e2e/settingsweb_test.go

  1package e2e
  2
  3import (
  4	"net/url"
  5	"strings"
  6	"testing"
  7)
  8
  9// TestRepoSettingsWeb drives the settings page: each control runs the
 10// command the CLI runs, so repo show and settings show are the check.
 11func TestRepoSettingsWeb(t *testing.T) {
 12	t.Parallel()
 13	inst := startInstanceWith(t, "[web]\nmode = \"accounts\"\n")
 14	aliceKey := inst.newKey(t, "alice")
 15	bobKey := inst.newKey(t, "bob")
 16	inst.admin(t, "admin", "user", "create", "alice",
 17		"--key", aliceKey+".pub", "--email", "alice@example.test", "--verified")
 18	inst.admin(t, "admin", "user", "create", "bob", "--key", bobKey+".pub")
 19	if _, errOut, code := inst.ssh(t, aliceKey, "", "repo", "create", "alice/app"); code != 0 {
 20		t.Fatalf("repo create: %s", errOut)
 21	}
 22
 23	alice := inst.login(t, aliceKey)
 24	set := inst.base() + "/alice/app/settings"
 25
 26	// Only admins reach the page, and only they see the tab.
 27	if _, body := browserGet(t, alice, inst.base()+"/alice/app"); !strings.Contains(body, "/alice/app/settings") {
 28		t.Fatalf("no settings tab for the owner:\n%s", body)
 29	}
 30	if status, _ := browserGet(t, inst.login(t, bobKey), set); status != 403 && status != 404 {
 31		t.Fatalf("reader reached settings: %d", status)
 32	}
 33
 34	post := func(v url.Values) string {
 35		t.Helper()
 36		status, body := browserPost(t, alice, set, v)
 37		if status != 200 {
 38			t.Fatalf("settings post %v: %d", v, status)
 39		}
 40		return body
 41	}
 42
 43	if body := post(url.Values{"field": {"description"}, "description": {"a thing"}}); !strings.Contains(body, `class="notice" role="status">Saved the description.`) {
 44		t.Fatalf("no success flash after saving the description:\n%s", body)
 45	}
 46	if body := post(url.Values{"field": {"topics"}, "topics": {"cli, forge"}}); !strings.Contains(body, `value="cli, forge"`) {
 47		t.Fatalf("topics field is not prefilled after save:\n%s", body)
 48	}
 49	if body := post(url.Values{"field": {"topics"}, "topics": {"forge"}}); strings.Contains(body, `>cli<`) || !strings.Contains(body, `value="forge"`) {
 50		t.Fatalf("removing a topic through the field failed:\n%s", body)
 51	}
 52	if body := post(url.Values{"field": {"website"}, "website": {"javascript:alert(1)"}}); !strings.Contains(body, `class="error"`) || !strings.Contains(body, `value="javascript:alert(1)"`) {
 53		t.Fatalf("error does not keep the submitted website:\n%s", body)
 54	}
 55
 56	post(url.Values{"field": {"description"}, "description": {"a fine tool"}})
 57	post(url.Values{"field": {"website"}, "website": {"https://tool.example"}})
 58	post(url.Values{"field": {"require-checks"}, "require-checks": {"on"}})
 59	post(url.Values{"field": {"require-approvals"}, "approvals": {"2"}})
 60	post(url.Values{"field": {"protect"}, "branch": {"main"}})
 61
 62	out, _, _ := inst.ssh(t, aliceKey, "", "repo", "show", "alice/app", "--json")
 63	for _, want := range []string{"a fine tool", "https://tool.example", `"forge"`} {
 64		if !strings.Contains(out, want) {
 65			t.Fatalf("repo show missing %q:\n%s", want, out)
 66		}
 67	}
 68	out, _, _ = inst.ssh(t, aliceKey, "", "repo", "settings", "show", "alice/app", "--json")
 69	for _, want := range []string{`"require_checks":true`, `"require_approvals":2`, `"main"`} {
 70		if !strings.Contains(out, want) {
 71			t.Fatalf("settings show missing %q:\n%s", want, out)
 72		}
 73	}
 74
 75	// Visibility is a new command; the web form drives it both ways.
 76	post(url.Values{"field": {"visibility"}, "visibility": {"private"}})
 77	if out, _, _ := inst.ssh(t, aliceKey, "", "repo", "show", "alice/app", "--json"); !strings.Contains(out, `"visibility":"private"`) {
 78		t.Fatalf("not private:\n%s", out)
 79	}
 80	// A private repo disappears from anonymous surfaces.
 81	if status, _ := inst.get(t, "/alice/app"); status != 404 {
 82		t.Fatalf("private repo still public: %d", status)
 83	}
 84	post(url.Values{"field": {"visibility"}, "visibility": {"public"}})
 85	if status, _ := inst.get(t, "/alice/app"); status != 200 {
 86		t.Fatalf("public repo not restored: %d", status)
 87	}
 88
 89	// Archiving is reversible from the page; unchecking the box unarchives.
 90	post(url.Values{"field": {"archive"}, "archive": {"on"}})
 91	if out, _, _ := inst.ssh(t, aliceKey, "", "repo", "show", "alice/app", "--json"); !strings.Contains(out, `"archived":true`) {
 92		t.Fatalf("not archived:\n%s", out)
 93	}
 94	post(url.Values{"field": {"archive"}})
 95	if out, _, _ := inst.ssh(t, aliceKey, "", "repo", "show", "alice/app", "--json"); strings.Contains(out, `"archived":true`) {
 96		t.Fatalf("still archived:\n%s", out)
 97	}
 98
 99	// Unprotecting works.
100	post(url.Values{"field": {"unprotect"}, "branch": {"main"}})
101	if out, _, _ := inst.ssh(t, aliceKey, "", "repo", "settings", "show", "alice/app", "--json"); strings.Contains(out, `"protected_branches"`) {
102		t.Fatalf("branch still protected:\n%s", out)
103	}
104}