feat(server): add file route integration tests with ownership
enforcement - test: cover authenticated register, login, upload, list, and download flow - test: verify file API routes reject test identity header injection - test: verify file API routes reject invalid, expired, and malformed tokens - test: verify cross-user ownership isolation for all file CRUD operations - refactor: rename test-only header constant to clarify it is not used in production
This commit is contained in:
@@ -0,0 +1,502 @@
|
||||
package server
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"encoding/json"
|
||||
"io"
|
||||
"mime/multipart"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/dhao2001/mygo/internal/app"
|
||||
"github.com/dhao2001/mygo/internal/auth"
|
||||
"github.com/dhao2001/mygo/internal/config"
|
||||
"github.com/dhao2001/mygo/internal/repository"
|
||||
"github.com/dhao2001/mygo/internal/service"
|
||||
"github.com/dhao2001/mygo/internal/storage"
|
||||
)
|
||||
|
||||
const (
|
||||
fileIntegrationJWTSecret = "test-secret"
|
||||
fileIntegrationMaxUploadSize = 20 << 20
|
||||
)
|
||||
|
||||
type fileIntegrationFixture struct {
|
||||
router http.Handler
|
||||
jwtSecret []byte
|
||||
}
|
||||
|
||||
type fileIntegrationTokens struct {
|
||||
AccessToken string `json:"access_token"`
|
||||
RefreshToken string `json:"refresh_token"`
|
||||
}
|
||||
|
||||
type fileIntegrationInfo struct {
|
||||
ID string `json:"id"`
|
||||
Name string `json:"name"`
|
||||
Size int64 `json:"size"`
|
||||
}
|
||||
|
||||
type fileIntegrationList struct {
|
||||
Files []fileIntegrationInfo `json:"files"`
|
||||
Total int64 `json:"total"`
|
||||
}
|
||||
|
||||
func newFileIntegrationFixture(t *testing.T) *fileIntegrationFixture {
|
||||
t.Helper()
|
||||
|
||||
dbCfg := config.DatabaseConfig{
|
||||
Driver: "sqlite3",
|
||||
SQLite: config.SQLiteConfig{Path: ":memory:"},
|
||||
}
|
||||
db, err := repository.Open(dbCfg)
|
||||
if err != nil {
|
||||
t.Fatalf("open db: %v", err)
|
||||
}
|
||||
if err := repository.AutoMigrate(db); err != nil {
|
||||
t.Fatalf("migrate: %v", err)
|
||||
}
|
||||
|
||||
userRepo := repository.NewUserRepository(db)
|
||||
sessionRepo := repository.NewSessionRepository(db)
|
||||
fileRepo := repository.NewFileRepository(db)
|
||||
credentialRepo := repository.NewCredentialRepository(db)
|
||||
store, err := storage.NewLocalStorage(t.TempDir())
|
||||
if err != nil {
|
||||
t.Fatalf("create local storage: %v", err)
|
||||
}
|
||||
|
||||
jwtSecret := []byte(fileIntegrationJWTSecret)
|
||||
authService := service.NewAuthService(
|
||||
userRepo,
|
||||
sessionRepo,
|
||||
credentialRepo,
|
||||
jwtSecret,
|
||||
15*time.Minute,
|
||||
168*time.Hour,
|
||||
)
|
||||
fileService := service.NewFileService(fileRepo, store, fileIntegrationMaxUploadSize, nil)
|
||||
cfg := &config.Config{
|
||||
JWT: config.JWTConfig{
|
||||
Secret: string(jwtSecret),
|
||||
AccessTTL: 15 * time.Minute,
|
||||
RefreshTTL: 168 * time.Hour,
|
||||
},
|
||||
Storage: config.StorageConfig{MaxUploadSize: fileIntegrationMaxUploadSize},
|
||||
}
|
||||
webApp := app.NewWebApp(
|
||||
cfg,
|
||||
db,
|
||||
userRepo,
|
||||
sessionRepo,
|
||||
fileRepo,
|
||||
credentialRepo,
|
||||
authService,
|
||||
service.NewAdminService(userRepo),
|
||||
fileService,
|
||||
store,
|
||||
)
|
||||
t.Cleanup(func() {
|
||||
if err := webApp.Close(); err != nil {
|
||||
t.Errorf("close web app: %v", err)
|
||||
}
|
||||
})
|
||||
|
||||
return &fileIntegrationFixture{
|
||||
router: NewRouter(webApp),
|
||||
jwtSecret: jwtSecret,
|
||||
}
|
||||
}
|
||||
|
||||
func (f *fileIntegrationFixture) registerAndLogin(
|
||||
t *testing.T,
|
||||
username string,
|
||||
) (string, fileIntegrationTokens) {
|
||||
t.Helper()
|
||||
|
||||
email := username + "@example.com"
|
||||
password := "password123"
|
||||
registerBody, err := json.Marshal(map[string]string{
|
||||
"username": username,
|
||||
"email": email,
|
||||
"password": password,
|
||||
})
|
||||
if err != nil {
|
||||
t.Fatalf("marshal register body: %v", err)
|
||||
}
|
||||
registerRequest := httptest.NewRequest(
|
||||
http.MethodPost,
|
||||
"/api/v1/auth/register",
|
||||
bytes.NewReader(registerBody),
|
||||
)
|
||||
registerRequest.Header.Set("Content-Type", "application/json")
|
||||
registerResponse := httptest.NewRecorder()
|
||||
f.router.ServeHTTP(registerResponse, registerRequest)
|
||||
if registerResponse.Code != http.StatusCreated {
|
||||
t.Fatalf("register %s: status=%d, body=%s", username, registerResponse.Code, registerResponse.Body.String())
|
||||
}
|
||||
|
||||
var registered struct {
|
||||
ID string `json:"id"`
|
||||
}
|
||||
if err := json.Unmarshal(registerResponse.Body.Bytes(), ®istered); err != nil {
|
||||
t.Fatalf("decode register response: %v", err)
|
||||
}
|
||||
if registered.ID == "" {
|
||||
t.Fatal("register response has empty user ID")
|
||||
}
|
||||
|
||||
loginBody, err := json.Marshal(map[string]string{
|
||||
"email": email,
|
||||
"password": password,
|
||||
})
|
||||
if err != nil {
|
||||
t.Fatalf("marshal login body: %v", err)
|
||||
}
|
||||
loginRequest := httptest.NewRequest(
|
||||
http.MethodPost,
|
||||
"/api/v1/auth/login",
|
||||
bytes.NewReader(loginBody),
|
||||
)
|
||||
loginRequest.Header.Set("Content-Type", "application/json")
|
||||
loginResponse := httptest.NewRecorder()
|
||||
f.router.ServeHTTP(loginResponse, loginRequest)
|
||||
if loginResponse.Code != http.StatusOK {
|
||||
t.Fatalf("login %s: status=%d, body=%s", username, loginResponse.Code, loginResponse.Body.String())
|
||||
}
|
||||
|
||||
var tokens fileIntegrationTokens
|
||||
if err := json.Unmarshal(loginResponse.Body.Bytes(), &tokens); err != nil {
|
||||
t.Fatalf("decode login response: %v", err)
|
||||
}
|
||||
if tokens.AccessToken == "" || tokens.RefreshToken == "" {
|
||||
t.Fatal("login response has an empty token")
|
||||
}
|
||||
|
||||
return registered.ID, tokens
|
||||
}
|
||||
|
||||
func newAuthenticatedFileRequest(method, target string, body io.Reader, token string) *http.Request {
|
||||
req := httptest.NewRequest(method, target, body)
|
||||
req.Header.Set("Authorization", "Bearer "+token)
|
||||
return req
|
||||
}
|
||||
|
||||
func newFileUploadRequest(
|
||||
t *testing.T,
|
||||
target, token, fileName string,
|
||||
content []byte,
|
||||
) *http.Request {
|
||||
t.Helper()
|
||||
|
||||
body := &bytes.Buffer{}
|
||||
writer := multipart.NewWriter(body)
|
||||
part, err := writer.CreateFormFile("file", fileName)
|
||||
if err != nil {
|
||||
t.Fatalf("create multipart file: %v", err)
|
||||
}
|
||||
if _, err := part.Write(content); err != nil {
|
||||
t.Fatalf("write multipart file: %v", err)
|
||||
}
|
||||
if err := writer.Close(); err != nil {
|
||||
t.Fatalf("close multipart writer: %v", err)
|
||||
}
|
||||
|
||||
req := newAuthenticatedFileRequest(http.MethodPost, target, body, token)
|
||||
req.Header.Set("Content-Type", writer.FormDataContentType())
|
||||
return req
|
||||
}
|
||||
|
||||
func (f *fileIntegrationFixture) uploadFile(
|
||||
t *testing.T,
|
||||
token, fileName string,
|
||||
content []byte,
|
||||
) fileIntegrationInfo {
|
||||
t.Helper()
|
||||
|
||||
req := newFileUploadRequest(t, "/api/v1/files", token, fileName, content)
|
||||
rec := httptest.NewRecorder()
|
||||
f.router.ServeHTTP(rec, req)
|
||||
if rec.Code != http.StatusCreated {
|
||||
t.Fatalf("upload %s: status=%d, body=%s", fileName, rec.Code, rec.Body.String())
|
||||
}
|
||||
|
||||
var uploaded fileIntegrationInfo
|
||||
if err := json.Unmarshal(rec.Body.Bytes(), &uploaded); err != nil {
|
||||
t.Fatalf("decode upload response: %v", err)
|
||||
}
|
||||
return uploaded
|
||||
}
|
||||
|
||||
func (f *fileIntegrationFixture) createDirectory(
|
||||
t *testing.T,
|
||||
token, name string,
|
||||
parentID *string,
|
||||
) fileIntegrationInfo {
|
||||
t.Helper()
|
||||
|
||||
body, err := json.Marshal(map[string]any{
|
||||
"name": name,
|
||||
"parent_id": parentID,
|
||||
})
|
||||
if err != nil {
|
||||
t.Fatalf("marshal create directory body: %v", err)
|
||||
}
|
||||
req := newAuthenticatedFileRequest(http.MethodPost, "/api/v1/files", bytes.NewReader(body), token)
|
||||
req.Header.Set("Content-Type", "application/json")
|
||||
rec := httptest.NewRecorder()
|
||||
f.router.ServeHTTP(rec, req)
|
||||
if rec.Code != http.StatusCreated {
|
||||
t.Fatalf("create directory %s: status=%d, body=%s", name, rec.Code, rec.Body.String())
|
||||
}
|
||||
|
||||
var created fileIntegrationInfo
|
||||
if err := json.Unmarshal(rec.Body.Bytes(), &created); err != nil {
|
||||
t.Fatalf("decode create directory response: %v", err)
|
||||
}
|
||||
return created
|
||||
}
|
||||
|
||||
func (f *fileIntegrationFixture) listFiles(
|
||||
t *testing.T,
|
||||
token, target string,
|
||||
) fileIntegrationList {
|
||||
t.Helper()
|
||||
|
||||
req := newAuthenticatedFileRequest(http.MethodGet, target, nil, token)
|
||||
rec := httptest.NewRecorder()
|
||||
f.router.ServeHTTP(rec, req)
|
||||
if rec.Code != http.StatusOK {
|
||||
t.Fatalf("list files: status=%d, body=%s", rec.Code, rec.Body.String())
|
||||
}
|
||||
|
||||
var list fileIntegrationList
|
||||
if err := json.Unmarshal(rec.Body.Bytes(), &list); err != nil {
|
||||
t.Fatalf("decode file list: %v", err)
|
||||
}
|
||||
return list
|
||||
}
|
||||
|
||||
func TestAuthenticatedFileFlow(t *testing.T) {
|
||||
fixture := newFileIntegrationFixture(t)
|
||||
_, tokens := fixture.registerAndLogin(t, "web-user")
|
||||
|
||||
initialList := fixture.listFiles(t, tokens.AccessToken, "/api/v1/files?offset=0&limit=50")
|
||||
if initialList.Total != 0 {
|
||||
t.Fatalf("initial total=%d, want 0", initialList.Total)
|
||||
}
|
||||
|
||||
fileContent := []byte("MyGO browser milestone upload")
|
||||
uploadedFile := fixture.uploadFile(t, tokens.AccessToken, "milestone.txt", fileContent)
|
||||
if uploadedFile.Name != "milestone.txt" || uploadedFile.Size != int64(len(fileContent)) {
|
||||
t.Fatalf("uploaded file=%+v, want name milestone.txt and size %d", uploadedFile, len(fileContent))
|
||||
}
|
||||
|
||||
uploadedList := fixture.listFiles(t, tokens.AccessToken, "/api/v1/files?offset=0&limit=50")
|
||||
if uploadedList.Total != 1 || len(uploadedList.Files) != 1 || uploadedList.Files[0].ID != uploadedFile.ID {
|
||||
t.Fatalf("uploaded list=%+v, want the uploaded file", uploadedList)
|
||||
}
|
||||
|
||||
downloadRequest := newAuthenticatedFileRequest(
|
||||
http.MethodGet,
|
||||
"/api/v1/files/"+uploadedFile.ID+"/content",
|
||||
nil,
|
||||
tokens.AccessToken,
|
||||
)
|
||||
downloadResponse := httptest.NewRecorder()
|
||||
fixture.router.ServeHTTP(downloadResponse, downloadRequest)
|
||||
if downloadResponse.Code != http.StatusOK {
|
||||
t.Fatalf("download: status=%d, body=%s", downloadResponse.Code, downloadResponse.Body.String())
|
||||
}
|
||||
if !bytes.Equal(downloadResponse.Body.Bytes(), fileContent) {
|
||||
t.Fatalf("downloaded content=%q, want %q", downloadResponse.Body.Bytes(), fileContent)
|
||||
}
|
||||
if disposition := downloadResponse.Header().Get("Content-Disposition"); disposition == "" {
|
||||
t.Fatal("download response has empty Content-Disposition")
|
||||
}
|
||||
}
|
||||
|
||||
func TestFileRoutesRejectTestIdentityHeaders(t *testing.T) {
|
||||
fixture := newFileIntegrationFixture(t)
|
||||
routes := []struct {
|
||||
name string
|
||||
method string
|
||||
target string
|
||||
}{
|
||||
{name: "list", method: http.MethodGet, target: "/api/v1/files"},
|
||||
{name: "upload", method: http.MethodPost, target: "/api/v1/files"},
|
||||
{name: "get", method: http.MethodGet, target: "/api/v1/files/file-id"},
|
||||
{name: "download", method: http.MethodGet, target: "/api/v1/files/file-id/content"},
|
||||
{name: "update", method: http.MethodPut, target: "/api/v1/files/file-id"},
|
||||
{name: "delete", method: http.MethodDelete, target: "/api/v1/files/file-id"},
|
||||
}
|
||||
|
||||
for _, route := range routes {
|
||||
t.Run(route.name, func(t *testing.T) {
|
||||
req := httptest.NewRequest(route.method, route.target, nil)
|
||||
req.Header.Set("X-Test-User-ID", "attacker")
|
||||
req.Header.Set("X-User-ID", "attacker")
|
||||
rec := httptest.NewRecorder()
|
||||
fixture.router.ServeHTTP(rec, req)
|
||||
|
||||
if rec.Code != http.StatusUnauthorized {
|
||||
t.Fatalf("status=%d, want %d; body=%s", rec.Code, http.StatusUnauthorized, rec.Body.String())
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestFileRoutesRejectInvalidAccessTokens(t *testing.T) {
|
||||
fixture := newFileIntegrationFixture(t)
|
||||
userID, tokens := fixture.registerAndLogin(t, "token-user")
|
||||
|
||||
wrongSignatureToken, err := auth.GenerateAccessToken(userID, []byte("wrong-secret"), 15*time.Minute)
|
||||
if err != nil {
|
||||
t.Fatalf("generate wrong-signature token: %v", err)
|
||||
}
|
||||
expiredToken, err := auth.GenerateAccessToken(userID, fixture.jwtSecret, -time.Minute)
|
||||
if err != nil {
|
||||
t.Fatalf("generate expired token: %v", err)
|
||||
}
|
||||
|
||||
tests := []struct {
|
||||
name string
|
||||
token string
|
||||
}{
|
||||
{name: "malformed", token: "not-a-jwt"},
|
||||
{name: "wrong-signature", token: wrongSignatureToken},
|
||||
{name: "expired", token: expiredToken},
|
||||
{name: "refresh-token", token: tokens.RefreshToken},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
req := newFileUploadRequest(t, "/api/v1/files", tt.token, tt.name+".txt", []byte("must not persist"))
|
||||
rec := httptest.NewRecorder()
|
||||
fixture.router.ServeHTTP(rec, req)
|
||||
|
||||
if rec.Code != http.StatusUnauthorized {
|
||||
t.Fatalf("status=%d, want %d; body=%s", rec.Code, http.StatusUnauthorized, rec.Body.String())
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
list := fixture.listFiles(t, tokens.AccessToken, "/api/v1/files")
|
||||
if list.Total != 0 || len(list.Files) != 0 {
|
||||
t.Fatalf("files after rejected uploads=%+v, want empty list", list)
|
||||
}
|
||||
}
|
||||
|
||||
func TestFileRoutesEnforceAuthenticatedOwnership(t *testing.T) {
|
||||
fixture := newFileIntegrationFixture(t)
|
||||
_, ownerTokens := fixture.registerAndLogin(t, "owner")
|
||||
_, otherTokens := fixture.registerAndLogin(t, "other-user")
|
||||
|
||||
privateDir := fixture.createDirectory(t, ownerTokens.AccessToken, "private", nil)
|
||||
fileContent := []byte("owner-only content")
|
||||
privateFile := fixture.uploadFile(t, ownerTokens.AccessToken, "owner.txt", fileContent)
|
||||
|
||||
otherList := fixture.listFiles(t, otherTokens.AccessToken, "/api/v1/files")
|
||||
if otherList.Total != 0 || len(otherList.Files) != 0 {
|
||||
t.Fatalf("other user's root list=%+v, want empty list", otherList)
|
||||
}
|
||||
|
||||
createBody, err := json.Marshal(map[string]any{
|
||||
"name": "intrusion",
|
||||
"parent_id": privateDir.ID,
|
||||
})
|
||||
if err != nil {
|
||||
t.Fatalf("marshal cross-owner create body: %v", err)
|
||||
}
|
||||
createRequest := newAuthenticatedFileRequest(
|
||||
http.MethodPost,
|
||||
"/api/v1/files",
|
||||
bytes.NewReader(createBody),
|
||||
otherTokens.AccessToken,
|
||||
)
|
||||
createRequest.Header.Set("Content-Type", "application/json")
|
||||
createResponse := httptest.NewRecorder()
|
||||
fixture.router.ServeHTTP(createResponse, createRequest)
|
||||
if createResponse.Code != http.StatusForbidden {
|
||||
t.Fatalf("cross-owner create: status=%d, want %d; body=%s", createResponse.Code, http.StatusForbidden, createResponse.Body.String())
|
||||
}
|
||||
|
||||
updateBody := []byte(`{"name":"stolen.txt"}`)
|
||||
requests := []struct {
|
||||
name string
|
||||
method string
|
||||
target string
|
||||
body []byte
|
||||
contentType string
|
||||
}{
|
||||
{name: "get", method: http.MethodGet, target: "/api/v1/files/" + privateFile.ID},
|
||||
{name: "download", method: http.MethodGet, target: "/api/v1/files/" + privateFile.ID + "/content"},
|
||||
{name: "update", method: http.MethodPut, target: "/api/v1/files/" + privateFile.ID, body: updateBody, contentType: "application/json"},
|
||||
{name: "delete", method: http.MethodDelete, target: "/api/v1/files/" + privateFile.ID},
|
||||
}
|
||||
|
||||
for _, request := range requests {
|
||||
t.Run(request.name, func(t *testing.T) {
|
||||
req := newAuthenticatedFileRequest(
|
||||
request.method,
|
||||
request.target,
|
||||
bytes.NewReader(request.body),
|
||||
otherTokens.AccessToken,
|
||||
)
|
||||
if request.contentType != "" {
|
||||
req.Header.Set("Content-Type", request.contentType)
|
||||
}
|
||||
rec := httptest.NewRecorder()
|
||||
fixture.router.ServeHTTP(rec, req)
|
||||
|
||||
if rec.Code != http.StatusForbidden {
|
||||
t.Fatalf("status=%d, want %d; body=%s", rec.Code, http.StatusForbidden, rec.Body.String())
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
getRequest := newAuthenticatedFileRequest(
|
||||
http.MethodGet,
|
||||
"/api/v1/files/"+privateFile.ID,
|
||||
nil,
|
||||
ownerTokens.AccessToken,
|
||||
)
|
||||
getResponse := httptest.NewRecorder()
|
||||
fixture.router.ServeHTTP(getResponse, getRequest)
|
||||
if getResponse.Code != http.StatusOK {
|
||||
t.Fatalf("owner get after rejected access: status=%d, body=%s", getResponse.Code, getResponse.Body.String())
|
||||
}
|
||||
var retainedFile fileIntegrationInfo
|
||||
if err := json.Unmarshal(getResponse.Body.Bytes(), &retainedFile); err != nil {
|
||||
t.Fatalf("decode retained file: %v", err)
|
||||
}
|
||||
if retainedFile.Name != privateFile.Name {
|
||||
t.Fatalf("retained file name=%q, want %q", retainedFile.Name, privateFile.Name)
|
||||
}
|
||||
|
||||
downloadRequest := newAuthenticatedFileRequest(
|
||||
http.MethodGet,
|
||||
"/api/v1/files/"+privateFile.ID+"/content",
|
||||
nil,
|
||||
ownerTokens.AccessToken,
|
||||
)
|
||||
downloadResponse := httptest.NewRecorder()
|
||||
fixture.router.ServeHTTP(downloadResponse, downloadRequest)
|
||||
if downloadResponse.Code != http.StatusOK {
|
||||
t.Fatalf("owner download after rejected access: status=%d, body=%s", downloadResponse.Code, downloadResponse.Body.String())
|
||||
}
|
||||
if !bytes.Equal(downloadResponse.Body.Bytes(), fileContent) {
|
||||
t.Fatalf("retained file content=%q, want %q", downloadResponse.Body.Bytes(), fileContent)
|
||||
}
|
||||
|
||||
dirList := fixture.listFiles(
|
||||
t,
|
||||
ownerTokens.AccessToken,
|
||||
"/api/v1/files?parent_id="+privateDir.ID,
|
||||
)
|
||||
if dirList.Total != 0 || len(dirList.Files) != 0 {
|
||||
t.Fatalf("private directory after rejected create=%+v, want empty list", dirList)
|
||||
}
|
||||
}
|
||||
@@ -4,8 +4,6 @@ import (
|
||||
"bytes"
|
||||
"context"
|
||||
"encoding/json"
|
||||
"io"
|
||||
"mime/multipart"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"testing"
|
||||
@@ -16,7 +14,6 @@ import (
|
||||
"github.com/dhao2001/mygo/internal/config"
|
||||
"github.com/dhao2001/mygo/internal/repository"
|
||||
"github.com/dhao2001/mygo/internal/service"
|
||||
"github.com/dhao2001/mygo/internal/storage"
|
||||
)
|
||||
|
||||
func TestVersionRoute(t *testing.T) {
|
||||
@@ -184,192 +181,3 @@ func TestAdminRoutes(t *testing.T) {
|
||||
t.Errorf("no-auth delete: status=%d, want %d, body=%s", rec.Code, http.StatusUnauthorized, rec.Body.String())
|
||||
}
|
||||
}
|
||||
|
||||
func TestAuthenticatedFileFlow(t *testing.T) {
|
||||
dbCfg := config.DatabaseConfig{
|
||||
Driver: "sqlite3",
|
||||
SQLite: config.SQLiteConfig{Path: ":memory:"},
|
||||
}
|
||||
db, err := repository.Open(dbCfg)
|
||||
if err != nil {
|
||||
t.Fatalf("open db: %v", err)
|
||||
}
|
||||
if err := repository.AutoMigrate(db); err != nil {
|
||||
t.Fatalf("migrate: %v", err)
|
||||
}
|
||||
|
||||
userRepo := repository.NewUserRepository(db)
|
||||
sessionRepo := repository.NewSessionRepository(db)
|
||||
fileRepo := repository.NewFileRepository(db)
|
||||
credentialRepo := repository.NewCredentialRepository(db)
|
||||
store, err := storage.NewLocalStorage(t.TempDir())
|
||||
if err != nil {
|
||||
t.Fatalf("create local storage: %v", err)
|
||||
}
|
||||
|
||||
const maxUploadSize = 20 << 20
|
||||
jwtSecret := []byte("test-secret")
|
||||
authService := service.NewAuthService(
|
||||
userRepo,
|
||||
sessionRepo,
|
||||
credentialRepo,
|
||||
jwtSecret,
|
||||
15*time.Minute,
|
||||
168*time.Hour,
|
||||
)
|
||||
fileService := service.NewFileService(fileRepo, store, maxUploadSize, nil)
|
||||
cfg := &config.Config{
|
||||
JWT: config.JWTConfig{
|
||||
Secret: string(jwtSecret),
|
||||
AccessTTL: 15 * time.Minute,
|
||||
RefreshTTL: 168 * time.Hour,
|
||||
},
|
||||
Storage: config.StorageConfig{MaxUploadSize: maxUploadSize},
|
||||
}
|
||||
webApp := app.NewWebApp(
|
||||
cfg,
|
||||
db,
|
||||
userRepo,
|
||||
sessionRepo,
|
||||
fileRepo,
|
||||
credentialRepo,
|
||||
authService,
|
||||
service.NewAdminService(userRepo),
|
||||
fileService,
|
||||
store,
|
||||
)
|
||||
t.Cleanup(func() {
|
||||
if err := webApp.Close(); err != nil {
|
||||
t.Errorf("close web app: %v", err)
|
||||
}
|
||||
})
|
||||
router := NewRouter(webApp)
|
||||
|
||||
registerBody := []byte(`{"username":"web-user","email":"web@example.com","password":"password123"}`)
|
||||
registerRequest := httptest.NewRequest(
|
||||
http.MethodPost,
|
||||
"/api/v1/auth/register",
|
||||
bytes.NewReader(registerBody),
|
||||
)
|
||||
registerRequest.Header.Set("Content-Type", "application/json")
|
||||
registerResponse := httptest.NewRecorder()
|
||||
router.ServeHTTP(registerResponse, registerRequest)
|
||||
if registerResponse.Code != http.StatusCreated {
|
||||
t.Fatalf("register: status=%d, body=%s", registerResponse.Code, registerResponse.Body.String())
|
||||
}
|
||||
|
||||
loginBody := []byte(`{"email":"web@example.com","password":"password123"}`)
|
||||
loginRequest := httptest.NewRequest(
|
||||
http.MethodPost,
|
||||
"/api/v1/auth/login",
|
||||
bytes.NewReader(loginBody),
|
||||
)
|
||||
loginRequest.Header.Set("Content-Type", "application/json")
|
||||
loginResponse := httptest.NewRecorder()
|
||||
router.ServeHTTP(loginResponse, loginRequest)
|
||||
if loginResponse.Code != http.StatusOK {
|
||||
t.Fatalf("login: status=%d, body=%s", loginResponse.Code, loginResponse.Body.String())
|
||||
}
|
||||
var tokens struct {
|
||||
AccessToken string `json:"access_token"`
|
||||
}
|
||||
if err := json.Unmarshal(loginResponse.Body.Bytes(), &tokens); err != nil {
|
||||
t.Fatalf("decode login response: %v", err)
|
||||
}
|
||||
if tokens.AccessToken == "" {
|
||||
t.Fatal("login response has empty access token")
|
||||
}
|
||||
|
||||
listRequest := httptest.NewRequest(http.MethodGet, "/api/v1/files?offset=0&limit=50", nil)
|
||||
listRequest.Header.Set("Authorization", "Bearer "+tokens.AccessToken)
|
||||
listResponse := httptest.NewRecorder()
|
||||
router.ServeHTTP(listResponse, listRequest)
|
||||
if listResponse.Code != http.StatusOK {
|
||||
t.Fatalf("initial list: status=%d, body=%s", listResponse.Code, listResponse.Body.String())
|
||||
}
|
||||
var initialList struct {
|
||||
Total int64 `json:"total"`
|
||||
}
|
||||
if err := json.Unmarshal(listResponse.Body.Bytes(), &initialList); err != nil {
|
||||
t.Fatalf("decode initial list: %v", err)
|
||||
}
|
||||
if initialList.Total != 0 {
|
||||
t.Fatalf("initial total=%d, want 0", initialList.Total)
|
||||
}
|
||||
|
||||
fileContent := []byte("MyGO browser milestone upload")
|
||||
uploadBody := &bytes.Buffer{}
|
||||
multipartWriter := multipart.NewWriter(uploadBody)
|
||||
filePart, err := multipartWriter.CreateFormFile("file", "milestone.txt")
|
||||
if err != nil {
|
||||
t.Fatalf("create multipart file: %v", err)
|
||||
}
|
||||
if _, err := filePart.Write(fileContent); err != nil {
|
||||
t.Fatalf("write multipart file: %v", err)
|
||||
}
|
||||
if err := multipartWriter.Close(); err != nil {
|
||||
t.Fatalf("close multipart writer: %v", err)
|
||||
}
|
||||
uploadRequest := httptest.NewRequest(http.MethodPost, "/api/v1/files", uploadBody)
|
||||
uploadRequest.Header.Set("Authorization", "Bearer "+tokens.AccessToken)
|
||||
uploadRequest.Header.Set("Content-Type", multipartWriter.FormDataContentType())
|
||||
uploadResponse := httptest.NewRecorder()
|
||||
router.ServeHTTP(uploadResponse, uploadRequest)
|
||||
if uploadResponse.Code != http.StatusCreated {
|
||||
t.Fatalf("upload: status=%d, body=%s", uploadResponse.Code, uploadResponse.Body.String())
|
||||
}
|
||||
var uploadedFile struct {
|
||||
ID string `json:"id"`
|
||||
Name string `json:"name"`
|
||||
Size int64 `json:"size"`
|
||||
}
|
||||
if err := json.Unmarshal(uploadResponse.Body.Bytes(), &uploadedFile); err != nil {
|
||||
t.Fatalf("decode upload response: %v", err)
|
||||
}
|
||||
if uploadedFile.Name != "milestone.txt" || uploadedFile.Size != int64(len(fileContent)) {
|
||||
t.Fatalf("uploaded file=%+v, want name milestone.txt and size %d", uploadedFile, len(fileContent))
|
||||
}
|
||||
|
||||
listRequest = httptest.NewRequest(http.MethodGet, "/api/v1/files?offset=0&limit=50", nil)
|
||||
listRequest.Header.Set("Authorization", "Bearer "+tokens.AccessToken)
|
||||
listResponse = httptest.NewRecorder()
|
||||
router.ServeHTTP(listResponse, listRequest)
|
||||
if listResponse.Code != http.StatusOK {
|
||||
t.Fatalf("list after upload: status=%d, body=%s", listResponse.Code, listResponse.Body.String())
|
||||
}
|
||||
var uploadedList struct {
|
||||
Files []struct {
|
||||
ID string `json:"id"`
|
||||
Name string `json:"name"`
|
||||
} `json:"files"`
|
||||
Total int64 `json:"total"`
|
||||
}
|
||||
if err := json.Unmarshal(listResponse.Body.Bytes(), &uploadedList); err != nil {
|
||||
t.Fatalf("decode uploaded list: %v", err)
|
||||
}
|
||||
if uploadedList.Total != 1 || len(uploadedList.Files) != 1 || uploadedList.Files[0].ID != uploadedFile.ID {
|
||||
t.Fatalf("uploaded list=%+v, want the uploaded file", uploadedList)
|
||||
}
|
||||
|
||||
downloadRequest := httptest.NewRequest(
|
||||
http.MethodGet,
|
||||
"/api/v1/files/"+uploadedFile.ID+"/content",
|
||||
nil,
|
||||
)
|
||||
downloadRequest.Header.Set("Authorization", "Bearer "+tokens.AccessToken)
|
||||
downloadResponse := httptest.NewRecorder()
|
||||
router.ServeHTTP(downloadResponse, downloadRequest)
|
||||
if downloadResponse.Code != http.StatusOK {
|
||||
t.Fatalf("download: status=%d, body=%s", downloadResponse.Code, downloadResponse.Body.String())
|
||||
}
|
||||
downloadedContent, err := io.ReadAll(downloadResponse.Body)
|
||||
if err != nil {
|
||||
t.Fatalf("read download response: %v", err)
|
||||
}
|
||||
if !bytes.Equal(downloadedContent, fileContent) {
|
||||
t.Fatalf("downloaded content=%q, want %q", downloadedContent, fileContent)
|
||||
}
|
||||
if disposition := downloadResponse.Header().Get("Content-Disposition"); disposition == "" {
|
||||
t.Fatal("download response has empty Content-Disposition")
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user