e2e/orgweb_test.go

  1package e2e
  2
  3import (
  4	"encoding/json"
  5	"net/http"
  6	"net/url"
  7	"strings"
  8	"testing"
  9)
 10
 11// TestOrgManagementWeb covers running an organization from the browser:
 12// membership and teams, admin-gated, dispatched through the same commands
 13// the CLI uses.
 14func TestOrgManagementWeb(t *testing.T) {
 15	inst := startInstanceWith(t, "[web]\nmode = \"accounts\"\n")
 16	aliceKey := inst.newKey(t, "alice")
 17	bobKey := inst.newKey(t, "bob")
 18	inst.admin(t, "admin", "user", "create", "alice", "--key", aliceKey+".pub")
 19	inst.admin(t, "admin", "user", "create", "bob", "--key", bobKey+".pub")
 20	if _, errOut, code := inst.ssh(t, aliceKey, "", "org", "create", "acme"); code != 0 {
 21		t.Fatalf("org create: %s", errOut)
 22	}
 23	if _, errOut, code := inst.ssh(t, aliceKey, "", "repo", "create", "acme/widget"); code != 0 {
 24		t.Fatalf("repo create: %s", errOut)
 25	}
 26
 27	alice := loginBrowser(t, inst, aliceKey)
 28
 29	// The management sections are admin-only: bob is not even a member.
 30	bob := loginBrowser(t, inst, bobKey)
 31	if _, body := browserGet(t, bob, inst.base()+"/acme"); strings.Contains(body, `value="member-add"`) {
 32		t.Fatal("a non-member sees organization controls")
 33	}
 34	// And POSTing anyway is refused by the command, not by the template.
 35	browserPost(t, bob, inst.base()+"/acme", url.Values{
 36		"field": {"member-add"}, "user": {"bob"}, "role": {"admin"},
 37	})
 38	if members := orgMembers(t, inst, aliceKey); len(members) != 1 {
 39		t.Fatalf("non-admin added themselves: %v", members)
 40	}
 41
 42	status, body := browserGet(t, alice, inst.base()+"/acme")
 43	if status != 200 || !strings.Contains(body, `value="member-add"`) {
 44		t.Fatalf("admin sees no controls: %d", status)
 45	}
 46
 47	// Add bob as a member through the form; confirm over SSH.
 48	browserPost(t, alice, inst.base()+"/acme", url.Values{
 49		"field": {"member-add"}, "user": {"bob"}, "role": {"member"},
 50	})
 51	if members := orgMembers(t, inst, aliceKey); len(members) != 2 {
 52		t.Fatalf("member not added: %v", members)
 53	}
 54
 55	// Create a team, put bob in it, and grant it write on the repo.
 56	browserPost(t, alice, inst.base()+"/acme", url.Values{
 57		"field": {"team-create"}, "team": {"builders"},
 58	})
 59	browserPost(t, alice, inst.base()+"/acme", url.Values{
 60		"field": {"team-add"}, "team": {"builders"}, "user": {"bob"},
 61	})
 62	browserPost(t, alice, inst.base()+"/acme", url.Values{
 63		"field": {"team-grant"}, "team": {"builders"},
 64		"repo": {"acme/widget"}, "role": {"write"},
 65	})
 66	out, _, _ := inst.ssh(t, aliceKey, "", "org", "team", "show", "acme", "builders", "--json")
 67	if !strings.Contains(out, `"bob"`) || !strings.Contains(out, `"acme/widget"`) ||
 68		!strings.Contains(out, `"write"`) {
 69		t.Fatalf("team not configured: %s", out)
 70	}
 71	// The grant is real access, not just a row: bob can now push.
 72	if _, errOut, code := inst.ssh(t, bobKey, "", "repo", "show", "acme/widget"); code != 0 {
 73		t.Fatalf("team grant did not confer access: %s", errOut)
 74	}
 75
 76	// The page shows what was built.
 77	_, body = browserGet(t, alice, inst.base()+"/acme")
 78	for _, want := range []string{"builders", "acme/widget", "1 member"} {
 79		if !strings.Contains(body, want) {
 80			t.Errorf("org page missing %q", want)
 81		}
 82	}
 83
 84	// Revoking and removing work the same way round.
 85	browserPost(t, alice, inst.base()+"/acme", url.Values{
 86		"field": {"team-revoke"}, "team": {"builders"}, "repo": {"acme/widget"},
 87	})
 88	browserPost(t, alice, inst.base()+"/acme", url.Values{
 89		"field": {"member-remove"}, "user": {"bob"},
 90	})
 91	if members := orgMembers(t, inst, aliceKey); len(members) != 1 {
 92		t.Fatalf("member not removed: %v", members)
 93	}
 94}
 95
 96// loginBrowser mints a session over SSH and returns a browser holding it.
 97func loginBrowser(t *testing.T, inst *instance, key string) *http.Client {
 98	t.Helper()
 99	out, errOut, code := inst.ssh(t, key, "", "web", "login", "--json")
100	if code != 0 {
101		t.Fatalf("web login: %s", errOut)
102	}
103	var env struct {
104		Data struct {
105			URL string `json:"url"`
106		} `json:"data"`
107	}
108	json.Unmarshal([]byte(out), &env)
109	c := newBrowser(t)
110	browserGet(t, c, inst.base()+env.Data.URL[strings.Index(env.Data.URL, "/login"):])
111	return c
112}
113
114func orgMembers(t *testing.T, inst *instance, key string) []string {
115	t.Helper()
116	out, _, _ := inst.ssh(t, key, "", "org", "members", "list", "acme", "--json")
117	var env struct {
118		Data struct {
119			Members []struct {
120				User string `json:"user"`
121			} `json:"members"`
122		} `json:"data"`
123	}
124	if err := json.Unmarshal([]byte(out), &env); err != nil {
125		t.Fatalf("members JSON: %v\n%s", err, out)
126	}
127	var names []string
128	for _, m := range env.Data.Members {
129		names = append(names, m.User)
130	}
131	return names
132}