From 1fc0ce7ed0c03c24293e04a6ac2a60cda6dc18e8 Mon Sep 17 00:00:00 2001
From: Jakub Zych <jakub@keios.eu>
Date: Tue, 20 Oct 2026 19:19:32 +0200
Subject: [PATCH] test: TestTurnstileRoutes pins golem15.user.turnstile per
 mode

Replaces TestTurnstileRoutesSmoke: empty adds nothing; open, closed and a
space-padded closed add turnstile:{mode} to POST login and register only,
every other route keeps its middleware; invalid values fail naming the key.
---
 ..._smoke_test.go => turnstile_routes_test.go | 86 +++++++++++--------
 1 file changed, 49 insertions(+), 37 deletions(-)
 rename turnstile_routes_smoke_test.go => turnstile_routes_test.go (60%)

diff --git a/turnstile_routes_smoke_test.go b/turnstile_routes_test.go
similarity index 60%
rename from turnstile_routes_smoke_test.go
rename to turnstile_routes_test.go
index 80f6feb..51bed23 100644
--- a/turnstile_routes_smoke_test.go
+++ b/turnstile_routes_test.go
@@ -88,7 +88,12 @@ func turnstileOf(route recordedRoute) []string {
 	return out
 }
 
-func TestTurnstileRoutesSmoke(t *testing.T) {
+// TestTurnstileRoutes pins golem15.user.turnstile (D-07): empty adds no
+// middleware; open and closed (surrounding spaces trimmed) append
+// turnstile:{mode} to POST /_user/api/v1/login and /register only, leaving
+// every other route's middleware as it is with the key empty; any other
+// value fails Routes naming the key.
+func TestTurnstileRoutes(t *testing.T) {
 	off, err := recordUserRoutes(t, "")
 	if err != nil {
 		t.Fatalf("empty turnstile: Routes error %v", err)
@@ -96,51 +101,58 @@ func TestTurnstileRoutesSmoke(t *testing.T) {
 	if len(off) == 0 {
 		t.Fatal("no routes recorded")
 	}
+	guarded := map[string]bool{
+		http.MethodPost + " /_user/api/v1/login":    true,
+		http.MethodPost + " /_user/api/v1/register": true,
+	}
+	seen := 0
 	for _, route := range off {
 		if got := turnstileOf(route); len(got) > 0 {
 			t.Errorf("empty turnstile: %s %s carries %v", route.method, route.path, got)
 		}
-	}
-
-	closed, err := recordUserRoutes(t, "closed")
-	if err != nil {
-		t.Fatalf("closed turnstile: Routes error %v", err)
-	}
-	if len(closed) != len(off) {
-		t.Fatalf("closed turnstile: %d routes, want %d", len(closed), len(off))
-	}
-	guarded := map[string]bool{"/_user/api/v1/login": true, "/_user/api/v1/register": true}
-	for i, route := range closed {
-		got := turnstileOf(route)
-		if guarded[route.path] && route.method == http.MethodPost {
-			if len(got) != 1 || got[0] != "turnstile:closed" {
-				t.Errorf("closed turnstile: POST %s middleware %v, want one turnstile:closed", route.path, route.middleware)
-			}
-			if strings.Join(route.middleware[:len(route.middleware)-1], ",") != strings.Join(off[i].middleware, ",") {
-				t.Errorf("closed turnstile: POST %s middleware %v, want %v plus turnstile:closed", route.path, route.middleware, off[i].middleware)
-			}
-			continue
-		}
-		if route.method != off[i].method || route.path != off[i].path ||
-			strings.Join(route.middleware, ",") != strings.Join(off[i].middleware, ",") {
-			t.Errorf("closed turnstile: %s %s %v changed from %s %s %v",
-				route.method, route.path, route.middleware, off[i].method, off[i].path, off[i].middleware)
+		if guarded[route.method+" "+route.path] {
+			seen++
 		}
 	}
-
-	open, err := recordUserRoutes(t, "open")
-	if err != nil {
-		t.Fatalf("open turnstile: Routes error %v", err)
+	if seen != len(guarded) {
+		t.Fatalf("found %d of the guarded routes, want %d", seen, len(guarded))
 	}
-	for _, route := range open {
-		if guarded[route.path] {
-			if got := turnstileOf(route); len(got) != 1 || got[0] != "turnstile:open" {
-				t.Errorf("open turnstile: %s middleware %v", route.path, route.middleware)
+
+	cases := []struct {
+		name, mode, want string
+	}{
+		{name: "open", mode: "open", want: "turnstile:open"},
+		{name: "closed", mode: "closed", want: "turnstile:closed"},
+		{name: "closed with spaces", mode: " closed ", want: "turnstile:closed"},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			got, err := recordUserRoutes(t, c.mode)
+			if err != nil {
+				t.Fatalf("Routes error %v", err)
 			}
-		}
+			if len(got) != len(off) {
+				t.Fatalf("%d routes, want %d", len(got), len(off))
+			}
+			for i, route := range got {
+				base := off[i]
+				if route.method != base.method || route.path != base.path {
+					t.Fatalf("route %d is %s %s, want %s %s", i, route.method, route.path, base.method, base.path)
+				}
+				want := base.middleware
+				if guarded[route.method+" "+route.path] {
+					want = append(append([]string{}, base.middleware...), c.want)
+				}
+				if strings.Join(route.middleware, ",") != strings.Join(want, ",") {
+					t.Errorf("%s %s middleware %v, want %v", route.method, route.path, route.middleware, want)
+				}
+			}
+		})
 	}
 
-	if _, err := recordUserRoutes(t, "bogus"); err == nil || !strings.Contains(err.Error(), "golem15.user.turnstile") {
-		t.Fatalf("bogus turnstile: error %v, want one naming golem15.user.turnstile", err)
+	for _, bad := range []string{"bogus", "Closed", "on", "true"} {
+		if _, err := recordUserRoutes(t, bad); err == nil || !strings.Contains(err.Error(), "golem15.user.turnstile") {
+			t.Errorf("turnstile %q: error %v, want one naming golem15.user.turnstile", bad, err)
+		}
 	}
 }