236 lines
8.8 KiB
Go
236 lines
8.8 KiB
Go
|
package httpapi
|
||
|
|
|
||
|
|
import (
|
||
|
|
"io"
|
||
|
|
"io/fs"
|
||
|
|
"log/slog"
|
||
|
|
"os"
|
||
|
|
"path/filepath"
|
||
|
|
"strings"
|
||
|
|
"testing"
|
||
|
|
"testing/fstest"
|
||
|
|
"time"
|
||
|
|
|
||
|
|
"github.com/kristianwind/verdande/internal/config"
|
||
|
|
"github.com/kristianwind/verdande/internal/store"
|
||
|
|
)
|
||
|
|
|
||
|
|
// serverWithWeb builds the real router around a frontend, which newTestServerWith
|
||
|
|
// cannot do — it passes nil for the web filesystem, because every other test here
|
||
|
|
// is about the API. The renaming only happens when there is something to rename.
|
||
|
|
func serverWithWeb(t *testing.T, edition string, web fs.FS) *Server {
|
||
|
|
t.Helper()
|
||
|
|
|
||
|
|
db, err := store.Open(filepath.Join(t.TempDir(), "test.db"))
|
||
|
|
if err != nil {
|
||
|
|
t.Fatalf("open db: %v", err)
|
||
|
|
}
|
||
|
|
t.Cleanup(func() { db.Close() })
|
||
|
|
|
||
|
|
cfg := &config.Config{
|
||
|
|
BaseURL: "http://localhost",
|
||
|
|
DataDir: t.TempDir(),
|
||
|
|
SessionTTL: 24 * time.Hour,
|
||
|
|
Edition: edition,
|
||
|
|
}
|
||
|
|
return New(cfg, db, slog.New(slog.NewTextHandler(io.Discard, nil)), web)
|
||
|
|
}
|
||
|
|
|
||
|
|
// The shell as the frontend build produces it, cut down to the parts that matter
|
||
|
|
// here: the two anchors that get renamed, and the inline theme script that must
|
||
|
|
// not be touched. TestAppHTMLStillCarriesTheAnchors below is what keeps this
|
||
|
|
// honest against the real file.
|
||
|
|
const builtShell = `<!doctype html>
|
||
|
|
<html lang="da" data-theme="dark">
|
||
|
|
<head>
|
||
|
|
<meta name="description" content="verdande — opgaver og projekter, delt." />
|
||
|
|
<link rel="manifest" href="/manifest.webmanifest" />
|
||
|
|
<title>verdande</title>
|
||
|
|
<script>
|
||
|
|
try {
|
||
|
|
const stored = localStorage.getItem('verdande:theme');
|
||
|
|
const look = localStorage.getItem('verdande:look');
|
||
|
|
if (look && look !== 'verdande') document.documentElement.dataset.look = look;
|
||
|
|
} catch (e) {}
|
||
|
|
</script>
|
||
|
|
</head>
|
||
|
|
<body></body>
|
||
|
|
</html>
|
||
|
|
`
|
||
|
|
|
||
|
|
const builtManifest = `{
|
||
|
|
"name": "verdande",
|
||
|
|
"short_name": "verdande",
|
||
|
|
"description": "Opgaver og projekter, delt.",
|
||
|
|
"start_url": "/"
|
||
|
|
}
|
||
|
|
`
|
||
|
|
|
||
|
|
func builtWeb() fstest.MapFS {
|
||
|
|
return fstest.MapFS{
|
||
|
|
"index.html": {Data: []byte(builtShell)},
|
||
|
|
"manifest.webmanifest": {Data: []byte(builtManifest)},
|
||
|
|
"_app/immutable/app.js": {Data: []byte("// app")},
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
// TestRenamingTheShellLeavesTheStorageKeysAlone is the one this file exists for.
|
||
|
|
//
|
||
|
|
// The product name and the localStorage prefix are the same word in app.html, and
|
||
|
|
// they are not the same thing: the prefix is read back by the app itself, so
|
||
|
|
// renaming it here and nowhere else sets the theme from one key and reads it from
|
||
|
|
// another. The symptom is the white flash on load that the inline script exists to
|
||
|
|
// prevent — which is to say, no error, nothing in a log, and nothing a test that
|
||
|
|
// merely checked the title would see.
|
||
|
|
func TestRenamingTheShellLeavesTheStorageKeysAlone(t *testing.T) {
|
||
|
|
shell, manifest, err := rebrandedAssets(builtWeb(), "urd", "urd — noter, delt.", "Noter, delt.")
|
||
|
|
if err != nil {
|
||
|
|
t.Fatalf("rebrandedAssets: %v", err)
|
||
|
|
}
|
||
|
|
|
||
|
|
got := string(shell)
|
||
|
|
for _, want := range []string{
|
||
|
|
"<title>urd</title>",
|
||
|
|
`content="urd — noter, delt."`,
|
||
|
|
} {
|
||
|
|
if !strings.Contains(got, want) {
|
||
|
|
t.Errorf("the shell does not contain %q", want)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
// Named values rather than "no occurrences of verdande": the three keys are
|
||
|
|
// what has to survive, so the assertion says the three keys.
|
||
|
|
for _, want := range []string{
|
||
|
|
`localStorage.getItem('verdande:theme')`,
|
||
|
|
`localStorage.getItem('verdande:look')`,
|
||
|
|
`look !== 'verdande'`,
|
||
|
|
} {
|
||
|
|
if !strings.Contains(got, want) {
|
||
|
|
t.Errorf("renaming the shell changed a storage key: %q is gone", want)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
if strings.Contains(got, "urd:theme") || strings.Contains(got, "urd:look") {
|
||
|
|
t.Error("renaming the shell rewrote a localStorage prefix; the app reads the verdande: ones")
|
||
|
|
}
|
||
|
|
|
||
|
|
gotManifest := string(manifest)
|
||
|
|
for _, want := range []string{`"name": "urd"`, `"short_name": "urd"`, `"description": "Noter, delt."`} {
|
||
|
|
if !strings.Contains(gotManifest, want) {
|
||
|
|
t.Errorf("the manifest does not contain %q", want)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
// TestRenamingTheShellKeepsTheCSPHashValid pins the relationship between the two
|
||
|
|
// files that is easy to break and impossible to notice: the policy names a hash of
|
||
|
|
// the inline script, and the renamed shell is what gets served. If a replacement
|
||
|
|
// ever reached inside the <script>, the hash would change, the browser would refuse
|
||
|
|
// to run it, and the page would be blank — in production only, because the policy
|
||
|
|
// is not enforced for a page opened from a file.
|
||
|
|
func TestRenamingTheShellKeepsTheCSPHashValid(t *testing.T) {
|
||
|
|
shell, _, err := rebrandedAssets(builtWeb(), "urd", "urd — noter, delt.", "Noter, delt.")
|
||
|
|
if err != nil {
|
||
|
|
t.Fatalf("rebrandedAssets: %v", err)
|
||
|
|
}
|
||
|
|
|
||
|
|
before := scriptHashesIn([]byte(builtShell))
|
||
|
|
after := scriptHashesIn(shell)
|
||
|
|
if len(before) != 1 {
|
||
|
|
t.Fatalf("the fixture should have exactly one inline script, found %d", len(before))
|
||
|
|
}
|
||
|
|
if len(after) != len(before) || after[0] != before[0] {
|
||
|
|
t.Errorf("renaming changed the inline script: policy had %v, served shell hashes to %v", before, after)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
// TestRenamingRefusesAMissingAnchor is the direction that matters more than the
|
||
|
|
// happy path. A replacement that silently matched nothing leaves an Urd instance
|
||
|
|
// calling itself verdande, which is cosmetic enough that nobody reports it — so the
|
||
|
|
// rewrite has to say so rather than return what it managed.
|
||
|
|
func TestRenamingRefusesAMissingAnchor(t *testing.T) {
|
||
|
|
cases := map[string]fstest.MapFS{
|
||
|
|
"no title": {
|
||
|
|
"index.html": {Data: []byte(strings.Replace(builtShell, "<title>verdande</title>", "<title>something else</title>", 1))},
|
||
|
|
"manifest.webmanifest": {Data: []byte(builtManifest)},
|
||
|
|
},
|
||
|
|
"no description": {
|
||
|
|
"index.html": {Data: []byte(strings.Replace(builtShell, `content="verdande — opgaver og projekter, delt."`, `content="other"`, 1))},
|
||
|
|
"manifest.webmanifest": {Data: []byte(builtManifest)},
|
||
|
|
},
|
||
|
|
"no manifest name": {
|
||
|
|
"index.html": {Data: []byte(builtShell)},
|
||
|
|
"manifest.webmanifest": {Data: []byte(strings.Replace(builtManifest, `"name": "verdande"`, `"name": "other"`, 1))},
|
||
|
|
},
|
||
|
|
"no index.html at all": {
|
||
|
|
"manifest.webmanifest": {Data: []byte(builtManifest)},
|
||
|
|
},
|
||
|
|
"no manifest at all": {
|
||
|
|
"index.html": {Data: []byte(builtShell)},
|
||
|
|
},
|
||
|
|
}
|
||
|
|
for name, web := range cases {
|
||
|
|
t.Run(name, func(t *testing.T) {
|
||
|
|
if _, _, err := rebrandedAssets(web, "urd", "d", "m"); err == nil {
|
||
|
|
t.Error("renaming reported success over a shell it could not rename")
|
||
|
|
}
|
||
|
|
})
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
// TestAppHTMLStillCarriesTheAnchors is what stops the fixture above from becoming a
|
||
|
|
// frozen copy of a file that has moved on.
|
||
|
|
//
|
||
|
|
// The anchors are exact strings in web/src/app.html, and that file is edited for
|
||
|
|
// unrelated reasons — a meta tag, a new theme attribute. An edit that reformats the
|
||
|
|
// title line or rewrites the description breaks the rename and nothing in Go would
|
||
|
|
// know, because the Go build graph has never heard of app.html.
|
||
|
|
//
|
||
|
|
// Note the caching trap that comes with reading a non-Go file from a test: `go
|
||
|
|
// test` will serve a cached green over a changed app.html. CI passes -count=1 in
|
||
|
|
// both workflows; a local run needs it typed.
|
||
|
|
func TestAppHTMLStillCarriesTheAnchors(t *testing.T) {
|
||
|
|
raw, err := os.ReadFile("../../web/src/app.html")
|
||
|
|
if err != nil {
|
||
|
|
t.Skipf("app.html is not reachable from here: %v", err)
|
||
|
|
}
|
||
|
|
src := string(raw)
|
||
|
|
|
||
|
|
for _, pair := range shellRebrands("urd", "d") {
|
||
|
|
if n := strings.Count(src, pair.old); n != 1 {
|
||
|
|
t.Errorf("web/src/app.html contains %d occurrences of the anchor %q, want exactly 1 — "+
|
||
|
|
"the notes edition renames the shell by replacing it", n, pair.old)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
// And the keys the rename must not touch, asserted here too: app.html is where
|
||
|
|
// somebody would rename them, and if they are renamed there they must be
|
||
|
|
// renamed in stores.svelte.js in the same commit.
|
||
|
|
if !strings.Contains(src, `localStorage.getItem('verdande:theme')`) {
|
||
|
|
t.Error("web/src/app.html no longer reads verdande:theme; check that the app reads the same key")
|
||
|
|
}
|
||
|
|
t.Logf("app.html: %d bytes, %d anchors found", len(raw), len(shellRebrands("urd", "d")))
|
||
|
|
}
|
||
|
|
|
||
|
|
// TestTheFullEditionServesTheBuiltFilesUnchanged is the control. Everything above
|
||
|
|
// is about the renamed path; this says the other edition does not go through it.
|
||
|
|
func TestTheFullEditionServesTheBuiltFilesUnchanged(t *testing.T) {
|
||
|
|
for _, edition := range []string{"full", "notes"} {
|
||
|
|
t.Run(edition, func(t *testing.T) {
|
||
|
|
srv := serverWithWeb(t, edition, builtWeb())
|
||
|
|
if edition == "full" {
|
||
|
|
if srv.renamed("index.html") != nil || srv.renamed("manifest.webmanifest") != nil {
|
||
|
|
t.Error("the full edition renamed the shell")
|
||
|
|
}
|
||
|
|
return
|
||
|
|
}
|
||
|
|
if srv.renamed("index.html") == nil || srv.renamed("manifest.webmanifest") == nil {
|
||
|
|
t.Fatal("the notes edition did not rename the shell")
|
||
|
|
}
|
||
|
|
if !strings.Contains(string(srv.renamed("index.html")), "<title>urd</title>") {
|
||
|
|
t.Error("the notes edition's shell does not say urd")
|
||
|
|
}
|
||
|
|
if srv.renamed("_app/immutable/app.js") != nil {
|
||
|
|
t.Error("a build asset was served from memory; only the shell and the manifest are renamed")
|
||
|
|
}
|
||
|
|
})
|
||
|
|
}
|
||
|
|
}
|