e2e/websignup_test.go

 1package e2e
 2
 3import (
 4	"fmt"
 5	"net/url"
 6	"os"
 7	"strings"
 8	"testing"
 9)
10
11func TestWebSignup(t *testing.T) {
12	smtp := startFakeSMTP(t)
13	inst := startInstanceWith(t, fmt.Sprintf(
14		"[web]\nmode = \"accounts\"\n[registration]\nmode = \"invite\"\n[mail]\nsmtp_host = %q\nfrom = \"noreply@gitbay.test\"\n",
15		smtp.addr))
16
17	// The landing page advertises signup; the form renders.
18	status, body := inst.get(t, "/")
19	if status != 200 || !strings.Contains(body, `href="/register"`) {
20		t.Fatalf("landing signup link: %d", status)
21	}
22	status, body = inst.get(t, "/register")
23	if status != 200 || !strings.Contains(body, "invite-only") || !strings.Contains(body, `name="key"`) {
24		t.Fatalf("register form: %d\n%s", status, body)
25	}
26	// The login page tells a brand-new visitor how to get an account.
27	status, body = inst.get(t, "/login")
28	if status != 200 || !strings.Contains(body, `href="/register"`) || !strings.Contains(body, "invite-only") {
29		t.Fatalf("login signup hint: %d\n%s", status, body)
30	}
31
32	// Invite issued over the admin path; redeemed through the browser.
33	inst.admin(t, "admin", "invite", "--email", "erin@example.test")
34	inviteCode := extractCode(t, smtp.waitMail(t, 0))
35	key := inst.newKey(t, "erin")
36	pub, err := os.ReadFile(key + ".pub")
37	if err != nil {
38		t.Fatal(err)
39	}
40
41	browser := newBrowser(t)
42	// A garbage key re-renders the form with the error, keeping the input.
43	_, body = browserPost(t, browser, inst.base()+"/register", url.Values{
44		"username": {"erin"}, "invite": {inviteCode}, "key": {"not a key"}})
45	if !strings.Contains(body, "does not parse as an SSH public key") || !strings.Contains(body, `value="erin"`) {
46		t.Fatalf("bad key handling:\n%s", body)
47	}
48	// A bad invite fails without burning anything.
49	_, body = browserPost(t, browser, inst.base()+"/register", url.Values{
50		"username": {"erin"}, "invite": {"deadbeef"}, "key": {string(pub)}})
51	if !strings.Contains(body, "invalid or already used") {
52		t.Fatalf("bad invite:\n%s", body)
53	}
54	// The real thing: account is active immediately (invite proves the mailbox).
55	status, body = browserPost(t, browser, inst.base()+"/register", url.Values{
56		"username": {"erin"}, "invite": {inviteCode}, "key": {string(pub)}})
57	if status != 200 || !strings.Contains(body, "welcome, erin") ||
58		!strings.Contains(body, `href="/settings"`) || !strings.Contains(body, "paste the code") {
59		t.Fatalf("signup: %d\n%s", status, body)
60	}
61	out, errOut, code := inst.ssh(t, key, "", "whoami")
62	if code != 0 || !strings.Contains(out, "erin") {
63		t.Fatalf("ssh after web signup: exit %d, %s%s", code, out, errOut)
64	}
65	// The invite is burned: reusing it (fresh browser, fresh key) fails.
66	key2 := inst.newKey(t, "mallory")
67	pub2, _ := os.ReadFile(key2 + ".pub")
68	_, body = browserPost(t, newBrowser(t), inst.base()+"/register", url.Values{
69		"username": {"mallory"}, "invite": {inviteCode}, "key": {string(pub2)}})
70	if !strings.Contains(body, "invalid or already used") {
71		t.Fatalf("invite reuse:\n%s", body)
72	}
73}
74
75func TestWebSignupClosedInstance(t *testing.T) {
76	inst := startInstanceWith(t, "[web]\nmode = \"accounts\"\n")
77	// Closed registration: no signup route at all, and no landing hint.
78	if status, _ := inst.get(t, "/register"); status != 404 {
79		t.Fatalf("register on closed instance: %d", status)
80	}
81	_, body := inst.get(t, "/")
82	if strings.Contains(body, `href="/register"`) {
83		t.Fatal("closed landing advertises signup")
84	}
85	_, body = inst.get(t, "/login")
86	if strings.Contains(body, `href="/register"`) {
87		t.Fatal("closed login page advertises signup")
88	}
89	if !strings.Contains(body, "not accepting new accounts") {
90		t.Fatalf("closed login page says nothing about accounts:\n%s", body)
91	}
92}