e2e/websignup_test.go

 1package e2e
 2
 3import (
 4	"fmt"
 5	"net/url"
 6	"os"
 7	"strings"
 8	"testing"
 9)
10
11func TestWebSignup(t *testing.T) {
12	smtp := startFakeSMTP(t)
13	inst := startInstanceWith(t, fmt.Sprintf(
14		"[web]\nmode = \"accounts\"\n[registration]\nmode = \"invite\"\n[mail]\nsmtp_host = %q\nfrom = \"noreply@gitbay.test\"\n",
15		smtp.addr))
16
17	// The landing page advertises signup; the form renders.
18	status, body := inst.get(t, "/")
19	if status != 200 || !strings.Contains(body, `href="/register"`) {
20		t.Fatalf("landing signup link: %d", status)
21	}
22	status, body = inst.get(t, "/register")
23	if status != 200 || !strings.Contains(body, "invite-only") || !strings.Contains(body, `name="key"`) {
24		t.Fatalf("register form: %d\n%s", status, body)
25	}
26
27	// Invite issued over the admin path; redeemed through the browser.
28	inst.admin(t, "admin", "invite", "--email", "erin@example.test")
29	inviteCode := extractCode(t, smtp.waitMail(t, 0))
30	key := inst.newKey(t, "erin")
31	pub, err := os.ReadFile(key + ".pub")
32	if err != nil {
33		t.Fatal(err)
34	}
35
36	browser := newBrowser(t)
37	// A garbage key re-renders the form with the error, keeping the input.
38	_, body = browserPost(t, browser, inst.base()+"/register", url.Values{
39		"username": {"erin"}, "invite": {inviteCode}, "key": {"not a key"}})
40	if !strings.Contains(body, "does not parse as an SSH public key") || !strings.Contains(body, `value="erin"`) {
41		t.Fatalf("bad key handling:\n%s", body)
42	}
43	// A bad invite fails without burning anything.
44	_, body = browserPost(t, browser, inst.base()+"/register", url.Values{
45		"username": {"erin"}, "invite": {"deadbeef"}, "key": {string(pub)}})
46	if !strings.Contains(body, "invalid or already used") {
47		t.Fatalf("bad invite:\n%s", body)
48	}
49	// The real thing: account is active immediately (invite proves the mailbox).
50	status, body = browserPost(t, browser, inst.base()+"/register", url.Values{
51		"username": {"erin"}, "invite": {inviteCode}, "key": {string(pub)}})
52	if status != 200 || !strings.Contains(body, "welcome, erin") {
53		t.Fatalf("signup: %d\n%s", status, body)
54	}
55	out, errOut, code := inst.ssh(t, key, "", "whoami")
56	if code != 0 || !strings.Contains(out, "erin") {
57		t.Fatalf("ssh after web signup: exit %d, %s%s", code, out, errOut)
58	}
59	// The invite is burned: reusing it (fresh browser, fresh key) fails.
60	key2 := inst.newKey(t, "mallory")
61	pub2, _ := os.ReadFile(key2 + ".pub")
62	_, body = browserPost(t, newBrowser(t), inst.base()+"/register", url.Values{
63		"username": {"mallory"}, "invite": {inviteCode}, "key": {string(pub2)}})
64	if !strings.Contains(body, "invalid or already used") {
65		t.Fatalf("invite reuse:\n%s", body)
66	}
67}
68
69func TestWebSignupClosedInstance(t *testing.T) {
70	inst := startInstanceWith(t, "[web]\nmode = \"accounts\"\n")
71	// Closed registration: no signup route at all, and no landing hint.
72	if status, _ := inst.get(t, "/register"); status != 404 {
73		t.Fatalf("register on closed instance: %d", status)
74	}
75	_, body := inst.get(t, "/")
76	if strings.Contains(body, `href="/register"`) {
77		t.Fatal("closed landing advertises signup")
78	}
79}