e2e/snippetweb_test.go

  1package e2e
  2
  3import (
  4	"encoding/json"
  5	"net/http"
  6	"net/url"
  7	"strings"
  8	"testing"
  9)
 10
 11func snippetIDFrom(t *testing.T, out string) string {
 12	t.Helper()
 13	var env struct {
 14		Data struct {
 15			ID string `json:"id"`
 16		} `json:"data"`
 17	}
 18	if err := json.Unmarshal([]byte(out), &env); err != nil || env.Data.ID == "" {
 19		t.Fatalf("snippet create: %s", out)
 20	}
 21	return env.Data.ID
 22}
 23
 24// Snippet pages: the owner's list, one snippet with highlighted files, the
 25// raw route, the owner-page link, and 404 for what the viewer may not see.
 26func TestSnippetsWeb(t *testing.T) {
 27	t.Parallel()
 28	inst := startInstanceWith(t, "[web]\nmode = \"accounts\"\n")
 29	aliceKey := inst.newKey(t, "alice")
 30	bobKey := inst.newKey(t, "bob")
 31	inst.admin(t, "admin", "user", "create", "alice", "--key", aliceKey+".pub", "--email", "alice@example.test", "--verified")
 32	inst.admin(t, "admin", "user", "create", "bob", "--key", bobKey+".pub", "--email", "bob@example.test", "--verified")
 33	must := func(key, stdin string, args ...string) string {
 34		t.Helper()
 35		out, errOut, code := inst.ssh(t, key, stdin, args...)
 36		if code != 0 {
 37			t.Fatalf("%v: exit %d %s", args, code, errOut)
 38		}
 39		return out
 40	}
 41	public := snippetIDFrom(t, must(aliceKey, "package main\n", "snippet", "create", "main.go", "--visibility", "public", "--description", "'hello world'", "--json"))
 42	unlisted := snippetIDFrom(t, must(aliceKey, "quiet\n", "snippet", "create", "q.txt", "--json"))
 43	private := snippetIDFrom(t, must(aliceKey, "secret\n", "snippet", "create", "s.txt", "--visibility", "private", "--json"))
 44
 45	// Anonymous: the public list, the unlisted page by URL, 404 for private.
 46	status, body := inst.get(t, "/alice/-/snippets")
 47	if status != 200 || !strings.Contains(body, public) || strings.Contains(body, unlisted) || strings.Contains(body, private) {
 48		t.Fatalf("anonymous list: %d\n%s", status, body)
 49	}
 50	status, body = inst.get(t, "/alice/-/snippets/"+public)
 51	if status != 200 || !strings.Contains(body, "hello world") || !strings.Contains(body, `class="chroma"`) || !strings.Contains(body, "/raw/main.go") {
 52		t.Fatalf("public page: %d\n%s", status, body)
 53	}
 54	if status, _ := inst.get(t, "/alice/-/snippets/"+unlisted); status != 200 {
 55		t.Fatalf("unlisted page: %d", status)
 56	}
 57	if status, _ := inst.get(t, "/alice/-/snippets/"+private); status != 404 {
 58		t.Fatalf("private page for anonymous: %d", status)
 59	}
 60	if status, _ := inst.get(t, "/bob/-/snippets/"+public); status != 404 {
 61		t.Fatalf("id under the wrong owner: %d", status)
 62	}
 63	if status, _ := inst.get(t, "/nobody/-/snippets"); status != 404 {
 64		t.Fatalf("list for a missing owner: %d", status)
 65	}
 66
 67	// Raw is text/plain with nosniff, whatever the extension.
 68	resp, err := http.Get(inst.base() + "/alice/-/snippets/" + public + "/raw/main.go")
 69	if err != nil {
 70		t.Fatal(err)
 71	}
 72	resp.Body.Close()
 73	if resp.StatusCode != 200 || !strings.HasPrefix(resp.Header.Get("Content-Type"), "text/plain") || resp.Header.Get("X-Content-Type-Options") != "nosniff" {
 74		t.Fatalf("raw headers: %d %v", resp.StatusCode, resp.Header)
 75	}
 76	if status, _ := inst.get(t, "/alice/-/snippets/"+public+"/raw/other.go"); status != 404 {
 77		t.Fatalf("raw for a missing file: %d", status)
 78	}
 79
 80	// The owner sees everything with visibility marks; the owner page links.
 81	alice := inst.login(t, aliceKey)
 82	status, body = browserGet(t, alice, inst.base()+"/alice/-/snippets")
 83	if status != 200 || !strings.Contains(body, private) || !strings.Contains(body, ">private<") {
 84		t.Fatalf("owner list: %d\n%s", status, body)
 85	}
 86	if status, body := browserGet(t, alice, inst.base()+"/alice/-/snippets/"+private); status != 200 || !strings.Contains(body, "secret") {
 87		t.Fatalf("owner's private page: %d", status)
 88	}
 89	if status, body := inst.get(t, "/alice"); status != 200 || !strings.Contains(body, `href="/alice/-/snippets"`) {
 90		t.Fatalf("owner page lacks the snippets link: %d", status)
 91	}
 92	// bob has no public snippets and is not the viewer: no link.
 93	if status, body := inst.get(t, "/bob"); status != 200 || strings.Contains(body, `href="/bob/-/snippets"`) {
 94		t.Fatalf("bob's page shows a snippets link with nothing to list: %d", status)
 95	}
 96
 97	// The create form makes a snippet through snippet create.
 98	status, body = browserPost(t, alice, inst.base()+"/alice/-/snippets/new", url.Values{
 99		"name": {"notes.md"}, "description": {"from the browser"}, "visibility": {"public"}, "content": {"# notes\n"}})
100	if status != 200 || !strings.Contains(body, "from the browser") || !strings.Contains(body, "notes.md") {
101		t.Fatalf("create form: %d\n%s", status, body)
102	}
103	var listed struct {
104		Data []struct {
105			ID          string `json:"id"`
106			Description string `json:"description"`
107		} `json:"data"`
108	}
109	json.Unmarshal([]byte(must(aliceKey, "", "snippet", "list", "--json")), &listed)
110	created := ""
111	for _, sn := range listed.Data {
112		if sn.Description == "from the browser" {
113			created = sn.ID
114		}
115	}
116	if created == "" {
117		t.Fatalf("created from the web, not listed: %+v", listed.Data)
118	}
119	if status, _ := browserGet(t, alice, inst.base()+"/bob/-/snippets/new"); status != 404 {
120		t.Fatalf("new form under another owner: %d", status)
121	}
122
123	// A refused create re-renders the form with the paste kept, not a
124	// bare error page.
125	_, body = browserPost(t, alice, inst.base()+"/alice/-/snippets/new", url.Values{
126		"name": {"../x"}, "content": {"kept content\n"}})
127	if !strings.Contains(body, `class="error"`) || !strings.Contains(body, "kept content") {
128		t.Fatalf("refused create form:\n%s", body)
129	}
130
131	// The file form replaces a file and adds one; remove drops it.
132	page := inst.base() + "/alice/-/snippets/" + created
133	if status, _ := browserPost(t, alice, page+"/file", url.Values{"name": {"notes.md"}, "content": {"# changed\n"}}); status != 200 {
134		t.Fatal("file replace failed")
135	}
136	if got := must(aliceKey, "", "snippet", "file", "get", created, "notes.md"); got != "# changed\n" {
137		t.Fatalf("after web replace: %q", got)
138	}
139	if status, _ := browserPost(t, alice, page+"/file", url.Values{"name": {"b.txt"}, "content": {"b\n"}}); status != 200 {
140		t.Fatal("file add failed")
141	}
142	// Removing a file needs its name typed; a bare post is refused and
143	// the file stays.
144	_, body = browserPost(t, alice, page+"/file/remove", url.Values{"name": {"b.txt"}})
145	if !strings.Contains(body, "type b.txt to confirm") {
146		t.Fatalf("unconfirmed file remove was not refused:\n%s", body)
147	}
148	if _, _, code := inst.ssh(t, aliceKey, "", "snippet", "file", "get", created, "b.txt"); code != 0 {
149		t.Fatalf("b.txt removed without confirmation: exit %d", code)
150	}
151	if status, _ := browserPost(t, alice, page+"/file/remove", url.Values{"name": {"b.txt"}, "confirm": {"b.txt"}}); status != 200 {
152		t.Fatal("file remove failed")
153	}
154	if _, _, code := inst.ssh(t, aliceKey, "", "snippet", "file", "get", created, "b.txt"); code != 3 {
155		t.Fatalf("b.txt after web remove: exit %d", code)
156	}
157	// A refusal comes back on the page as a message, not a bare error.
158	// The confirmation matches, so the refusal under test is still the
159	// command's last-file rule.
160	_, body = browserPost(t, alice, page+"/file/remove", url.Values{"name": {"notes.md"}, "confirm": {"notes.md"}})
161	if !strings.Contains(body, `class="error"`) || !strings.Contains(body, "at least one file") {
162		t.Fatalf("last-file refusal on the page:\n%s", body)
163	}
164
165	// Edit changes visibility; delete removes.
166	if status, _ := browserPost(t, alice, page+"/edit", url.Values{"description": {"renamed"}, "visibility": {"private"}}); status != 200 {
167		t.Fatal("edit failed")
168	}
169	if status, _ := inst.get(t, "/alice/-/snippets/"+created); status != 404 {
170		t.Fatalf("private after web edit, anonymous: %d", status)
171	}
172	// bob cannot write alice's snippet from the browser either.
173	bob := inst.login(t, bobKey)
174	// A logged-in stranger sees the same visibility rule as anonymous:
175	// 404 for a private snippet, 200 for an unlisted one.
176	if status, _ := browserGet(t, bob, inst.base()+"/alice/-/snippets/"+private); status != 404 {
177		t.Fatalf("stranger on a private page: %d", status)
178	}
179	if status, _ := browserGet(t, bob, inst.base()+"/alice/-/snippets/"+unlisted); status != 200 {
180		t.Fatalf("stranger on an unlisted page: %d", status)
181	}
182	// An unconfirmed delete on a private snippet is still 404 for a
183	// stranger: the snippet is resolved, and refused, before the
184	// confirmation is even checked.
185	if status, _ := browserPost(t, bob, inst.base()+"/alice/-/snippets/"+private+"/delete", nil); status != 404 {
186		t.Fatalf("stranger's unconfirmed delete on a private snippet: %d", status)
187	}
188	if status, _ := browserPost(t, bob, inst.base()+"/alice/-/snippets/"+public+"/edit", url.Values{"description": {"x"}, "visibility": {"public"}}); status != 403 {
189		t.Fatalf("bob editing alice's snippet: %d", status)
190	}
191	// Deleting needs the public id typed to confirm; a bare post leaves
192	// the snippet in place.
193	_, body = browserPost(t, alice, page+"/delete", nil)
194	if !strings.Contains(body, "type "+created+" to confirm") {
195		t.Fatalf("unconfirmed delete was not refused:\n%s", body)
196	}
197	if _, _, code := inst.ssh(t, aliceKey, "", "snippet", "show", created); code != 0 {
198		t.Fatalf("snippet deleted without confirmation: exit %d", code)
199	}
200	if status, _ := browserPost(t, alice, page+"/delete", url.Values{"confirm": {created}}); status != 200 {
201		t.Fatal("delete failed")
202	}
203	if _, _, code := inst.ssh(t, aliceKey, "", "snippet", "show", created); code != 3 {
204		t.Fatalf("after web delete: exit %d", code)
205	}
206}