Phase 1.2: session login + empty HTMX dashboard
- Session login for the single user Sam: server-side session store with an HMAC-signed session cookie, POST /login, POST /logout, and double-submit CSRF on every form post. Unauthenticated requests to / and /partials/* redirect to /login?next=... - Empty dashboard shell in the Family Home Lab design system: left nav (category and folder placeholders), centre list, right detail pane. - Copy tokens.css and the self-hosted Inter fonts from the family-home-lab design system into web/static; vendor htmx 2.0.4. No cross-project imports at runtime. - Dark mode via prefers-color-scheme plus a persisted toggle; phone-first layout with 44px touch targets, hairline borders, 8px grid, pill CTAs. - Config: EMAIL_AGENT_PASSWORD for the login password, falling back to EMAIL_AGENT_SESSION_SECRET so one configured secret is enough. Co-Authored-By: Paperclip <noreply@paperclip.ing>
This commit is contained in:
@@ -6,20 +6,28 @@ import (
|
||||
"log/slog"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"net/url"
|
||||
"path/filepath"
|
||||
"regexp"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"gitea.lab.audasmedia.com.au/sam/email_agent/internal/config"
|
||||
"gitea.lab.audasmedia.com.au/sam/email_agent/internal/session"
|
||||
"gitea.lab.audasmedia.com.au/sam/email_agent/internal/store"
|
||||
)
|
||||
|
||||
const testPassword = "test-password"
|
||||
|
||||
func newTestServer(t *testing.T) *Server {
|
||||
t.Helper()
|
||||
cfg := &config.Config{
|
||||
Env: "test",
|
||||
Addr: ":0",
|
||||
DBPath: filepath.Join(t.TempDir(), "email_agent.db"),
|
||||
LogLevel: "error",
|
||||
Env: "test",
|
||||
Addr: ":0",
|
||||
DBPath: filepath.Join(t.TempDir(), "email_agent.db"),
|
||||
LogLevel: "error",
|
||||
SessionSecret: "test-session-secret",
|
||||
Password: testPassword,
|
||||
}
|
||||
st, err := store.Open(context.Background(), cfg.DBPath)
|
||||
if err != nil {
|
||||
@@ -65,9 +73,9 @@ func TestReadyz(t *testing.T) {
|
||||
}
|
||||
}
|
||||
|
||||
func TestIndexRendersHTML(t *testing.T) {
|
||||
func TestStaticTokensServed(t *testing.T) {
|
||||
srv := newTestServer(t)
|
||||
req := httptest.NewRequest(http.MethodGet, "/", nil)
|
||||
req := httptest.NewRequest(http.MethodGet, "/static/tokens.css", nil)
|
||||
rec := httptest.NewRecorder()
|
||||
|
||||
srv.Handler().ServeHTTP(rec, req)
|
||||
@@ -75,7 +83,180 @@ func TestIndexRendersHTML(t *testing.T) {
|
||||
if rec.Code != http.StatusOK {
|
||||
t.Fatalf("status = %d, want %d", rec.Code, http.StatusOK)
|
||||
}
|
||||
if ct := rec.Header().Get("Content-Type"); ct == "" {
|
||||
t.Error("Content-Type header is empty")
|
||||
if !strings.Contains(rec.Body.String(), "--canvas-soft") {
|
||||
t.Error("tokens.css does not contain the design tokens")
|
||||
}
|
||||
}
|
||||
|
||||
func TestUnauthenticatedRedirectsToLogin(t *testing.T) {
|
||||
srv := newTestServer(t)
|
||||
req := httptest.NewRequest(http.MethodGet, "/", nil)
|
||||
rec := httptest.NewRecorder()
|
||||
|
||||
srv.Handler().ServeHTTP(rec, req)
|
||||
|
||||
if rec.Code != http.StatusSeeOther {
|
||||
t.Fatalf("status = %d, want %d", rec.Code, http.StatusSeeOther)
|
||||
}
|
||||
if loc := rec.Header().Get("Location"); !strings.HasPrefix(loc, "/login") {
|
||||
t.Errorf("Location = %q, want /login…", loc)
|
||||
}
|
||||
}
|
||||
|
||||
func TestLoginPageRenders(t *testing.T) {
|
||||
srv := newTestServer(t)
|
||||
req := httptest.NewRequest(http.MethodGet, "/login", nil)
|
||||
rec := httptest.NewRecorder()
|
||||
|
||||
srv.Handler().ServeHTTP(rec, req)
|
||||
|
||||
if rec.Code != http.StatusOK {
|
||||
t.Fatalf("status = %d, want %d", rec.Code, http.StatusOK)
|
||||
}
|
||||
body := rec.Body.String()
|
||||
if !strings.Contains(body, "Sign in") || !strings.Contains(body, `name="csrf"`) {
|
||||
t.Error("login page is missing the form or CSRF field")
|
||||
}
|
||||
if findCookie(t, rec.Result().Cookies(), csrfCookieName) == nil {
|
||||
t.Error("login page did not set the CSRF cookie")
|
||||
}
|
||||
}
|
||||
|
||||
func TestLoginFlowAndDashboard(t *testing.T) {
|
||||
srv := newTestServer(t)
|
||||
h := srv.Handler()
|
||||
|
||||
// 1. Load the login page to obtain the CSRF token.
|
||||
rec := httptest.NewRecorder()
|
||||
h.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/login", nil))
|
||||
csrf := csrfFromBody(t, rec.Body.String())
|
||||
csrfCookie := findCookie(t, rec.Result().Cookies(), csrfCookieName)
|
||||
|
||||
// 2. Sign in with the right password.
|
||||
rec = httptest.NewRecorder()
|
||||
h.ServeHTTP(rec, loginRequest(csrf, testPassword, csrfCookie))
|
||||
if rec.Code != http.StatusSeeOther {
|
||||
t.Fatalf("login status = %d, want %d (body: %s)", rec.Code, http.StatusSeeOther, rec.Body.String())
|
||||
}
|
||||
sessionCookie := findCookie(t, rec.Result().Cookies(), session.CookieName)
|
||||
if sessionCookie == nil {
|
||||
t.Fatal("login did not set the session cookie")
|
||||
}
|
||||
|
||||
// 3. The dashboard renders with the session cookie.
|
||||
req := httptest.NewRequest(http.MethodGet, "/", nil)
|
||||
req.AddCookie(sessionCookie)
|
||||
rec = httptest.NewRecorder()
|
||||
h.ServeHTTP(rec, req)
|
||||
if rec.Code != http.StatusOK {
|
||||
t.Fatalf("dashboard status = %d, want %d", rec.Code, http.StatusOK)
|
||||
}
|
||||
body := rec.Body.String()
|
||||
for _, want := range []string{"Good ", "Inbox", "Categories", "Folders", "Log out"} {
|
||||
if !strings.Contains(body, want) {
|
||||
t.Errorf("dashboard body missing %q", want)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestLoginWrongPassword(t *testing.T) {
|
||||
srv := newTestServer(t)
|
||||
h := srv.Handler()
|
||||
|
||||
rec := httptest.NewRecorder()
|
||||
h.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/login", nil))
|
||||
csrf := csrfFromBody(t, rec.Body.String())
|
||||
csrfCookie := findCookie(t, rec.Result().Cookies(), csrfCookieName)
|
||||
|
||||
rec = httptest.NewRecorder()
|
||||
h.ServeHTTP(rec, loginRequest(csrf, "wrong-password", csrfCookie))
|
||||
if rec.Code != http.StatusUnauthorized {
|
||||
t.Fatalf("status = %d, want %d", rec.Code, http.StatusUnauthorized)
|
||||
}
|
||||
if findCookie(t, rec.Result().Cookies(), session.CookieName) != nil {
|
||||
t.Error("a session cookie was issued for a failed login")
|
||||
}
|
||||
}
|
||||
|
||||
func TestLoginRejectsMissingCSRF(t *testing.T) {
|
||||
srv := newTestServer(t)
|
||||
|
||||
form := url.Values{"password": {testPassword}}
|
||||
req := httptest.NewRequest(http.MethodPost, "/login", strings.NewReader(form.Encode()))
|
||||
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
||||
rec := httptest.NewRecorder()
|
||||
srv.Handler().ServeHTTP(rec, req)
|
||||
|
||||
if rec.Code != http.StatusForbidden {
|
||||
t.Fatalf("status = %d, want %d", rec.Code, http.StatusForbidden)
|
||||
}
|
||||
}
|
||||
|
||||
func TestLogoutDestroysSession(t *testing.T) {
|
||||
srv := newTestServer(t)
|
||||
h := srv.Handler()
|
||||
|
||||
rec := httptest.NewRecorder()
|
||||
h.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/login", nil))
|
||||
csrf := csrfFromBody(t, rec.Body.String())
|
||||
csrfCookie := findCookie(t, rec.Result().Cookies(), csrfCookieName)
|
||||
|
||||
rec = httptest.NewRecorder()
|
||||
h.ServeHTTP(rec, loginRequest(csrf, testPassword, csrfCookie))
|
||||
sessionCookie := findCookie(t, rec.Result().Cookies(), session.CookieName)
|
||||
if sessionCookie == nil {
|
||||
t.Fatal("login did not set the session cookie")
|
||||
}
|
||||
|
||||
// Log out, carrying both the CSRF and session cookies.
|
||||
form := url.Values{"csrf": {csrf}}
|
||||
req := httptest.NewRequest(http.MethodPost, "/logout", strings.NewReader(form.Encode()))
|
||||
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
||||
req.AddCookie(csrfCookie)
|
||||
req.AddCookie(sessionCookie)
|
||||
rec = httptest.NewRecorder()
|
||||
h.ServeHTTP(rec, req)
|
||||
if rec.Code != http.StatusSeeOther {
|
||||
t.Fatalf("logout status = %d, want %d", rec.Code, http.StatusSeeOther)
|
||||
}
|
||||
|
||||
// The old session no longer reaches the dashboard.
|
||||
req = httptest.NewRequest(http.MethodGet, "/", nil)
|
||||
req.AddCookie(sessionCookie)
|
||||
rec = httptest.NewRecorder()
|
||||
h.ServeHTTP(rec, req)
|
||||
if rec.Code != http.StatusSeeOther {
|
||||
t.Fatalf("dashboard after logout = %d, want %d", rec.Code, http.StatusSeeOther)
|
||||
}
|
||||
}
|
||||
|
||||
func loginRequest(csrf, password string, csrfCookie *http.Cookie) *http.Request {
|
||||
form := url.Values{"password": {password}, "csrf": {csrf}}
|
||||
req := httptest.NewRequest(http.MethodPost, "/login", strings.NewReader(form.Encode()))
|
||||
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
||||
if csrfCookie != nil {
|
||||
req.AddCookie(csrfCookie)
|
||||
}
|
||||
return req
|
||||
}
|
||||
|
||||
var csrfFieldRE = regexp.MustCompile(`name="csrf" value="([^"]*)"`)
|
||||
|
||||
func csrfFromBody(t *testing.T, body string) string {
|
||||
t.Helper()
|
||||
m := csrfFieldRE.FindStringSubmatch(body)
|
||||
if len(m) < 2 || m[1] == "" {
|
||||
t.Fatalf("no CSRF token in body")
|
||||
}
|
||||
return m[1]
|
||||
}
|
||||
|
||||
func findCookie(t *testing.T, cookies []*http.Cookie, name string) *http.Cookie {
|
||||
t.Helper()
|
||||
for _, c := range cookies {
|
||||
if c.Name == name && c.Value != "" {
|
||||
return c
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user