d5ec97c6f3
Register through logout is one in-process flow, and token mint accepts read, write, ai, and the two-scope combination. Co-authored-by: Cursor <cursoragent@cursor.com>
60 lines
2.2 KiB
Go
60 lines
2.2 KiB
Go
package user
|
|
|
|
import (
|
|
"encoding/json"
|
|
"net/http"
|
|
"testing"
|
|
|
|
"git.golem15.com/golem15/fonoteka/plugins/golem15/user/controllers"
|
|
)
|
|
|
|
func TestSessionSequence(t *testing.T) {
|
|
app, _ := sessionApp(t, "0s")
|
|
disableRegisterThrottle(t, app)
|
|
|
|
reg := postRegister(t, app, "203.0.113.10", `{"email":"sequence@example.test","password":"correct-horse","password_confirmation":"correct-horse","name":"Seq"}`)
|
|
if reg.Code != http.StatusOK {
|
|
t.Fatalf("register %d %s", reg.Code, reg.Body.String())
|
|
}
|
|
token := tokenFrom(t, reg.Body.Bytes())
|
|
|
|
fetch := bearer(t, controllers.Fetch(app), http.MethodGet, "/_user/api/v1/fetch", token)
|
|
if fetch.Code != http.StatusOK {
|
|
t.Fatalf("fetch %d %s", fetch.Code, fetch.Body.String())
|
|
}
|
|
updated := bearerJSON(t, controllers.Update(app), "/_user/api/v1/update", token, `{"name":"Seq","surname":"User","email":"sequence@example.test"}`)
|
|
if updated.Code != http.StatusOK {
|
|
t.Fatalf("update %d %s", updated.Code, updated.Body.String())
|
|
}
|
|
changed := bearerJSON(t, controllers.ChangePassword(app), "/_user/api/v1/change-password", token, `{"current_password":"correct-horse","password":"parity-alice-next","password_confirmation":"parity-alice-next"}`)
|
|
if changed.Code != http.StatusOK {
|
|
t.Fatalf("change-password %d %s", changed.Code, changed.Body.String())
|
|
}
|
|
refreshed := bearer(t, controllers.Refresh(app), http.MethodPost, "/_user/api/v1/refresh", token)
|
|
if refreshed.Code != http.StatusOK {
|
|
t.Fatalf("refresh %d %s", refreshed.Code, refreshed.Body.String())
|
|
}
|
|
next := tokenFrom(t, refreshed.Body.Bytes())
|
|
out := bearer(t, controllers.Logout(app), http.MethodPost, "/_user/api/v1/logout", next)
|
|
if out.Code != http.StatusOK {
|
|
t.Fatalf("logout %d %s", out.Code, out.Body.String())
|
|
}
|
|
again := bearer(t, controllers.Fetch(app), http.MethodGet, "/_user/api/v1/fetch", next)
|
|
if again.Code != http.StatusUnauthorized {
|
|
t.Fatalf("reused fetch %d %s", again.Code, again.Body.String())
|
|
}
|
|
}
|
|
|
|
func tokenFrom(t *testing.T, raw []byte) string {
|
|
t.Helper()
|
|
var body map[string]any
|
|
if err := json.Unmarshal(raw, &body); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
token, _ := body["token"].(string)
|
|
if token == "" {
|
|
t.Fatalf("token missing: %s", raw)
|
|
}
|
|
return token
|
|
}
|