Spaces:
Paused
Paused
| mod common; | |
| use axum::body::Body; | |
| use axum::http::{Request, StatusCode}; | |
| use http_body_util::BodyExt; | |
| use tower::ServiceExt; | |
| fn json_body(json: serde_json::Value) -> Body { | |
| Body::from(json.to_string()) | |
| } | |
| async fn setup_creates_admin_and_returns_token() { | |
| let (app, _state) = common::setup_test_app().await; | |
| let req = Request::builder() | |
| .method("POST") | |
| .uri("/api/auth/setup") | |
| .header("content-type", "application/json") | |
| .body(json_body(serde_json::json!({ | |
| "username": "admin", | |
| "password": "testpassword123" | |
| }))) | |
| .unwrap(); | |
| let res = app.oneshot(req).await.unwrap(); | |
| assert_eq!(res.status(), StatusCode::OK); | |
| let set_cookie = common::extract_set_cookie(res.headers()); | |
| assert!(set_cookie.is_some(), "should set refresh cookie"); | |
| let body = res.into_body().collect().await.unwrap().to_bytes(); | |
| let json: serde_json::Value = serde_json::from_slice(&body).unwrap(); | |
| assert!(json["token"].is_string()); | |
| } | |
| async fn setup_fails_when_admin_exists() { | |
| let (app, _state) = common::setup_test_app().await; | |
| // First setup succeeds | |
| common::setup_admin(&app).await; | |
| // Second setup fails | |
| let req = Request::builder() | |
| .method("POST") | |
| .uri("/api/auth/setup") | |
| .header("content-type", "application/json") | |
| .body(json_body(serde_json::json!({ | |
| "username": "admin2", | |
| "password": "testpassword123" | |
| }))) | |
| .unwrap(); | |
| let res = app.oneshot(req).await.unwrap(); | |
| assert_eq!(res.status(), StatusCode::FORBIDDEN); | |
| } | |
| async fn login_with_valid_credentials() { | |
| let (app, _state) = common::setup_test_app().await; | |
| common::setup_admin(&app).await; | |
| let req = Request::builder() | |
| .method("POST") | |
| .uri("/api/auth/login") | |
| .header("content-type", "application/json") | |
| .body(json_body(serde_json::json!({ | |
| "username": "admin", | |
| "password": "testpassword123" | |
| }))) | |
| .unwrap(); | |
| let res = app.oneshot(req).await.unwrap(); | |
| assert_eq!(res.status(), StatusCode::OK); | |
| let body = res.into_body().collect().await.unwrap().to_bytes(); | |
| let json: serde_json::Value = serde_json::from_slice(&body).unwrap(); | |
| assert!(json["token"].is_string()); | |
| } | |
| async fn login_with_wrong_password() { | |
| let (app, _state) = common::setup_test_app().await; | |
| common::setup_admin(&app).await; | |
| let req = Request::builder() | |
| .method("POST") | |
| .uri("/api/auth/login") | |
| .header("content-type", "application/json") | |
| .body(json_body(serde_json::json!({ | |
| "username": "admin", | |
| "password": "wrongpassword" | |
| }))) | |
| .unwrap(); | |
| let res = app.oneshot(req).await.unwrap(); | |
| assert_eq!(res.status(), StatusCode::UNAUTHORIZED); | |
| } | |
| async fn login_with_unknown_user() { | |
| let (app, _state) = common::setup_test_app().await; | |
| common::setup_admin(&app).await; | |
| let req = Request::builder() | |
| .method("POST") | |
| .uri("/api/auth/login") | |
| .header("content-type", "application/json") | |
| .body(json_body(serde_json::json!({ | |
| "username": "nonexistent", | |
| "password": "testpassword123" | |
| }))) | |
| .unwrap(); | |
| let res = app.oneshot(req).await.unwrap(); | |
| assert_eq!(res.status(), StatusCode::UNAUTHORIZED); | |
| } | |
| async fn refresh_with_valid_cookie() { | |
| let (app, _state) = common::setup_test_app().await; | |
| // Setup to get refresh token | |
| let req = Request::builder() | |
| .method("POST") | |
| .uri("/api/auth/setup") | |
| .header("content-type", "application/json") | |
| .body(json_body(serde_json::json!({ | |
| "username": "admin", | |
| "password": "testpassword123" | |
| }))) | |
| .unwrap(); | |
| let res = app.clone().oneshot(req).await.unwrap(); | |
| let set_cookie = common::extract_set_cookie(res.headers()).unwrap(); | |
| let refresh_token = common::extract_refresh_token(&set_cookie).unwrap(); | |
| // Use refresh token | |
| let req = Request::builder() | |
| .method("POST") | |
| .uri("/api/auth/refresh") | |
| .header("cookie", format!("refresh_token={refresh_token}")) | |
| .body(Body::empty()) | |
| .unwrap(); | |
| let res = app.oneshot(req).await.unwrap(); | |
| assert_eq!(res.status(), StatusCode::OK); | |
| // Should get new tokens | |
| let new_set_cookie = common::extract_set_cookie(res.headers()); | |
| assert!(new_set_cookie.is_some(), "should set new refresh cookie"); | |
| let body = res.into_body().collect().await.unwrap().to_bytes(); | |
| let json: serde_json::Value = serde_json::from_slice(&body).unwrap(); | |
| assert!(json["token"].is_string()); | |
| } | |
| async fn refresh_token_rotation_invalidates_old() { | |
| let (app, _state) = common::setup_test_app().await; | |
| // Setup to get refresh token | |
| let req = Request::builder() | |
| .method("POST") | |
| .uri("/api/auth/setup") | |
| .header("content-type", "application/json") | |
| .body(json_body(serde_json::json!({ | |
| "username": "admin", | |
| "password": "testpassword123" | |
| }))) | |
| .unwrap(); | |
| let res = app.clone().oneshot(req).await.unwrap(); | |
| let set_cookie = common::extract_set_cookie(res.headers()).unwrap(); | |
| let old_refresh = common::extract_refresh_token(&set_cookie).unwrap(); | |
| // Use refresh token (first time — should work) | |
| let req = Request::builder() | |
| .method("POST") | |
| .uri("/api/auth/refresh") | |
| .header("cookie", format!("refresh_token={old_refresh}")) | |
| .body(Body::empty()) | |
| .unwrap(); | |
| let res = app.clone().oneshot(req).await.unwrap(); | |
| assert_eq!(res.status(), StatusCode::OK); | |
| // Use same old refresh token again — should fail (rotated) | |
| let req = Request::builder() | |
| .method("POST") | |
| .uri("/api/auth/refresh") | |
| .header("cookie", format!("refresh_token={old_refresh}")) | |
| .body(Body::empty()) | |
| .unwrap(); | |
| let res = app.oneshot(req).await.unwrap(); | |
| assert_eq!(res.status(), StatusCode::UNAUTHORIZED); | |
| } | |
| async fn refresh_without_cookie_returns_401() { | |
| let (app, _state) = common::setup_test_app().await; | |
| let req = Request::builder() | |
| .method("POST") | |
| .uri("/api/auth/refresh") | |
| .body(Body::empty()) | |
| .unwrap(); | |
| let res = app.oneshot(req).await.unwrap(); | |
| assert_eq!(res.status(), StatusCode::UNAUTHORIZED); | |
| } | |
| async fn logout_clears_tokens() { | |
| let (app, _state) = common::setup_test_app().await; | |
| let token = common::setup_admin(&app).await; | |
| let req = Request::builder() | |
| .method("POST") | |
| .uri("/api/auth/logout") | |
| .header("authorization", format!("Bearer {token}")) | |
| .body(Body::empty()) | |
| .unwrap(); | |
| let res = app.oneshot(req).await.unwrap(); | |
| assert_eq!(res.status(), StatusCode::OK); | |
| let set_cookie = common::extract_set_cookie(res.headers()).unwrap(); | |
| assert!(set_cookie.contains("Max-Age=0"), "should clear cookie"); | |
| } | |
| async fn auth_status_setup_required_true() { | |
| let (app, _state) = common::setup_test_app().await; | |
| let req = Request::builder() | |
| .uri("/api/auth/status") | |
| .body(Body::empty()) | |
| .unwrap(); | |
| let res = app.oneshot(req).await.unwrap(); | |
| assert_eq!(res.status(), StatusCode::OK); | |
| let body = res.into_body().collect().await.unwrap().to_bytes(); | |
| let json: serde_json::Value = serde_json::from_slice(&body).unwrap(); | |
| assert_eq!(json["setup_required"], true); | |
| } | |
| async fn auth_status_setup_required_false() { | |
| let (app, _state) = common::setup_test_app().await; | |
| common::setup_admin(&app).await; | |
| let req = Request::builder() | |
| .uri("/api/auth/status") | |
| .body(Body::empty()) | |
| .unwrap(); | |
| let res = app.oneshot(req).await.unwrap(); | |
| assert_eq!(res.status(), StatusCode::OK); | |
| let body = res.into_body().collect().await.unwrap().to_bytes(); | |
| let json: serde_json::Value = serde_json::from_slice(&body).unwrap(); | |
| assert_eq!(json["setup_required"], false); | |
| } | |