842 lines
28 KiB
Go
842 lines
28 KiB
Go
package e2e
|
|
|
|
import (
|
|
"bytes"
|
|
"encoding/json"
|
|
"fmt"
|
|
"io"
|
|
"net/http"
|
|
"net/url"
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
|
|
"goyco/internal/config"
|
|
"goyco/internal/services"
|
|
"goyco/internal/testutils"
|
|
|
|
"github.com/golang-jwt/jwt/v5"
|
|
)
|
|
|
|
func TestE2E_ResendVerificationEmail(t *testing.T) {
|
|
ctx := setupTestContext(t)
|
|
|
|
t.Run("resend_verification_email", func(t *testing.T) {
|
|
t.Run("resend_verification_email_succeeds", func(t *testing.T) {
|
|
createdUser := ctx.createUserWithCleanup(t, "resenduser", "Password123!")
|
|
|
|
user, err := ctx.server.UserRepo.GetByID(createdUser.ID)
|
|
if err != nil {
|
|
t.Fatalf("Failed to get user: %v", err)
|
|
}
|
|
user.EmailVerified = false
|
|
user.EmailVerificationToken = ""
|
|
user.EmailVerificationSentAt = nil
|
|
if err := ctx.server.UserRepo.Update(user); err != nil {
|
|
t.Fatalf("Failed to update user: %v", err)
|
|
}
|
|
|
|
ctx.server.EmailSender.Reset()
|
|
|
|
statusCode := ctx.resendVerification(t, createdUser.Email)
|
|
if statusCode != http.StatusOK {
|
|
t.Errorf("Expected resend verification email to succeed with status 200, got %d", statusCode)
|
|
}
|
|
|
|
newToken := ctx.server.EmailSender.VerificationToken()
|
|
if newToken == "" {
|
|
t.Errorf("Expected resend verification email to contain a verification token, but token is empty")
|
|
}
|
|
})
|
|
|
|
t.Run("new_verification_token_generated", func(t *testing.T) {
|
|
testUser := ctx.createUserWithCleanup(t, "tokenuser", "Password123!")
|
|
|
|
user, err := ctx.server.UserRepo.GetByID(testUser.ID)
|
|
if err != nil {
|
|
t.Fatalf("Failed to get user: %v", err)
|
|
}
|
|
user.EmailVerified = false
|
|
user.EmailVerificationToken = ""
|
|
user.EmailVerificationSentAt = nil
|
|
if err := ctx.server.UserRepo.Update(user); err != nil {
|
|
t.Fatalf("Failed to update user: %v", err)
|
|
}
|
|
|
|
ctx.server.EmailSender.Reset()
|
|
|
|
firstIP := testutils.GenerateTestIP()
|
|
statusCode := ctx.resendVerificationWithIP(t, testUser.Email, firstIP)
|
|
if statusCode != http.StatusOK {
|
|
t.Errorf("Expected first resend to succeed, got status %d", statusCode)
|
|
}
|
|
failIfRateLimited(t, statusCode, "first resend verification")
|
|
|
|
firstToken := ctx.server.EmailSender.VerificationToken()
|
|
if firstToken == "" {
|
|
t.Fatalf("Expected first verification token to be generated")
|
|
}
|
|
|
|
userAfterFirstResend, err := ctx.server.UserRepo.GetByID(testUser.ID)
|
|
if err != nil {
|
|
t.Fatalf("Failed to reload user after first resend: %v", err)
|
|
}
|
|
firstTokenHash := userAfterFirstResend.EmailVerificationToken
|
|
userAfterFirstResend.EmailVerificationSentAt = nil
|
|
if err := ctx.server.UserRepo.Update(userAfterFirstResend); err != nil {
|
|
t.Fatalf("Failed to reset verification resend cooldown: %v", err)
|
|
}
|
|
|
|
ctx.server.EmailSender.Reset()
|
|
|
|
secondIP := testutils.GenerateTestIP()
|
|
statusCode = ctx.resendVerificationWithIP(t, testUser.Email, secondIP)
|
|
failIfRateLimited(t, statusCode, "second resend verification")
|
|
if statusCode != http.StatusOK {
|
|
t.Errorf("Expected second resend to succeed, got status %d", statusCode)
|
|
}
|
|
|
|
secondToken := ctx.server.EmailSender.VerificationToken()
|
|
if secondToken == "" {
|
|
t.Fatalf("Expected second verification token to be generated")
|
|
}
|
|
|
|
ctx.assertEventually(t, func() bool {
|
|
updatedUser, err := ctx.server.UserRepo.GetByID(testUser.ID)
|
|
if err != nil {
|
|
return false
|
|
}
|
|
return updatedUser.EmailVerificationToken != "" && updatedUser.EmailVerificationToken != firstTokenHash
|
|
}, 1*time.Second)
|
|
|
|
if firstToken == secondToken {
|
|
t.Errorf("Expected new verification token to be different from old token")
|
|
}
|
|
})
|
|
|
|
t.Run("old_verification_token_behavior", func(t *testing.T) {
|
|
testUser := ctx.createUserWithCleanup(t, "oldtokenuser", "Password123!")
|
|
|
|
user, err := ctx.server.UserRepo.GetByID(testUser.ID)
|
|
if err != nil {
|
|
t.Fatalf("Failed to get user: %v", err)
|
|
}
|
|
user.EmailVerified = false
|
|
user.EmailVerificationToken = ""
|
|
user.EmailVerificationSentAt = nil
|
|
if err := ctx.server.UserRepo.Update(user); err != nil {
|
|
t.Fatalf("Failed to update user: %v", err)
|
|
}
|
|
|
|
ctx.server.EmailSender.Reset()
|
|
|
|
firstIP := testutils.GenerateTestIP()
|
|
statusCode := ctx.resendVerificationWithIP(t, testUser.Email, firstIP)
|
|
if statusCode != http.StatusOK {
|
|
t.Errorf("Expected first resend to succeed, got status %d", statusCode)
|
|
}
|
|
failIfRateLimited(t, statusCode, "first resend verification for old token")
|
|
|
|
oldToken := ctx.server.EmailSender.VerificationToken()
|
|
if oldToken == "" {
|
|
t.Fatalf("Expected first verification token to be generated")
|
|
}
|
|
|
|
userAfterFirstResend, err := ctx.server.UserRepo.GetByID(testUser.ID)
|
|
if err != nil {
|
|
t.Fatalf("Failed to reload user after first resend: %v", err)
|
|
}
|
|
userAfterFirstResend.EmailVerificationSentAt = nil
|
|
if err := ctx.server.UserRepo.Update(userAfterFirstResend); err != nil {
|
|
t.Fatalf("Failed to reset verification resend cooldown: %v", err)
|
|
}
|
|
|
|
ctx.server.EmailSender.Reset()
|
|
|
|
secondIP := testutils.GenerateTestIP()
|
|
statusCode = ctx.resendVerificationWithIP(t, testUser.Email, secondIP)
|
|
failIfRateLimited(t, statusCode, "second resend verification for old token")
|
|
if statusCode != http.StatusOK {
|
|
t.Errorf("Expected second resend to succeed, got status %d", statusCode)
|
|
}
|
|
|
|
newToken := ctx.server.EmailSender.VerificationToken()
|
|
if newToken == "" {
|
|
t.Fatalf("Expected second verification token to be generated")
|
|
}
|
|
|
|
confirmURL := fmt.Sprintf("%s/api/auth/confirm?token=%s", ctx.baseURL, url.QueryEscape(oldToken))
|
|
request, err := http.NewRequest(http.MethodGet, confirmURL, nil)
|
|
if err != nil {
|
|
t.Fatalf("Failed to create confirmation request: %v", err)
|
|
}
|
|
request.Header.Set("User-Agent", "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36")
|
|
|
|
resp, err := ctx.client.Do(request)
|
|
if err != nil {
|
|
t.Fatalf("Confirmation request failed: %v", err)
|
|
}
|
|
defer resp.Body.Close()
|
|
|
|
if resp.StatusCode == http.StatusOK {
|
|
t.Errorf("Expected old verification token to be invalidated, but confirmation succeeded with status 200")
|
|
}
|
|
|
|
confirmURL = fmt.Sprintf("%s/api/auth/confirm?token=%s", ctx.baseURL, url.QueryEscape(newToken))
|
|
request, err = http.NewRequest(http.MethodGet, confirmURL, nil)
|
|
if err != nil {
|
|
t.Fatalf("Failed to create confirmation request: %v", err)
|
|
}
|
|
request.Header.Set("User-Agent", "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36")
|
|
|
|
resp, err = ctx.client.Do(request)
|
|
if err != nil {
|
|
t.Fatalf("Confirmation request failed: %v", err)
|
|
}
|
|
defer resp.Body.Close()
|
|
|
|
if resp.StatusCode != http.StatusOK {
|
|
body, _ := io.ReadAll(resp.Body)
|
|
t.Errorf("Expected new verification token to work, got status %d. Body: %s", resp.StatusCode, string(body))
|
|
}
|
|
|
|
updatedUser, err := ctx.server.UserRepo.GetByID(testUser.ID)
|
|
if err != nil {
|
|
t.Fatalf("Failed to get updated user: %v", err)
|
|
}
|
|
if !updatedUser.EmailVerified {
|
|
t.Errorf("Expected user to be verified after confirming with new token")
|
|
}
|
|
})
|
|
|
|
t.Run("already_verified_account_response", func(t *testing.T) {
|
|
testUser := ctx.createUserWithCleanup(t, "verifieduser", "Password123!")
|
|
|
|
user, err := ctx.server.UserRepo.GetByID(testUser.ID)
|
|
if err != nil {
|
|
t.Fatalf("Failed to get user: %v", err)
|
|
}
|
|
user.EmailVerified = true
|
|
now := time.Now()
|
|
user.EmailVerifiedAt = &now
|
|
if err := ctx.server.UserRepo.Update(user); err != nil {
|
|
t.Fatalf("Failed to update user: %v", err)
|
|
}
|
|
|
|
statusCode := ctx.resendVerification(t, testUser.Email)
|
|
if statusCode != http.StatusConflict {
|
|
t.Errorf("Expected resend verification for already verified account to return status 409 (Conflict), got %d", statusCode)
|
|
}
|
|
})
|
|
|
|
t.Run("invalid_email_format", func(t *testing.T) {
|
|
statusCode := ctx.resendVerification(t, "invalid-email")
|
|
if statusCode != http.StatusBadRequest {
|
|
t.Errorf("Expected invalid email format to return status 400, got %d", statusCode)
|
|
}
|
|
})
|
|
|
|
t.Run("nonexistent_email", func(t *testing.T) {
|
|
statusCode := ctx.resendVerification(t, "nonexistent@example.com")
|
|
if statusCode != http.StatusNotFound {
|
|
t.Errorf("Expected non-existent email to return status 404, got %d", statusCode)
|
|
}
|
|
})
|
|
|
|
t.Run("empty_email", func(t *testing.T) {
|
|
statusCode := ctx.resendVerification(t, "")
|
|
if statusCode != http.StatusBadRequest {
|
|
t.Errorf("Expected empty email to return status 400, got %d", statusCode)
|
|
}
|
|
})
|
|
})
|
|
}
|
|
|
|
func TestE2E_InvalidTokenScenarios(t *testing.T) {
|
|
ctx := setupTestContext(t)
|
|
|
|
t.Run("invalid_token_scenarios", func(t *testing.T) {
|
|
createdUser := ctx.createUserWithCleanup(t, "tokenuser", "Password123!")
|
|
|
|
t.Run("empty_token_rejected", func(t *testing.T) {
|
|
statusCode := ctx.makeRequestWithToken(t, "")
|
|
if statusCode != http.StatusUnauthorized {
|
|
t.Errorf("Expected empty token to be rejected with status 401, got %d", statusCode)
|
|
}
|
|
})
|
|
|
|
t.Run("missing_authorization_header_rejected", func(t *testing.T) {
|
|
request, err := testutils.NewRequestBuilder("GET", ctx.baseURL+"/api/auth/me").Build()
|
|
if err != nil {
|
|
t.Fatalf("Failed to create request: %v", err)
|
|
}
|
|
|
|
resp, err := ctx.client.Do(request)
|
|
if err != nil {
|
|
t.Fatalf("Failed to make request: %v", err)
|
|
}
|
|
defer resp.Body.Close()
|
|
|
|
if resp.StatusCode != http.StatusUnauthorized {
|
|
t.Errorf("Expected missing Authorization header to be rejected with status 401, got %d", resp.StatusCode)
|
|
}
|
|
})
|
|
|
|
t.Run("malformed_token_rejected", func(t *testing.T) {
|
|
malformedTokens := []string{
|
|
"not.a.valid.token",
|
|
"just-a-string",
|
|
"invalid",
|
|
"Bearer token",
|
|
"12345",
|
|
"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9",
|
|
}
|
|
|
|
for _, malformedToken := range malformedTokens {
|
|
statusCode := ctx.makeRequestWithToken(t, malformedToken)
|
|
if statusCode != http.StatusUnauthorized {
|
|
t.Errorf("Expected malformed token '%s' to be rejected with status 401, got %d", malformedToken, statusCode)
|
|
}
|
|
}
|
|
})
|
|
|
|
t.Run("invalid_jwt_format_rejected", func(t *testing.T) {
|
|
invalidJWT := "not.a.valid.token"
|
|
statusCode := ctx.makeRequestWithToken(t, invalidJWT)
|
|
if statusCode != http.StatusUnauthorized {
|
|
t.Errorf("Expected invalid JWT format to be rejected with status 401, got %d", statusCode)
|
|
}
|
|
})
|
|
|
|
t.Run("expired_token_rejected", func(t *testing.T) {
|
|
user, err := ctx.server.UserRepo.GetByID(createdUser.ID)
|
|
if err != nil {
|
|
t.Fatalf("Failed to get user: %v", err)
|
|
}
|
|
|
|
cfg := &config.Config{
|
|
JWT: config.JWTConfig{
|
|
Secret: "test-secret-key-for-testing-purposes-only",
|
|
Expiration: 24,
|
|
RefreshExpiration: 168,
|
|
Issuer: "goyco",
|
|
Audience: "goyco-users",
|
|
},
|
|
}
|
|
|
|
expiredToken := generateExpiredToken(t, user, &cfg.JWT)
|
|
statusCode := ctx.makeRequestWithToken(t, expiredToken)
|
|
if statusCode != http.StatusUnauthorized {
|
|
t.Errorf("Expected expired token to be rejected with status 401, got %d", statusCode)
|
|
}
|
|
})
|
|
|
|
t.Run("tampered_token_rejected", func(t *testing.T) {
|
|
user, err := ctx.server.UserRepo.GetByID(createdUser.ID)
|
|
if err != nil {
|
|
t.Fatalf("Failed to get user: %v", err)
|
|
}
|
|
|
|
cfg := &config.Config{
|
|
JWT: config.JWTConfig{
|
|
Secret: "test-secret-key-for-testing-purposes-only",
|
|
Expiration: 24,
|
|
RefreshExpiration: 168,
|
|
Issuer: "goyco",
|
|
Audience: "goyco-users",
|
|
},
|
|
}
|
|
|
|
tamperedToken := generateTamperedToken(t, user, &cfg.JWT)
|
|
statusCode := ctx.makeRequestWithToken(t, tamperedToken)
|
|
if statusCode != http.StatusUnauthorized {
|
|
t.Errorf("Expected tampered token to be rejected with status 401, got %d", statusCode)
|
|
}
|
|
})
|
|
|
|
t.Run("token_with_wrong_issuer_rejected", func(t *testing.T) {
|
|
user, err := ctx.server.UserRepo.GetByID(createdUser.ID)
|
|
if err != nil {
|
|
t.Fatalf("Failed to get user: %v", err)
|
|
}
|
|
|
|
cfg := &config.Config{
|
|
JWT: config.JWTConfig{
|
|
Secret: "test-secret-key-for-testing-purposes-only",
|
|
Expiration: 24,
|
|
RefreshExpiration: 168,
|
|
Issuer: "wrong-issuer",
|
|
Audience: "goyco-users",
|
|
},
|
|
}
|
|
|
|
claims := services.TokenClaims{
|
|
UserID: user.ID,
|
|
Username: user.Username,
|
|
SessionVersion: user.SessionVersion,
|
|
TokenType: services.TokenTypeAccess,
|
|
RegisteredClaims: jwt.RegisteredClaims{
|
|
Issuer: cfg.JWT.Issuer,
|
|
Audience: []string{cfg.JWT.Audience},
|
|
Subject: fmt.Sprint(user.ID),
|
|
IssuedAt: jwt.NewNumericDate(time.Now()),
|
|
ExpiresAt: jwt.NewNumericDate(time.Now().Add(24 * time.Hour)),
|
|
},
|
|
}
|
|
|
|
token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
|
|
wrongIssuerToken, err := token.SignedString([]byte("test-secret-key-for-testing-purposes-only"))
|
|
if err != nil {
|
|
t.Fatalf("Failed to create token with wrong issuer: %v", err)
|
|
}
|
|
|
|
statusCode := ctx.makeRequestWithToken(t, wrongIssuerToken)
|
|
if statusCode != http.StatusUnauthorized {
|
|
t.Errorf("Expected token with wrong issuer to be rejected with status 401, got %d", statusCode)
|
|
}
|
|
})
|
|
|
|
t.Run("token_with_wrong_audience_rejected", func(t *testing.T) {
|
|
user, err := ctx.server.UserRepo.GetByID(createdUser.ID)
|
|
if err != nil {
|
|
t.Fatalf("Failed to get user: %v", err)
|
|
}
|
|
|
|
claims := services.TokenClaims{
|
|
UserID: user.ID,
|
|
Username: user.Username,
|
|
SessionVersion: user.SessionVersion,
|
|
TokenType: services.TokenTypeAccess,
|
|
RegisteredClaims: jwt.RegisteredClaims{
|
|
Issuer: "goyco",
|
|
Audience: []string{"wrong-audience"},
|
|
Subject: fmt.Sprint(user.ID),
|
|
IssuedAt: jwt.NewNumericDate(time.Now()),
|
|
ExpiresAt: jwt.NewNumericDate(time.Now().Add(24 * time.Hour)),
|
|
},
|
|
}
|
|
|
|
token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
|
|
wrongAudienceToken, err := token.SignedString([]byte("test-secret-key-for-testing-purposes-only"))
|
|
if err != nil {
|
|
t.Fatalf("Failed to create token with wrong audience: %v", err)
|
|
}
|
|
|
|
statusCode := ctx.makeRequestWithToken(t, wrongAudienceToken)
|
|
if statusCode != http.StatusUnauthorized {
|
|
t.Errorf("Expected token with wrong audience to be rejected with status 401, got %d", statusCode)
|
|
}
|
|
})
|
|
|
|
t.Run("token_with_invalid_characters_rejected", func(t *testing.T) {
|
|
invalidTokens := []string{
|
|
strings.Repeat("a", 1000),
|
|
"!@#$%^&*()",
|
|
"invalid.token.format",
|
|
}
|
|
|
|
for _, invalidToken := range invalidTokens {
|
|
statusCode := ctx.makeRequestWithToken(t, invalidToken)
|
|
if statusCode != http.StatusUnauthorized {
|
|
t.Errorf("Expected token with invalid characters '%s' to be rejected with status 401, got %d", invalidToken, statusCode)
|
|
}
|
|
}
|
|
|
|
})
|
|
})
|
|
}
|
|
|
|
func TestE2E_AccountLockoutBehavior(t *testing.T) {
|
|
ctx := setupTestContext(t)
|
|
|
|
t.Run("account_lockout_behavior", func(t *testing.T) {
|
|
createdUser := ctx.createUserWithCleanup(t, "lockuser", "Password123!")
|
|
t.Cleanup(func() {
|
|
user, err := ctx.server.UserRepo.GetByID(createdUser.ID)
|
|
if err == nil && user != nil && user.Locked {
|
|
ctx.server.UserRepo.Unlock(createdUser.ID)
|
|
}
|
|
})
|
|
|
|
t.Run("account_can_be_locked", func(t *testing.T) {
|
|
if err := ctx.server.UserRepo.Lock(createdUser.ID); err != nil {
|
|
t.Fatalf("Failed to lock account: %v", err)
|
|
}
|
|
|
|
user, err := ctx.server.UserRepo.GetByID(createdUser.ID)
|
|
if err != nil {
|
|
t.Fatalf("Failed to get user: %v", err)
|
|
}
|
|
if !user.Locked {
|
|
t.Errorf("Expected account to be locked, but Locked is false")
|
|
}
|
|
})
|
|
|
|
t.Run("locked_account_cannot_login", func(t *testing.T) {
|
|
if err := ctx.server.UserRepo.Lock(createdUser.ID); err != nil {
|
|
t.Fatalf("Failed to lock account: %v", err)
|
|
}
|
|
|
|
user, err := ctx.server.UserRepo.GetByID(createdUser.ID)
|
|
if err != nil {
|
|
t.Fatalf("Failed to get user: %v", err)
|
|
}
|
|
if !user.Locked {
|
|
t.Fatalf("Account lock failed - user.Locked is still false after locking")
|
|
}
|
|
|
|
loginData := map[string]string{
|
|
"username": createdUser.Username,
|
|
"password": createdUser.Password,
|
|
}
|
|
|
|
body, err := json.Marshal(loginData)
|
|
if err != nil {
|
|
t.Fatalf("Failed to marshal login data: %v", err)
|
|
}
|
|
|
|
request, err := http.NewRequest(http.MethodPost, ctx.baseURL+"/api/auth/login", bytes.NewReader(body))
|
|
if err != nil {
|
|
t.Fatalf("Failed to create login request: %v", err)
|
|
}
|
|
request.Header.Set("Content-Type", "application/json")
|
|
request.Header.Set("User-Agent", "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36")
|
|
request.Header.Set("Accept-Encoding", "gzip")
|
|
|
|
request.Header.Set("X-Forwarded-For", testutils.GenerateTestIP())
|
|
|
|
resp, err := ctx.client.Do(request)
|
|
if err != nil {
|
|
t.Fatalf("Failed to make login request: %v", err)
|
|
}
|
|
defer resp.Body.Close()
|
|
|
|
failIfRateLimited(t, resp.StatusCode, "locked account login behavior")
|
|
|
|
if resp.StatusCode == http.StatusOK {
|
|
t.Errorf("Expected locked account login to fail (not 200 OK), got status %d. This indicates lock is not working.", resp.StatusCode)
|
|
}
|
|
|
|
if resp.StatusCode != http.StatusForbidden && resp.StatusCode != http.StatusUnauthorized {
|
|
t.Logf("Note: Locked account login returned status %d (expected 403 or 401). Account lock state verified in database.", resp.StatusCode)
|
|
}
|
|
})
|
|
|
|
t.Run("locked_account_returns_appropriate_error", func(t *testing.T) {
|
|
|
|
if err := ctx.server.UserRepo.Lock(createdUser.ID); err != nil {
|
|
t.Fatalf("Failed to lock account: %v", err)
|
|
}
|
|
|
|
loginData := map[string]string{
|
|
"username": createdUser.Username,
|
|
"password": createdUser.Password,
|
|
}
|
|
|
|
body, err := json.Marshal(loginData)
|
|
if err != nil {
|
|
t.Fatalf("Failed to marshal login data: %v", err)
|
|
}
|
|
|
|
request, err := http.NewRequest(http.MethodPost, ctx.baseURL+"/api/auth/login", bytes.NewReader(body))
|
|
if err != nil {
|
|
t.Fatalf("Failed to create login request: %v", err)
|
|
}
|
|
request.Header.Set("Content-Type", "application/json")
|
|
request.Header.Set("User-Agent", "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36")
|
|
request.Header.Set("Accept-Encoding", "gzip")
|
|
request.Header.Set("X-Forwarded-For", testutils.GenerateTestIP())
|
|
|
|
resp, err := ctx.client.Do(request)
|
|
if err != nil {
|
|
t.Fatalf("Failed to make login request: %v", err)
|
|
}
|
|
defer resp.Body.Close()
|
|
|
|
failIfRateLimited(t, resp.StatusCode, "locked account error response")
|
|
|
|
if resp.StatusCode == http.StatusOK {
|
|
t.Errorf("Expected locked account login to fail, got status 200 (OK)")
|
|
}
|
|
|
|
reader, cleanup, err := getResponseReader(resp)
|
|
if err != nil {
|
|
t.Fatalf("Failed to get response reader: %v", err)
|
|
}
|
|
defer cleanup()
|
|
|
|
var loginResp map[string]any
|
|
if err := json.NewDecoder(reader).Decode(&loginResp); err != nil {
|
|
t.Fatalf("Failed to decode login response: %v", err)
|
|
}
|
|
|
|
if resp.StatusCode == http.StatusForbidden {
|
|
errorMsg, hasError := loginResp["error"].(string)
|
|
if !hasError {
|
|
t.Errorf("Expected error message in response for locked account, but 'error' field is missing or not a string")
|
|
} else {
|
|
if !strings.Contains(strings.ToLower(errorMsg), "locked") {
|
|
t.Errorf("Expected error message to mention 'locked' for status 403, got: %s", errorMsg)
|
|
}
|
|
}
|
|
}
|
|
|
|
success, hasSuccess := loginResp["success"].(bool)
|
|
if hasSuccess && success {
|
|
t.Errorf("Expected login response to indicate failure (success: false), got success: true")
|
|
}
|
|
})
|
|
|
|
t.Run("account_unlock_works", func(t *testing.T) {
|
|
if err := ctx.server.UserRepo.Unlock(createdUser.ID); err != nil {
|
|
t.Fatalf("Failed to unlock account: %v", err)
|
|
}
|
|
|
|
user, err := ctx.server.UserRepo.GetByID(createdUser.ID)
|
|
if err != nil {
|
|
t.Fatalf("Failed to get user: %v", err)
|
|
}
|
|
if user.Locked {
|
|
t.Errorf("Expected account to be unlocked, but Locked is true")
|
|
}
|
|
})
|
|
|
|
t.Run("unlocked_account_can_login", func(t *testing.T) {
|
|
if err := ctx.server.UserRepo.Unlock(createdUser.ID); err != nil {
|
|
t.Fatalf("Failed to unlock account: %v", err)
|
|
}
|
|
|
|
user, err := ctx.server.UserRepo.GetByID(createdUser.ID)
|
|
if err != nil {
|
|
t.Fatalf("Failed to get user: %v", err)
|
|
}
|
|
if user.Locked {
|
|
t.Fatalf("Expected account to be unlocked, but Locked is true")
|
|
}
|
|
|
|
authClient := ctx.loginUser(t, createdUser.Username, createdUser.Password)
|
|
if authClient.Token == "" {
|
|
t.Errorf("Expected unlocked account to be able to login, but login failed")
|
|
}
|
|
})
|
|
|
|
t.Run("locking_already_locked_account_is_idempotent", func(t *testing.T) {
|
|
if err := ctx.server.UserRepo.Lock(createdUser.ID); err != nil {
|
|
t.Fatalf("Failed to lock already locked account: %v", err)
|
|
}
|
|
|
|
user, err := ctx.server.UserRepo.GetByID(createdUser.ID)
|
|
if err != nil {
|
|
t.Fatalf("Failed to get user: %v", err)
|
|
}
|
|
if !user.Locked {
|
|
t.Errorf("Expected account to remain locked after second lock operation, but Locked is false")
|
|
}
|
|
|
|
if err := ctx.server.UserRepo.Unlock(createdUser.ID); err != nil {
|
|
t.Logf("Warning: Failed to unlock account after idempotent test: %v", err)
|
|
}
|
|
})
|
|
|
|
t.Run("unlocking_already_unlocked_account_is_idempotent", func(t *testing.T) {
|
|
ctx.server.UserRepo.Unlock(createdUser.ID)
|
|
|
|
if err := ctx.server.UserRepo.Unlock(createdUser.ID); err != nil {
|
|
t.Fatalf("Failed to unlock already unlocked account: %v", err)
|
|
}
|
|
|
|
user, err := ctx.server.UserRepo.GetByID(createdUser.ID)
|
|
if err != nil {
|
|
t.Fatalf("Failed to get user: %v", err)
|
|
}
|
|
if user.Locked {
|
|
t.Errorf("Expected account to remain unlocked after second unlock operation, but Locked is true")
|
|
}
|
|
})
|
|
})
|
|
}
|
|
|
|
func TestE2E_EmailUsernameUniqueness(t *testing.T) {
|
|
ctx := setupTestContext(t)
|
|
|
|
t.Run("email_username_uniqueness", func(t *testing.T) {
|
|
var createdUsers []*TestUser
|
|
|
|
t.Cleanup(func() {
|
|
for _, user := range createdUsers {
|
|
if user != nil {
|
|
ctx.server.UserRepo.Delete(user.ID)
|
|
}
|
|
}
|
|
})
|
|
|
|
firstUser := ctx.createUserWithCleanup(t, "firstuser", "Password123!")
|
|
createdUsers = append(createdUsers, firstUser)
|
|
|
|
t.Run("duplicate_email_registration_fails", func(t *testing.T) {
|
|
duplicateUsername := uniqueUsername(t, "dupuser")
|
|
|
|
registerData := map[string]string{
|
|
"username": duplicateUsername,
|
|
"email": firstUser.Email,
|
|
"password": "Password123!",
|
|
}
|
|
body, err := json.Marshal(registerData)
|
|
if err != nil {
|
|
t.Fatalf("failed to marshal register data: %v", err)
|
|
}
|
|
headers := map[string]string{"Content-Type": "application/json"}
|
|
statusCode := ctx.doRequestExpectStatus(t, "POST", "/api/auth/register", http.StatusConflict, bytes.NewReader(body), headers)
|
|
failIfRateLimited(t, statusCode, "duplicate email registration")
|
|
|
|
if statusCode != http.StatusConflict {
|
|
t.Errorf("Expected duplicate email registration to return status 409 (Conflict), got %d", statusCode)
|
|
}
|
|
|
|
_, err = ctx.server.UserRepo.GetByUsername(duplicateUsername)
|
|
if err == nil {
|
|
t.Errorf("Expected duplicate user with email %s not to be created, but user exists", firstUser.Email)
|
|
}
|
|
})
|
|
|
|
t.Run("duplicate_username_registration_fails", func(t *testing.T) {
|
|
duplicateEmail := uniqueEmail(t, "dupemail")
|
|
|
|
registerData := map[string]string{
|
|
"username": firstUser.Username,
|
|
"email": duplicateEmail,
|
|
"password": "Password123!",
|
|
}
|
|
body, err := json.Marshal(registerData)
|
|
if err != nil {
|
|
t.Fatalf("failed to marshal register data: %v", err)
|
|
}
|
|
headers := map[string]string{"Content-Type": "application/json"}
|
|
statusCode := ctx.doRequestExpectStatus(t, "POST", "/api/auth/register", http.StatusConflict, bytes.NewReader(body), headers)
|
|
failIfRateLimited(t, statusCode, "duplicate username registration")
|
|
|
|
if statusCode != http.StatusConflict {
|
|
t.Errorf("Expected duplicate username registration to return status 409 (Conflict), got %d", statusCode)
|
|
}
|
|
|
|
existingUser, err := ctx.server.UserRepo.GetByUsername(firstUser.Username)
|
|
if err != nil {
|
|
t.Errorf("Original user should still exist, got error: %v", err)
|
|
} else if existingUser.Email != firstUser.Email {
|
|
t.Errorf("Original user's email should not have changed, expected %s, got %s", firstUser.Email, existingUser.Email)
|
|
}
|
|
})
|
|
|
|
t.Run("email_update_to_existing_email_fails", func(t *testing.T) {
|
|
secondUser := ctx.createUserWithCleanup(t, "seconduser", "Password123!")
|
|
createdUsers = append(createdUsers, secondUser)
|
|
|
|
authClient, err := ctx.loginUserSafe(t, secondUser.Username, secondUser.Password)
|
|
if err != nil {
|
|
|
|
t.Skip("Skipping email update test: login failed (likely password hashing issue)")
|
|
return
|
|
}
|
|
|
|
statusCode := authClient.UpdateEmailExpectStatus(t, firstUser.Email)
|
|
if statusCode != http.StatusConflict {
|
|
t.Errorf("Expected email update to existing email to return status 409 (Conflict), got %d", statusCode)
|
|
}
|
|
|
|
updatedUser, err := ctx.server.UserRepo.GetByID(secondUser.ID)
|
|
if err != nil {
|
|
t.Fatalf("Failed to get updated user: %v", err)
|
|
}
|
|
if updatedUser.Email != secondUser.Email {
|
|
t.Errorf("Expected secondUser's email to remain unchanged, got %s instead of %s", updatedUser.Email, secondUser.Email)
|
|
}
|
|
})
|
|
|
|
t.Run("username_update_to_existing_username_fails", func(t *testing.T) {
|
|
var thirdUser *TestUser
|
|
var authClient *AuthenticatedClient
|
|
|
|
if len(createdUsers) >= 2 {
|
|
thirdUser = createdUsers[1]
|
|
} else {
|
|
thirdUser = ctx.createUserWithCleanup(t, "thirduser", "Password123!")
|
|
createdUsers = append(createdUsers, thirdUser)
|
|
}
|
|
|
|
clientTmp, err := ctx.loginUserSafe(t, thirdUser.Username, thirdUser.Password)
|
|
if err != nil {
|
|
|
|
t.Skip("Skipping username update test: login failed (likely password hashing issue)")
|
|
return
|
|
}
|
|
authClient = clientTmp
|
|
|
|
statusCode := authClient.UpdateUsernameExpectStatus(t, firstUser.Username)
|
|
if statusCode != http.StatusConflict {
|
|
t.Errorf("Expected username update to existing username to return status 409 (Conflict), got %d", statusCode)
|
|
}
|
|
|
|
updatedUser, err := ctx.server.UserRepo.GetByID(thirdUser.ID)
|
|
if err != nil {
|
|
t.Fatalf("Failed to get updated user: %v", err)
|
|
}
|
|
if updatedUser.Username != thirdUser.Username {
|
|
t.Errorf("Expected thirdUser's username to remain unchanged, got %s instead of %s", updatedUser.Username, thirdUser.Username)
|
|
}
|
|
})
|
|
|
|
t.Run("users_can_update_to_own_email_username", func(t *testing.T) {
|
|
testUser := ctx.createUserWithCleanup(t, "owntestuser", "Password123!")
|
|
createdUsers = append(createdUsers, testUser)
|
|
|
|
authClient, err := ctx.loginUserSafe(t, testUser.Username, testUser.Password)
|
|
if err != nil {
|
|
|
|
t.Skip("Skipping own email/username update test: login failed (likely password hashing issue)")
|
|
return
|
|
}
|
|
|
|
statusCode := authClient.UpdateEmailExpectStatus(t, testUser.Email)
|
|
|
|
if statusCode == http.StatusConflict {
|
|
t.Errorf("Updating email to own email should not return 409 (Conflict), got %d. This might indicate incorrect duplicate detection.", statusCode)
|
|
}
|
|
|
|
statusCode = authClient.UpdateUsernameExpectStatus(t, testUser.Username)
|
|
|
|
if statusCode == http.StatusConflict {
|
|
t.Errorf("Updating username to own username should not return 409 (Conflict), got %d. This might indicate incorrect duplicate detection.", statusCode)
|
|
}
|
|
})
|
|
|
|
t.Run("case_insensitive_email_uniqueness", func(t *testing.T) {
|
|
caseVariation := strings.ToUpper(firstUser.Email)
|
|
if caseVariation == firstUser.Email {
|
|
|
|
caseVariation = strings.ToLower(firstUser.Email)
|
|
}
|
|
|
|
if caseVariation != firstUser.Email {
|
|
|
|
duplicateUsername := uniqueUsername(t, "caseuser")
|
|
registerData := map[string]string{
|
|
"username": duplicateUsername,
|
|
"email": caseVariation,
|
|
"password": "Password123!",
|
|
}
|
|
body, err := json.Marshal(registerData)
|
|
if err != nil {
|
|
t.Fatalf("failed to marshal register data: %v", err)
|
|
}
|
|
headers := map[string]string{"Content-Type": "application/json"}
|
|
statusCode := ctx.doRequestExpectStatus(t, "POST", "/api/auth/register", http.StatusConflict, bytes.NewReader(body), headers)
|
|
failIfRateLimited(t, statusCode, "case-insensitive duplicate email registration")
|
|
|
|
if statusCode != http.StatusConflict {
|
|
t.Errorf("Expected case-variation of existing email to return status 409 (Conflict), got %d", statusCode)
|
|
}
|
|
}
|
|
})
|
|
})
|
|
}
|