93 lines
3.1 KiB
Go
93 lines
3.1 KiB
Go
package httpapi
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
|
|
"mixmaker/backend/internal/application"
|
|
"mixmaker/backend/internal/domain"
|
|
"mixmaker/backend/internal/realtime"
|
|
)
|
|
|
|
func TestCreateEventRequestDefaultsEveryonePing(t *testing.T) {
|
|
if !((createEventRequest{}).options().PingEveryone) {
|
|
t.Fatal("legacy create requests without pingEveryone must keep @everyone enabled")
|
|
}
|
|
}
|
|
|
|
func TestCreateEventRequestCanDisableEveryonePing(t *testing.T) {
|
|
disabled := false
|
|
if (createEventRequest{PingEveryone: &disabled}).options().PingEveryone {
|
|
t.Fatal("explicit false pingEveryone must disable the ping")
|
|
}
|
|
}
|
|
|
|
type profileHTTPStore struct {
|
|
application.Store
|
|
account domain.Account
|
|
player domain.Player
|
|
}
|
|
|
|
func (s *profileHTTPStore) AccountBySession(context.Context, string) (domain.Account, domain.Player, error) {
|
|
return s.account, s.player, nil
|
|
}
|
|
|
|
func (s *profileHTTPStore) GetPlayer(context.Context, string) (domain.Player, error) {
|
|
return s.player, nil
|
|
}
|
|
|
|
func (s *profileHTTPStore) ListEvents(context.Context, time.Time) ([]domain.Event, error) {
|
|
return []domain.Event{}, nil
|
|
}
|
|
|
|
func TestPlayerProfileHTTPResponseIsPublicSafe(t *testing.T) {
|
|
store := &profileHTTPStore{
|
|
account: domain.Account{ID: "account", Role: domain.RolePlayer},
|
|
player: domain.Player{
|
|
ID: "player", AccountID: "account", DisplayName: "Ana", BattleTag: "Ana#1234",
|
|
Ratings: domain.Ratings{Tank: 10, Damage: 20, Support: 30},
|
|
PreferredPlayerIDs: []string{"secret-preference"}, AvoidedPlayerIDs: []string{"secret-avoid"},
|
|
},
|
|
}
|
|
hub := realtime.New()
|
|
handler := New(application.New(store, hub, nil), store, hub, Config{CookieName: "session"})
|
|
request := httptest.NewRequest(http.MethodGet, "/api/players/player", nil)
|
|
request.AddCookie(&http.Cookie{Name: "session", Value: "valid"})
|
|
response := httptest.NewRecorder()
|
|
handler.ServeHTTP(response, request)
|
|
|
|
if response.Code != http.StatusOK {
|
|
t.Fatalf("unexpected status %d: %s", response.Code, response.Body.String())
|
|
}
|
|
var body map[string]any
|
|
if err := json.Unmarshal(response.Body.Bytes(), &body); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
encoded := response.Body.String()
|
|
if strings.Contains(encoded, "preferred") || strings.Contains(encoded, "avoid") || strings.Contains(encoded, "accountId") {
|
|
t.Fatalf("profile leaked private fields: %s", encoded)
|
|
}
|
|
}
|
|
|
|
func TestModeratorCannotUpdateCommunitySettings(t *testing.T) {
|
|
store := &profileHTTPStore{
|
|
account: domain.Account{ID: "moderator", Role: domain.RoleModerator},
|
|
player: domain.Player{ID: "player", AccountID: "moderator"},
|
|
}
|
|
hub := realtime.New()
|
|
handler := New(application.New(store, hub, nil), store, hub, Config{CookieName: "session"})
|
|
request := httptest.NewRequest(http.MethodPut, "/api/community/settings", strings.NewReader(`{"discordInviteUrl":""}`))
|
|
request.AddCookie(&http.Cookie{Name: "session", Value: "valid"})
|
|
response := httptest.NewRecorder()
|
|
handler.ServeHTTP(response, request)
|
|
|
|
if response.Code != http.StatusForbidden {
|
|
t.Fatalf("moderator update returned %d: %s", response.Code, response.Body.String())
|
|
}
|
|
}
|