sm-user-plugin/admin_harness_test.go

package user

import (
	"bytes"
	"context"
	"database/sql"
	"encoding/json"
	"fmt"
	"io"
	"net/http"
	"net/http/httptest"
	"net/url"
	"os"
	"path/filepath"
	"strconv"
	"strings"
	"sync"
	"sync/atomic"
	"testing"
	"time"

	"git.golem15.com/golem15/sm-user-plugin/models"
	"git.golem15.com/golem15/summercms/modules/backpack"
	"git.golem15.com/golem15/summercms/modules/bouncer"
	"git.golem15.com/golem15/summercms/modules/cabana"
	"git.golem15.com/golem15/summercms/modules/compass"
	"git.golem15.com/golem15/summercms/modules/lagoon"
	"git.golem15.com/golem15/summercms/modules/lagoon/attach"
	"git.golem15.com/golem15/summercms/modules/party"
	"git.golem15.com/golem15/summercms/modules/surf"
	"gocloud.dev/blob"
	"gocloud.dev/blob/memblob"
	"gorm.io/gorm"
)

// The admin test harness boots the plugin the way an application does
// (party.Activate, lagoon.Migrate, surf.Assemble) with the admin API mounted,
// on its own database in the session container, and mints backend
// administrators with a chosen permission set.
//
//	env := newAdminEnv(t)
//	token := env.admin(t, permAccessUsers)
//	rec := env.call(t, http.MethodGet, adminAPI("/golem15/user/users"), token, nil)

const (
	// adminUsersPath is the Users controller under the admin API.
	adminUsersPath = "/golem15/user/users"

	permAccessUsers      = "golem15.users.access_users"
	permManagePrivileged = "golem15.users.manage_privileged_groups"
)

var (
	adminHarnessOnce sync.Once
	adminHarnessGDB  *gorm.DB
	adminHarnessSQL  *sql.DB
	adminHarnessErr  error
	// adminSeq makes logins, emails and codes unique across the tests that
	// share the harness database.
	adminSeq atomic.Uint64
)

// adminEnv is one booted application: the assembled handler, its app, the
// shared harness database and the in-memory blob bucket.
type adminEnv struct {
	h      http.Handler
	app    *backpack.App
	gdb    *gorm.DB
	bucket *blob.Bucket
}

// adminAPI builds a path under the admin API prefix.
func adminAPI(rel string) string {
	return cabana.DefaultAdminPrefix + "/api/v1" + rel
}

// adminStamp returns a token unique within the test binary, for emails,
// logins and group codes.
func adminStamp() string {
	return fmt.Sprintf("%d%d", time.Now().UnixNano()%1_000_000_000, adminSeq.Add(1))
}

// adminHarnessDB opens (once) the harness database: a second database in the
// session container, migrated by lagoon.Migrate on the first boot.
func adminHarnessDB(t *testing.T) (*gorm.DB, *sql.DB) {
	t.Helper()
	if testing.Short() {
		t.Skip("requires testcontainers postgres")
	}
	_, admin := sessionDB(t)
	adminHarnessOnce.Do(func() {
		ctx, cancel := context.WithTimeout(context.Background(), time.Minute)
		defer cancel()
		const name = "user_admin"
		if _, err := admin.ExecContext(ctx, `CREATE DATABASE `+name+` TEMPLATE template0 ENCODING 'UTF8' LOCALE_PROVIDER icu ICU_LOCALE 'pl-PL'`); err != nil {
			adminHarnessErr = err
			return
		}
		u, err := url.Parse(sessionDSN)
		if err != nil {
			adminHarnessErr = err
			return
		}
		u.Path = "/" + name
		db, err := sql.Open("pgx", u.String())
		if err != nil {
			adminHarnessErr = err
			return
		}
		gdb, err := lagoon.Use(ctx, db)
		if err != nil {
			adminHarnessErr = err
			return
		}
		adminHarnessSQL, adminHarnessGDB = db, gdb
	})
	if adminHarnessErr != nil {
		t.Fatal(adminHarnessErr)
	}
	return adminHarnessGDB, adminHarnessSQL
}

// newAdminEnv boots the plugin alone with the admin API mounted. configure
// functions adjust the config before the plugin is activated.
func newAdminEnv(t *testing.T, configure ...func(*compass.Config)) *adminEnv {
	t.Helper()
	gdb, sqlDB := adminHarnessDB(t)
	dir := t.TempDir()
	if err := os.WriteFile(filepath.Join(dir, "app.yaml"), []byte("name: user-admin\nlocale: en\nfallback_locale: en\nurl: https://app.example.test\n"), 0o644); err != nil {
		t.Fatal(err)
	}
	cfg, err := compass.Open(compass.Options{
		Dir: dir,
		Environ: []string{
			"SUMMER_ENV=development",
			"SUMMER_GOLEM15__USER__JWT__SECRET=" + sessionSecret,
			"SUMMER_ADMIN__JWT__SECRET=" + adminHarnessSecret,
		},
	})
	if err != nil {
		t.Fatal(err)
	}
	for key, value := range map[string]any{
		"http.body_limits.default_bytes": 1048576,
		"http.body_limits.upload_bytes":  8388608,
	} {
		if err := cfg.Set(key, value); err != nil {
			t.Fatal(err)
		}
	}
	app := backpack.New(cfg)
	if err := lagoon.Publish(app, sqlDB, gdb); err != nil {
		t.Fatal(err)
	}
	bucket := memblob.OpenBucket(nil)
	t.Cleanup(func() { _ = bucket.Close() })
	if err := attach.Publish(app, bucket); err != nil {
		t.Fatal(err)
	}
	// The registered plugin value is shared by every boot in this binary;
	// its blacklist sweep is started at most once and is harmless here.
	plugins, err := party.Activate(app, []string{"golem15.user"})
	if err != nil {
		t.Fatal(err)
	}
	// Overrides go in after the plugin's own config defaults were merged.
	for _, fn := range configure {
		fn(app.Config)
	}
	if err := lagoon.Migrate(gdb, plugins); err != nil {
		t.Fatal(err)
	}
	h, err := surf.Assemble(app, plugins)
	if err != nil {
		t.Fatal(err)
	}
	return &adminEnv{h: h, app: app, gdb: gdb, bucket: bucket}
}

// admin inserts a backend role holding exactly permissions and a backend
// user in it, logs the user in and returns the bearer token. No permission
// at all gives an administrator who may sign in and open nothing.
func (e *adminEnv) admin(t *testing.T, permissions ...string) string {
	t.Helper()
	stamp := adminStamp()
	login := "admin-" + stamp
	password := "admin-secret-" + stamp
	hash, err := bouncer.HashPassword(10, password)
	if err != nil {
		t.Fatal(err)
	}
	grants := map[string]int{}
	for _, code := range permissions {
		grants[code] = 1
	}
	raw, err := json.Marshal(grants)
	if err != nil {
		t.Fatal(err)
	}
	var roleID uint
	if err := e.gdb.Raw(`INSERT INTO backend_user_roles (name, code, permissions, is_system, created_at, updated_at) VALUES (?, ?, ?, FALSE, NOW(), NOW()) RETURNING id`,
		"Role "+stamp, "role-"+stamp, string(raw)).Scan(&roleID).Error; err != nil || roleID == 0 {
		t.Fatalf("backend role: id=%d err=%v", roleID, err)
	}
	if err := e.gdb.Exec(`INSERT INTO backend_users (login, email, password, is_activated, is_superuser, role_id, created_at, updated_at) VALUES (?, ?, ?, TRUE, FALSE, ?, NOW(), NOW())`,
		login, login+"@example.test", hash, roleID).Error; err != nil {
		t.Fatal(err)
	}
	rec := e.call(t, http.MethodPost, adminAPI("/auth/login"), "", map[string]string{"login": login, "password": password})
	if rec.Code != http.StatusOK {
		t.Fatalf("admin login %s: %d %s", login, rec.Code, rec.Body.String())
	}
	var body struct {
		Data struct {
			AccessToken string `json:"access_token"`
		} `json:"data"`
	}
	if err := json.Unmarshal(rec.Body.Bytes(), &body); err != nil || body.Data.AccessToken == "" {
		t.Fatalf("admin login body: %s err=%v", rec.Body.String(), err)
	}
	return body.Data.AccessToken
}

// call sends one request through the assembled handler. body is JSON-encoded
// unless it is nil; token, when set, is sent as a bearer token. The request
// locale is English and each call comes from its own address, so the login
// throttle never trips inside one test.
func (e *adminEnv) call(t *testing.T, method, path, token string, body any) *httptest.ResponseRecorder {
	t.Helper()
	var reader io.Reader
	if body != nil {
		raw, err := json.Marshal(body)
		if err != nil {
			t.Fatal(err)
		}
		reader = bytes.NewReader(raw)
	}
	req := httptest.NewRequest(method, path, reader)
	req.Host = "example.com"
	req.RemoteAddr = fmt.Sprintf("198.51.100.%d:4000", adminSeq.Add(1)%250+1)
	req.Header.Set("Accept-Language", "en")
	req.Header.Set("Content-Type", "application/json")
	if token != "" {
		req.Header.Set("Authorization", "Bearer "+token)
	}
	rec := httptest.NewRecorder()
	e.h.ServeHTTP(rec, req)
	return rec
}

// expect is call plus a status assertion.
func (e *adminEnv) expect(t *testing.T, status int, method, path, token string, body any) *httptest.ResponseRecorder {
	t.Helper()
	rec := e.call(t, method, path, token, body)
	if rec.Code != status {
		t.Fatalf("%s %s = %d, want %d: %s", method, path, rec.Code, status, rec.Body.String())
	}
	return rec
}

// adminEnvelope is the admin API answer: data and meta on success, error
// otherwise.
type adminEnvelope struct {
	Data  json.RawMessage `json:"data"`
	Meta  json.RawMessage `json:"meta"`
	Error struct {
		Code    string              `json:"code"`
		Message string              `json:"message"`
		Details map[string][]string `json:"details"`
	} `json:"error"`
}

// adminDecode parses an admin API answer.
func adminDecode(t *testing.T, rec *httptest.ResponseRecorder) adminEnvelope {
	t.Helper()
	var env adminEnvelope
	if err := json.Unmarshal(rec.Body.Bytes(), &env); err != nil {
		t.Fatalf("admin body %q: %v", rec.Body.String(), err)
	}
	return env
}

// adminInto decodes the data of an admin API answer into out.
func adminInto(t *testing.T, rec *httptest.ResponseRecorder, out any) adminEnvelope {
	t.Helper()
	env := adminDecode(t, rec)
	if err := json.Unmarshal(env.Data, out); err != nil {
		t.Fatalf("admin data %q: %v", string(env.Data), err)
	}
	return env
}

// adminUserList is a decoded Users list page.
type adminUserList struct {
	Rows      []map[string]any
	RowStates map[string][]string
	Total     int
	Raw       string
}

// has reports whether the page holds the user.
func (l adminUserList) has(id uint) bool { return l.row(id) != nil }

// row returns the list row of the user, or nil.
func (l adminUserList) row(id uint) map[string]any {
	for _, row := range l.Rows {
		if n, ok := row["id"].(float64); ok && uint(n) == id {
			return row
		}
	}
	return nil
}

// states returns the row states of the user.
func (l adminUserList) states(id uint) []string {
	return l.RowStates[strconv.FormatUint(uint64(id), 10)]
}

// users lists the Users screen with a raw query string (without the leading
// question mark) and expects 200.
func (e *adminEnv) users(t *testing.T, token, query string) adminUserList {
	t.Helper()
	path := adminAPI(adminUsersPath)
	if query != "" {
		path += "?" + query
	}
	rec := e.expect(t, http.StatusOK, http.MethodGet, path, token, nil)
	out := adminUserList{Raw: rec.Body.String()}
	env := adminInto(t, rec, &out.Rows)
	var meta struct {
		Total     int                 `json:"total"`
		RowStates map[string][]string `json:"row_states"`
	}
	if err := json.Unmarshal(env.Meta, &meta); err != nil {
		t.Fatalf("list meta %q: %v", string(env.Meta), err)
	}
	out.RowStates, out.Total = meta.RowStates, meta.Total
	return out
}

// userPath is the admin API path of one user, with an optional suffix such
// as "/actions/activate".
func userPath(id uint, suffix string) string {
	return adminAPI(adminUsersPath) + "/" + strconv.FormatUint(uint64(id), 10) + suffix
}

// seedUser stores a frontend user with the password correct-horse. The email
// is unique; mutate adjusts the row before it is inserted.
func (e *adminEnv) seedUser(t *testing.T, label string, mutate func(*models.User)) *models.User {
	t.Helper()
	hash, err := bouncer.HashPassword(10, "correct-horse")
	if err != nil {
		t.Fatal(err)
	}
	name := label
	user := &models.User{Email: label + "-" + adminStamp() + "@example.test", Password: hash, Name: &name, IsActivated: true}
	if mutate != nil {
		mutate(user)
	}
	if err := e.gdb.Omit("Groups").Create(user).Error; err != nil {
		t.Fatal(err)
	}
	return user
}

// seedGroup stores a user group; an empty code stores a group without one.
func (e *adminEnv) seedGroup(t *testing.T, name, code string) *models.UserGroup {
	t.Helper()
	group := &models.UserGroup{Name: name}
	if code != "" {
		group.Code = &code
	}
	if err := e.gdb.Create(group).Error; err != nil {
		t.Fatal(err)
	}
	return group
}

// join puts the user into the groups by writing users_groups directly.
func (e *adminEnv) join(t *testing.T, user *models.User, groups ...*models.UserGroup) {
	t.Helper()
	for _, group := range groups {
		if err := e.gdb.Exec(`INSERT INTO users_groups (user_id, user_group_id) VALUES (?, ?)`, user.ID, group.ID).Error; err != nil {
			t.Fatal(err)
		}
	}
}

// reload reads a user row, deactivated or not; nil when it is gone.
func (e *adminEnv) reload(t *testing.T, id uint) *models.User {
	t.Helper()
	var user models.User
	err := e.gdb.Unscoped().Where("id = ?", id).Take(&user).Error
	if err == gorm.ErrRecordNotFound {
		return nil
	}
	if err != nil {
		t.Fatal(err)
	}
	return &user
}

// groupIDs returns the user's users_groups rows, ordered.
func (e *adminEnv) groupIDs(t *testing.T, userID uint) []uint {
	t.Helper()
	ids := []uint{}
	if err := e.gdb.Raw(`SELECT user_group_id FROM users_groups WHERE user_id = ? ORDER BY user_group_id`, userID).Scan(&ids).Error; err != nil {
		t.Fatal(err)
	}
	return ids
}

// userLogin signs a frontend user in through the user API route and returns
// the status and the token.
func (e *adminEnv) userLogin(t *testing.T, email, password string) (int, string) {
	t.Helper()
	rec := e.call(t, http.MethodPost, "/_user/api/v1/login", "", map[string]string{"email": email, "password": password})
	var body struct {
		Token string `json:"token"`
	}
	_ = json.Unmarshal(rec.Body.Bytes(), &body)
	return rec.Code, body.Token
}

// assertNoSecret fails when an admin response carries a password key, a
// stored hash or the given plain text.
func assertNoSecret(t *testing.T, raw string, plain ...string) {
	t.Helper()
	lower := strings.ToLower(raw)
	if strings.Contains(lower, `"password`) || strings.Contains(raw, "$2a$") || strings.Contains(raw, "$2y$") {
		t.Fatalf("admin response carries a password: %s", raw)
	}
	for _, secret := range plain {
		if secret != "" && strings.Contains(raw, secret) {
			t.Fatalf("admin response carries a secret value: %s", raw)
		}
	}
}