e2e/snippetweb_test.go
206 lines · 9436 bytes
1package e2e
2
3import (
4 "encoding/json"
5 "net/http"
6 "net/url"
7 "strings"
8 "testing"
9)
10
11func snippetIDFrom(t *testing.T, out string) string {
12 t.Helper()
13 var env struct {
14 Data struct {
15 ID string `json:"id"`
16 } `json:"data"`
17 }
18 if err := json.Unmarshal([]byte(out), &env); err != nil || env.Data.ID == "" {
19 t.Fatalf("snippet create: %s", out)
20 }
21 return env.Data.ID
22}
23
24// Snippet pages: the owner's list, one snippet with highlighted files, the
25// raw route, the owner-page link, and 404 for what the viewer may not see.
26func TestSnippetsWeb(t *testing.T) {
27 t.Parallel()
28 inst := startInstanceWith(t, "[web]\nmode = \"accounts\"\n")
29 aliceKey := inst.newKey(t, "alice")
30 bobKey := inst.newKey(t, "bob")
31 inst.admin(t, "admin", "user", "create", "alice", "--key", aliceKey+".pub", "--email", "alice@example.test", "--verified")
32 inst.admin(t, "admin", "user", "create", "bob", "--key", bobKey+".pub", "--email", "bob@example.test", "--verified")
33 must := func(key, stdin string, args ...string) string {
34 t.Helper()
35 out, errOut, code := inst.ssh(t, key, stdin, args...)
36 if code != 0 {
37 t.Fatalf("%v: exit %d %s", args, code, errOut)
38 }
39 return out
40 }
41 public := snippetIDFrom(t, must(aliceKey, "package main\n", "snippet", "create", "main.go", "--visibility", "public", "--description", "'hello world'", "--json"))
42 unlisted := snippetIDFrom(t, must(aliceKey, "quiet\n", "snippet", "create", "q.txt", "--json"))
43 private := snippetIDFrom(t, must(aliceKey, "secret\n", "snippet", "create", "s.txt", "--visibility", "private", "--json"))
44
45 // Anonymous: the public list, the unlisted page by URL, 404 for private.
46 status, body := inst.get(t, "/alice/-/snippets")
47 if status != 200 || !strings.Contains(body, public) || strings.Contains(body, unlisted) || strings.Contains(body, private) {
48 t.Fatalf("anonymous list: %d\n%s", status, body)
49 }
50 status, body = inst.get(t, "/alice/-/snippets/"+public)
51 if status != 200 || !strings.Contains(body, "hello world") || !strings.Contains(body, `class="chroma"`) || !strings.Contains(body, "/raw/main.go") {
52 t.Fatalf("public page: %d\n%s", status, body)
53 }
54 if status, _ := inst.get(t, "/alice/-/snippets/"+unlisted); status != 200 {
55 t.Fatalf("unlisted page: %d", status)
56 }
57 if status, _ := inst.get(t, "/alice/-/snippets/"+private); status != 404 {
58 t.Fatalf("private page for anonymous: %d", status)
59 }
60 if status, _ := inst.get(t, "/bob/-/snippets/"+public); status != 404 {
61 t.Fatalf("id under the wrong owner: %d", status)
62 }
63 if status, _ := inst.get(t, "/nobody/-/snippets"); status != 404 {
64 t.Fatalf("list for a missing owner: %d", status)
65 }
66
67 // Raw is text/plain with nosniff, whatever the extension.
68 resp, err := http.Get(inst.base() + "/alice/-/snippets/" + public + "/raw/main.go")
69 if err != nil {
70 t.Fatal(err)
71 }
72 resp.Body.Close()
73 if resp.StatusCode != 200 || !strings.HasPrefix(resp.Header.Get("Content-Type"), "text/plain") || resp.Header.Get("X-Content-Type-Options") != "nosniff" {
74 t.Fatalf("raw headers: %d %v", resp.StatusCode, resp.Header)
75 }
76 if status, _ := inst.get(t, "/alice/-/snippets/"+public+"/raw/other.go"); status != 404 {
77 t.Fatalf("raw for a missing file: %d", status)
78 }
79
80 // The owner sees everything with visibility marks; the owner page links.
81 alice := inst.login(t, aliceKey)
82 status, body = browserGet(t, alice, inst.base()+"/alice/-/snippets")
83 if status != 200 || !strings.Contains(body, private) || !strings.Contains(body, ">private<") {
84 t.Fatalf("owner list: %d\n%s", status, body)
85 }
86 if status, body := browserGet(t, alice, inst.base()+"/alice/-/snippets/"+private); status != 200 || !strings.Contains(body, "secret") {
87 t.Fatalf("owner's private page: %d", status)
88 }
89 if status, body := inst.get(t, "/alice"); status != 200 || !strings.Contains(body, `href="/alice/-/snippets"`) {
90 t.Fatalf("owner page lacks the snippets link: %d", status)
91 }
92 // bob has no public snippets and is not the viewer: no link.
93 if status, body := inst.get(t, "/bob"); status != 200 || strings.Contains(body, `href="/bob/-/snippets"`) {
94 t.Fatalf("bob's page shows a snippets link with nothing to list: %d", status)
95 }
96
97 // The create form makes a snippet through snippet create.
98 status, body = browserPost(t, alice, inst.base()+"/alice/-/snippets/new", url.Values{
99 "name": {"notes.md"}, "description": {"from the browser"}, "visibility": {"public"}, "content": {"# notes\n"}})
100 if status != 200 || !strings.Contains(body, "from the browser") || !strings.Contains(body, "notes.md") {
101 t.Fatalf("create form: %d\n%s", status, body)
102 }
103 var listed struct {
104 Data []struct {
105 ID string `json:"id"`
106 Description string `json:"description"`
107 } `json:"data"`
108 }
109 json.Unmarshal([]byte(must(aliceKey, "", "snippet", "list", "--json")), &listed)
110 created := ""
111 for _, sn := range listed.Data {
112 if sn.Description == "from the browser" {
113 created = sn.ID
114 }
115 }
116 if created == "" {
117 t.Fatalf("created from the web, not listed: %+v", listed.Data)
118 }
119 if status, _ := browserGet(t, alice, inst.base()+"/bob/-/snippets/new"); status != 404 {
120 t.Fatalf("new form under another owner: %d", status)
121 }
122
123 // A refused create re-renders the form with the paste kept, not a
124 // bare error page.
125 _, body = browserPost(t, alice, inst.base()+"/alice/-/snippets/new", url.Values{
126 "name": {"../x"}, "content": {"kept content\n"}})
127 if !strings.Contains(body, `class="error"`) || !strings.Contains(body, "kept content") {
128 t.Fatalf("refused create form:\n%s", body)
129 }
130
131 // The file form replaces a file and adds one; remove drops it.
132 page := inst.base() + "/alice/-/snippets/" + created
133 if status, _ := browserPost(t, alice, page+"/file", url.Values{"name": {"notes.md"}, "content": {"# changed\n"}}); status != 200 {
134 t.Fatal("file replace failed")
135 }
136 if got := must(aliceKey, "", "snippet", "file", "get", created, "notes.md"); got != "# changed\n" {
137 t.Fatalf("after web replace: %q", got)
138 }
139 if status, _ := browserPost(t, alice, page+"/file", url.Values{"name": {"b.txt"}, "content": {"b\n"}}); status != 200 {
140 t.Fatal("file add failed")
141 }
142 // Removing a file needs its name typed; a bare post is refused and
143 // the file stays.
144 _, body = browserPost(t, alice, page+"/file/remove", url.Values{"name": {"b.txt"}})
145 if !strings.Contains(body, "type b.txt to confirm") {
146 t.Fatalf("unconfirmed file remove was not refused:\n%s", body)
147 }
148 if _, _, code := inst.ssh(t, aliceKey, "", "snippet", "file", "get", created, "b.txt"); code != 0 {
149 t.Fatalf("b.txt removed without confirmation: exit %d", code)
150 }
151 if status, _ := browserPost(t, alice, page+"/file/remove", url.Values{"name": {"b.txt"}, "confirm": {"b.txt"}}); status != 200 {
152 t.Fatal("file remove failed")
153 }
154 if _, _, code := inst.ssh(t, aliceKey, "", "snippet", "file", "get", created, "b.txt"); code != 3 {
155 t.Fatalf("b.txt after web remove: exit %d", code)
156 }
157 // A refusal comes back on the page as a message, not a bare error.
158 // The confirmation matches, so the refusal under test is still the
159 // command's last-file rule.
160 _, body = browserPost(t, alice, page+"/file/remove", url.Values{"name": {"notes.md"}, "confirm": {"notes.md"}})
161 if !strings.Contains(body, `class="error"`) || !strings.Contains(body, "at least one file") {
162 t.Fatalf("last-file refusal on the page:\n%s", body)
163 }
164
165 // Edit changes visibility; delete removes.
166 if status, _ := browserPost(t, alice, page+"/edit", url.Values{"description": {"renamed"}, "visibility": {"private"}}); status != 200 {
167 t.Fatal("edit failed")
168 }
169 if status, _ := inst.get(t, "/alice/-/snippets/"+created); status != 404 {
170 t.Fatalf("private after web edit, anonymous: %d", status)
171 }
172 // bob cannot write alice's snippet from the browser either.
173 bob := inst.login(t, bobKey)
174 // A logged-in stranger sees the same visibility rule as anonymous:
175 // 404 for a private snippet, 200 for an unlisted one.
176 if status, _ := browserGet(t, bob, inst.base()+"/alice/-/snippets/"+private); status != 404 {
177 t.Fatalf("stranger on a private page: %d", status)
178 }
179 if status, _ := browserGet(t, bob, inst.base()+"/alice/-/snippets/"+unlisted); status != 200 {
180 t.Fatalf("stranger on an unlisted page: %d", status)
181 }
182 // An unconfirmed delete on a private snippet is still 404 for a
183 // stranger: the snippet is resolved, and refused, before the
184 // confirmation is even checked.
185 if status, _ := browserPost(t, bob, inst.base()+"/alice/-/snippets/"+private+"/delete", nil); status != 404 {
186 t.Fatalf("stranger's unconfirmed delete on a private snippet: %d", status)
187 }
188 if status, _ := browserPost(t, bob, inst.base()+"/alice/-/snippets/"+public+"/edit", url.Values{"description": {"x"}, "visibility": {"public"}}); status != 403 {
189 t.Fatalf("bob editing alice's snippet: %d", status)
190 }
191 // Deleting needs the public id typed to confirm; a bare post leaves
192 // the snippet in place.
193 _, body = browserPost(t, alice, page+"/delete", nil)
194 if !strings.Contains(body, "type "+created+" to confirm") {
195 t.Fatalf("unconfirmed delete was not refused:\n%s", body)
196 }
197 if _, _, code := inst.ssh(t, aliceKey, "", "snippet", "show", created); code != 0 {
198 t.Fatalf("snippet deleted without confirmation: exit %d", code)
199 }
200 if status, _ := browserPost(t, alice, page+"/delete", url.Values{"confirm": {created}}); status != 200 {
201 t.Fatal("delete failed")
202 }
203 if _, _, code := inst.ssh(t, aliceKey, "", "snippet", "show", created); code != 3 {
204 t.Fatalf("after web delete: exit %d", code)
205 }
206}