
// Add the missing email identifier.
|
|
rec = do(http.MethodPost, "/api/auth/me/identifiers", access, map[string]string{
|
|
"email": "phoneonly@test.local",
|
|
})
|
|
if rec.Code != http.StatusOK {
|
|
t.Fatalf("add identifier status = %d body = %s", rec.Code, rec.Body.String())
|
|
}
|
|
var added struct {
|
|
User models.SelfUser `json:"user"`
|
|
}
|
|
_ = json.Unmarshal(rec.Body.Bytes(), &added)
|
|
if added.User.Email != "phoneonly@test.local" {
|
|
t.Fatalf("email not added: %+v", added.User)
|
|
}
|
|
|
|
// Change the password, which revokes every refresh token.
|
|
rec = do(http.MethodPost, "/api/auth/me/password", access, map[string]string{
|
|
"current_password": "password123", "new_password": "newpassword",
|
|
})
|
|
if rec.Code != http.StatusNoContent {
|
|
t.Fatalf("change password status = %d body = %s", rec.Code, rec.Body.String())
|
|
}
|
|
rec = do(http.MethodPost, "/api/auth/refresh", "", map[string]string{
|
|
"refresh_token": logged.Tokens.RefreshToken,
|
|
})
|
|
if rec.Code != http.StatusUnauthorized {
|
|
t.Fatalf("refresh after password change status = %d, want 401", rec.Code)
|
|
}
|
|
|
|
// The new password works; login by the added email.
|
|
rec = do(http.MethodPost, "/api/auth/login", "", map[string]string{
|
|
"identifier": "phoneonly@test.local", "password": "newpassword",
|
|
})
|
|
if rec.Code != http.StatusOK {
|
|
t.Fatalf("login with new password status = %d body = %s", rec.Code, rec.Body.String())
|
|
}
|
|
var relogged authBody
|
|
_ = json.Unmarshal(rec.Body.Bytes(), &relogged)
|
|
|
|
// Delete the account: it disappears immediately.
|
|
rec = do(http.MethodDelete, "/api/auth/me", relogged.Tokens.AccessToken, map[string]string{
|
|
"password": "newpassword",
|
|
})
|
|
if rec.Code != http.StatusNoContent {
|
|
t.Fatalf("delete status = %d body = %s", rec.Code, rec.Body.String())
|
|
}
|
|
rec = do(http.MethodPost, "/api/auth/login", "", map[string]string{
|
|
"identifier": phone, "password": "newpassword",
|
|
})
|
|
if rec.Code != http.StatusUnauthorized {
|
|
t.Fatalf("login after delete status = %d, want 401", rec.Code)
|
|
}
|
|
}
|