package main
import (
"net/http"
"strings"
"testing"
)
// A private team's pages are not found to an outsider and its name is
// absent from the directory; to a member they are the team's pages.
func TestAPrivateTeamsPagesAreNotFoundToOutsiders(t *testing.T) {
g := newSiteRig(t)
if err := g.db.AddTeam("hush", "Hush", "Quiet work", "alice"); err != nil {
t.Fatal(err)
}
if _, err := g.db.SetTeamPrivate("hush", true); err != nil {
t.Fatal(err)
}
for _, p := range []string{"/t/hush", "/t/hush/people", "/t/hush/tickets", "/t/hush/avatar", "/api/v1/teams/hush"} {
if code, _ := g.doAs("", http.MethodGet, p, "", "", nil); code != http.StatusNotFound {
t.Errorf("FAIL: %s answered a stranger %d", p, code)
}
}
if _, body := g.doAs("", http.MethodGet, "/teams", "", "", nil); strings.Contains(body, "/t/hush") {
t.Error("FAIL: the directory names a private team to a stranger")
}
if code, body := g.doAs("alice", http.MethodGet, "/api/v1/teams/hush", doorPassword, "", nil); code != http.StatusOK || !strings.Contains(body, `"private":true`) {
t.Errorf("FAIL: a member cannot read the private team: %d %s", code, body)
}
}