Christophe Vila
e37173ea08
Completes the internal/api scoping pass -- the whole package now compiles against the per-user store/sync/garmin signatures from Tasks 4-13. Also fixes the test helpers (newTestServer now returns the provisioned userID) and a latent bug in TestResolveUser_LeavesContextEmptyWhenNotProvisioned, which relied on doJSON's hardcoded "test-user" session sub being unprovisioned -- never caught before since internal/api couldn't compile since Task 12. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
69 lines
2.4 KiB
Go
69 lines
2.4 KiB
Go
package api
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"path/filepath"
|
|
"testing"
|
|
|
|
"geniusrun/backend/internal/auth"
|
|
authmock "geniusrun/backend/internal/auth/mock"
|
|
"geniusrun/backend/internal/garmin"
|
|
"geniusrun/backend/internal/garmin/mock"
|
|
"geniusrun/backend/internal/store"
|
|
appsync "geniusrun/backend/internal/sync"
|
|
)
|
|
|
|
func TestResolveUser_AttachesResolvedUserWhenProvisioned(t *testing.T) {
|
|
s, _, userID := newTestServer(t)
|
|
|
|
var gotUserID int64
|
|
var gotOK bool
|
|
handler := auth.RequireSession(testSessionConfig.Secret)(s.resolveUser(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
u, ok := userFromContext(r.Context())
|
|
gotUserID, gotOK = u.ID, ok
|
|
})))
|
|
|
|
rec := doJSON(t, handler, http.MethodGet, "/", nil) // doJSON's test cookie carries Sub: "test-user"
|
|
_ = rec
|
|
if !gotOK || gotUserID != userID {
|
|
t.Fatalf("resolveUser: ok=%v userID=%d, want ok=true userID=%d", gotOK, gotUserID, userID)
|
|
}
|
|
}
|
|
|
|
func TestResolveUser_LeavesContextEmptyWhenNotProvisioned(t *testing.T) {
|
|
// Deliberately not newTestServer(t): that helper auto-provisions the
|
|
// "test-user" sub that doJSON's cookie always carries, which would
|
|
// defeat the point of this test. Build a server against a bare DB
|
|
// instead, same pattern as setup_test.go's unprovisioned-session tests.
|
|
db, err := store.Open(filepath.Join(t.TempDir(), "geniusrun_test.db"))
|
|
if err != nil {
|
|
t.Fatalf("store.Open: %v", err)
|
|
}
|
|
t.Cleanup(func() { db.Close() })
|
|
m := &mock.Client{}
|
|
s := NewServer(db, func(garmin.Config) garmin.Client { return m }, garmin.Config{}, appsync.Config{}, &authmock.Verifier{}, testSessionConfig)
|
|
|
|
var gotOK bool
|
|
handler := auth.RequireSession(testSessionConfig.Secret)(s.resolveUser(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
_, gotOK = userFromContext(r.Context())
|
|
})))
|
|
|
|
doJSON(t, handler, http.MethodGet, "/", nil) // "test-user" sub, never provisioned in this test
|
|
if gotOK {
|
|
t.Fatal("expected userFromContext to report not-found for an unprovisioned sub")
|
|
}
|
|
}
|
|
|
|
func TestRequireProvisionedUser_RejectsWhenNoUserResolved(t *testing.T) {
|
|
handler := requireProvisionedUser(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
t.Fatal("handler should not be reached")
|
|
}))
|
|
req := httptest.NewRequest(http.MethodGet, "/", nil)
|
|
rec := httptest.NewRecorder()
|
|
handler.ServeHTTP(rec, req)
|
|
if rec.Code != http.StatusForbidden {
|
|
t.Fatalf("status = %d, want 403", rec.Code)
|
|
}
|
|
}
|