package api
import (
"os"
"strings"
"testing"
)
// A mention completion must not carry capability letters.
//
// people.mention returned each handle with the account's full capability
// string, "so a composer can say who it is about to name" - and nothing
// ever read it. What it did instead was answer any signed-in account
// with a map of who holds what on the repository. jva measured it as a
// Reader on quarry: nine handles, and the rows for the two site
// administrators carried the whole alphabet,
// abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.
// Anonymous was refused, so the door was "any member", and the letters
// came back on every keystroke of an autocomplete.
//
// Asserted on the source because the property is an ABSENCE. A response
// test can only show that today's fixture has no letters in it; this
// fails if the field comes back at all, which is the thing that must not
// happen again.
func TestAMentionCompletionCarriesNoCapabilityLetters(t *testing.T) {
src, err := os.ReadFile("refs.go")
if err != nil {
t.Fatal(err)
}
decl := string(src)
i := strings.Index(decl, "type mentionHandle struct {")
if i < 0 {
t.Fatal("mentionHandle is gone - if it moved, move this guard with it")
}
body := decl[i:]
if end := strings.Index(body, "}"); end >= 0 {
body = body[:end]
}
if strings.Contains(body, "Caps") || strings.Contains(body, `json:"caps"`) {
t.Errorf("mentionHandle carries capability letters again:\n%s\n"+
"the letters may decide who is completable, but they must not leave the server", body)
}
}
// The filter is the half that has to stay: an account with no letters on
// the repository is not worth completing. Removing the field by removing
// the lookup would quietly start offering strangers.
func TestTheCompletionStillFiltersOnTheLetters(t *testing.T) {
src, err := os.ReadFile("refs.go")
if err != nil {
t.Fatal(err)
}
i := strings.Index(string(src), `Name: "people.mention"`)
if i < 0 {
t.Fatal("people.mention is gone")
}
body := string(src)[i:]
if end := strings.Index(body, "\n\tif err := ops.Register"); end > 0 {
body = body[:end]
}
if !strings.Contains(body, "anyCapLetters") {
t.Error("people.mention no longer filters candidates on their letters: " +
"it will complete accounts with nothing on this repository")
}
}