/home/mrjunejune/zenbu: mrjunejune/test/admin_api

annotate mrjunejune/test/admin_api_test.c @ 279:b3b547563ec7

Add Google connector service and agent wiki Implement the C/Seobeo Google Drive and Gmail connector with encrypted OAuth storage, Zenbu authentication, browser testing, AI tool discovery, chunked HTTP decoding, and Bazel coverage. Consolidate repository guidance into progressive wiki documentation and enforce arena-first allocation for new first-party C code. Co-authored-by: Copilot <[email protected]> Copilot-Session: 84c338fd-0939-4bb3-b7f3-1062eb213e5d

author	MrJuneJune <me@mrjunejune.com>
date	Mon, 17 Aug 2026 22:22:36 -0700
parents	04fee26ecce0
children

rev	line source
264 04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1 /*
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	2 * admin_api_test.c — unit tests for the admin API handlers.
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	3 *
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	4 * Tests run in-process against real store + crypto (no network).
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	5 * A fresh SQLite database is created per group.
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	6 */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	7
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	8 #include "mrjunejune/admin_api.h"
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	9 #include "mrjunejune/auth_api.h"
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	10
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	11 #include "auth/auth_crypto.h"
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	12 #include "auth/auth_store.h"
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	13 #include "deita/deita.h"
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	14 #include "dowa/dowa.h"
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	15 #include "seobeo/seobeo.h"
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	16
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	17 #include <assert.h>
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	18 #include <stdarg.h>
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	19 #include <stdio.h>
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	20 #include <string.h>
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	21 #include <stdlib.h>
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	22 #include <unistd.h>
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	23
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	24 #include <openssl/crypto.h>
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	25
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	26 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	27 /* Utilities */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	28 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	29
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	30 #define ASSERT(cond) \
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	31 do { \
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	32 if (!(cond)) { \
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	33 fprintf(stderr, "FAIL [%s:%d]: %s\n", __FILE__, __LINE__, #cond); \
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	34 abort(); \
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	35 } \
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	36 } while (0)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	37
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	38 #define TEST(name) \
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	39 do { fprintf(stdout, " %-60s", name); fflush(stdout); } while (0)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	40
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	41 #define PASS() \
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	42 do { fprintf(stdout, "PASS\n"); } while (0)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	43
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	44 static const uint8 k_secret[64] = {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	45 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	46 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	47 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	48 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, 0x20,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	49 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 0x28,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	50 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f, 0x30,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	51 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	52 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f, 0x40,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	53 };
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	54
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	55 static void make_temp_db(char *out, size_t capacity)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	56 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	57 snprintf(out, capacity, "/tmp/admin_api_test_XXXXXX");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	58 int fd = mkstemp(out);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	59 ASSERT(fd >= 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	60 close(fd);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	61 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	62
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	63 static void init_auth(const char *db)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	64 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	65 boolean ok = Auth_API_Init(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	66 db, k_secret, sizeof(k_secret),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	67 NULL, NULL, NULL,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	68 AUTH_API_SESSION_IDLE_TTL_DEFAULT,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	69 AUTH_API_SESSION_ABS_TTL_DEFAULT,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	70 AUTH_API_GUEST_TTL_DEFAULT,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	71 TRUE); /* dev_insecure_cookie */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	72 ASSERT(ok);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	73 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	74
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	75 static Seobeo_Request_Entry make_request(Dowa_Arena arena, ...)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	76 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	77 Seobeo_Request_Entry *req = NULL;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	78 va_list ap;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	79 va_start(ap, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	80 const char *key;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	81 while ((key = va_arg(ap, const char *)) != NULL)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	82 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	83 char k = (char )key;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	84 const char val = va_arg(ap, const char );
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	85 char stored = (char )val;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	86 if (strcmp(key, "Body") == 0)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	87 stored = Dowa_Arena_Copy(arena, val, strlen(val) + 1);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	88 Dowa_HashMap_Push_Arena(req, k, stored, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	89 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	90 va_end(ap);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	91 return req;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	92 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	93
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	94 static const char resp_status(Seobeo_Request_Entry resp)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	95 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	96 void *p = Dowa_HashMap_Get_Ptr(resp, "status");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	97 return p ? ((Seobeo_Request_Entry *)p)->value : NULL;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	98 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	99
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	100 static const char resp_body(Seobeo_Request_Entry resp)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	101 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	102 void *p = Dowa_HashMap_Get_Ptr(resp, "body");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	103 return p ? ((Seobeo_Request_Entry *)p)->value : NULL;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	104 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	105
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	106 /*
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	107 * Create a user and return the new user_id.
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	108 * Hash a real password so the store accepts it.
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	109 */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	110 static boolean create_test_user(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	111 Auth_Store *store,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	112 const char *username,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	113 const char *password,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	114 const char *role,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	115 boolean must_change,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	116 char id_out[37])
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	117 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	118 char hash[AUTH_CRYPTO_PASSWORD_HASH_ENCODED_SIZE];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	119 if (Auth_Crypto_Password_Hash(password, hash, sizeof(hash)) != AUTH_CRYPTO_OK)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	120 return FALSE;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	121 Auth_Store_Result r = Auth_Store_Create_User(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	122 store, username, hash, role, must_change, id_out);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	123 OPENSSL_cleanse(hash, sizeof(hash));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	124 return r == AUTH_STORE_OK;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	125 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	126
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	127 /*
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	128 * Login as a user and return the session cookie value + CSRF token.
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	129 * Returns TRUE on success.
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	130 */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	131 static boolean login_user(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	132 Dowa_Arena *arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	133 const char *username,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	134 const char *password,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	135 char session_cookie_out[],
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	136 size_t cookie_cap,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	137 char csrf_out[],
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	138 size_t csrf_cap)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	139 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	140 /* 1. Get a guest session to obtain a CSRF token + guest cookie. */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	141 Seobeo_Request_Entry *sess_req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	142 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	143 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	144 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	145 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	146 Seobeo_Request_Entry *sess_resp =
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	147 Auth_API_Test_Session_Handler(sess_req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	148 const char *sess_body = resp_body(sess_resp);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	149 ASSERT(sess_body);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	150
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	151 /* Extract csrfToken from session response. */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	152 const char *csrf_start = strstr(sess_body, "\"csrfToken\":\"");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	153 ASSERT(csrf_start);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	154 csrf_start += strlen("\"csrfToken\":\"");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	155 const char *csrf_end = strchr(csrf_start, '"');
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	156 ASSERT(csrf_end);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	157 size_t csrf_len = (size_t)(csrf_end - csrf_start);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	158 ASSERT(csrf_len < csrf_cap);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	159 memcpy(csrf_out, csrf_start, csrf_len);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	160 csrf_out[csrf_len] = '\0';
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	161
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	162 /* Extract the guest cookie from Set-Cookie to send with login. */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	163 char guest_cookie_val[512] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	164 void *sc_kv = Dowa_HashMap_Get_Ptr(sess_resp, "Set-Cookie");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	165 if (sc_kv)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	166 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	167 const char sc_hdr = ((Seobeo_Request_Entry )sc_kv)->value;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	168 const char *gc_start = strstr(sc_hdr, "mjj_guest=");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	169 if (gc_start)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	170 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	171 gc_start += strlen("mjj_guest=");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	172 const char *gc_end = strchr(gc_start, ';');
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	173 size_t gclen = gc_end
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	174 ? (size_t)(gc_end - gc_start)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	175 : strlen(gc_start);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	176 if (gclen < sizeof(guest_cookie_val))
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	177 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	178 memcpy(guest_cookie_val, gc_start, gclen);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	179 guest_cookie_val[gclen] = '\0';
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	180 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	181 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	182 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	183
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	184 /* 2. Call login with the guest cookie so Resolve_Principal finds the same guest. */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	185 char login_body[512];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	186 snprintf(login_body, sizeof(login_body),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	187 "{\"username\":\"%s\",\"password\":\"%s\",\"csrfToken\":\"%s\"}",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	188 username, password, csrf_out);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	189
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	190 char cookie_hdr[512] = {0};
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	191 if (guest_cookie_val[0] != '\0')
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	192 snprintf(cookie_hdr, sizeof(cookie_hdr),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	193 "mjj_guest=%s", guest_cookie_val);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	194
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	195 Seobeo_Request_Entry *login_req;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	196 if (cookie_hdr[0] != '\0')
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	197 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	198 login_req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	199 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	200 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	201 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	202 "Origin", "http://localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	203 "Cookie", cookie_hdr,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	204 "Body", login_body,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	205 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	206 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	207 else
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	208 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	209 login_req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	210 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	211 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	212 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	213 "Origin", "http://localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	214 "Body", login_body,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	215 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	216 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	217
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	218 Seobeo_Request_Entry *login_resp =
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	219 Auth_API_Test_Login_Handler(login_req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	220 const char *st = resp_status(login_resp);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	221 if (!st \|\| strcmp(st, "200") != 0)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	222 return FALSE;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	223
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	224 /* 3. Extract session cookie value. */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	225 void *lsc_kv = Dowa_HashMap_Get_Ptr(login_resp, "Set-Cookie");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	226 if (!lsc_kv) return FALSE;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	227 const char lsc_hdr = ((Seobeo_Request_Entry )lsc_kv)->value;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	228 const char *cookie_start = strstr(lsc_hdr, "mjj_session=");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	229 if (!cookie_start) return FALSE;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	230 cookie_start += strlen("mjj_session=");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	231 const char *cookie_end = strchr(cookie_start, ';');
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	232 size_t clen = cookie_end
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	233 ? (size_t)(cookie_end - cookie_start)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	234 : strlen(cookie_start);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	235 ASSERT(clen < cookie_cap);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	236 memcpy(session_cookie_out, cookie_start, clen);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	237 session_cookie_out[clen] = '\0';
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	238
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	239 /* 4. Fetch a fresh CSRF from the authenticated session. */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	240 char auth_cookie_hdr[512];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	241 snprintf(auth_cookie_hdr, sizeof(auth_cookie_hdr),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	242 "mjj_session=%s", session_cookie_out);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	243 Seobeo_Request_Entry *csrfsess_req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	244 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	245 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	246 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	247 "Cookie", auth_cookie_hdr,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	248 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	249 Seobeo_Request_Entry *csrfsess_resp =
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	250 Auth_API_Test_Session_Handler(csrfsess_req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	251 const char *csrfsess_body = resp_body(csrfsess_resp);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	252 ASSERT(csrfsess_body);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	253 const char *cs2 = strstr(csrfsess_body, "\"csrfToken\":\"");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	254 ASSERT(cs2);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	255 cs2 += strlen("\"csrfToken\":\"");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	256 const char *ce2 = strchr(cs2, '"');
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	257 ASSERT(ce2);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	258 size_t cl2 = (size_t)(ce2 - cs2);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	259 ASSERT(cl2 < csrf_cap);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	260 memcpy(csrf_out, cs2, cl2);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	261 csrf_out[cl2] = '\0';
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	262
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	263 return TRUE;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	264 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	265
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	266 /* Build a request with session cookie + CSRF header + body. */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	267 static Seobeo_Request_Entry *make_admin_req(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	268 Dowa_Arena *arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	269 const char *method,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	270 const char *session_cookie,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	271 const char *csrf_token,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	272 const char *body,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	273 const char *id_param)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	274 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	275 /* Allocate cookie_hdr from arena so the pointer stays valid after return. */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	276 char *cookie_hdr = Dowa_Arena_Allocate(arena, 528);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	277 ASSERT(cookie_hdr);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	278 snprintf(cookie_hdr, 528, "mjj_session=%s", session_cookie);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	279
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	280 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	281 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	282 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	283 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	284 "Origin", "http://localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	285 "Cookie", cookie_hdr,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	286 "X-CSRF-Token", (char *)csrf_token,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	287 "Body", body ? (char *)body : "",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	288 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	289 if (id_param)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	290 Dowa_HashMap_Push_Arena(req, ":id", (char *)id_param, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	291 return req;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	292 (void)method;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	293 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	294
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	295 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	296 /* Test group: non-admin denial */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	297 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	298
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	299 static void test_non_admin_denial(void)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	300 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	301 printf("\n[non-admin denial]\n");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	302
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	303 char db[256];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	304 make_temp_db(db, sizeof(db));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	305 init_auth(db);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	306 Auth_Store *store = Auth_API_Get_Store();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	307
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	308 char member_id[37];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	309 ASSERT(create_test_user(store, "member1", "password123456", "member", FALSE, member_id));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	310
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	311 Dowa_Arena arena = Dowa_Arena_Create(128 1024);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	312
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	313 char scookie[512], csrf[512];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	314 ASSERT(login_user(arena, "member1", "password123456",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	315 scookie, sizeof(scookie), csrf, sizeof(csrf)));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	316
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	317 TEST("member cannot list users (403)");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	318 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	319 Seobeo_Request_Entry *req = make_admin_req(arena, "GET", scookie, csrf, NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	320 Seobeo_Request_Entry *resp = Admin_API_Test_List_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	321 ASSERT(strcmp(resp_status(resp), "403") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	322 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	323 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	324
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	325 TEST("member cannot create users (403)");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	326 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	327 Seobeo_Request_Entry *req = make_admin_req(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	328 arena, "POST", scookie, csrf,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	329 "{\"username\":\"hack\",\"temporaryPassword\":\"password123456\"}", NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	330 Seobeo_Request_Entry *resp = Admin_API_Test_Create_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	331 ASSERT(strcmp(resp_status(resp), "403") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	332 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	333 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	334
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	335 TEST("unauthenticated list → 401");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	336 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	337 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	338 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	339 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	340 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	341 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	342 Seobeo_Request_Entry *resp = Admin_API_Test_List_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	343 ASSERT(strcmp(resp_status(resp), "401") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	344 /* No page content must leak */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	345 const char *body = resp_body(resp);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	346 ASSERT(!body \|\| strstr(body, "password") == NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	347 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	348 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	349
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	350 TEST("unauthenticated page → redirect (not content)");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	351 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	352 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	353 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	354 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	355 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	356 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	357 Seobeo_Request_Entry *resp = Admin_API_Test_Page_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	358 const char *st = resp_status(resp);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	359 /* Must be 302 redirect; body must be empty/no admin content */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	360 ASSERT(st && (strcmp(st, "302") == 0 \|\| strcmp(st, "401") == 0));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	361 const char *body = resp_body(resp);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	362 ASSERT(!body \|\| strstr(body, "<table") == NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	363 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	364 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	365
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	366 Dowa_Arena_Free(arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	367 Auth_API_Destroy();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	368 unlink(db);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	369 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	370
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	371 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	372 /* Test group: forced-password denial */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	373 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	374
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	375 static void test_forced_password_denial(void)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	376 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	377 printf("\n[forced-password denial]\n");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	378
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	379 char db[256];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	380 make_temp_db(db, sizeof(db));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	381 init_auth(db);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	382 Auth_Store *store = Auth_API_Get_Store();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	383
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	384 char admin_id[37];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	385 ASSERT(create_test_user(store, "fadmin", "password123456", "admin", TRUE, admin_id));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	386
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	387 Dowa_Arena arena = Dowa_Arena_Create(128 1024);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	388
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	389 char scookie[512], csrf[512];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	390 ASSERT(login_user(arena, "fadmin", "password123456",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	391 scookie, sizeof(scookie), csrf, sizeof(csrf)));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	392
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	393 TEST("admin with must_change_password blocked from list (403)");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	394 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	395 Seobeo_Request_Entry *req = make_admin_req(arena, "GET", scookie, csrf, NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	396 Seobeo_Request_Entry *resp = Admin_API_Test_List_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	397 ASSERT(strcmp(resp_status(resp), "403") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	398 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	399 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	400
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	401 TEST("admin with must_change_password blocked from create (403)");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	402 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	403 Seobeo_Request_Entry *req = make_admin_req(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	404 arena, "POST", scookie, csrf,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	405 "{\"username\":\"newu\",\"temporaryPassword\":\"password123456\"}", NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	406 Seobeo_Request_Entry *resp = Admin_API_Test_Create_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	407 ASSERT(strcmp(resp_status(resp), "403") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	408 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	409 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	410
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	411 Dowa_Arena_Free(arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	412 Auth_API_Destroy();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	413 unlink(db);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	414 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	415
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	416 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	417 /* Test group: create user */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	418 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	419
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	420 static void test_create_user(void)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	421 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	422 printf("\n[create user]\n");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	423
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	424 char db[256];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	425 make_temp_db(db, sizeof(db));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	426 init_auth(db);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	427 Auth_Store *store = Auth_API_Get_Store();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	428
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	429 char admin_id[37];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	430 ASSERT(create_test_user(store, "admin1", "password123456", "admin", FALSE, admin_id));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	431
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	432 Dowa_Arena arena = Dowa_Arena_Create(128 1024);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	433 char scookie[512], csrf[512];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	434 ASSERT(login_user(arena, "admin1", "password123456",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	435 scookie, sizeof(scookie), csrf, sizeof(csrf)));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	436
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	437 TEST("create user succeeds → 201, mustChangePassword=true");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	438 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	439 Seobeo_Request_Entry *req = make_admin_req(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	440 arena, "POST", scookie, csrf,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	441 "{\"username\":\"newuser\",\"temporaryPassword\":\"temppass123456\"}", NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	442 Seobeo_Request_Entry *resp = Admin_API_Test_Create_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	443 ASSERT(strcmp(resp_status(resp), "201") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	444 const char *body = resp_body(resp);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	445 ASSERT(body && strstr(body, "\"mustChangePassword\":true") != NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	446 /* No hash/digest in response */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	447 ASSERT(strstr(body, "hash") == NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	448 ASSERT(strstr(body, "password_hash") == NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	449 ASSERT(strstr(body, "digest") == NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	450 ASSERT(strstr(body, "session") == NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	451 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	452 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	453
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	454 TEST("duplicate username → 409");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	455 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	456 Seobeo_Request_Entry *req = make_admin_req(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	457 arena, "POST", scookie, csrf,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	458 "{\"username\":\"newuser\",\"temporaryPassword\":\"temppass123456\"}", NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	459 Seobeo_Request_Entry *resp = Admin_API_Test_Create_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	460 ASSERT(strcmp(resp_status(resp), "409") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	461 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	462 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	463
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	464 TEST("short password → 400 policy error");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	465 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	466 Seobeo_Request_Entry *req = make_admin_req(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	467 arena, "POST", scookie, csrf,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	468 "{\"username\":\"shortpw\",\"temporaryPassword\":\"tooshort\"}", NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	469 Seobeo_Request_Entry *resp = Admin_API_Test_Create_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	470 ASSERT(strcmp(resp_status(resp), "400") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	471 const char *body = resp_body(resp);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	472 ASSERT(body && strstr(body, "password_policy") != NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	473 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	474 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	475
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	476 TEST("invalid role → 400");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	477 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	478 Seobeo_Request_Entry *req = make_admin_req(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	479 arena, "POST", scookie, csrf,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	480 "{\"username\":\"badrole\",\"temporaryPassword\":\"temppass123456\",\"role\":\"superuser\"}", NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	481 Seobeo_Request_Entry *resp = Admin_API_Test_Create_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	482 ASSERT(strcmp(resp_status(resp), "400") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	483 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	484 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	485
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	486 TEST("CSRF rejection → 403");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	487 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	488 char bad_cookie_hdr[512];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	489 snprintf(bad_cookie_hdr, sizeof(bad_cookie_hdr), "mjj_session=%s", scookie);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	490 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	491 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	492 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	493 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	494 "Origin", "http://localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	495 "Cookie", bad_cookie_hdr,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	496 "X-CSRF-Token", "BADCSRF",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	497 "Body", "{\"username\":\"x\",\"temporaryPassword\":\"temppass123456\"}",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	498 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	499 Seobeo_Request_Entry *resp = Admin_API_Test_Create_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	500 ASSERT(strcmp(resp_status(resp), "403") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	501 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	502 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	503
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	504 TEST("origin rejection → 403");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	505 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	506 char cookie_hdr[512];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	507 snprintf(cookie_hdr, sizeof(cookie_hdr), "mjj_session=%s", scookie);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	508 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	509 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	510 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	511 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	512 "Origin", "http://evil.com",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	513 "Cookie", cookie_hdr,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	514 "X-CSRF-Token", csrf,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	515 "Body", "{\"username\":\"y\",\"temporaryPassword\":\"temppass123456\"}",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	516 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	517 Seobeo_Request_Entry *resp = Admin_API_Test_Create_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	518 ASSERT(strcmp(resp_status(resp), "403") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	519 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	520 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	521
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	522 TEST("audit insertion failure rolls back user creation");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	523 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	524 Deita_Connection *connection = Deita_Connection_Create(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	525 DEITA_DATABASE_TYPE_SQLITE3, db);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	526 ASSERT(connection);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	527 ASSERT(Deita_Query_Execute_Update(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	528 connection,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	529 "CREATE TRIGGER fail_admin_api_audit"
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	530 " BEFORE INSERT ON admin_audit_log"
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	531 " BEGIN SELECT RAISE(ABORT, 'forced audit failure'); END") >= 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	532 Deita_Connection_Close(connection);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	533
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	534 Seobeo_Request_Entry *req = make_admin_req(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	535 arena, "POST", scookie, csrf,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	536 "{\"username\":\"auditfail\","
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	537 "\"temporaryPassword\":\"temppass123456\"}",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	538 NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	539 Seobeo_Request_Entry *resp = Admin_API_Test_Create_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	540 ASSERT(strcmp(resp_status(resp), "500") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	541
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	542 Auth_User_Auth_Record record;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	543 memset(&record, 0, sizeof(record));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	544 ASSERT(Auth_Store_Find_User_By_Username(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	545 store, "auditfail", &record) == AUTH_STORE_NOT_FOUND);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	546
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	547 connection = Deita_Connection_Create(DEITA_DATABASE_TYPE_SQLITE3, db);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	548 ASSERT(connection);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	549 ASSERT(Deita_Query_Execute_Update(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	550 connection, "DROP TRIGGER fail_admin_api_audit") >= 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	551 Deita_Connection_Close(connection);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	552 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	553 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	554
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	555 Dowa_Arena_Free(arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	556 Auth_API_Destroy();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	557 unlink(db);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	558 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	559
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	560 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	561 /* Test group: enable/disable */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	562 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	563
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	564 static void test_enable_disable(void)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	565 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	566 printf("\n[enable/disable]\n");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	567
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	568 char db[256];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	569 make_temp_db(db, sizeof(db));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	570 init_auth(db);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	571 Auth_Store *store = Auth_API_Get_Store();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	572
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	573 char admin_id[37], user_id[37];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	574 ASSERT(create_test_user(store, "admin1", "password123456", "admin", FALSE, admin_id));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	575 ASSERT(create_test_user(store, "user1", "password123456", "member", FALSE, user_id));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	576
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	577 Dowa_Arena arena = Dowa_Arena_Create(128 1024);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	578 char scookie[512], csrf[512];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	579 ASSERT(login_user(arena, "admin1", "password123456",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	580 scookie, sizeof(scookie), csrf, sizeof(csrf)));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	581
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	582 const char *user_token_digest =
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	583 "1111111111111111111111111111111111111111111111111111111111111111";
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	584 const char *user_csrf_digest =
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	585 "2222222222222222222222222222222222222222222222222222222222222222";
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	586 int64 session_now = (int64)time(NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	587 Auth_Session_Record user_session;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	588 ASSERT(Auth_Store_Create_Session(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	589 store, user_id, user_token_digest, user_csrf_digest,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	590 3600, 86400, session_now, &user_session) == AUTH_STORE_OK);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	591
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	592 TEST("disable user → 200, status=disabled");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	593 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	594 Seobeo_Request_Entry *req = make_admin_req(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	595 arena, "PATCH", scookie, csrf, "{\"op\":\"disable\"}", user_id);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	596 Seobeo_Request_Entry *resp = Admin_API_Test_Update_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	597 ASSERT(strcmp(resp_status(resp), "200") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	598 const char *body = resp_body(resp);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	599 ASSERT(body && strstr(body, "\"status\":\"disabled\"") != NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	600 Auth_Session_Record found_session;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	601 Auth_User_Record found_user;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	602 ASSERT(Auth_Store_Find_Session(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	603 store, user_token_digest, session_now + 1,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	604 &found_session, &found_user) == AUTH_STORE_REVOKED);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	605 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	606 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	607
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	608 TEST("enable user → 200, status=active");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	609 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	610 Seobeo_Request_Entry *req = make_admin_req(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	611 arena, "PATCH", scookie, csrf, "{\"op\":\"enable\"}", user_id);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	612 Seobeo_Request_Entry *resp = Admin_API_Test_Update_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	613 ASSERT(strcmp(resp_status(resp), "200") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	614 const char *body = resp_body(resp);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	615 ASSERT(body && strstr(body, "\"status\":\"active\"") != NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	616 Auth_Session_Record found_session;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	617 Auth_User_Record found_user;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	618 ASSERT(Auth_Store_Find_Session(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	619 store, user_token_digest, session_now + 2,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	620 &found_session, &found_user) == AUTH_STORE_REVOKED);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	621 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	622 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	623
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	624 TEST("disable last active admin → 409 last_admin");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	625 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	626 /* admin1 is the only admin */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	627 Seobeo_Request_Entry *req = make_admin_req(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	628 arena, "PATCH", scookie, csrf, "{\"op\":\"disable\"}", admin_id);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	629 Seobeo_Request_Entry *resp = Admin_API_Test_Update_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	630 ASSERT(strcmp(resp_status(resp), "409") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	631 const char *body = resp_body(resp);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	632 ASSERT(body && strstr(body, "last_admin") != NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	633 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	634 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	635
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	636 TEST("response body contains no secrets");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	637 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	638 Seobeo_Request_Entry *req = make_admin_req(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	639 arena, "PATCH", scookie, csrf, "{\"op\":\"enable\"}", user_id);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	640 Seobeo_Request_Entry *resp = Admin_API_Test_Update_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	641 const char *body = resp_body(resp);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	642 ASSERT(body && strstr(body, "hash") == NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	643 ASSERT(body && strstr(body, "digest") == NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	644 ASSERT(body && strstr(body, "session") == NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	645 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	646 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	647
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	648 Dowa_Arena_Free(arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	649 Auth_API_Destroy();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	650 unlink(db);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	651 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	652
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	653 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	654 /* Test group: role update */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	655 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	656
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	657 static void test_role_update(void)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	658 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	659 printf("\n[role update]\n");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	660
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	661 char db[256];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	662 make_temp_db(db, sizeof(db));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	663 init_auth(db);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	664 Auth_Store *store = Auth_API_Get_Store();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	665
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	666 char admin_id[37], user_id[37];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	667 ASSERT(create_test_user(store, "admin1", "password123456", "admin", FALSE, admin_id));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	668 ASSERT(create_test_user(store, "user1", "password123456", "member", FALSE, user_id));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	669
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	670 Dowa_Arena arena = Dowa_Arena_Create(128 1024);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	671 char scookie[512], csrf[512];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	672 ASSERT(login_user(arena, "admin1", "password123456",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	673 scookie, sizeof(scookie), csrf, sizeof(csrf)));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	674
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	675 TEST("promote member to admin → 200");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	676 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	677 Seobeo_Request_Entry *req = make_admin_req(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	678 arena, "PATCH", scookie, csrf,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	679 "{\"op\":\"set_role\",\"role\":\"admin\"}", user_id);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	680 Seobeo_Request_Entry *resp = Admin_API_Test_Update_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	681 ASSERT(strcmp(resp_status(resp), "200") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	682 ASSERT(strstr(resp_body(resp), "\"role\":\"admin\"") != NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	683 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	684 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	685
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	686 TEST("demote admin to member → 200 (2 admins → safe)");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	687 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	688 Seobeo_Request_Entry *req = make_admin_req(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	689 arena, "PATCH", scookie, csrf,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	690 "{\"op\":\"set_role\",\"role\":\"member\"}", user_id);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	691 Seobeo_Request_Entry *resp = Admin_API_Test_Update_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	692 ASSERT(strcmp(resp_status(resp), "200") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	693 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	694 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	695
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	696 TEST("demote last admin → 409");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	697 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	698 Seobeo_Request_Entry *req = make_admin_req(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	699 arena, "PATCH", scookie, csrf,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	700 "{\"op\":\"set_role\",\"role\":\"member\"}", admin_id);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	701 Seobeo_Request_Entry *resp = Admin_API_Test_Update_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	702 ASSERT(strcmp(resp_status(resp), "409") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	703 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	704 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	705
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	706 TEST("invalid role value → 400");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	707 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	708 Seobeo_Request_Entry *req = make_admin_req(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	709 arena, "PATCH", scookie, csrf,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	710 "{\"op\":\"set_role\",\"role\":\"superuser\"}", user_id);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	711 Seobeo_Request_Entry *resp = Admin_API_Test_Update_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	712 ASSERT(strcmp(resp_status(resp), "400") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	713 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	714 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	715
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	716 Dowa_Arena_Free(arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	717 Auth_API_Destroy();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	718 unlink(db);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	719 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	720
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	721 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	722 /* Test group: temp password reset */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	723 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	724
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	725 static void test_temp_reset(void)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	726 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	727 printf("\n[temp password reset]\n");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	728
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	729 char db[256];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	730 make_temp_db(db, sizeof(db));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	731 init_auth(db);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	732 Auth_Store *store = Auth_API_Get_Store();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	733
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	734 char admin_id[37], user_id[37];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	735 ASSERT(create_test_user(store, "admin1", "password123456", "admin", FALSE, admin_id));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	736 ASSERT(create_test_user(store, "user1", "password123456", "member", FALSE, user_id));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	737
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	738 Dowa_Arena arena = Dowa_Arena_Create(128 1024);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	739 char scookie[512], csrf[512];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	740 ASSERT(login_user(arena, "admin1", "password123456",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	741 scookie, sizeof(scookie), csrf, sizeof(csrf)));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	742
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	743 TEST("temp reset sets mustChangePassword=true in response");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	744 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	745 Seobeo_Request_Entry *req = make_admin_req(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	746 arena, "PATCH", scookie, csrf,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	747 "{\"op\":\"temp_reset\",\"temporaryPassword\":\"newtemp123456\"}", user_id);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	748 Seobeo_Request_Entry *resp = Admin_API_Test_Update_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	749 ASSERT(strcmp(resp_status(resp), "200") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	750 const char *body = resp_body(resp);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	751 ASSERT(body && strstr(body, "\"mustChangePassword\":true") != NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	752 /* No raw password, hash, or digest in response. */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	753 ASSERT(strstr(body, "hash") == NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	754 ASSERT(strstr(body, "digest") == NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	755 ASSERT(strstr(body, "newtemp123456") == NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	756 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	757 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	758
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	759 TEST("temp reset short password → 400");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	760 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	761 Seobeo_Request_Entry *req = make_admin_req(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	762 arena, "PATCH", scookie, csrf,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	763 "{\"op\":\"temp_reset\",\"temporaryPassword\":\"short\"}", user_id);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	764 Seobeo_Request_Entry *resp = Admin_API_Test_Update_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	765 ASSERT(strcmp(resp_status(resp), "400") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	766 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	767 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	768
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	769 TEST("user can login after reset with new temp password");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	770 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	771 /* Login as user1 with the new temp password. */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	772 char u_cookie[512], u_csrf[512];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	773 boolean ok = login_user(arena, "user1", "newtemp123456",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	774 u_cookie, sizeof(u_cookie),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	775 u_csrf, sizeof(u_csrf));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	776 ASSERT(ok);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	777 /* Confirm must_change_password is set. */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	778 char cookie_hdr[512];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	779 snprintf(cookie_hdr, sizeof(cookie_hdr), "mjj_session=%s", u_cookie);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	780 Seobeo_Request_Entry *sreq = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	781 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	782 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	783 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	784 "Cookie", cookie_hdr,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	785 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	786 Seobeo_Request_Entry *sresp = Auth_API_Test_Session_Handler(sreq, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	787 const char *sbody = resp_body(sresp);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	788 ASSERT(sbody && strstr(sbody, "\"mustChangePassword\":true") != NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	789 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	790 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	791
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	792 Dowa_Arena_Free(arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	793 Auth_API_Destroy();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	794 unlink(db);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	795 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	796
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	797 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	798 /* Test group: session revocation */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	799 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	800
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	801 static void test_session_revocation(void)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	802 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	803 printf("\n[session revocation]\n");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	804
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	805 char db[256];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	806 make_temp_db(db, sizeof(db));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	807 init_auth(db);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	808 Auth_Store *store = Auth_API_Get_Store();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	809
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	810 char admin_id[37], user_id[37];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	811 ASSERT(create_test_user(store, "admin1", "password123456", "admin", FALSE, admin_id));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	812 ASSERT(create_test_user(store, "user1", "password123456", "member", FALSE, user_id));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	813
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	814 Dowa_Arena arena = Dowa_Arena_Create(128 1024);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	815 char admin_cookie[512], admin_csrf[512];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	816 ASSERT(login_user(arena, "admin1", "password123456",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	817 admin_cookie, sizeof(admin_cookie),
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	818 admin_csrf, sizeof(admin_csrf)));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	819
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	820 /* Login user1 to create a session. */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	821 char u_cookie[512], u_csrf[512];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	822 ASSERT(login_user(arena, "user1", "password123456",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	823 u_cookie, sizeof(u_cookie), u_csrf, sizeof(u_csrf)));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	824
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	825 TEST("DELETE /api/admin/users/:id/sessions → 200");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	826 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	827 Seobeo_Request_Entry *req = make_admin_req(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	828 arena, "DELETE", admin_cookie, admin_csrf, NULL, user_id);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	829 Seobeo_Request_Entry *resp =
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	830 Admin_API_Test_Revoke_Sessions_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	831 ASSERT(strcmp(resp_status(resp), "200") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	832 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	833 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	834
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	835 TEST("user session is invalid after revocation");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	836 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	837 char cookie_hdr[512];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	838 snprintf(cookie_hdr, sizeof(cookie_hdr), "mjj_session=%s", u_cookie);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	839 Seobeo_Request_Entry *sreq = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	840 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	841 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	842 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	843 "Cookie", cookie_hdr,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	844 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	845 Seobeo_Request_Entry *sresp = Auth_API_Test_Session_Handler(sreq, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	846 const char *sbody = resp_body(sresp);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	847 /* Should fall back to guest after session revoked */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	848 ASSERT(sbody && strstr(sbody, "\"kind\":\"user\"") == NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	849 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	850 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	851
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	852 TEST("revoke sessions for non-existent user → 404");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	853 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	854 Seobeo_Request_Entry *req = make_admin_req(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	855 arena, "DELETE", admin_cookie, admin_csrf, NULL,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	856 "00000000-0000-0000-0000-000000000000");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	857 Seobeo_Request_Entry *resp =
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	858 Admin_API_Test_Revoke_Sessions_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	859 ASSERT(strcmp(resp_status(resp), "404") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	860 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	861 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	862
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	863 TEST("CSRF required for DELETE → 403 without CSRF");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	864 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	865 char cookie_hdr[512];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	866 snprintf(cookie_hdr, sizeof(cookie_hdr), "mjj_session=%s", admin_cookie);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	867 Seobeo_Request_Entry *req = make_request(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	868 arena,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	869 "Host", "localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	870 "Remote-Addr", "127.0.0.1",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	871 "Origin", "http://localhost",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	872 "Cookie", cookie_hdr,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	873 ":id", user_id,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	874 NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	875 Seobeo_Request_Entry *resp =
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	876 Admin_API_Test_Revoke_Sessions_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	877 ASSERT(strcmp(resp_status(resp), "403") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	878 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	879 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	880
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	881 Dowa_Arena_Free(arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	882 Auth_API_Destroy();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	883 unlink(db);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	884 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	885
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	886 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	887 /* Test group: no secrets in responses */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	888 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	889
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	890 static void test_no_secret_fields(void)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	891 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	892 printf("\n[no secret fields in JSON/page]\n");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	893
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	894 char db[256];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	895 make_temp_db(db, sizeof(db));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	896 init_auth(db);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	897 Auth_Store *store = Auth_API_Get_Store();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	898
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	899 char admin_id[37];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	900 ASSERT(create_test_user(store, "admin1", "password123456", "admin", FALSE, admin_id));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	901 ASSERT(create_test_user(store, "user2", "password123456", "member", FALSE, admin_id));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	902
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	903 Dowa_Arena arena = Dowa_Arena_Create(128 1024);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	904 char scookie[512], csrf[512];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	905 ASSERT(login_user(arena, "admin1", "password123456",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	906 scookie, sizeof(scookie), csrf, sizeof(csrf)));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	907
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	908 TEST("list response has no password_hash, session, digest, or guest fields");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	909 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	910 Seobeo_Request_Entry *req = make_admin_req(arena, "GET", scookie, csrf, NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	911 Seobeo_Request_Entry *resp = Admin_API_Test_List_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	912 ASSERT(strcmp(resp_status(resp), "200") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	913 const char *body = resp_body(resp);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	914 ASSERT(body);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	915 ASSERT(strstr(body, "password_hash") == NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	916 ASSERT(strstr(body, "passwordHash") == NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	917 ASSERT(strstr(body, "token_digest") == NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	918 ASSERT(strstr(body, "csrf_digest") == NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	919 ASSERT(strstr(body, "guest_id") == NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	920 ASSERT(strstr(body, "ip_binding") == NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	921 ASSERT(strstr(body, "session") == NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	922 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	923 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	924
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	925 TEST("audit log for create contains no credentials");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	926 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	927 /* Create a user, then verify audit log doesn't have hash/password. */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	928 Seobeo_Request_Entry *req = make_admin_req(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	929 arena, "POST", scookie, csrf,
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	930 "{\"username\":\"audituser\",\"temporaryPassword\":\"auditpass123456\"}", NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	931 Seobeo_Request_Entry *resp = Admin_API_Test_Create_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	932 ASSERT(strcmp(resp_status(resp), "201") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	933 const char *body = resp_body(resp);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	934 ASSERT(body && strstr(body, "auditpass123456") == NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	935 ASSERT(body && strstr(body, "hash") == NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	936 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	937 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	938
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	939 Dowa_Arena_Free(arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	940 Auth_API_Destroy();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	941 unlink(db);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	942 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	943
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	944 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	945 /* Test group: list pagination */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	946 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	947
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	948 static void test_list_pagination(void)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	949 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	950 printf("\n[list pagination]\n");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	951
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	952 char db[256];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	953 make_temp_db(db, sizeof(db));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	954 init_auth(db);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	955 Auth_Store *store = Auth_API_Get_Store();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	956
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	957 char admin_id[37];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	958 ASSERT(create_test_user(store, "admin1", "password123456", "admin", FALSE, admin_id));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	959 /* Create 5 more users. */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	960 for (int i = 0; i < 5; i++)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	961 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	962 char uname[32], uid[37];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	963 snprintf(uname, sizeof(uname), "user%d", i);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	964 ASSERT(create_test_user(store, uname, "password123456", "member", FALSE, uid));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	965 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	966
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	967 Dowa_Arena arena = Dowa_Arena_Create(128 1024);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	968 char scookie[512], csrf[512];
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	969 ASSERT(login_user(arena, "admin1", "password123456",
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	970 scookie, sizeof(scookie), csrf, sizeof(csrf)));
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	971
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	972 TEST("list all users includes total count");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	973 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	974 Seobeo_Request_Entry *req = make_admin_req(arena, "GET", scookie, csrf, NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	975 Seobeo_Request_Entry *resp = Admin_API_Test_List_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	976 ASSERT(strcmp(resp_status(resp), "200") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	977 const char *body = resp_body(resp);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	978 ASSERT(body && strstr(body, "\"total\":6") != NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	979 ASSERT(body && strstr(body, "\"users\":[") != NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	980 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	981 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	982
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	983 TEST("huge page number returns an empty page without overflow");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	984 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	985 Seobeo_Request_Entry *req =
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	986 make_admin_req(arena, "GET", scookie, csrf, NULL, NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	987 Dowa_HashMap_Push_Arena(
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	988 req, "Query-page", "9223372036854775807", arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	989 Dowa_HashMap_Push_Arena(req, "Query-limit", "100", arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	990 Seobeo_Request_Entry *resp = Admin_API_Test_List_Handler(req, arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	991 ASSERT(strcmp(resp_status(resp), "200") == 0);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	992 const char *body = resp_body(resp);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	993 ASSERT(body && strstr(body, "\"users\":[]") != NULL);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	994 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	995 PASS();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	996
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	997 Dowa_Arena_Free(arena);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	998 Auth_API_Destroy();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	999 unlink(db);
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1000 }
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1001
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1002 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1003 /* main */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1004 /* ------------------------------------------------------------------ */
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1005
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1006 int main(void)
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1007 {
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1008 printf("=== admin_api_test ===\n");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1009
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1010 test_non_admin_denial();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1011 test_forced_password_denial();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1012 test_create_user();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1013 test_enable_disable();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1014 test_role_update();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1015 test_temp_reset();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1016 test_session_revocation();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1017 test_no_secret_fields();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1018 test_list_pagination();
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1019
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1020 printf("\n=== ALL TESTS PASSED ===\n");
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1021 return 0;
04fee26ecce0 add authenticated JRPG conversation platform MrJuneJune <me@mrjunejune.com> parents: diff changeset	1022 }

Mercurial

annotate mrjunejune/test/admin_api_test.c @ 279:b3b547563ec7