bookmarks/main_admin_test.go at master · TechFunWay/bookmarks · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
package main

// Regression tests for admin create endpoints
// (handleAdminCreateFolder, handleAdminCreateBookmark, handleAdminReorderNodes).
//
// Bug B7/B8/B9: these handlers accept any int64 in `user_id` and create
// nodes / reorder children for a non-existent user. The result is orphan
// rows in the nodes table (or a silent no-op for reorder) and an audit
// log entry that points to a user nobody can identify. Validating the
// target user up front makes the failure visible and the audit trail
// accurate.

import (
	"context"
	"net/http"
	"testing"
)

// TestHandleAdminCreateFolder_UnknownUser_Returns404 verifies that
// creating a folder for a non-existent user fails with 404.
//
// RED (before fix): the handler inserts a row with the supplied user_id
// even when the user does not exist. The test asserts the row count
// does not change and the response is 404.
func TestHandleAdminCreateFolder_UnknownUser_Returns404(t *testing.T) {
	srv, db := newTestServer(t)
	adminID := insertTestUser(t, db, "root", true)

	r := newAdminRouter(srv)
	body := map[string]any{
		"user_id": int64(999999),
		"title":   "ghost folder",
	}
	req := jsonRequest(t, "POST", "/admin/folders", body)
	req.Header.Set("Authorization", userTokenFor("root"))
	rec := do(t, r, req)

	if rec.Code != http.StatusNotFound {
		t.Fatalf("want 404 for unknown user_id, got %d (body=%q)", rec.Code, rec.Body.String())
	}

	var nodeCount int
	if err := db.QueryRowContext(context.Background(),
		`SELECT COUNT(*) FROM nodes WHERE user_id = 999999`).Scan(&nodeCount); err != nil {
		t.Fatalf("count nodes: %v", err)
	}
	if nodeCount != 0 {
		t.Fatalf("handler should not insert rows for unknown user; nodes created: %d", nodeCount)
	}
	_ = adminID
}

func TestHandleAdminCreateFolder_ValidUser_Succeeds(t *testing.T) {
	srv, db := newTestServer(t)
	insertTestUser(t, db, "root", true)
	aliceID := insertTestUser(t, db, "alice", false)

	r := newAdminRouter(srv)
	body := map[string]any{"user_id": aliceID, "title": "alice folder"}
	req := jsonRequest(t, "POST", "/admin/folders", body)
	req.Header.Set("Authorization", userTokenFor("root"))
	rec := do(t, r, req)

	if rec.Code != http.StatusCreated {
		t.Fatalf("valid user_id: want 201, got %d (body=%q)", rec.Code, rec.Body.String())
	}
}

// TestHandleAdminCreateBookmark_UnknownUser_Returns404 mirrors the
// folder case for the bookmark handler.
func TestHandleAdminCreateBookmark_UnknownUser_Returns404(t *testing.T) {
	srv, db := newTestServer(t)
	insertTestUser(t, db, "root", true)

	r := newAdminRouter(srv)
	body := map[string]any{
		"user_id": int64(999999),
		"url":     "https://example.com",
		"title":   "ghost bookmark",
	}
	req := jsonRequest(t, "POST", "/admin/bookmarks", body)
	req.Header.Set("Authorization", userTokenFor("root"))
	rec := do(t, r, req)

	if rec.Code != http.StatusNotFound {
		t.Fatalf("want 404 for unknown user_id, got %d (body=%q)", rec.Code, rec.Body.String())
	}
}

// TestHandleAdminReorderNodes_UnknownUser_Returns404 verifies reorder
// also rejects unknown user ids.
func TestHandleAdminReorderNodes_UnknownUser_Returns404(t *testing.T) {
	srv, db := newTestServer(t)
	insertTestUser(t, db, "root", true)

	r := newAdminRouter(srv)
	body := map[string]any{
		"user_id":     int64(999999),
		"parent_id":   nil,
		"ordered_ids": []int64{1, 2, 3},
	}
	req := jsonRequest(t, "PUT", "/admin/nodes/reorder", body)
	req.Header.Set("Authorization", userTokenFor("root"))
	rec := do(t, r, req)

	if rec.Code != http.StatusNotFound {
		t.Fatalf("want 404 for unknown user_id, got %d (body=%q)", rec.Code, rec.Body.String())
	}
}