Added user profile page, prepped for TOTP 2fa

2026-07-16 22:13:54 +02:00
parent 63deb02d39
commit c8f47768a3
11 changed files with 850 additions and 15 deletions
@@ -0,0 +1,157 @@
+package api
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"codeberg.org/SquidSE/ClusterCanvas/service/internal/settings"
+)
+
+type securityResponseTest struct {
+	Security settings.SecuritySettings `json:"security"`
+}
+
+func TestSecurityGetReturnsDefaultsWhenMissing(t *testing.T) {
+	t.Parallel()
+
+	configDir := t.TempDir()
+	router := NewRouter(configDir)
+
+	request := httptest.NewRequest(http.MethodGet, "/api/v1/security", nil)
+	recorder := httptest.NewRecorder()
+	router.ServeHTTP(recorder, request)
+
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("expected status %d, got %d", http.StatusOK, recorder.Code)
+	}
+
+	var payload securityResponseTest
+	if err := json.NewDecoder(recorder.Body).Decode(&payload); err != nil {
+		t.Fatalf("decode response: %v", err)
+	}
+
+	want := settings.DefaultSecuritySettings()
+	if payload.Security != want {
+		t.Fatalf("got %#v, want %#v", payload.Security, want)
+	}
+}
+
+func TestSecurityPutRejectsIdleTimeoutZero(t *testing.T) {
+	t.Parallel()
+
+	configDir := t.TempDir()
+	router := NewRouter(configDir)
+
+	body := []byte(`{
+		"security": {
+			"idle_timeout_minutes": 0,
+			"session_lifetime_hours": 24,
+			"reauth_sensitive_actions": false,
+			"reauth_grace_minutes": 15
+		}
+	}`)
+	request := httptest.NewRequest(http.MethodPut, "/api/v1/security", bytes.NewReader(body))
+	recorder := httptest.NewRecorder()
+	router.ServeHTTP(recorder, request)
+
+	if recorder.Code != http.StatusBadRequest {
+		t.Fatalf("expected status %d, got %d", http.StatusBadRequest, recorder.Code)
+	}
+}
+
+func TestSecurityPutRejectsIdleTimeoutAboveMax(t *testing.T) {
+	t.Parallel()
+
+	configDir := t.TempDir()
+	router := NewRouter(configDir)
+
+	body := []byte(`{
+		"security": {
+			"idle_timeout_minutes": 241,
+			"session_lifetime_hours": 24,
+			"reauth_sensitive_actions": false,
+			"reauth_grace_minutes": 15
+		}
+	}`)
+	request := httptest.NewRequest(http.MethodPut, "/api/v1/security", bytes.NewReader(body))
+	recorder := httptest.NewRecorder()
+	router.ServeHTTP(recorder, request)
+
+	if recorder.Code != http.StatusBadRequest {
+		t.Fatalf("expected status %d, got %d", http.StatusBadRequest, recorder.Code)
+	}
+}
+
+func TestSecurityPutRejectsSessionLifetimeZero(t *testing.T) {
+	t.Parallel()
+
+	configDir := t.TempDir()
+	router := NewRouter(configDir)
+
+	body := []byte(`{
+		"security": {
+			"idle_timeout_minutes": 30,
+			"session_lifetime_hours": 0,
+			"reauth_sensitive_actions": false,
+			"reauth_grace_minutes": 15
+		}
+	}`)
+	request := httptest.NewRequest(http.MethodPut, "/api/v1/security", bytes.NewReader(body))
+	recorder := httptest.NewRecorder()
+	router.ServeHTTP(recorder, request)
+
+	if recorder.Code != http.StatusBadRequest {
+		t.Fatalf("expected status %d, got %d", http.StatusBadRequest, recorder.Code)
+	}
+}
+
+func TestSecurityPutRoundTrip(t *testing.T) {
+	t.Parallel()
+
+	configDir := t.TempDir()
+	router := NewRouter(configDir)
+
+	body := []byte(`{
+		"security": {
+			"idle_timeout_minutes": 45,
+			"session_lifetime_hours": 12,
+			"reauth_sensitive_actions": true,
+			"reauth_grace_minutes": 0,
+			"totp_enabled": true
+		}
+	}`)
+	putReq := httptest.NewRequest(http.MethodPut, "/api/v1/security", bytes.NewReader(body))
+	putRec := httptest.NewRecorder()
+	router.ServeHTTP(putRec, putReq)
+
+	if putRec.Code != http.StatusOK {
+		t.Fatalf("expected status %d, got %d", http.StatusOK, putRec.Code)
+	}
+
+	getReq := httptest.NewRequest(http.MethodGet, "/api/v1/security", nil)
+	getRec := httptest.NewRecorder()
+	router.ServeHTTP(getRec, getReq)
+
+	if getRec.Code != http.StatusOK {
+		t.Fatalf("expected status %d, got %d", http.StatusOK, getRec.Code)
+	}
+
+	var payload securityResponseTest
+	if err := json.NewDecoder(getRec.Body).Decode(&payload); err != nil {
+		t.Fatalf("decode response: %v", err)
+	}
+
+	want := settings.SecuritySettings{
+		IdleTimeoutMinutes:     45,
+		SessionLifetimeHours:     12,
+		ReauthSensitiveActions: true,
+		ReauthGraceMinutes:     0,
+		TotpEnabled:            true,
+	}
+	if payload.Security != want {
+		t.Fatalf("got %#v, want %#v", payload.Security, want)
+	}
+}