internal/httpd/logindisabled_test.go

 1package httpd
 2
 3import (
 4	"net/http/httptest"
 5	"strings"
 6	"testing"
 7	"time"
 8
 9	"gitbay.org/gitbay/internal/config"
10	"gitbay.org/gitbay/internal/store"
11)
12
13// login() re-reads the user after ConsumeLoginToken and refuses a disabled
14// account with the same badLoginToken page a bad token gets (#155, #156).
15// SetUserDisabled also deletes login_tokens, which would mask this guard if
16// the test went through it, so the token is inserted directly and the row
17// is disabled with a bare UPDATE — bypassing SetUserDisabled entirely.
18func TestLoginRefusesTokenForDisabledAccount(t *testing.T) {
19	st, err := store.Open(":memory:")
20	if err != nil {
21		t.Fatal(err)
22	}
23	defer st.Close()
24	if err := st.MigrateUp(); err != nil {
25		t.Fatal(err)
26	}
27
28	uid, err := st.CreateUser("alice", false)
29	if err != nil {
30		t.Fatal(err)
31	}
32	tok, hash, err := store.NewToken()
33	if err != nil {
34		t.Fatal(err)
35	}
36	if err := st.CreateLoginToken(uid, hash, time.Hour); err != nil {
37		t.Fatal(err)
38	}
39	if _, err := st.DB.Exec("UPDATE users SET disabled = 1 WHERE id = ?", uid); err != nil {
40		t.Fatal(err)
41	}
42
43	s := New(config.Default(), st, nil)
44	rr := httptest.NewRecorder()
45	req := httptest.NewRequest("GET", "/login?token="+tok, nil)
46	s.login(rr, req)
47
48	for _, c := range rr.Result().Cookies() {
49		if c.Name == sessionCookie {
50			t.Fatalf("login set a session cookie for a disabled account: %+v", c)
51		}
52	}
53	if !strings.Contains(rr.Body.String(), badLoginToken) {
54		t.Errorf("body = %q, want the bad-token page", rr.Body.String())
55	}
56}