steve
293532f021
Build image / build-and-push (push) Successful in 5s
Co-authored-by: Steve Dudenhoeffer <[email protected]>
101 lines
3.5 KiB
Go
101 lines
3.5 KiB
Go
package api
|
|
|
|
import (
|
|
"encoding/json"
|
|
"net/http"
|
|
"strconv"
|
|
"testing"
|
|
)
|
|
|
|
func plantPath(id int64) string {
|
|
return "/api/v1/plants/" + strconv.FormatInt(id, 10)
|
|
}
|
|
|
|
// firstBuiltinID returns the id of a seeded built-in (no ownerId key) from a
|
|
// /plants list response, plus the total count.
|
|
func firstBuiltinID(t *testing.T, body []byte) (int64, int) {
|
|
t.Helper()
|
|
var list []map[string]any
|
|
if err := json.Unmarshal(body, &list); err != nil {
|
|
t.Fatalf("decode plants list: %v (body %s)", err, body)
|
|
}
|
|
for _, p := range list {
|
|
if _, owned := p["ownerId"]; !owned {
|
|
return int64(p["id"].(float64)), len(list)
|
|
}
|
|
}
|
|
t.Fatal("no built-in plant in list")
|
|
return 0, 0
|
|
}
|
|
|
|
func TestPlantCatalogFlow(t *testing.T) {
|
|
r := authEngine(t, localCfg())
|
|
cookie := registerAndCookie(t, r, "[email protected]")
|
|
|
|
// List → seeded built-ins present.
|
|
w := doJSON(t, r, http.MethodGet, "/api/v1/plants", nil, cookie)
|
|
if w.Code != http.StatusOK {
|
|
t.Fatalf("list status = %d, body %s", w.Code, w.Body.String())
|
|
}
|
|
builtinID, count := firstBuiltinID(t, w.Body.Bytes())
|
|
if count < 30 {
|
|
t.Errorf("catalog = %d plants, want >= 30 seeded", count)
|
|
}
|
|
|
|
// Create a custom plant → 201.
|
|
w = doJSON(t, r, http.MethodPost, "/api/v1/plants",
|
|
map[string]any{"name": "My tomato", "category": "vegetable", "spacingCm": 55, "color": "#e53935", "icon": "🍅"}, cookie)
|
|
if w.Code != http.StatusCreated {
|
|
t.Fatalf("create status = %d, body %s", w.Code, w.Body.String())
|
|
}
|
|
created := decodeMap(t, w.Body.Bytes())
|
|
id := int64(created["id"].(float64))
|
|
if created["ownerId"] == nil {
|
|
t.Error("custom plant should carry ownerId")
|
|
}
|
|
|
|
// Patch the custom plant with its version → 200, bumped.
|
|
w = doJSON(t, r, http.MethodPatch, plantPath(id), map[string]any{"spacingCm": 50, "version": 1}, cookie)
|
|
if w.Code != http.StatusOK {
|
|
t.Fatalf("patch status = %d, body %s", w.Code, w.Body.String())
|
|
}
|
|
if decodeMap(t, w.Body.Bytes())["version"].(float64) != 2 {
|
|
t.Error("patch didn't bump version")
|
|
}
|
|
|
|
// A built-in is read-only: patch and delete both → 403.
|
|
if w := doJSON(t, r, http.MethodPatch, plantPath(builtinID), map[string]any{"spacingCm": 99, "version": 1}, cookie); w.Code != http.StatusForbidden {
|
|
t.Errorf("patch built-in = %d, want 403", w.Code)
|
|
}
|
|
if w := doJSON(t, r, http.MethodDelete, plantPath(builtinID), nil, cookie); w.Code != http.StatusForbidden {
|
|
t.Errorf("delete built-in = %d, want 403", w.Code)
|
|
}
|
|
|
|
// Delete the custom plant → 204.
|
|
if w := doJSON(t, r, http.MethodDelete, plantPath(id), nil, cookie); w.Code != http.StatusNoContent {
|
|
t.Errorf("delete custom = %d, want 204", w.Code)
|
|
}
|
|
}
|
|
|
|
func TestPlantVisibilityAcrossUsersAPI(t *testing.T) {
|
|
r := authEngine(t, localCfg())
|
|
alice := registerAndCookie(t, r, "[email protected]")
|
|
bob := registerAndCookie(t, r, "[email protected]")
|
|
|
|
w := doJSON(t, r, http.MethodPost, "/api/v1/plants",
|
|
map[string]any{"name": "Alice mint", "category": "herb", "spacingCm": 30, "color": "#66bb6a", "icon": "🌿"}, alice)
|
|
id := int64(decodeMap(t, w.Body.Bytes())["id"].(float64))
|
|
|
|
// Bob can't see it → editing masks as 404, not 403.
|
|
if w := doJSON(t, r, http.MethodPatch, plantPath(id), map[string]any{"name": "x", "version": 1}, bob); w.Code != http.StatusNotFound {
|
|
t.Errorf("bob patch alice's plant = %d, want 404", w.Code)
|
|
}
|
|
}
|
|
|
|
func TestPlantsRequireAuth(t *testing.T) {
|
|
r := authEngine(t, localCfg())
|
|
if w := doJSON(t, r, http.MethodGet, "/api/v1/plants", nil, nil); w.Code != http.StatusUnauthorized {
|
|
t.Errorf("unauthenticated list = %d, want 401", w.Code)
|
|
}
|
|
}
|