init

internal/adminapi/system_test.go

@@ -0,0 +1,101 @@
+package adminapi
+
+import (
+	"net/http"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/iceBear67/simplepages/api"
+)
+
+func TestWhoAmIReportsTheCaller(t *testing.T) {
+	e := newEnv(t)
+	e.createProject(t, "demo")
+	future := time.Now().Add(time.Hour).Truncate(time.Second)
+	proj := e.createKey(t, api.PathProjectKeys("demo"), e.adminToken,
+		api.CreateKeyRequest{Name: "ci", ExpiresAt: &future})
+
+	t.Run("project scope", func(t *testing.T) {
+		status, body := e.do(t, http.MethodGet, api.PathWhoAmI(), proj.Token, nil)
+		var who api.WhoAmI
+		mustJSON(t, status, http.StatusOK, body, &who)
+		if who.KeyID != proj.Key.ID {
+			t.Errorf("key_id = %q, want %q", who.KeyID, proj.Key.ID)
+		}
+		if who.Scope != api.ScopeProject || who.Project != "demo" || who.Name != "ci" {
+			t.Errorf("whoami = %+v, want scope project on demo named ci", who)
+		}
+		if who.ExpiresAt == nil || !who.ExpiresAt.Equal(future) {
+			t.Errorf("expires_at = %v, want %v", who.ExpiresAt, future)
+		}
+	})
+
+	t.Run("admin scope", func(t *testing.T) {
+		status, body := e.do(t, http.MethodGet, api.PathWhoAmI(), e.adminToken, nil)
+		var who api.WhoAmI
+		mustJSON(t, status, http.StatusOK, body, &who)
+		if who.Scope != api.ScopeAdmin {
+			t.Errorf("scope = %q, want admin", who.Scope)
+		}
+		// An admin key belongs to no project, and saying otherwise would suggest
+		// the caller is confined to one.
+		if who.Project != "" {
+			t.Errorf("project = %q, want empty for an admin key", who.Project)
+		}
+	})
+
+	// whoami names a credential, so it must not be cached by anything between
+	// the CLI and the server.
+	t.Run("no-store", func(t *testing.T) {
+		resp := e.doResp(t, http.MethodGet, api.PathWhoAmI(), proj.Token, nil)
+		if cc := resp.Header.Get("Cache-Control"); !strings.Contains(cc, "no-store") {
+			t.Errorf("Cache-Control = %q, want it to contain no-store", cc)
+		}
+	})
+}
+
+func TestSystemInfo(t *testing.T) {
+	e := newEnv(t)
+	e.createProject(t, "a")
+	e.createProject(t, "b")
+
+	status, body := e.do(t, http.MethodGet, api.PathSystemInfo(), e.adminToken, nil)
+	var info api.SystemInfo
+	mustJSON(t, status, http.StatusOK, body, &info)
+
+	if info.Projects != 2 {
+		t.Errorf("projects = %d, want 2", info.Projects)
+	}
+	if info.Deployments != 0 || info.Blobs != 0 || info.CASBytes != 0 {
+		t.Errorf("expected an empty CAS, got %+v", info)
+	}
+	if info.SchemaVer < 1 {
+		t.Errorf("schema_version = %d, want at least 1", info.SchemaVer)
+	}
+	if info.Version == "" {
+		t.Error("version is empty")
+	}
+	// The link mode is not known until the CAS is opened in M2; reporting an
+	// empty string would read as "no linking" rather than "not determined".
+	if info.LinkMode != "unknown" {
+		t.Errorf("link_mode = %q, want unknown", info.LinkMode)
+	}
+	if info.UptimeS < 0 {
+		t.Errorf("uptime_s = %d", info.UptimeS)
+	}
+}
+
+func TestSystemInfoIsAdminOnly(t *testing.T) {
+	e := newEnv(t)
+	e.createProject(t, "demo")
+	token := e.mintProject(t, e.projectID(t, "demo"), "ci")
+
+	status, body := e.do(t, http.MethodGet, api.PathSystemInfo(), token, nil)
+	if status != http.StatusForbidden {
+		t.Fatalf("status = %d, want 403; body: %s", status, body)
+	}
+	if got := errCode(t, body); got != api.CodeForbidden {
+		t.Errorf("code = %q, want %q", got, api.CodeForbidden)
+	}
+}