2156 lines
74 KiB
Rust
2156 lines
74 KiB
Rust
//! End-to-end tests for the TOTP auth gate.
|
|
//!
|
|
//! These drive the real router over HTTP (through `tower`'s `oneshot`) rather
|
|
//! than calling handlers directly, because the thing worth protecting is the
|
|
//! gate itself: an unauthenticated caller must never observe note content.
|
|
|
|
use axum::body::Body;
|
|
use axum::http::{header, Request, StatusCode};
|
|
use eternalibre_notes::auth::{AuthError, AuthState};
|
|
use eternalibre_notes::routes::{self, AppState};
|
|
use std::path::{Path, PathBuf};
|
|
use std::sync::atomic::{AtomicU32, Ordering};
|
|
use std::sync::{Arc, OnceLock};
|
|
use tower::util::ServiceExt;
|
|
|
|
/// One shared notes directory for the whole test binary.
|
|
///
|
|
/// `ETERNALIBRE_NOTES_DIR` is process-global, so it must be set exactly once
|
|
/// before any test can race to change it.
|
|
fn shared_notes_dir() -> &'static Path {
|
|
static DIR: OnceLock<PathBuf> = OnceLock::new();
|
|
DIR.get_or_init(|| {
|
|
let mut p = std::env::temp_dir();
|
|
p.push(format!("eternalibre-it-notes-{}", std::process::id()));
|
|
let _ = std::fs::remove_dir_all(&p);
|
|
std::fs::create_dir_all(&p).unwrap();
|
|
std::env::set_var("ETERNALIBRE_NOTES_DIR", &p);
|
|
p
|
|
})
|
|
}
|
|
|
|
fn temp_secret_path(tag: &str) -> PathBuf {
|
|
static COUNTER: AtomicU32 = AtomicU32::new(0);
|
|
let n = COUNTER.fetch_add(1, Ordering::Relaxed);
|
|
let mut p = std::env::temp_dir();
|
|
p.push(format!(
|
|
"eternalibre-it-{}-{}-{}",
|
|
tag,
|
|
std::process::id(),
|
|
n
|
|
));
|
|
p.set_extension("secret");
|
|
let _ = std::fs::remove_file(&p);
|
|
p
|
|
}
|
|
|
|
struct Fixture {
|
|
app: axum::Router,
|
|
auth: Arc<AuthState>,
|
|
secret_file: PathBuf,
|
|
token: Option<String>,
|
|
secret: String,
|
|
base_path: String,
|
|
}
|
|
|
|
impl Fixture {
|
|
/// An app whose secret file does not exist yet.
|
|
///
|
|
/// TOTP enrolment happens in the terminal before the listener binds, so
|
|
/// this state is only reachable in-process. The router still handles it,
|
|
/// which is what lets these tests assert the defensive 503 path.
|
|
fn fresh(tag: &str) -> Self {
|
|
Self::build(tag, "")
|
|
}
|
|
|
|
/// An app mounted under a reverse-proxy subdirectory.
|
|
fn with_base_path(tag: &str, base_path: &str) -> Self {
|
|
Self::build(tag, base_path)
|
|
}
|
|
|
|
fn build(tag: &str, base_path: &str) -> Self {
|
|
let secret_file = temp_secret_path(tag);
|
|
let auth = Arc::new(AuthState::with_secret_path(&secret_file));
|
|
Self {
|
|
// `routes::app`, not `routes::router`: the real binary mounts
|
|
// static assets alongside the gated routes, and a test that skips
|
|
// that assembly cannot see asset regressions.
|
|
app: routes::app(AppState {
|
|
auth: auth.clone(),
|
|
base_path: base_path.into(),
|
|
}),
|
|
auth,
|
|
secret_file,
|
|
token: None,
|
|
secret: String::new(),
|
|
base_path: base_path.to_string(),
|
|
}
|
|
}
|
|
|
|
/// Completes enrolment against the `AuthState` directly, which is what the
|
|
/// terminal setup flow does before the server starts.
|
|
fn provision(mut self) -> Self {
|
|
let material = self.auth.begin_setup().unwrap();
|
|
self.secret = material.secret;
|
|
let code = valid_code(&self.secret);
|
|
self.token = Some(self.auth.verify_setup(&code).expect("provisioning"));
|
|
self
|
|
}
|
|
|
|
/// An app that has completed setup, with a live session cookie.
|
|
fn provisioned(tag: &str) -> Self {
|
|
Self::fresh(tag).provision()
|
|
}
|
|
|
|
/// Logs in over HTTP, exercising the real `/login` route.
|
|
///
|
|
/// A rejected code just means the 30s TOTP window rolled over between
|
|
/// enrolment and this call, so retry against the live secret rather than
|
|
/// failing on a timing coincidence.
|
|
async fn login_over_http(self) -> Self {
|
|
// Enrol first if the caller hasn't, so this can be chained onto a
|
|
// bare fixture.
|
|
let mut f = if self.secret.is_empty() {
|
|
self.provision()
|
|
} else {
|
|
self
|
|
};
|
|
for _ in 0..3 {
|
|
let code = valid_code(&f.secret);
|
|
let (status, _, cookie) = f.post_form("/login", &format!("code={code}")).await;
|
|
if status == StatusCode::SEE_OTHER {
|
|
f.token = Some(session_value(&cookie.expect("login sets a cookie")));
|
|
return f;
|
|
}
|
|
}
|
|
panic!("could not log in over HTTP with a valid code");
|
|
}
|
|
|
|
/// The URL the app is *expected* to emit for an app-absolute path.
|
|
///
|
|
/// Requests themselves are always app-absolute: a reverse proxy strips
|
|
/// the base prefix before forwarding, so the app never sees it. The base
|
|
/// path only shows up in generated hrefs, form actions, and redirects.
|
|
fn expect(&self, app_path: &str) -> String {
|
|
format!("{}{}", self.base_path, app_path)
|
|
}
|
|
|
|
fn cookie_header(&self) -> String {
|
|
format!("eternalibre_session={}", self.token.clone().unwrap())
|
|
}
|
|
|
|
async fn get(&self, uri: &str) -> (StatusCode, String) {
|
|
let res = self
|
|
.app
|
|
.clone()
|
|
.oneshot(Request::builder().uri(uri).body(Body::empty()).unwrap())
|
|
.await
|
|
.unwrap();
|
|
finish(res).await
|
|
}
|
|
|
|
/// GET carrying the session cookie.
|
|
async fn get_authed(&self, uri: &str) -> (StatusCode, String) {
|
|
finish(self.get_authed_response(uri, None).await).await
|
|
}
|
|
|
|
async fn get_authed_with_theme(&self, uri: &str, theme: &str) -> axum::response::Response {
|
|
self.get_authed_response(uri, Some(theme)).await
|
|
}
|
|
|
|
async fn get_authed_response(
|
|
&self,
|
|
uri: &str,
|
|
theme: Option<&str>,
|
|
) -> axum::response::Response {
|
|
let mut cookie = self.cookie_header();
|
|
if let Some(theme) = theme {
|
|
cookie.push_str(&format!("; theme={theme}"));
|
|
}
|
|
self.app
|
|
.clone()
|
|
.oneshot(
|
|
Request::builder()
|
|
.uri(uri)
|
|
.header(header::COOKIE, cookie)
|
|
.body(Body::empty())
|
|
.unwrap(),
|
|
)
|
|
.await
|
|
.unwrap()
|
|
}
|
|
|
|
/// POST as an anonymous visitor.
|
|
async fn post_form(&self, uri: &str, body: &str) -> (StatusCode, String, Option<String>) {
|
|
let res = self
|
|
.app
|
|
.clone()
|
|
.oneshot(
|
|
Request::builder()
|
|
.method("POST")
|
|
.uri(uri)
|
|
.header(header::CONTENT_TYPE, "application/x-www-form-urlencoded")
|
|
.body(Body::from(body.to_string()))
|
|
.unwrap(),
|
|
)
|
|
.await
|
|
.unwrap();
|
|
respond(res).await
|
|
}
|
|
|
|
/// POST carrying the session cookie.
|
|
async fn post_authed(&self, uri: &str, body: &str) -> (StatusCode, String, Option<String>) {
|
|
let res = self
|
|
.app
|
|
.clone()
|
|
.oneshot(
|
|
Request::builder()
|
|
.method("POST")
|
|
.uri(uri)
|
|
.header(header::CONTENT_TYPE, "application/x-www-form-urlencoded")
|
|
.header(header::COOKIE, self.cookie_header())
|
|
.body(Body::from(body.to_string()))
|
|
.unwrap(),
|
|
)
|
|
.await
|
|
.unwrap();
|
|
respond(res).await
|
|
}
|
|
|
|
/// Creates a note and returns its id.
|
|
async fn create_note(&self) -> String {
|
|
let (_, _, loc) = self.post_authed("/notes", "").await;
|
|
loc.expect("create redirects to the new note")
|
|
.rsplit('/')
|
|
.next()
|
|
.unwrap()
|
|
.to_string()
|
|
}
|
|
|
|
/// GET with an arbitrary cookie string, for spoofed-credential checks.
|
|
async fn get_with_cookie(&self, cookie: &str) -> (StatusCode, String) {
|
|
let res = self
|
|
.app
|
|
.clone()
|
|
.oneshot(
|
|
Request::builder()
|
|
.uri("/")
|
|
.header(header::COOKIE, cookie)
|
|
.body(Body::empty())
|
|
.unwrap(),
|
|
)
|
|
.await
|
|
.unwrap();
|
|
finish(res).await
|
|
}
|
|
}
|
|
|
|
impl Drop for Fixture {
|
|
fn drop(&mut self) {
|
|
let _ = std::fs::remove_file(&self.secret_file);
|
|
}
|
|
}
|
|
|
|
async fn finish(res: axum::response::Response) -> (StatusCode, String) {
|
|
let status = res.status();
|
|
let loc = res
|
|
.headers()
|
|
.get(header::LOCATION)
|
|
.and_then(|v| v.to_str().ok())
|
|
.map(|s| format!("LOCATION: {s}"));
|
|
let bytes = axum::body::to_bytes(res.into_body(), 1 << 20)
|
|
.await
|
|
.unwrap();
|
|
let mut text = String::from_utf8_lossy(&bytes).into_owned();
|
|
if let Some(l) = loc {
|
|
text.push('\n');
|
|
text.push_str(&l);
|
|
}
|
|
(status, text)
|
|
}
|
|
|
|
async fn respond(res: axum::response::Response) -> (StatusCode, String, Option<String>) {
|
|
let status = res.status();
|
|
let cookie = res
|
|
.headers()
|
|
.get(header::SET_COOKIE)
|
|
.and_then(|v| v.to_str().ok())
|
|
.map(|s| s.to_string());
|
|
let loc = res
|
|
.headers()
|
|
.get(header::LOCATION)
|
|
.and_then(|v| v.to_str().ok())
|
|
.map(|s| s.to_string());
|
|
let bytes = axum::body::to_bytes(res.into_body(), 1 << 20)
|
|
.await
|
|
.unwrap();
|
|
let text = String::from_utf8_lossy(&bytes).into_owned();
|
|
(status, text, cookie.or(loc))
|
|
}
|
|
|
|
fn session_value(set_cookie: &str) -> String {
|
|
set_cookie
|
|
.split(';')
|
|
.next()
|
|
.expect("cookie pair")
|
|
.split_once('=')
|
|
.expect("key=value")
|
|
.1
|
|
.to_string()
|
|
}
|
|
|
|
/// What a real authenticator app would display for this secret right now.
|
|
fn current_code(encoded_secret: &str) -> String {
|
|
use totp_rs::{Algorithm, Builder, Secret};
|
|
Builder::new()
|
|
.with_algorithm(Algorithm::SHA1)
|
|
.with_digits(6)
|
|
.with_skew(1)
|
|
.with_step_duration(30)
|
|
.with_account_name("local")
|
|
.with_issuer(Some("EternaLibre Notes"))
|
|
.with_secret(Secret::try_from_base32(encoded_secret).unwrap())
|
|
.build()
|
|
.unwrap()
|
|
.generate_current()
|
|
.to_string()
|
|
}
|
|
|
|
/// Rejects a secret that is not a usable Base32 TOTP key, with a readable
|
|
/// message. A silently empty code would otherwise look like a TOTP mismatch.
|
|
fn valid_code(secret: &str) -> String {
|
|
assert!(
|
|
secret.len() >= 16 && !secret.is_empty(),
|
|
"test fixture has an unusable secret: {secret:?}"
|
|
);
|
|
let code = current_code(secret);
|
|
assert_eq!(
|
|
code.len(),
|
|
6,
|
|
"expected a 6-digit code, got {code:?} from a bad secret"
|
|
);
|
|
code
|
|
}
|
|
|
|
// ---------------------------------------------------------------- gating ----
|
|
|
|
/// Every data-bearing route must refuse an anonymous caller. This is the core
|
|
/// security assertion: note content must not leak to an unauthenticated peer.
|
|
#[tokio::test]
|
|
async fn anonymous_cannot_read_any_note_route() {
|
|
shared_notes_dir();
|
|
let f = Fixture::provisioned("anon");
|
|
|
|
for uri in ["/", "/notes/some-id", "/about", "/export", "/preview"] {
|
|
let (status, body) = f.get(uri).await;
|
|
assert!(
|
|
status == StatusCode::SEE_OTHER || status == StatusCode::UNAUTHORIZED,
|
|
"{uri} returned {status}, expected a redirect or 401"
|
|
);
|
|
assert!(
|
|
!body.contains("app-body"),
|
|
"{uri} leaked the app shell to an anonymous caller"
|
|
);
|
|
}
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn anonymous_always_redirects_to_login() {
|
|
let f = Fixture::provisioned("anon-login");
|
|
let (status, body) = f.get("/").await;
|
|
assert_eq!(status, StatusCode::SEE_OTHER);
|
|
assert!(body.contains("LOCATION: /login"), "got: {body}");
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn forged_session_cookie_is_rejected() {
|
|
let f = Fixture::provisioned("forged");
|
|
|
|
let res = f
|
|
.app
|
|
.clone()
|
|
.oneshot(
|
|
Request::builder()
|
|
.uri("/")
|
|
.header(header::COOKIE, "eternalibre_session=0000000000000000")
|
|
.body(Body::empty())
|
|
.unwrap(),
|
|
)
|
|
.await
|
|
.unwrap();
|
|
|
|
assert_eq!(res.status(), StatusCode::SEE_OTHER);
|
|
assert_eq!(f.auth.session_count(), 1, "forged token created no session");
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn empty_session_cookie_is_rejected() {
|
|
let f = Fixture::provisioned("emptycookie");
|
|
let (status, _) = f.get_with_cookie("eternalibre_session=").await;
|
|
assert_eq!(status, StatusCode::SEE_OTHER);
|
|
}
|
|
|
|
// ------------------------------------------------------------ access with ----
|
|
|
|
#[tokio::test]
|
|
async fn authenticated_user_can_reach_the_app() {
|
|
let f = Fixture::provisioned("ok");
|
|
let (status, body) = f.get_authed("/").await;
|
|
assert_eq!(status, StatusCode::OK);
|
|
assert!(body.contains("app-body"), "expected the app shell");
|
|
assert!(body.contains("EternaLibre Notes"));
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn note_content_is_invisible_until_authenticated() {
|
|
let f = Fixture::provisioned("leak");
|
|
let id = f.create_note().await;
|
|
|
|
let marker = "TOPSECRET-CANARY-9f2a";
|
|
let (status, _, _) = f
|
|
.post_authed(
|
|
&format!("/notes/{id}"),
|
|
&format!("_method=put&title=Canary&content={marker}"),
|
|
)
|
|
.await;
|
|
assert_eq!(status, StatusCode::SEE_OTHER);
|
|
|
|
// The authenticated user does see it, proving the marker exists at all.
|
|
let (status, authed) = f.get_authed(&format!("/notes/{id}")).await;
|
|
assert_eq!(status, StatusCode::OK);
|
|
assert!(authed.contains(marker), "test is not exercising real data");
|
|
|
|
// An anonymous request for the same note must not echo it back.
|
|
let (status, anon) = f.get(&format!("/notes/{id}")).await;
|
|
assert_eq!(status, StatusCode::SEE_OTHER);
|
|
assert!(
|
|
!anon.contains(marker),
|
|
"note content leaked to an unauthenticated request"
|
|
);
|
|
assert!(!anon.contains("Canary"), "note title leaked");
|
|
|
|
// Nor does the index page list it.
|
|
let (_, index) = f.get("/").await;
|
|
assert!(!index.contains("Canary"), "note title leaked via index");
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn preview_requires_authentication() {
|
|
let f = Fixture::provisioned("preview-gate");
|
|
|
|
let (status, body, _) = f.post_form("/preview", "content=%23+Hello").await;
|
|
assert_eq!(status, StatusCode::UNAUTHORIZED);
|
|
assert!(
|
|
!body.contains("<h1>"),
|
|
"markdown was rendered for an anonymous caller"
|
|
);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn preview_works_once_authenticated() {
|
|
let f = Fixture::provisioned("preview-ok");
|
|
let (status, body, _) = f.post_authed("/preview", "content=%23+Hello").await;
|
|
assert_eq!(status, StatusCode::OK);
|
|
assert!(body.contains("<h1>Hello</h1>"), "got: {body}");
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn export_requires_authentication() {
|
|
let f = Fixture::provisioned("export-gate");
|
|
let (status, body) = f.get("/export").await;
|
|
assert_eq!(status, StatusCode::SEE_OTHER);
|
|
assert!(!body.contains("EternaLibre Notes Export"));
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn single_note_export_menu_is_disabled_without_a_selected_note() {
|
|
let f = Fixture::provisioned("note-export-menu");
|
|
let (status, body) = f.get_authed("/").await;
|
|
assert_eq!(status, StatusCode::OK);
|
|
assert!(body.contains("aria-disabled=\"true\""));
|
|
assert!(!body.contains("/export/pdf"));
|
|
assert!(!body.contains("/export/markdown"));
|
|
assert!(!body.contains("/export/html"));
|
|
|
|
let id = f.create_note().await;
|
|
let (status, selected) = f.get_authed(&format!("/notes/{id}")).await;
|
|
assert_eq!(status, StatusCode::OK);
|
|
assert!(selected.contains("Print/PDF"));
|
|
assert!(selected.contains("menu-submenu-list"));
|
|
for format in ["pdf", "markdown", "html"] {
|
|
assert!(
|
|
selected.contains(&format!("href=\"/notes/{id}/export/{format}\"")),
|
|
"selected note should expose the {format} export"
|
|
);
|
|
}
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn single_note_exports_require_authentication() {
|
|
let f = Fixture::provisioned("note-export-gate");
|
|
let id = f.create_note().await;
|
|
for format in ["pdf", "markdown", "html"] {
|
|
let (status, body) = f.get(&format!("/notes/{id}/export/{format}")).await;
|
|
assert_eq!(status, StatusCode::SEE_OTHER);
|
|
assert!(!body.contains("Export Secret"));
|
|
}
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn markdown_export_downloads_the_saved_note() {
|
|
let f = Fixture::provisioned("markdown-export");
|
|
let id = f.create_note().await;
|
|
let (status, _, _) = f
|
|
.post_authed(
|
|
&format!("/notes/{id}"),
|
|
"_method=put&title=Saved+Version&content=First+paragraph",
|
|
)
|
|
.await;
|
|
assert_eq!(status, StatusCode::SEE_OTHER);
|
|
|
|
let response = f
|
|
.get_authed_response(&format!("/notes/{id}/export/markdown"), None)
|
|
.await;
|
|
assert_eq!(response.status(), StatusCode::OK);
|
|
assert_eq!(
|
|
response.headers()[header::CONTENT_TYPE],
|
|
"text/markdown; charset=utf-8"
|
|
);
|
|
assert_eq!(
|
|
response.headers()[header::CONTENT_DISPOSITION],
|
|
"attachment; filename=\"saved-version.md\""
|
|
);
|
|
assert_eq!(
|
|
response.headers()[header::CACHE_CONTROL],
|
|
"private, no-store"
|
|
);
|
|
let body = axum::body::to_bytes(response.into_body(), 1 << 20)
|
|
.await
|
|
.unwrap();
|
|
assert_eq!(
|
|
String::from_utf8_lossy(&body),
|
|
"# Saved Version\n\nFirst paragraph"
|
|
);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn html_export_is_standalone_and_uses_the_selected_theme() {
|
|
let f = Fixture::provisioned("html-export");
|
|
let id = f.create_note().await;
|
|
let (status, _, _) = f
|
|
.post_authed(
|
|
&format!("/notes/{id}"),
|
|
"_method=put&title=HTML+Note&content=%23+Heading%0A%0ARendered+body",
|
|
)
|
|
.await;
|
|
assert_eq!(status, StatusCode::SEE_OTHER);
|
|
|
|
let response = f
|
|
.get_authed_with_theme(&format!("/notes/{id}/export/html"), "Dracula")
|
|
.await;
|
|
assert_eq!(response.status(), StatusCode::OK);
|
|
assert_eq!(
|
|
response.headers()[header::CONTENT_DISPOSITION],
|
|
"attachment; filename=\"html-note.html\""
|
|
);
|
|
let body = axum::body::to_bytes(response.into_body(), 1 << 20)
|
|
.await
|
|
.unwrap();
|
|
let body = String::from_utf8_lossy(&body);
|
|
assert!(body.contains("data-theme=\"Dracula\""));
|
|
assert!(body.contains("--app-bg: #282a36;"));
|
|
assert!(body.contains("<h1 class=\"note-export-title\">HTML Note</h1>"));
|
|
assert!(body.contains("<h1>Heading</h1>"));
|
|
assert!(body.contains("<p>Rendered body</p>"));
|
|
assert!(
|
|
body.contains(".markdown-body pre"),
|
|
"application styles are inlined"
|
|
);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn pdf_export_opens_a_theme_aware_print_document() {
|
|
let f = Fixture::provisioned("pdf-export");
|
|
let id = f.create_note().await;
|
|
let (status, _, _) = f
|
|
.post_authed(
|
|
&format!("/notes/{id}"),
|
|
"_method=put&title=Print+Note&content=Printed+body",
|
|
)
|
|
.await;
|
|
assert_eq!(status, StatusCode::SEE_OTHER);
|
|
|
|
let response = f
|
|
.get_authed_with_theme(&format!("/notes/{id}/export/pdf"), "Breeze Dark")
|
|
.await;
|
|
assert_eq!(response.status(), StatusCode::OK);
|
|
assert_eq!(
|
|
response.headers()[header::CONTENT_TYPE],
|
|
"text/html; charset=utf-8"
|
|
);
|
|
assert_eq!(
|
|
response.headers()[header::CONTENT_DISPOSITION],
|
|
"inline; filename=\"print-note.html\""
|
|
);
|
|
let body = axum::body::to_bytes(response.into_body(), 1 << 20)
|
|
.await
|
|
.unwrap();
|
|
let body = String::from_utf8_lossy(&body);
|
|
assert!(body.contains("data-theme=\"Breeze Dark\""));
|
|
assert!(body.contains("--app-bg: #232629;"));
|
|
assert!(body.contains("print-color-adjust: exact;"));
|
|
assert!(body.contains("window.print()"));
|
|
assert!(body.contains("Printed body"));
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn exporting_a_missing_note_returns_not_found() {
|
|
let f = Fixture::provisioned("missing-export");
|
|
for format in ["pdf", "markdown", "html"] {
|
|
let (status, _) = f
|
|
.get_authed(&format!("/notes/does-not-exist/export/{format}"))
|
|
.await;
|
|
assert_eq!(status, StatusCode::NOT_FOUND);
|
|
}
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn write_routes_require_authentication() {
|
|
let f = Fixture::provisioned("write-gate");
|
|
|
|
// Creating a note anonymously must not create anything.
|
|
let before = std::fs::read_dir(shared_notes_dir()).unwrap().count();
|
|
let (status, _, _) = f.post_form("/notes", "").await;
|
|
assert_eq!(status, StatusCode::SEE_OTHER);
|
|
let after = std::fs::read_dir(shared_notes_dir()).unwrap().count();
|
|
assert_eq!(before, after, "anonymous POST created a note");
|
|
|
|
// Theme changes are gated too.
|
|
let (status, _, _) = f.post_form("/theme", "theme=Dracula").await;
|
|
assert_eq!(status, StatusCode::SEE_OTHER);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn deleting_a_note_requires_authentication() {
|
|
let f = Fixture::provisioned("delete-gate");
|
|
let id = f.create_note().await;
|
|
|
|
let (status, _, _) = f.post_form(&format!("/notes/{id}"), "_method=delete").await;
|
|
assert_eq!(status, StatusCode::SEE_OTHER);
|
|
|
|
// Still present, i.e. the anonymous delete did not take effect.
|
|
let (status, _) = f.get_authed(&format!("/notes/{id}")).await;
|
|
assert_eq!(status, StatusCode::OK);
|
|
}
|
|
|
|
// ---------------------------------------------------------------- folders ----
|
|
|
|
#[tokio::test]
|
|
async fn folder_creation_creates_a_note_in_the_folder() {
|
|
let f = Fixture::provisioned("folder-create");
|
|
let (status, _, loc) = f.post_authed("/folders", "name=Project+Notes").await;
|
|
assert_eq!(status, StatusCode::SEE_OTHER);
|
|
let loc = loc.expect("folder creation redirects");
|
|
assert!(loc.starts_with("/notes/"), "got: {loc}");
|
|
|
|
// The new note should appear in the folder view.
|
|
let (status, body) = f.get_authed("/?folder=Project%20Notes").await;
|
|
assert_eq!(status, StatusCode::OK);
|
|
assert!(
|
|
body.contains("Project Notes"),
|
|
"folder nav should list the folder"
|
|
);
|
|
assert!(
|
|
body.contains("Untitled"),
|
|
"the new note should be in the folder"
|
|
);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn folder_filtering_shows_only_folder_notes() {
|
|
let f = Fixture::provisioned("folder-filter");
|
|
let root_id = f.create_note().await;
|
|
let (_, _, loc) = f.post_authed("/folders", "name=Work").await;
|
|
let work_loc = loc.expect("folder creation redirects");
|
|
let work_id = work_loc.rsplit('/').next().unwrap().to_string();
|
|
|
|
// Root view shows both.
|
|
let (status, body) = f.get_authed("/").await;
|
|
assert_eq!(status, StatusCode::OK);
|
|
assert!(
|
|
body.contains(&root_id),
|
|
"root note should appear in All Notes"
|
|
);
|
|
assert!(
|
|
body.contains(&work_id),
|
|
"folder note should appear in All Notes"
|
|
);
|
|
|
|
// Folder view shows only the folder note.
|
|
let (status, body) = f.get_authed("/?folder=Work").await;
|
|
assert_eq!(status, StatusCode::OK);
|
|
assert!(
|
|
!body.contains(&root_id),
|
|
"root note should not appear in folder view"
|
|
);
|
|
assert!(
|
|
body.contains(&work_id),
|
|
"folder note should appear in folder view"
|
|
);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn new_note_in_folder_creates_with_prefix() {
|
|
let f = Fixture::provisioned("folder-new-note");
|
|
let (status, _, loc) = f.post_authed("/notes", "folder=Personal").await;
|
|
assert_eq!(status, StatusCode::SEE_OTHER);
|
|
let loc = loc.expect("create redirects");
|
|
let id = loc.rsplit('/').next().unwrap().to_string();
|
|
|
|
// The file on disk should have the [Personal] prefix.
|
|
let dir = shared_notes_dir();
|
|
let entries: Vec<_> = std::fs::read_dir(dir)
|
|
.unwrap()
|
|
.filter_map(|e| e.ok())
|
|
.map(|e| e.file_name().to_string_lossy().to_string())
|
|
.collect();
|
|
let found = entries
|
|
.iter()
|
|
.any(|name| name.starts_with("[Personal]") && name.contains(&id));
|
|
assert!(
|
|
found,
|
|
"expected a [Personal]-prefixed file for {id}, got: {entries:?}"
|
|
);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn folder_route_requires_authentication() {
|
|
let f = Fixture::provisioned("folder-gate");
|
|
let (status, _, _) = f.post_form("/folders", "name=Secret").await;
|
|
assert_eq!(status, StatusCode::SEE_OTHER);
|
|
|
|
// No note should have been created.
|
|
let (status, body) = f.get("/").await;
|
|
assert_eq!(status, StatusCode::SEE_OTHER);
|
|
assert!(!body.contains("Secret"));
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn invalid_folder_name_is_rejected() {
|
|
use percent_encoding::{utf8_percent_encode, NON_ALPHANUMERIC};
|
|
|
|
let f = Fixture::provisioned("folder-invalid");
|
|
for name in [
|
|
"",
|
|
" ",
|
|
"has]bracket",
|
|
"has/slash",
|
|
"has\\backslash",
|
|
"..",
|
|
".hidden",
|
|
"foo;bar",
|
|
"foo|bar",
|
|
"foo&bar",
|
|
"foo$bar",
|
|
"foo`bar",
|
|
"foo(bar)",
|
|
"foo<bar>",
|
|
] {
|
|
let encoded = utf8_percent_encode(name, NON_ALPHANUMERIC).to_string();
|
|
let body = format!("name={encoded}");
|
|
let (status, _, loc) = f.post_authed("/folders", &body).await;
|
|
// Should redirect back to / with an error, not to a new note.
|
|
assert_eq!(
|
|
status,
|
|
StatusCode::SEE_OTHER,
|
|
"folder name {name:?} should redirect back"
|
|
);
|
|
let loc = loc.expect("should have a Location header");
|
|
assert!(
|
|
loc.starts_with("/?error="),
|
|
"expected redirect to /?error=..., got: {loc}"
|
|
);
|
|
}
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn folder_creation_error_shows_flash_message() {
|
|
let f = Fixture::provisioned("folder-flash");
|
|
let (_, _, loc) = f.post_authed("/folders", "name=has%2Fslash").await;
|
|
let loc = loc.expect("should redirect");
|
|
assert!(loc.starts_with("/?error="), "got: {loc}");
|
|
|
|
// Follow the redirect and verify the flash message appears.
|
|
let (status, body) = f
|
|
.get_authed("/?error=folder+name+cannot+contain+%27%2F%27+or+%27%5C%27")
|
|
.await;
|
|
assert_eq!(status, StatusCode::OK);
|
|
assert!(
|
|
body.contains("flash-message"),
|
|
"page should contain the flash-message element"
|
|
);
|
|
assert!(
|
|
body.contains("folder name cannot contain"),
|
|
"flash message should show the validation error"
|
|
);
|
|
}
|
|
|
|
// ------------------------------------------------------- moving a note ----
|
|
|
|
/// Every on-disk note file whose `[Folder]uuid` stem parses to `id`.
|
|
fn files_for_id(id: &str) -> Vec<String> {
|
|
let Ok(entries) = std::fs::read_dir(shared_notes_dir()) else {
|
|
return Vec::new();
|
|
};
|
|
let mut found: Vec<String> = entries
|
|
.filter_map(|e| e.ok())
|
|
.map(|e| e.file_name().to_string_lossy().to_string())
|
|
.filter(|name| {
|
|
let stem = name.strip_suffix(".md").unwrap_or(name);
|
|
let stripped = stem.strip_prefix('[').and_then(|s| s.split_once(']'));
|
|
let parsed = stripped.map(|(_, rest)| rest).unwrap_or(stem);
|
|
parsed == id
|
|
})
|
|
.collect();
|
|
found.sort();
|
|
found
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn move_route_renames_the_note_file() {
|
|
let f = Fixture::provisioned("move-rename");
|
|
let id = f.create_note().await;
|
|
f.post_authed(&format!("/notes/{id}"), "title=Movable&content=Body")
|
|
.await;
|
|
|
|
let (status, _, loc) = f
|
|
.post_authed(&format!("/notes/{id}/move"), "folder=Work")
|
|
.await;
|
|
assert_eq!(status, StatusCode::SEE_OTHER);
|
|
assert_eq!(loc.as_deref(), Some(format!("/notes/{id}").as_str()));
|
|
|
|
// The file was renamed, not duplicated: the bare name is gone and exactly
|
|
// one prefixed file claims the id.
|
|
assert_eq!(files_for_id(&id), vec![format!("[Work]{id}.md")]);
|
|
|
|
// Content survived the move.
|
|
let (status, body) = f.get_authed(&format!("/notes/{id}")).await;
|
|
assert_eq!(status, StatusCode::OK);
|
|
assert!(body.contains("Movable"), "title should survive the move");
|
|
assert!(body.contains("Body"), "content should survive the move");
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn move_route_to_root_strips_the_prefix() {
|
|
let f = Fixture::provisioned("move-root");
|
|
let (_, _, loc) = f.post_authed("/folders", "name=Work").await;
|
|
let work_id = loc
|
|
.expect("redirect")
|
|
.rsplit('/')
|
|
.next()
|
|
.unwrap()
|
|
.to_string();
|
|
assert_eq!(files_for_id(&work_id), vec![format!("[Work]{work_id}.md")]);
|
|
|
|
// An empty folder is the root, which is how "All Notes" and the move
|
|
// form's Unfiled option both express "no folder".
|
|
let (status, _, _) = f
|
|
.post_authed(&format!("/notes/{work_id}/move"), "folder=")
|
|
.await;
|
|
assert_eq!(status, StatusCode::SEE_OTHER);
|
|
assert_eq!(files_for_id(&work_id), vec![format!("{work_id}.md")]);
|
|
}
|
|
|
|
/// The bug this whole feature hangs on.
|
|
///
|
|
/// `save_note` derives the filename from `note.folder` but never removes the
|
|
/// file it replaced, so a "move" implemented as a re-save leaves the original
|
|
/// behind. `list_notes` then returns the same id twice and the sidebar renders
|
|
/// the note twice, with the two copies ordered by whatever `updated_at` each
|
|
/// file happened to carry. This pins the rename rather than the re-save.
|
|
#[tokio::test]
|
|
async fn move_route_leaves_no_duplicate_file_or_listing() {
|
|
let f = Fixture::provisioned("move-nodup");
|
|
let id = f.create_note().await;
|
|
|
|
f.post_authed(&format!("/notes/{id}/move"), "folder=Work")
|
|
.await;
|
|
assert_eq!(
|
|
files_for_id(&id).len(),
|
|
1,
|
|
"one file on disk should claim the id, got: {:?}",
|
|
files_for_id(&id)
|
|
);
|
|
|
|
f.post_authed(&format!("/notes/{id}/move"), "folder=Home")
|
|
.await;
|
|
assert_eq!(
|
|
files_for_id(&id).len(),
|
|
1,
|
|
"repeated moves must not accumulate files, got: {:?}",
|
|
files_for_id(&id)
|
|
);
|
|
|
|
let (_, body) = f.get_authed("/").await;
|
|
assert_eq!(
|
|
body.matches(&format!("data-note-id=\"{id}\"")).count(),
|
|
1,
|
|
"the sidebar should list the note exactly once"
|
|
);
|
|
|
|
// The folder listing shows one copy, the root listing none.
|
|
let (_, home) = f.get_authed("/?folder=Home").await;
|
|
assert_eq!(home.matches(&format!("data-note-id=\"{id}\"")).count(), 1);
|
|
let (_, work) = f.get_authed("/?folder=Work").await;
|
|
assert!(
|
|
!work.contains(&id),
|
|
"the note left Work, so it must not appear there"
|
|
);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn move_route_rejects_invalid_folder_names_without_touching_the_file() {
|
|
let f = Fixture::provisioned("move-invalid");
|
|
let id = f.create_note().await;
|
|
|
|
for (name, body) in [
|
|
("has]bracket", "folder=has%5Dbracket"),
|
|
("has/slash", "folder=has%2Fslash"),
|
|
("path traversal", "folder=..%2F..%2Fetc"),
|
|
("empty after trim", "folder=%20%20"),
|
|
] {
|
|
let (status, _, loc) = f.post_authed(&format!("/notes/{id}/move"), body).await;
|
|
assert_eq!(
|
|
status,
|
|
StatusCode::SEE_OTHER,
|
|
"{name} should redirect back with an error"
|
|
);
|
|
assert!(
|
|
loc.expect("redirect").starts_with("/?error="),
|
|
"{name} should land on /?error="
|
|
);
|
|
assert_eq!(
|
|
files_for_id(&id),
|
|
vec![format!("{id}.md")],
|
|
"{name} must leave the file where it was"
|
|
);
|
|
}
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn move_route_requires_authentication() {
|
|
let f = Fixture::provisioned("move-gate");
|
|
let id = f.create_note().await;
|
|
|
|
let (status, _, loc) = f
|
|
.post_form(&format!("/notes/{id}/move"), "folder=Secret")
|
|
.await;
|
|
assert_eq!(status, StatusCode::SEE_OTHER);
|
|
assert_eq!(loc.as_deref(), Some("/login"));
|
|
|
|
assert_eq!(
|
|
files_for_id(&id),
|
|
vec![format!("{id}.md")],
|
|
"an unauthenticated move must not reach the filesystem"
|
|
);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn move_route_redirects_through_the_base_path() {
|
|
let f = Fixture::with_base_path("move-base", "/forgejo")
|
|
.login_over_http()
|
|
.await;
|
|
let id = f.create_note().await;
|
|
|
|
let (status, _, loc) = f
|
|
.post_authed(&format!("/notes/{id}/move"), "folder=Work")
|
|
.await;
|
|
assert_eq!(status, StatusCode::SEE_OTHER);
|
|
assert_eq!(
|
|
loc.as_deref(),
|
|
Some(format!("/forgejo/notes/{id}").as_str())
|
|
);
|
|
assert_eq!(files_for_id(&id), vec![format!("[Work]{id}.md")]);
|
|
}
|
|
|
|
/// The drag affordances are server-rendered, so the hooks are assertable even
|
|
/// though the drag itself needs JavaScript.
|
|
#[tokio::test]
|
|
async fn sidebar_note_items_and_folder_items_carry_drag_hooks() {
|
|
let f = Fixture::provisioned("drag-hooks");
|
|
let id = f.create_note().await;
|
|
f.post_authed(&format!("/notes/{id}/move"), "folder=Work")
|
|
.await;
|
|
|
|
let (status, body) = f.get_authed("/").await;
|
|
assert_eq!(status, StatusCode::OK);
|
|
|
|
assert!(
|
|
body.contains(&format!("data-note-id=\"{id}\"")),
|
|
"note items must expose their id for the drag payload"
|
|
);
|
|
assert!(
|
|
body.contains("draggable=\"true\""),
|
|
"note items must be draggable"
|
|
);
|
|
// The anchor must opt out, or the browser starts a native link drag and
|
|
// the folder never lights up as a drop target.
|
|
assert!(
|
|
body.contains("draggable=\"false\""),
|
|
"the inner anchor must opt out of native link dragging"
|
|
);
|
|
assert!(
|
|
body.contains("data-drop-folder=\"Work\""),
|
|
"each folder nav item must name its folder"
|
|
);
|
|
assert!(
|
|
body.contains("data-drop-folder=\"\""),
|
|
"All Notes must be a drop target that means the root"
|
|
);
|
|
}
|
|
|
|
/// Desktop re-files through File > Move to Folder…. Each entry is its own form
|
|
/// posting to `/notes/:id/move`, so a click is a real POST and no JavaScript
|
|
/// performs the move.
|
|
#[tokio::test]
|
|
async fn the_move_menu_posts_the_move_route() {
|
|
let f = Fixture::provisioned("move-menu");
|
|
f.post_authed("/folders", "name=Alpha").await;
|
|
f.post_authed("/folders", "name=Beta").await;
|
|
let id = f.create_note().await;
|
|
|
|
let (status, body) = f.get_authed(&format!("/notes/{id}")).await;
|
|
assert_eq!(status, StatusCode::OK);
|
|
|
|
assert!(
|
|
body.contains("Move to Folder"),
|
|
"the File menu should offer a Move to Folder submenu"
|
|
);
|
|
|
|
// Scope to the submenu before counting. `list_folders()` reads the shared
|
|
// notes directory, which every test in this binary writes to, so the app's
|
|
// folder list legitimately holds folders created by unrelated tests. A
|
|
// whole-page count would therefore be asserting on global state.
|
|
//
|
|
// Anchored on the Alpine binding, not on the label text: `style.css` is
|
|
// inlined into the page and its comments mention the menu by name, so a
|
|
// text search finds the stylesheet first.
|
|
let trigger = body
|
|
.find("toggleSubmenu('noteMove'")
|
|
.expect("the submenu trigger");
|
|
let submenu_end = body[trigger..]
|
|
.find("</ul>")
|
|
.map(|i| trigger + i)
|
|
.expect("the submenu list should close");
|
|
let submenu = &body[trigger..submenu_end];
|
|
|
|
let action = format!("action=\"/notes/{id}/move\"");
|
|
|
|
// One destination per folder in the sidebar, plus (Unfiled). Counted from
|
|
// the sidebar rather than hardcoded, because the shared notes directory
|
|
// means other tests' folders are legitimately present. The invariant worth
|
|
// pinning is that the menu and the sidebar agree on which folders exist.
|
|
let nav = folder_nav_region(&body);
|
|
let nav_items = nav.matches("data-drop-folder=\"").count();
|
|
assert_eq!(
|
|
submenu.matches(&action).count(),
|
|
nav_items,
|
|
"the submenu should offer (Unfiled) plus one entry per sidebar \
|
|
folder ({nav_items} destinations), got:\n{submenu}"
|
|
);
|
|
|
|
// The two folders this test created must both be offered.
|
|
assert!(
|
|
submenu.contains("value=\"Alpha\""),
|
|
"Alpha should be listed"
|
|
);
|
|
assert!(submenu.contains("value=\"Beta\""), "Beta should be listed");
|
|
|
|
// Folder names run to 100 characters and the flyout is capped to the
|
|
// viewport, so a long name wraps across lines. The untruncated name stays
|
|
// reachable via the title attribute.
|
|
assert!(
|
|
submenu.contains("title=\"Alpha\""),
|
|
"each folder button should carry its full name as a title"
|
|
);
|
|
|
|
// Un-filing comes first, matching the sidebar's own ordering.
|
|
let unfiled = submenu
|
|
.find("value=\"\"")
|
|
.expect("the submenu should offer (Unfiled)");
|
|
let alpha = submenu.find("value=\"Alpha\"").expect("Alpha");
|
|
assert!(unfiled < alpha, "(Unfiled) should be listed first");
|
|
|
|
// (Unfiled) posts an empty folder, which the route reads as the root.
|
|
assert!(
|
|
body.contains("<input type=\"hidden\" name=\"folder\" value=\"\">"),
|
|
"the submenu should offer a way to un-file a note"
|
|
);
|
|
assert!(
|
|
body.contains("<input type=\"hidden\" name=\"folder\" value=\"Alpha\">"),
|
|
"each folder should post its own name"
|
|
);
|
|
|
|
// Disabled with no note open, matching Export Note As….
|
|
let (status, empty) = f.get_authed("/").await;
|
|
assert_eq!(status, StatusCode::OK);
|
|
assert!(
|
|
empty.contains("Move to Folder"),
|
|
"the trigger should still render without a note"
|
|
);
|
|
}
|
|
|
|
/// Mobile's re-filing control. It must stay in the markup at every breakpoint —
|
|
/// CSS decides which entry point shows — and it must work without JavaScript,
|
|
/// which is the whole reason it exists beside the menu.
|
|
#[tokio::test]
|
|
async fn the_move_bar_survives_for_mobile() {
|
|
let f = Fixture::provisioned("move-bar");
|
|
f.post_authed("/folders", "name=Alpha").await;
|
|
let id = f.create_note().await;
|
|
|
|
let (status, body) = f.get_authed(&format!("/notes/{id}")).await;
|
|
assert_eq!(status, StatusCode::OK);
|
|
|
|
assert!(
|
|
body.contains("class=\"move-folder-bar\""),
|
|
"the mobile bar should be in the markup"
|
|
);
|
|
assert!(
|
|
body.contains(&format!("action=\"/notes/{id}/move\"")),
|
|
"the bar should post to the move route"
|
|
);
|
|
assert!(
|
|
body.contains("name=\"folder\""),
|
|
"the bar needs a folder field"
|
|
);
|
|
|
|
// A select cannot submit a form by itself. If an auto-submit handler came
|
|
// back, the button would look redundant and the control would silently stop
|
|
// working with JS off — which is the only reason it is here.
|
|
//
|
|
// Both bounds are anchored on markup. `style.css` is inlined into the page,
|
|
// so a search for `move-folder-bar` finds the stylesheet first and the
|
|
// slice covers CSS, where both assertions pass without inspecting
|
|
// anything. The bar holds exactly one form, so that form's close tag is a
|
|
// reliable end bound covering both its attributes and its button.
|
|
let bar_start = body
|
|
.find("class=\"move-folder-bar\"")
|
|
.expect("the bar markup");
|
|
let bar_end = body[bar_start..]
|
|
.find("</form>")
|
|
.map(|i| bar_start + i + "</form>".len())
|
|
.expect("the bar holds one form");
|
|
let bar = &body[bar_start..bar_end];
|
|
|
|
assert!(
|
|
!bar.contains("x-on:change"),
|
|
"the bar must not auto-submit on change; the button is the only \
|
|
submit path and the control has to work without JS"
|
|
);
|
|
assert!(
|
|
bar.contains("<button type=\"submit\""),
|
|
"the bar needs its submit button"
|
|
);
|
|
}
|
|
|
|
/// Neither re-filing entry point may carry `desktop-only`.
|
|
///
|
|
/// This is a regression guard for a bug that shipped: the bar had
|
|
/// `desktop-only` *and* a `@media (min-width: 601px) { display: none }` rule.
|
|
/// `.desktop-only` hides at `max-width: 600px`, so the two rules composed to
|
|
/// hide the bar at every width, leaving phones with no way to re-file a note
|
|
/// at all — the menu was `desktop-only` too, and HTML5 drag does not fire on
|
|
/// touch.
|
|
///
|
|
/// Nothing in a Rust test can observe `display: none`, which is why the earlier
|
|
/// version of this check passed while the control was invisible. Pinning the
|
|
/// *contract* — the class must be absent from both, with the bar hidden by a
|
|
/// `min-width` query instead — is what actually catches the mistake.
|
|
#[tokio::test]
|
|
async fn move_entry_points_are_not_desktop_only() {
|
|
let f = Fixture::provisioned("move-not-desktop-only");
|
|
f.post_authed("/folders", "name=Alpha").await;
|
|
let id = f.create_note().await;
|
|
|
|
let (status, body) = f.get_authed(&format!("/notes/{id}")).await;
|
|
assert_eq!(status, StatusCode::OK);
|
|
|
|
assert!(
|
|
!body.contains("class=\"move-folder-bar desktop-only\""),
|
|
"`.desktop-only` hides at max-width 600px, so adding it to the bar \
|
|
would hide the mobile control that only exists below that width"
|
|
);
|
|
|
|
let trigger = body
|
|
.find("toggleSubmenu('noteMove'")
|
|
.expect("the submenu trigger");
|
|
let submenu_end = body[trigger..]
|
|
.find("</ul>")
|
|
.map(|i| trigger + i)
|
|
.expect("the submenu list should close");
|
|
let submenu = &body[trigger..submenu_end];
|
|
|
|
assert!(
|
|
!submenu.contains("desktop-only"),
|
|
"the File submenu is the mobile entry point too and must stay visible \
|
|
at every width"
|
|
);
|
|
}
|
|
|
|
/// The move control must not be swallowed by the browser as an illegally
|
|
/// nested form: a form inside a form is invalid and the inner element is
|
|
/// discarded outright.
|
|
#[tokio::test]
|
|
async fn the_move_form_is_a_sibling_of_the_note_form() {
|
|
let f = Fixture::provisioned("move-form-shape");
|
|
let id = f.create_note().await;
|
|
let (status, body) = f.get_authed(&format!("/notes/{id}")).await;
|
|
assert_eq!(status, StatusCode::OK);
|
|
|
|
let note_form = body
|
|
.find("<form id=\"note-form\"")
|
|
.expect("the note form should be present");
|
|
let note_form_end = body[note_form..]
|
|
.find("</form>")
|
|
.map(|i| note_form + i)
|
|
.expect("the note form should be closed");
|
|
// Match the markup, not the bare class name: `style.css` is inlined into
|
|
// every page, so a plain `find("move-folder-form")` lands on the
|
|
// stylesheet text and passes while the real control is nested wrongly.
|
|
let move_form = body
|
|
.find("class=\"move-folder-form\"")
|
|
.expect("the move form should be present");
|
|
|
|
assert!(
|
|
move_form > note_form_end,
|
|
"a form nested inside #note-form is invalid HTML and browsers drop the \
|
|
inner element entirely, silently deleting the no-JS move control"
|
|
);
|
|
|
|
assert!(
|
|
body.contains(&format!("action=\"/notes/{id}/move\"")),
|
|
"the move form should post to the move route"
|
|
);
|
|
assert!(
|
|
body.contains("name=\"folder\""),
|
|
"the move form needs a folder field"
|
|
);
|
|
}
|
|
|
|
/// `app.js` is inlined verbatim, so a regression in it is invisible to every
|
|
/// other test in the suite. Behind a base path an origin-absolute move URL
|
|
/// resolves against the site root, never reaches the app, and the proxy's own
|
|
/// 404 comes back.
|
|
#[tokio::test]
|
|
async fn the_move_fetch_uses_the_injected_base_path() {
|
|
let f = Fixture::with_base_path("move-fetch-base", "/forgejo")
|
|
.login_over_http()
|
|
.await;
|
|
let (status, body) = f.get_authed("/").await;
|
|
assert_eq!(status, StatusCode::OK);
|
|
|
|
assert!(
|
|
body.contains("fetch(base + '/notes/'"),
|
|
"app.js should build the move URL from __BASE_PATH__"
|
|
);
|
|
assert!(
|
|
!body.contains("fetch('/notes/'"),
|
|
"app.js must not hardcode an origin-absolute move path"
|
|
);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn sidebar_shows_folder_navigation() {
|
|
let f = Fixture::provisioned("folder-nav");
|
|
f.post_authed("/folders", "name=Alpha").await;
|
|
f.post_authed("/folders", "name=Beta").await;
|
|
|
|
let (status, body) = f.get_authed("/").await;
|
|
assert_eq!(status, StatusCode::OK);
|
|
assert!(body.contains("All Notes"), "should show All Notes");
|
|
assert!(body.contains("Alpha"), "should show Alpha folder");
|
|
assert!(body.contains("Beta"), "should show Beta folder");
|
|
assert!(body.contains("nav-count"), "should show note counts");
|
|
}
|
|
|
|
/// The folder nav is wrapped in `.folder-nav-container` with a pull-tab toggle
|
|
/// button. The toggle must be present in the markup at every width (CSS hides
|
|
/// it on desktop) so mobile users can collapse/expand the folder list.
|
|
#[tokio::test]
|
|
async fn folder_nav_container_has_toggle_button() {
|
|
let f = Fixture::provisioned("folder-nav-toggle");
|
|
f.post_authed("/folders", "name=Alpha").await;
|
|
|
|
let (status, body) = f.get_authed("/").await;
|
|
assert_eq!(status, StatusCode::OK);
|
|
|
|
assert!(
|
|
body.contains("class=\"folder-nav-container\""),
|
|
"the folder nav should be wrapped in .folder-nav-container"
|
|
);
|
|
assert!(
|
|
body.contains("class=\"folder-nav-toggle\""),
|
|
"the pull-tab toggle button should be in the markup"
|
|
);
|
|
assert!(
|
|
body.contains("toggleFolderNav()"),
|
|
"the toggle button should call toggleFolderNav()"
|
|
);
|
|
assert!(
|
|
body.contains("aria-controls=\"folder-nav-list\""),
|
|
"the toggle should reference the folder nav list via aria-controls"
|
|
);
|
|
}
|
|
|
|
/// The View menu has a Hide/Show Folder Nav toggle that shares the same state
|
|
/// as the pull-tab button.
|
|
#[tokio::test]
|
|
async fn view_menu_has_folder_nav_toggle() {
|
|
let f = Fixture::provisioned("view-menu-folder-nav");
|
|
|
|
let (status, body) = f.get_authed("/").await;
|
|
assert_eq!(status, StatusCode::OK);
|
|
|
|
// Find the View menu dropdown and check it contains the folder nav toggle
|
|
let view_start = body
|
|
.find("toggleMenu('view')")
|
|
.expect("the View menu should exist");
|
|
let view_end = body[view_start..]
|
|
.find("</ul>")
|
|
.map(|i| view_start + i)
|
|
.expect("the View menu dropdown should close");
|
|
let view_menu = &body[view_start..view_end];
|
|
|
|
assert!(
|
|
view_menu.contains("toggleFolderNav()"),
|
|
"the View menu should have a folder nav toggle"
|
|
);
|
|
assert!(
|
|
view_menu.contains("Folder Nav"),
|
|
"the View menu toggle should mention Folder Nav"
|
|
);
|
|
}
|
|
|
|
/// Save Note lives in the File menu, not the Edit menu.
|
|
#[tokio::test]
|
|
async fn save_note_is_in_file_menu() {
|
|
let f = Fixture::provisioned("save-note-file-menu");
|
|
let id = f.create_note().await;
|
|
|
|
let (status, body) = f.get_authed(&format!("/notes/{id}")).await;
|
|
assert_eq!(status, StatusCode::OK);
|
|
|
|
// Find the File menu dropdown
|
|
let file_start = body
|
|
.find("toggleMenu('file')")
|
|
.expect("the File menu should exist");
|
|
let file_end = body[file_start..]
|
|
.find("</ul>")
|
|
.map(|i| file_start + i)
|
|
.expect("the File menu dropdown should close");
|
|
let file_menu = &body[file_start..file_end];
|
|
|
|
assert!(
|
|
file_menu.contains("saveCurrentNote()"),
|
|
"Save Note should be in the File menu"
|
|
);
|
|
assert!(
|
|
file_menu.contains("Save Note"),
|
|
"Save Note label should be in the File menu"
|
|
);
|
|
|
|
// Find the Edit menu dropdown
|
|
let edit_start = body
|
|
.find("toggleMenu('edit')")
|
|
.expect("the Edit menu should exist");
|
|
let edit_end = body[edit_start..]
|
|
.find("</ul>")
|
|
.map(|i| edit_start + i)
|
|
.expect("the Edit menu dropdown should close");
|
|
let edit_menu = &body[edit_start..edit_end];
|
|
|
|
assert!(
|
|
!edit_menu.contains("saveCurrentNote()"),
|
|
"Save Note should NOT be in the Edit menu"
|
|
);
|
|
}
|
|
|
|
/// On mobile, the folder nav and note list scroll independently within their
|
|
/// own bounded areas. The sidebar itself does not scroll, and the pull-tab
|
|
/// toggle stays visible above the scrolling folder list.
|
|
#[tokio::test]
|
|
async fn mobile_folder_nav_scrolls_independently() {
|
|
let f = Fixture::provisioned("mobile-independent-scroll");
|
|
f.post_authed("/folders", "name=Alpha").await;
|
|
|
|
let (status, body) = f.get_authed("/").await;
|
|
assert_eq!(status, StatusCode::OK);
|
|
|
|
// The mobile CSS must make the sidebar non-scrollable and give the
|
|
// folder nav and note list their own scroll areas.
|
|
let mobile_css_start = body
|
|
.find("@media (max-width: 600px)")
|
|
.expect("mobile media query should exist");
|
|
let mobile_css = &body[mobile_css_start..];
|
|
|
|
assert!(
|
|
mobile_css.contains(".sidebar") && mobile_css.contains("overflow: hidden"),
|
|
"mobile sidebar should not scroll"
|
|
);
|
|
assert!(
|
|
mobile_css.contains(".folder-nav") && mobile_css.contains("overflow-y: auto"),
|
|
"folder nav should scroll independently"
|
|
);
|
|
assert!(
|
|
mobile_css.contains(".note-list") && mobile_css.contains("overflow-y: auto"),
|
|
"note list should scroll independently"
|
|
);
|
|
assert!(
|
|
mobile_css.contains("max-height: 40%"),
|
|
"folder nav container should have a max height"
|
|
);
|
|
}
|
|
|
|
/// The `folder-nav` list, and nothing else.
|
|
///
|
|
/// Scoped deliberately: `.nav-count` also appears in the inlined stylesheet,
|
|
/// and counting the whole body would let a badge elsewhere in the page stand in
|
|
/// for a nav badge that is not there — which is how the test below would come
|
|
/// to pass while showing the wrong thing.
|
|
fn folder_nav_region(body: &str) -> &str {
|
|
let start = body
|
|
.find("id=\"folder-nav-list\"")
|
|
.expect("the folder nav should be present");
|
|
// Back up to the opening <ul tag
|
|
let ul_start = body[..start]
|
|
.rfind("<ul")
|
|
.expect("the folder nav should have a <ul> tag");
|
|
let rest = &body[ul_start..];
|
|
let end = rest.find("</ul>").expect("the folder nav should be closed");
|
|
&rest[..end]
|
|
}
|
|
|
|
/// Counts the badges inside one nav item's link.
|
|
///
|
|
/// Returns `None` when the label is not in the nav at all, so a test can tell
|
|
/// "no badge" apart from "no such folder" instead of both reading as zero.
|
|
fn nav_count_for(region: &str, label: &str) -> Option<usize> {
|
|
let anchor = region
|
|
.split("<a href=")
|
|
.find(|chunk| chunk.contains(&format!(">{label}</span>")))
|
|
.unwrap_or_else(|| panic!("no nav item labelled {label:?} in:\n{region}"));
|
|
Some(anchor.matches("nav-count").count())
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn all_notes_view_shows_every_folder_count() {
|
|
let f = Fixture::provisioned("nav-count-all");
|
|
f.post_authed("/folders", "name=Alpha").await;
|
|
f.post_authed("/folders", "name=Beta").await;
|
|
|
|
let (status, body) = f.get_authed("/").await;
|
|
assert_eq!(status, StatusCode::OK);
|
|
let nav = folder_nav_region(&body);
|
|
|
|
// Every folder is visible at once here, so the counts are a real summary
|
|
// and every one of them earns its place.
|
|
assert_eq!(
|
|
nav_count_for(nav, "All Notes"),
|
|
Some(1),
|
|
"All Notes should be badged in the All Notes view"
|
|
);
|
|
assert_eq!(
|
|
nav_count_for(nav, "Alpha"),
|
|
Some(1),
|
|
"each folder should be badged in the All Notes view"
|
|
);
|
|
assert_eq!(nav_count_for(nav, "Beta"), Some(1));
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn folder_view_shows_only_the_active_folder_count() {
|
|
let f = Fixture::provisioned("nav-count-one");
|
|
f.post_authed("/folders", "name=Alpha").await;
|
|
f.post_authed("/folders", "name=Beta").await;
|
|
|
|
let (status, body) = f.get_authed("/?folder=Alpha").await;
|
|
assert_eq!(status, StatusCode::OK);
|
|
let nav = folder_nav_region(&body);
|
|
|
|
// Exactly one badge: the folder you are in. The siblings are not merely
|
|
// un-highlighted, they carry nothing at all.
|
|
assert_eq!(
|
|
nav_count_for(nav, "Alpha"),
|
|
Some(1),
|
|
"the open folder should be badged"
|
|
);
|
|
assert_eq!(
|
|
nav_count_for(nav, "Beta"),
|
|
Some(0),
|
|
"a sibling folder should carry no badge, not a zero"
|
|
);
|
|
assert_eq!(
|
|
nav_count_for(nav, "All Notes"),
|
|
Some(0),
|
|
"a badge there would be this folder's count under a different label"
|
|
);
|
|
|
|
// Belt and braces: the whole nav holds one badge, so a badge appearing
|
|
// anywhere unexpected fails rather than being absorbed above.
|
|
assert_eq!(
|
|
nav.matches("nav-count").count(),
|
|
1,
|
|
"a folder view should show exactly one badge, got:\n{nav}"
|
|
);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn note_in_folder_shows_folder_in_editor() {
|
|
let f = Fixture::provisioned("folder-editor");
|
|
let (_, _, loc) = f.post_authed("/folders", "name=Projects").await;
|
|
let loc = loc.expect("folder creation redirects");
|
|
let id = loc.rsplit('/').next().unwrap().to_string();
|
|
|
|
let (status, body) = f.get_authed(&format!("/notes/{id}")).await;
|
|
assert_eq!(status, StatusCode::OK);
|
|
assert!(
|
|
body.contains("Projects"),
|
|
"editor should show the note's folder"
|
|
);
|
|
assert!(
|
|
body.contains("note-folder"),
|
|
"should use the note-folder class"
|
|
);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn folder_creation_with_special_characters() {
|
|
let f = Fixture::provisioned("folder-special");
|
|
// Spaces and unicode are fine.
|
|
let (status, _, loc) = f
|
|
.post_authed("/folders", "name=My+%E2%9C%93+Projects")
|
|
.await;
|
|
assert_eq!(status, StatusCode::SEE_OTHER);
|
|
let loc = loc.expect("folder creation redirects");
|
|
assert!(loc.starts_with("/notes/"));
|
|
}
|
|
|
|
// ------------------------------------------------------------------ auth ----
|
|
|
|
/// There is deliberately no `/setup` route. Enrolment happens in the
|
|
/// terminal before the listener binds, so an HTTP-reachable setup endpoint
|
|
/// could be claimed by anyone who reaches the port first.
|
|
#[tokio::test]
|
|
async fn there_is_no_web_setup_route() {
|
|
let f = Fixture::fresh("no-setup-route");
|
|
let (status, _) = f.get("/setup").await;
|
|
assert_eq!(
|
|
status,
|
|
StatusCode::NOT_FOUND,
|
|
"/setup must not exist over HTTP"
|
|
);
|
|
}
|
|
|
|
/// A wrong code during terminal enrolment must leave no trace: no secret file
|
|
/// written and the device still unprovisioned.
|
|
#[tokio::test]
|
|
async fn wrong_enrolment_code_writes_nothing() {
|
|
let f = Fixture::fresh("bad-enrol");
|
|
f.auth.begin_setup().unwrap();
|
|
|
|
assert_eq!(f.auth.verify_setup("000000"), Err(AuthError::InvalidCode));
|
|
assert!(f.auth.needs_setup());
|
|
assert!(
|
|
!f.secret_file.exists(),
|
|
"a failed enrolment must not write the secret"
|
|
);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn login_page_is_shown_after_provisioning() {
|
|
let f = Fixture::provisioned("loginpage");
|
|
let (status, body) = f.get("/login").await;
|
|
assert_eq!(status, StatusCode::OK);
|
|
assert!(body.contains("Unlock"));
|
|
assert!(!body.contains("<svg"), "login must not show a QR code");
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn wrong_login_code_is_rejected_without_cookie() {
|
|
let f = Fixture::provisioned("badlogin");
|
|
let (status, body, cookie) = f.post_form("/login", "code=111111").await;
|
|
assert_eq!(status, StatusCode::OK);
|
|
assert!(body.contains("was not accepted"));
|
|
assert!(cookie.is_none());
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn valid_login_code_issues_a_hardened_session_cookie() {
|
|
let f = Fixture::provisioned("goodlogin");
|
|
let code = valid_code(&f.secret);
|
|
let (status, _, cookie) = f.post_form("/login", &format!("code={code}")).await;
|
|
assert_eq!(status, StatusCode::SEE_OTHER);
|
|
|
|
let set_cookie = cookie.expect("login should set a session");
|
|
assert!(set_cookie.contains("HttpOnly"), "cookie must be HttpOnly");
|
|
assert!(set_cookie.contains("SameSite=Strict"), "got: {set_cookie}");
|
|
assert!(
|
|
set_cookie.contains("Max-Age=3600"),
|
|
"expected a 1 hour session, got: {set_cookie}"
|
|
);
|
|
assert!(
|
|
set_cookie.contains("Path=/;"),
|
|
"at the root the cookie path should be the default path, got: {set_cookie}"
|
|
);
|
|
}
|
|
|
|
/// Unprovisioned is only reachable in-process now, so the login page says so
|
|
/// instead of redirecting to a route that no longer exists.
|
|
#[tokio::test]
|
|
async fn login_reports_unprovisioned_device() {
|
|
let f = Fixture::fresh("login-unprov");
|
|
let (status, body) = f.get("/login").await;
|
|
assert_eq!(status, StatusCode::SERVICE_UNAVAILABLE);
|
|
assert!(body.contains("terminal"), "got: {body}");
|
|
assert!(!body.contains("/setup"), "must not point at a dead route");
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn logout_invalidates_the_session() {
|
|
let f = Fixture::provisioned("logout");
|
|
let token = f.token.clone().unwrap();
|
|
assert!(f.auth.validate_session(&token));
|
|
|
|
let res = f
|
|
.app
|
|
.clone()
|
|
.oneshot(
|
|
Request::builder()
|
|
.method("POST")
|
|
.uri("/logout")
|
|
.header(header::COOKIE, f.cookie_header())
|
|
.body(Body::empty())
|
|
.unwrap(),
|
|
)
|
|
.await
|
|
.unwrap();
|
|
assert_eq!(res.status(), StatusCode::SEE_OTHER);
|
|
|
|
assert!(
|
|
!f.auth.validate_session(&token),
|
|
"server must forget the token, not just clear the cookie"
|
|
);
|
|
|
|
// The now-dead cookie no longer grants access.
|
|
let res = f
|
|
.app
|
|
.clone()
|
|
.oneshot(
|
|
Request::builder()
|
|
.uri("/")
|
|
.header(header::COOKIE, format!("eternalibre_session={token}"))
|
|
.body(Body::empty())
|
|
.unwrap(),
|
|
)
|
|
.await
|
|
.unwrap();
|
|
assert_eq!(res.status(), StatusCode::SEE_OTHER);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn sessions_survive_across_requests() {
|
|
let f = Fixture::provisioned("persist");
|
|
for _ in 0..3 {
|
|
let (status, _) = f.get_authed("/").await;
|
|
assert_eq!(status, StatusCode::OK, "session should persist");
|
|
}
|
|
assert_eq!(f.auth.session_count(), 1);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn separate_logins_get_separate_sessions() {
|
|
let f = Fixture::provisioned("multi");
|
|
let code = valid_code(&f.secret);
|
|
let (_, _, cookie) = f.post_form("/login", &format!("code={code}")).await;
|
|
let second = session_value(&cookie.unwrap());
|
|
|
|
assert_ne!(second, f.token.clone().unwrap());
|
|
assert_eq!(f.auth.session_count(), 2);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn theme_cookie_alongside_session_still_works() {
|
|
let f = Fixture::provisioned("themecookie");
|
|
|
|
let res = f
|
|
.app
|
|
.clone()
|
|
.oneshot(
|
|
Request::builder()
|
|
.uri("/")
|
|
.header(
|
|
header::COOKIE,
|
|
format!(
|
|
"theme=Dracula; eternalibre_session={}",
|
|
f.token.clone().unwrap()
|
|
),
|
|
)
|
|
.body(Body::empty())
|
|
.unwrap(),
|
|
)
|
|
.await
|
|
.unwrap();
|
|
|
|
assert_eq!(res.status(), StatusCode::OK);
|
|
let bytes = axum::body::to_bytes(res.into_body(), 1 << 20)
|
|
.await
|
|
.unwrap();
|
|
assert!(String::from_utf8_lossy(&bytes).contains("data-theme=\"Dracula\""));
|
|
}
|
|
|
|
// ----------------------------------------------------------- about page ----
|
|
|
|
/// The about page's mobile styling hangs entirely off this one class.
|
|
///
|
|
/// `style.css` turns `.back-link` into a full-width 44px touch target on
|
|
/// mobile, matching the HIG minimum the rest of the app enforces. Drop the
|
|
/// class and the only way off the page silently reverts to a ~13px text
|
|
/// link — which is exactly the "assumes a desktop view" problem it was
|
|
/// added to fix. The heading rule is anchored on `main > h1` and so needs
|
|
/// no class, but the link does.
|
|
#[tokio::test]
|
|
async fn about_page_back_link_is_styled() {
|
|
let f = Fixture::fresh("about-link").login_over_http().await;
|
|
let (status, body) = f.get_authed("/about").await;
|
|
assert_eq!(status, StatusCode::OK);
|
|
assert!(
|
|
body.contains(r#"class="back-link""#),
|
|
"about page is missing the back-link class that style.css targets"
|
|
);
|
|
assert!(
|
|
body.contains("Back to notes"),
|
|
"about page should still offer a way back"
|
|
);
|
|
}
|
|
|
|
/// The about page is a separate document from the app shell, so it inlines
|
|
/// `style.css` itself. If that inlining were dropped, every mobile rule
|
|
/// would be dead on this page specifically.
|
|
#[tokio::test]
|
|
async fn about_page_inlines_the_stylesheet() {
|
|
let f = Fixture::fresh("about-css").login_over_http().await;
|
|
let (status, body) = f.get_authed("/about").await;
|
|
assert_eq!(status, StatusCode::OK);
|
|
assert!(
|
|
body.contains(".about-page main > h1"),
|
|
"about page should inline the stylesheet that styles it"
|
|
);
|
|
// Match the full selector, not just the class name. A substring check on
|
|
// `.back-link` also matches `.back-link-foo`, which is how this test
|
|
// passed the first time it was run against a deliberately broken sheet.
|
|
assert!(
|
|
body.contains(".about-page .back-link {"),
|
|
"the inlined sheet should carry the back-link rules"
|
|
);
|
|
}
|
|
|
|
/// Every screen must declare a viewport, or mobile browsers fall back to a
|
|
/// ~980px layout viewport and scale the whole page down.
|
|
///
|
|
/// That silently disables every `@media (max-width: 600px)` rule in the
|
|
/// stylesheet, so a screen can carry a full set of mobile rules and still
|
|
/// render the desktop layout — which is exactly what happened to `/about`.
|
|
/// The failure is invisible in a desktop browser and invisible to any test
|
|
/// that only asserts the CSS was inlined, which is why it is pinned here
|
|
/// per-screen rather than once.
|
|
#[tokio::test]
|
|
async fn every_screen_declares_a_viewport() {
|
|
let f = Fixture::fresh("viewport").login_over_http().await;
|
|
for path in ["/", "/about"] {
|
|
let (status, body) = f.get_authed(path).await;
|
|
assert_eq!(status, StatusCode::OK, "{path}");
|
|
assert!(
|
|
body.contains(r#"name="viewport""#)
|
|
&& body.contains(r#"content="width=device-width, initial-scale=1"#),
|
|
"{path} is missing a viewport meta tag; mobile will scale it down \
|
|
and none of the max-width media queries will match"
|
|
);
|
|
}
|
|
}
|
|
|
|
/// `app.js` is inlined into the page, so it cannot call the server-side
|
|
/// `base.url()` helper. Its one `fetch()` has to build the URL itself, which
|
|
/// is what `window.__BASE_PATH__` is for.
|
|
///
|
|
/// Without it, `fetch('/preview')` resolves against the origin root. Behind
|
|
/// a reverse proxy mounted at a subdirectory that never reaches the app, and
|
|
/// the proxy's own 404 body gets swapped into the preview pane. The symptom
|
|
/// is a preview pane full of "404 Not Found" while typing.
|
|
#[tokio::test]
|
|
async fn the_base_path_is_handed_to_client_side_js() {
|
|
// With a base path set, the browser must be told about it.
|
|
let f = Fixture::with_base_path("base-js", "/forgejo")
|
|
.login_over_http()
|
|
.await;
|
|
let (status, body) = f.get_authed("/").await;
|
|
assert_eq!(status, StatusCode::OK);
|
|
// Backtick template literal, matching the `__INITIAL_PREVIEW__` line
|
|
// above it and escaped by the same `escape_js` helper.
|
|
assert!(
|
|
body.contains("window.__BASE_PATH__ = `/forgejo`;"),
|
|
"client JS should be handed the base path"
|
|
);
|
|
|
|
// Without one, the value must be empty rather than the string "undefined",
|
|
// so the fetch URL stays byte-identical to the pre-fix behaviour.
|
|
let plain = Fixture::fresh("base-js-none").login_over_http().await;
|
|
let (status, body) = plain.get_authed("/").await;
|
|
assert_eq!(status, StatusCode::OK);
|
|
assert!(
|
|
body.contains("window.__BASE_PATH__ = ``;"),
|
|
"with no base path the client value should be empty"
|
|
);
|
|
}
|
|
|
|
/// The `fetch()` in `app.js` must actually use the injected value. This is
|
|
/// the assertion that would have caught the original bug: `app.js` is
|
|
/// inlined verbatim, so a regression there is invisible to every other test.
|
|
#[tokio::test]
|
|
async fn the_preview_fetch_uses_the_injected_base_path() {
|
|
let f = Fixture::with_base_path("fetch-base", "/forgejo")
|
|
.login_over_http()
|
|
.await;
|
|
let (status, body) = f.get_authed("/").await;
|
|
assert_eq!(status, StatusCode::OK);
|
|
assert!(
|
|
body.contains("fetch(base + '/preview'"),
|
|
"app.js should build the preview URL from __BASE_PATH__"
|
|
);
|
|
assert!(
|
|
!body.contains("fetch('/preview'"),
|
|
"app.js must not hardcode an origin-absolute /preview"
|
|
);
|
|
}
|
|
|
|
/// The about page advertises a version, and it must be the one in
|
|
/// `Cargo.toml`.
|
|
///
|
|
/// The title bar used to carry a hand-written `"v0.1"` that had already
|
|
/// drifted from the crate's `0.1.0`. Both now read `CARGO_PKG_VERSION`, so
|
|
/// this pins that they agree with the manifest rather than with each other.
|
|
#[tokio::test]
|
|
async fn about_page_reports_the_manifest_version() {
|
|
let f = Fixture::fresh("about-version").login_over_http().await;
|
|
let (status, body) = f.get_authed("/about").await;
|
|
assert_eq!(status, StatusCode::OK);
|
|
|
|
let version = env!("CARGO_PKG_VERSION");
|
|
assert!(
|
|
body.contains(&format!("Version {version}")),
|
|
"about page should report version {version}"
|
|
);
|
|
// The title bar must show the same string, not a separately maintained one.
|
|
let (shell_status, shell) = f.get_authed("/").await;
|
|
assert_eq!(shell_status, StatusCode::OK);
|
|
assert!(
|
|
shell.contains(&format!("EternaLibre Notes v{version}")),
|
|
"title bar should show v{version} from the manifest"
|
|
);
|
|
}
|
|
|
|
/// The theme counts are derived from the palette, not typed in. If someone
|
|
/// adds or removes a theme, this keeps the page honest without a manual edit.
|
|
#[tokio::test]
|
|
async fn about_page_theme_counts_come_from_the_palette() {
|
|
use eternalibre_notes::themes::PREDEFINED_THEMES;
|
|
|
|
let total = PREDEFINED_THEMES.len();
|
|
let dark = PREDEFINED_THEMES.iter().filter(|t| t.is_dark()).count();
|
|
let light = total - dark;
|
|
|
|
let f = Fixture::fresh("about-themes").login_over_http().await;
|
|
let (status, body) = f.get_authed("/about").await;
|
|
assert_eq!(status, StatusCode::OK);
|
|
assert!(
|
|
body.contains(&format!(
|
|
"{total} built-in themes ({dark} dark, {light} light)"
|
|
)),
|
|
"about page should report {total} themes split {dark} dark / {light} light"
|
|
);
|
|
}
|
|
|
|
/// Outbound links must carry `rel="noopener noreferrer"`. The app advertises
|
|
/// that it never talks to a third party, and these are the only links that
|
|
/// leave the machine, so they should not leak a referrer when followed.
|
|
#[tokio::test]
|
|
async fn about_page_external_links_are_hardened() {
|
|
let f = Fixture::fresh("about-links").login_over_http().await;
|
|
let (status, body) = f.get_authed("/about").await;
|
|
assert_eq!(status, StatusCode::OK);
|
|
|
|
for target in [
|
|
"https://github.com/MARKMENTAL",
|
|
"https://mentalnet.xyz/forgejo-v2/",
|
|
"https://github.com/MARKMENTAL/tuxdock",
|
|
"https://github.com/MARKMENTAL/mentalnet-gnu-linux",
|
|
] {
|
|
assert!(body.contains(target), "about page should link to {target}");
|
|
}
|
|
|
|
// Check every external anchor, so a link added later without the
|
|
// hardening attributes fails here instead of shipping quietly.
|
|
let externals: Vec<&str> = body
|
|
.match_indices("<a href=\"https://")
|
|
.map(|(i, _)| &body[i..])
|
|
.collect();
|
|
assert!(
|
|
!externals.is_empty(),
|
|
"expected external links on the about page"
|
|
);
|
|
for a in externals {
|
|
let tag = &a[..a.find('>').expect("unterminated anchor")];
|
|
assert!(
|
|
tag.contains(r#"rel="noopener noreferrer""#),
|
|
"external link missing rel hardening: {tag}"
|
|
);
|
|
}
|
|
}
|
|
|
|
// ------------------------------------------------------------- base path ----
|
|
|
|
/// Every generated URL must carry the base prefix, or a browser behind the
|
|
/// proxy would resolve `/about` against the site root and 404.
|
|
#[tokio::test]
|
|
async fn base_path_prefixes_generated_links() {
|
|
let f = Fixture::with_base_path("base-links", "/forgejo")
|
|
.login_over_http()
|
|
.await;
|
|
let (status, body) = f.get_authed("/").await;
|
|
assert_eq!(status, StatusCode::OK);
|
|
|
|
// `/static/alpine.min.js` is the only externally-loaded asset;
|
|
// `app.js` is inlined via `include_str!`, so it has no URL to rewrite.
|
|
for target in [
|
|
"/about",
|
|
"/export",
|
|
"/notes",
|
|
"/theme",
|
|
"/static/alpine.min.js",
|
|
] {
|
|
let expected = f.expect(target);
|
|
assert!(
|
|
body.contains(&format!("\"{expected}\"")) || body.contains(&format!("'{expected}'")),
|
|
"expected {expected} in generated markup"
|
|
);
|
|
}
|
|
assert!(
|
|
!body.contains("href=\"/about\""),
|
|
"found a root-absolute link that would escape the prefix"
|
|
);
|
|
assert!(
|
|
!body.contains("src=\"/static/"),
|
|
"found a root-absolute asset URL that would escape the prefix"
|
|
);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn base_path_prefixes_single_note_export_links() {
|
|
let f = Fixture::with_base_path("base-note-export", "/forgejo")
|
|
.login_over_http()
|
|
.await;
|
|
let id = f.create_note().await;
|
|
let (status, body) = f.get_authed(&format!("/notes/{id}")).await;
|
|
assert_eq!(status, StatusCode::OK);
|
|
|
|
for format in ["pdf", "markdown", "html"] {
|
|
assert!(
|
|
body.contains(&format!("href=\"/forgejo/notes/{id}/export/{format}\"")),
|
|
"{format} export link should include the base path"
|
|
);
|
|
}
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn base_path_prefixes_redirects() {
|
|
let f = Fixture::with_base_path("base-redirect", "/forgejo")
|
|
.login_over_http()
|
|
.await;
|
|
|
|
// Creating a note redirects to the new note's URL.
|
|
let (_, _, loc) = f.post_authed("/notes", "").await;
|
|
let loc = loc.expect("create redirects");
|
|
assert!(
|
|
loc.starts_with("/forgejo/notes/"),
|
|
"redirect escaped the base path: {loc}"
|
|
);
|
|
|
|
// An unauthenticated request must bounce within the prefix too.
|
|
let anon = Fixture::with_base_path("base-anon", "/forgejo");
|
|
let (status, body) = anon.get("/").await;
|
|
assert_eq!(status, StatusCode::SEE_OTHER);
|
|
assert!(
|
|
body.contains("LOCATION: /forgejo/login"),
|
|
"login redirect escaped the base path: {body}"
|
|
);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn base_path_scopes_the_session_cookie() {
|
|
let f = Fixture::with_base_path("base-cookie", "/forgejo")
|
|
.login_over_http()
|
|
.await;
|
|
// The fixture captured only the token value, so log in again to inspect
|
|
// the raw Set-Cookie header.
|
|
let code = valid_code(&f.secret);
|
|
let (_, _, set_cookie) = f.post_form("/login", &format!("code={code}")).await;
|
|
let raw = set_cookie.expect("login sets a cookie");
|
|
assert!(
|
|
raw.contains("Path=/forgejo"),
|
|
"cookie must be scoped to the prefix, got: {raw}"
|
|
);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn base_path_login_form_posts_to_the_prefix() {
|
|
let f = Fixture::with_base_path("base-form", "/forgejo").provision();
|
|
let (status, body) = f.get("/login").await;
|
|
assert_eq!(status, StatusCode::OK);
|
|
assert!(
|
|
body.contains(r#"action="/forgejo/login""#),
|
|
"login form action escaped the prefix"
|
|
);
|
|
}
|
|
|
|
/// A reverse proxy strips the base path before forwarding, so the path the
|
|
/// app actually receives for a static asset is app-absolute.
|
|
///
|
|
/// This is the assertion that catches the bug where the static nest was
|
|
/// registered at `{base}/static`: the asset 404'd, `x-data="app()"` never
|
|
/// initialised, and every Alpine directive — including the File menu
|
|
/// dropdowns — silently stopped working.
|
|
///
|
|
/// It drives `routes::app`, the same assembly `main.rs` uses, rather than
|
|
/// hand-rolling a router, so it fails if the real configuration regresses.
|
|
#[tokio::test]
|
|
async fn alpine_is_served_app_absolute_even_with_a_base_path() {
|
|
use eternalibre_notes::routes::{self, AppState};
|
|
|
|
let secret_file = temp_secret_path("static-abs");
|
|
let auth = Arc::new(AuthState::with_secret_path(&secret_file));
|
|
let app = routes::app(AppState {
|
|
auth,
|
|
base_path: "/forgejo".into(),
|
|
});
|
|
|
|
let (status, body) = fetch(&app, "/static/alpine.min.js").await;
|
|
assert_eq!(
|
|
status,
|
|
StatusCode::OK,
|
|
"Alpine must be served at the app-absolute path; a miss here leaves \
|
|
x-data=\"app()\" uninitialised and the menus dead"
|
|
);
|
|
assert!(
|
|
body.contains("Alpine"),
|
|
"expected the Alpine bundle, got {} bytes",
|
|
body.len()
|
|
);
|
|
|
|
// The prefixed path is not a route on the app: the proxy is what strips
|
|
// the prefix, so the app must not also accept it.
|
|
assert_ne!(
|
|
fetch(&app, "/forgejo/static/alpine.min.js").await.0,
|
|
StatusCode::OK,
|
|
"static should not be reachable at the prefixed path"
|
|
);
|
|
|
|
let _ = std::fs::remove_file(&secret_file);
|
|
}
|
|
|
|
/// Alpine must be reachable *without* a session: it is what makes every
|
|
/// Alpine directive work, and it sits outside the auth gate.
|
|
#[tokio::test]
|
|
async fn alpine_is_served_without_a_session() {
|
|
let f = Fixture::fresh("static-anon");
|
|
let (status, body) = f.get("/static/alpine.min.js").await;
|
|
assert_eq!(status, StatusCode::OK);
|
|
assert!(body.contains("Alpine"));
|
|
}
|
|
|
|
/// The bytes are baked in at compile time, so the response can be cached
|
|
/// indefinitely and is unaffected by the working directory.
|
|
#[tokio::test]
|
|
async fn alpine_response_is_immutably_cacheable() {
|
|
let f = Fixture::fresh("static-cache");
|
|
let res = f
|
|
.app
|
|
.clone()
|
|
.oneshot(
|
|
Request::builder()
|
|
.uri("/static/alpine.min.js")
|
|
.body(Body::empty())
|
|
.unwrap(),
|
|
)
|
|
.await
|
|
.unwrap();
|
|
|
|
assert_eq!(res.status(), StatusCode::OK);
|
|
let cache = res
|
|
.headers()
|
|
.get(header::CACHE_CONTROL)
|
|
.and_then(|v| v.to_str().ok())
|
|
.unwrap_or_default();
|
|
assert!(
|
|
cache.contains("immutable"),
|
|
"expected an immutable cache header, got {cache:?}"
|
|
);
|
|
let ctype = res
|
|
.headers()
|
|
.get(header::CONTENT_TYPE)
|
|
.and_then(|v| v.to_str().ok())
|
|
.unwrap_or_default();
|
|
assert!(
|
|
ctype.contains("javascript"),
|
|
"expected a JavaScript content type, got {ctype:?}"
|
|
);
|
|
}
|
|
|
|
/// The app must not depend on a `static/` directory existing at runtime.
|
|
/// This is the regression that bit a real deployment: the binary was moved
|
|
/// without its `static/` folder and every Alpine directive went dead.
|
|
#[tokio::test]
|
|
async fn alpine_is_available_without_a_static_directory() {
|
|
use eternalibre_notes::routes::{self, AppState};
|
|
|
|
let secret_file = temp_secret_path("static-nodir");
|
|
let auth = Arc::new(AuthState::with_secret_path(&secret_file));
|
|
let app = routes::app(AppState {
|
|
auth,
|
|
base_path: "".into(),
|
|
});
|
|
|
|
// Nothing is read from disk at request time; the bundle is linked in.
|
|
let (status, body) = fetch(&app, "/static/alpine.min.js").await;
|
|
assert_eq!(status, StatusCode::OK);
|
|
assert!(
|
|
body.len() > 10_000,
|
|
"bundle looks truncated: {} bytes",
|
|
body.len()
|
|
);
|
|
|
|
let _ = std::fs::remove_file(&secret_file);
|
|
}
|
|
|
|
/// GET a path and return its status and body.
|
|
async fn fetch(app: &axum::Router, path: &str) -> (StatusCode, String) {
|
|
let res = app
|
|
.clone()
|
|
.oneshot(Request::builder().uri(path).body(Body::empty()).unwrap())
|
|
.await
|
|
.unwrap();
|
|
let status = res.status();
|
|
let bytes = axum::body::to_bytes(res.into_body(), 4 << 20)
|
|
.await
|
|
.unwrap();
|
|
(status, String::from_utf8_lossy(&bytes).into_owned())
|
|
}
|