changing layout

internal/web/handlers_test.go

@@ -0,0 +1,81 @@
+package web
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/example/cms/internal/domain"
+	"github.com/example/cms/internal/security"
+)
+
+type fakeContent struct{ updated bool }
+
+func (f *fakeContent) List(context.Context, int, int, string, string, []string) ([]domain.Content, error) {
+	return nil, nil
+}
+func (f *fakeContent) ListCategories(context.Context) ([]domain.Category, error) { return nil, nil }
+func (f *fakeContent) ListBadges(context.Context) ([]domain.Badge, error)        { return nil, nil }
+func (f *fakeContent) Get(context.Context, string) (domain.Content, error) {
+	return domain.Content{Slug: "post", Title: "Post", Body: "body"}, nil
+}
+func (f *fakeContent) Update(_ context.Context, c domain.Content) (domain.Content, error) {
+	f.updated = true
+	return c, nil
+}
+
+func newTestRoutes(content *fakeContent) http.Handler {
+	return NewHandler(content, security.NewSSOTokenVerifier("X-SSO-Token", "", "")).Routes("http://localhost:5173")
+}
+
+func TestAnonymousCanReadButNotEdit(t *testing.T) {
+	content := &fakeContent{}
+	routes := newTestRoutes(content)
+
+	get := httptest.NewRecorder()
+	routes.ServeHTTP(get, httptest.NewRequest(http.MethodGet, "/api/content/post", nil))
+	if get.Code != http.StatusOK {
+		t.Fatalf("anonymous read status = %d, want %d", get.Code, http.StatusOK)
+	}
+
+	put := httptest.NewRecorder()
+	routes.ServeHTTP(put, httptest.NewRequest(http.MethodPut, "/api/content/post", strings.NewReader(`{"title":"T","body":"B"}`)))
+	if put.Code != http.StatusUnauthorized {
+		t.Fatalf("anonymous update status = %d, want %d", put.Code, http.StatusUnauthorized)
+	}
+	if content.updated {
+		t.Fatal("anonymous request must not reach the content service")
+	}
+
+	session := httptest.NewRecorder()
+	routes.ServeHTTP(session, httptest.NewRequest(http.MethodGet, "/api/auth/session", nil))
+	if !strings.Contains(session.Body.String(), `"authenticated":false`) {
+		t.Fatalf("anonymous session = %s", session.Body.String())
+	}
+}
+
+func TestProxyIdentityCanEdit(t *testing.T) {
+	content := &fakeContent{}
+	routes := newTestRoutes(content)
+
+	put := httptest.NewRequest(http.MethodPut, "/api/content/post", strings.NewReader(`{"title":"T","body":"B"}`))
+	put.Header.Set("X-SSO-Token", "owner-token")
+	putRec := httptest.NewRecorder()
+	routes.ServeHTTP(putRec, put)
+	if putRec.Code != http.StatusOK {
+		t.Fatalf("owner update status = %d, body = %s", putRec.Code, putRec.Body.String())
+	}
+	if !content.updated {
+		t.Fatal("owner request must reach the content service")
+	}
+
+	session := httptest.NewRequest(http.MethodGet, "/api/auth/session", nil)
+	session.Header.Set("X-SSO-Token", "owner-token")
+	sessionRec := httptest.NewRecorder()
+	routes.ServeHTTP(sessionRec, session)
+	if !strings.Contains(sessionRec.Body.String(), `"canEdit":true`) {
+		t.Fatalf("owner session = %s", sessionRec.Body.String())
+	}
+}