109 lines
3.7 KiB
Go
109 lines
3.7 KiB
Go
package e2e
|
|
|
|
import (
|
|
"net/http"
|
|
"testing"
|
|
)
|
|
|
|
func TestE2E_PostManagement(t *testing.T) {
|
|
ctx := setupTestContext(t)
|
|
|
|
t.Run("post_crud_operations", func(t *testing.T) {
|
|
_, authClient := ctx.createUserAndLogin(t, "testuser", "StrongPass123!")
|
|
|
|
createdPost := authClient.CreatePost(t, "Original Post", "https://example.com/original", "Original content")
|
|
updatedPost := authClient.UpdatePost(t, createdPost.ID, "Updated Post", "https://example.com/updated", "Updated content")
|
|
|
|
if updatedPost.Title != "Updated Post" {
|
|
t.Errorf("Expected updated title 'Updated Post', got '%s'", updatedPost.Title)
|
|
}
|
|
if updatedPost.Content != "Updated content" {
|
|
t.Errorf("Expected updated content 'Updated content', got '%s'", updatedPost.Content)
|
|
}
|
|
|
|
postsResp := authClient.GetPosts(t)
|
|
assertPostInList(t, postsResp, updatedPost)
|
|
|
|
authClient.DeletePost(t, createdPost.ID)
|
|
|
|
finalPostsResp := authClient.GetPosts(t)
|
|
if len(finalPostsResp.Data.Posts) > 0 {
|
|
for _, post := range finalPostsResp.Data.Posts {
|
|
if post.ID == createdPost.ID {
|
|
t.Errorf("Expected post to be deleted, but it still appears in posts list")
|
|
break
|
|
}
|
|
}
|
|
}
|
|
})
|
|
}
|
|
|
|
func TestE2E_PostOwnershipAuthorization(t *testing.T) {
|
|
ctx := setupTestContext(t)
|
|
|
|
t.Run("post_ownership_authorization", func(t *testing.T) {
|
|
createdUsers := ctx.createMultipleUsersWithCleanup(t, 2, "user", "StrongPass123!")
|
|
user1 := createdUsers[0]
|
|
user2 := createdUsers[1]
|
|
|
|
authClient1 := ctx.loginUser(t, user1.Username, user1.Password)
|
|
createdPost := authClient1.CreatePost(t, "User1's Post", "https://example.com/user1", "This is user1's post content")
|
|
|
|
authClient2 := ctx.loginUser(t, user2.Username, user2.Password)
|
|
|
|
t.Run("user2_cannot_update_user1_post", func(t *testing.T) {
|
|
statusCode := authClient2.UpdatePostExpectStatus(t, createdPost.ID, "Hacked Title", "https://evil.com", "Hacked content")
|
|
if statusCode != http.StatusForbidden {
|
|
t.Errorf("Expected 403 Forbidden when User2 tries to update User1's post, got %d", statusCode)
|
|
}
|
|
})
|
|
|
|
t.Run("user2_cannot_delete_user1_post", func(t *testing.T) {
|
|
statusCode := authClient2.DeletePostExpectStatus(t, createdPost.ID)
|
|
if statusCode != http.StatusForbidden {
|
|
t.Errorf("Expected 403 Forbidden when User2 tries to delete User1's post, got %d", statusCode)
|
|
}
|
|
})
|
|
|
|
t.Run("user1_post_unchanged", func(t *testing.T) {
|
|
postsResp := authClient1.GetPosts(t)
|
|
found := false
|
|
for _, post := range postsResp.Data.Posts {
|
|
if post.ID == createdPost.ID {
|
|
found = true
|
|
if post.Title != createdPost.Title {
|
|
t.Errorf("Expected post title to remain '%s', but it was modified to '%s'", createdPost.Title, post.Title)
|
|
}
|
|
if post.Content != createdPost.Content {
|
|
t.Errorf("Expected post content to remain unchanged, but it was modified")
|
|
}
|
|
break
|
|
}
|
|
}
|
|
if !found {
|
|
t.Errorf("Expected User1's post to still exist, but it was not found in the posts list")
|
|
}
|
|
})
|
|
|
|
t.Run("user1_can_update_own_post", func(t *testing.T) {
|
|
updatedPost := authClient1.UpdatePost(t, createdPost.ID, "Updated by User1", "https://example.com/updated", "Updated content by User1")
|
|
if updatedPost.Title != "Updated by User1" {
|
|
t.Errorf("Expected post title to be 'Updated by User1', got '%s'", updatedPost.Title)
|
|
}
|
|
})
|
|
|
|
t.Run("user1_can_delete_own_post", func(t *testing.T) {
|
|
deletablePost := authClient1.CreatePost(t, "Deletable Post", "https://example.com/deletable", "This post will be deleted")
|
|
authClient1.DeletePost(t, deletablePost.ID)
|
|
|
|
postsResp := authClient1.GetPosts(t)
|
|
for _, post := range postsResp.Data.Posts {
|
|
if post.ID == deletablePost.ID {
|
|
t.Errorf("Expected post %d to be deleted, but it still exists", deletablePost.ID)
|
|
break
|
|
}
|
|
}
|
|
})
|
|
})
|
|
}
|