e2e/accountweb_test.go

  1package e2e
  2
  3import (
  4	"encoding/json"
  5	"io"
  6	"net/url"
  7	"os"
  8	"strings"
  9	"testing"
 10)
 11
 12// TestAccountSettingsWeb covers managing your own keys and addresses from a
 13// browser session. Public keys are the only credential-shaped input the web
 14// accepts; secrets and token minting stay on SSH.
 15func TestAccountSettingsWeb(t *testing.T) {
 16	inst := startInstanceWith(t, "[web]\nmode = \"accounts\"\n")
 17	aliceKey := inst.newKey(t, "alice")
 18	inst.admin(t, "admin", "user", "create", "alice",
 19		"--key", aliceKey+".pub", "--email", "alice@example.test", "--verified")
 20
 21	out, _, code := inst.ssh(t, aliceKey, "", "web", "login", "--json")
 22	if code != 0 {
 23		t.Fatal("web login failed")
 24	}
 25	var env struct {
 26		Data struct {
 27			URL string `json:"url"`
 28		} `json:"data"`
 29	}
 30	json.Unmarshal([]byte(out), &env)
 31	browser := newBrowser(t)
 32	browserGet(t, browser, inst.base()+env.Data.URL[strings.Index(env.Data.URL, "/login"):])
 33
 34	status, body := browserGet(t, browser, inst.base()+"/settings")
 35	if status != 200 {
 36		t.Fatalf("account settings: %d", status)
 37	}
 38	// The key that signed us in is listed, and its address shows verified.
 39	if !strings.Contains(body, "SHA256:") {
 40		t.Error("no SSH key fingerprint listed")
 41	}
 42	// Keys are stored in wire format, which holds no comment; anything
 43	// pulled out of it and printed would be binary noise.
 44	if strings.Contains(body, "\ufffd") {
 45		t.Error("key row is rendering raw blob bytes")
 46	}
 47	if !strings.Contains(body, "alice@example.test") || !strings.Contains(body, "verified") {
 48		t.Error("verified address not shown")
 49	}
 50
 51	// Add a second key through the form, then confirm it over SSH — the
 52	// web write must land in the same place the CLI reads.
 53	second := inst.newKey(t, "alice2")
 54	raw, err := os.ReadFile(second + ".pub")
 55	if err != nil {
 56		t.Fatal(err)
 57	}
 58	pub := string(raw)
 59	if status, _ := browserPost(t, browser, inst.base()+"/settings", url.Values{
 60		"field": {"key-add"}, "key": {pub}, "scope": {"git"},
 61	}); status != 303 && status != 200 {
 62		t.Fatalf("key add: %d", status)
 63	}
 64	out, _, _ = inst.ssh(t, aliceKey, "", "keys", "list", "--json")
 65	if strings.Count(out, "SHA256:") != 2 || !strings.Contains(out, `"scope":"git"`) {
 66		t.Fatalf("key not registered with its scope: %s", out)
 67	}
 68
 69	// A git-scoped key can move git data but cannot run commands, so the
 70	// scope the form set is really enforced.
 71	if _, _, code := inst.ssh(t, second, "", "whoami"); code == 0 {
 72		t.Error("git-scoped key ran a control command")
 73	}
 74
 75	// Removing it through the form removes it for SSH too.
 76	fp := gitScopedFingerprint(t, out)
 77	if status, _ := browserPost(t, browser, inst.base()+"/settings", url.Values{
 78		"field": {"key-remove"}, "fingerprint": {fp},
 79	}); status != 303 && status != 200 {
 80		t.Fatalf("key remove: %d", status)
 81	}
 82	out, _, _ = inst.ssh(t, aliceKey, "", "keys", "list", "--json")
 83	if strings.Count(out, "SHA256:") != 1 {
 84		t.Fatalf("key not removed: %s", out)
 85	}
 86
 87	// Garbage is refused by the same validation the CLI uses, and says so.
 88	// The redirect carries the message, so the followed page shows it.
 89	_, body = browserPost(t, browser, inst.base()+"/settings", url.Values{
 90		"field": {"key-add"}, "key": {"not a key"},
 91	})
 92	if !strings.Contains(body, `class="error"`) {
 93		t.Error("invalid key accepted without an error")
 94	}
 95
 96	// Token minting is SSHOnly and has no web form to reach it.
 97	if strings.Contains(body, `value="token-mint"`) {
 98		t.Error("token minting exposed on the web")
 99	}
100
101	// The account bundle downloads as an attachment, carrying what
102	// "account export" writes (#166).
103	resp, err := browser.Get(inst.base() + "/settings/export")
104	if err != nil {
105		t.Fatal(err)
106	}
107	defer resp.Body.Close()
108	bundle, _ := io.ReadAll(resp.Body)
109	if resp.StatusCode != 200 {
110		t.Fatalf("export: %d", resp.StatusCode)
111	}
112	if !strings.Contains(resp.Header.Get("Content-Disposition"), `filename="alice.bundle"`) {
113		t.Errorf("export is not an attachment: %q", resp.Header.Get("Content-Disposition"))
114	}
115	var got struct {
116		Bundle   string `json:"bundle"`
117		Username string `json:"username"`
118	}
119	if err := json.Unmarshal(bundle, &got); err != nil {
120		t.Fatalf("bundle is not JSON: %v\n%s", err, bundle)
121	}
122	if got.Username != "alice" || !strings.HasPrefix(got.Bundle, "gitbay-account/") {
123		t.Errorf("wrong bundle: %s", bundle)
124	}
125}
126
127// gitScopedFingerprint pulls the fingerprint of the git-scoped key out of
128// "auth keys list --json".
129func gitScopedFingerprint(t *testing.T, blob string) string {
130	t.Helper()
131	var env struct {
132		Data []struct {
133			Fingerprint string `json:"fingerprint"`
134			Scope       string `json:"scope"`
135		} `json:"data"`
136	}
137	if err := json.Unmarshal([]byte(blob), &env); err != nil {
138		t.Fatalf("keys list JSON: %v\n%s", err, blob)
139	}
140	for _, k := range env.Data {
141		if k.Scope == "git" {
142			return k.Fingerprint
143		}
144	}
145	t.Fatalf("no git-scoped key in %s", blob)
146	return ""
147}