package web
import (
"net/http/httptest"
"strings"
"testing"
"craftdesign.group/quarry/internal/api"
"craftdesign.group/quarry/internal/ops"
)
// /new is reachable by any signed-in account and refused anonymously —
// creation is open now, not a site-admin surface, so the page's floor
// is Token rather than Admin.
func TestNewRepoGateIsSignedInNotAdmin(t *testing.T) {
verify := Verify(func(string, string, string, ops.Auth) api.Decision { return api.Denied })
for _, tc := range []struct {
name string
roles map[string]ops.Auth
want bool
}{
{"signed in, no role anywhere", map[string]ops.Auth{"": ops.Token}, true},
{"anonymous (no session)", nil, false},
} {
t.Run(tc.name, func(t *testing.T) {
sess := fakeSessions{user: "someone", roles: tc.roles}
req := httptest.NewRequest("GET", "/new", nil)
if tc.roles != nil {
req = withCookie("/new")
}
w := httptest.NewRecorder()
_, ok := gateAt(verify, sess, "", ops.Token, w, req)
if ok != tc.want {
t.Fatalf("gateAt admitted=%v, want %v (status %d)", ok, tc.want, w.Code)
}
})
}
}
// The settings page's mirrorable line carries its hook and reflects the
// stored setting, and is disabled while the repository is private —
// where the setting has no effect (a private repository is never
// mirrorable regardless of the flag).
func TestSettingsMirrorableHook(t *testing.T) {
on := renderSettings(t, pageData{Repo: "alpha", RepoMirrorable: true})
if !strings.Contains(on, `data-hook="repo-mirrorable"`) {
t.Fatal("the mirrorable line carries no data-hook")
}
if !strings.Contains(on, `name="mirrorable" value="on" checked`) {
t.Errorf("a mirrorable repository did not render checked: %s", on)
}
off := renderSettings(t, pageData{Repo: "alpha", RepoMirrorable: false})
if strings.Contains(off, `name="mirrorable" value="on" checked`) {
t.Errorf("a non-mirrorable repository rendered checked: %s", off)
}
private := renderSettings(t, pageData{Repo: "alpha", RepoMirrorable: true, RepoPrivate: true})
if !strings.Contains(private, `disabled`) {
t.Error("the mirrorable checkbox is not disabled on a private repository")
}
}
// Creation's home-page affordance is driven by CanCreate, which is now
// "signed in" rather than "site admin" — any account sees the button.
func TestDashboardOffersCreationToAnySignedInAccount(t *testing.T) {
var sb strings.Builder
if err := noHooks.template(dashboardPage).Execute(&sb, pageData{Dash: &dashData{CanCreate: true}}); err != nil {
t.Fatalf("render: %v", err)
}
if !strings.Contains(sb.String(), `href="/new"`) {
t.Error("a signed-in non-admin was not offered repository creation")
}
}