package main
import (
"net/http"
"net/http/httptest"
"testing"
"craftdesign.group/quarry/internal/oltp"
"craftdesign.group/quarry/internal/ops"
)
// A page read with a web-scope token is read AS the token's account, so
// a private repository the account may see is not answered as missing.
// Only a read: a browser replays cached Basic credentials on its own, so
// naming a viewer on a POST would be a forgery's gift. The API door, and
// a token without web scope, are unchanged.
func TestAPageReadWithAWebTokenIsReadAsItsAccount(t *testing.T) {
g := newDoorRig(t)
web, _ := g.mint(t, oltp.TokenSpec{Scopes: scopes(oltp.ScopeWeb)})
apiOnly, _ := g.mint(t, oltp.TokenSpec{Name: "a", Scopes: scopes(oltp.ScopeAPI)})
var seen string
h := g.doors.wrap(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
seen = ops.User(req.Context())
}))
call := func(method, path, token string) string {
seen = "unset"
req := httptest.NewRequest(method, path, nil)
req.Header.Set("Authorization", "Bearer "+token)
h.ServeHTTP(httptest.NewRecorder(), req)
return seen
}
if got := call(http.MethodGet, "/r/vault/timeline", web); got != "jan" {
t.Errorf("FAIL: a GET with a web token was read as %q, want jan", got)
}
if got := call(http.MethodPost, "/r/vault/settings", web); got != "" {
t.Errorf("FAIL: a POST with a web token was given the viewer %q", got)
}
if got := call(http.MethodGet, "/r/vault/timeline", apiOnly); got != "" {
t.Errorf("FAIL: a token without web scope was read as %q", got)
}
}