Added session tests.

adsnaider · adsnaider · commit c44606327358 · 2022-04-15T17:21:20.000-07:00
diff --git a/src/controllers/user/session.rs b/src/controllers/user/session.rs
@@ -16,7 +16,7 @@ use crate::Env;
 
 pub const SESSION_COOKIE_NAME: &str = "crates_auth";
 
-fn session_cookie(token: &NewSecureToken, secure: bool) -> Cookie<'static> {
+pub fn session_cookie(token: &NewSecureToken, secure: bool) -> Cookie<'static> {
     Cookie::build(SESSION_COOKIE_NAME, token.plaintext().to_string())
         .http_only(true)
         .secure(secure)
diff --git a/src/tests/authentication.rs b/src/tests/authentication.rs
@@ -2,13 +2,51 @@ use crate::util::{RequestHelper, Response};
 use crate::TestApp;
 
 use crate::util::encode_session_header;
+use cargo_registry::controllers::user::session::session_cookie;
+use cargo_registry::util::token::SecureToken;
+use cargo_registry::util::token::SecureTokenKind;
 use conduit::{header, Body, Method, StatusCode};
 
 static URL: &str = "/api/v1/me/updates";
 static MUST_LOGIN: &[u8] = br#"{"errors":[{"detail":"must be logged in to perform that action"}]}"#;
 static INTERNAL_ERROR_NO_USER: &str =
     "user_id from cookie not found in database caused by NotFound";
 
+#[test]
+fn persistent_session_user() {
+    let (app, _) = TestApp::init().empty();
+    let user = app.db_new_user("user1").with_session();
+    let request = user.request_builder(Method::GET, URL);
+    let response: Response<Body> = user.run(request);
+    assert_eq!(response.status(), StatusCode::OK);
+}
+
+#[test]
+fn incorrect_session_is_forbidden() {
+    let (_, anon) = TestApp::init().empty();
+
+    let token = SecureToken::generate(SecureTokenKind::Session);
+    // Create a cookie that isn't in the database.
+    let cookie = session_cookie(&token, false).to_string();
+    let mut request = anon.request_builder(Method::GET, URL);
+    request.header(header::COOKIE, &cookie);
+    let response: Response<Body> = anon.run(request);
+    assert_eq!(response.status(), StatusCode::FORBIDDEN);
+    assert_eq!(
+        response.into_json(),
+        json!({"errors": [{"detail": "must be logged in to perform that action"}]})
+    );
+}
+
+#[test]
+fn cookie_user() {
+    let (_, _, cookie_user) = TestApp::init().with_user();
+    let request = cookie_user.request_builder(Method::GET, URL);
+
+    let response: Response<Body> = cookie_user.run(request);
+    assert_eq!(response.status(), StatusCode::OK);
+}
+
 #[test]
 fn anonymous_user_unauthorized() {
     let (_, anon) = TestApp::init().empty();
diff --git a/src/tests/util.rs b/src/tests/util.rs
@@ -23,7 +23,12 @@ use crate::{
     builders::PublishBuilder, CategoryListResponse, CategoryResponse, CrateList, CrateResponse,
     GoodCrate, OkBool, OwnersResponse, VersionResponse,
 };
+use cargo_registry::controllers::user::session::session_cookie;
+use cargo_registry::models::PersistentSession;
 use cargo_registry::models::{ApiToken, CreatedApiToken, User};
+use cargo_registry::util::token::NewSecureToken;
+use cargo_registry::util::token::SecureToken;
+use cargo_registry::util::token::SecureTokenKind;
 
 use conduit::{BoxError, Handler, Method};
 use conduit_cookie::SessionMiddleware;
@@ -270,6 +275,43 @@ impl MockCookieUser {
             token,
         }
     }
+
+    pub fn with_session(&self) -> MockSessionUser {
+        let ip_addr = "192.168.0.42";
+        let user_agent = "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36";
+
+        let token = SecureToken::generate(SecureTokenKind::Session);
+
+        self.app.db(|conn| {
+            PersistentSession::create(self.user.id, &token, ip_addr.parse().unwrap(), user_agent)
+                .insert(&conn)
+                .unwrap()
+        });
+
+        MockSessionUser {
+            app: self.app.clone(),
+            token,
+        }
+    }
+}
+
+pub struct MockSessionUser {
+    app: TestApp,
+    token: NewSecureToken,
+}
+
+impl RequestHelper for MockSessionUser {
+    fn request_builder(&self, method: Method, path: &str) -> MockRequest {
+        let cookie = session_cookie(&self.token, false).to_string();
+
+        let mut request = req(method, path);
+        request.header(header::COOKIE, &cookie);
+        request
+    }
+
+    fn app(&self) -> &TestApp {
+        &self.app
+    }
 }
 
 /// A type that can generate token authenticated requests
diff --git a/src/util.rs b/src/util.rs
@@ -12,7 +12,7 @@ mod io_util;
 mod request_helpers;
 mod request_proxy;
 pub mod rfc3339;
-pub(crate) mod token;
+pub mod token;
 
 pub type AppResponse = Response<conduit::Body>;
 pub type EndpointResult = Result<AppResponse, Box<dyn errors::AppError>>;
diff --git a/src/util/token.rs b/src/util/token.rs
@@ -12,7 +12,7 @@ pub struct SecureToken {
 }
 
 impl SecureToken {
-    pub(crate) fn generate(kind: SecureTokenKind) -> NewSecureToken {
+    pub fn generate(kind: SecureTokenKind) -> NewSecureToken {
         let plaintext = format!(
             "{}{}",
             kind.prefix(),
@@ -26,7 +26,7 @@ impl SecureToken {
         }
     }
 
-    pub(crate) fn parse(kind: SecureTokenKind, plaintext: &str) -> Option<Self> {
+    pub fn parse(kind: SecureTokenKind, plaintext: &str) -> Option<Self> {
         // This will both reject tokens without a prefix and tokens of the wrong kind.
         if SecureTokenKind::from_token(plaintext) != Some(kind) {
             return None;
@@ -60,18 +60,18 @@ impl FromSql<Bytea, Pg> for SecureToken {
     }
 }
 
-pub(crate) struct NewSecureToken {
+pub struct NewSecureToken {
     plaintext: String,
     inner: SecureToken,
 }
 
 impl NewSecureToken {
-    pub(crate) fn plaintext(&self) -> &str {
+    pub fn plaintext(&self) -> &str {
         &self.plaintext
     }
 
     #[cfg(test)]
-    pub(crate) fn into_inner(self) -> SecureToken {
+    pub fn into_inner(self) -> SecureToken {
         self.inner
     }
 }
@@ -120,7 +120,7 @@ secure_token_kind! {
     /// NEVER CHANGE THE PREFIX OF EXISTING TOKEN TYPES!!! Doing so will implicitly revoke all the
     /// tokens of that kind, distrupting production users.
     #[derive(Debug, Copy, Clone, Eq, PartialEq, Hash)]
-    pub(crate) enum SecureTokenKind {
+    pub enum SecureTokenKind {
         Api => "cio", // Crates.IO
         Session => "ses", // Session tokens.
     }

Original file line number	Diff line number	Diff line change
`@@ -12,7 +12,7 @@ pub struct SecureToken {`
`12`	`12`	`}`
`13`	`13`
`14`	`14`	`impl SecureToken {`
`15`		`- pub(crate) fn generate(kind: SecureTokenKind) -> NewSecureToken {`
	`15`	`+ pub fn generate(kind: SecureTokenKind) -> NewSecureToken {`
`16`	`16`	`let plaintext = format!(`
`17`	`17`	`"{}{}",`
`18`	`18`	`kind.prefix(),`
`@@ -26,7 +26,7 @@ impl SecureToken {`
`26`	`26`	`}`
`27`	`27`	`}`
`28`	`28`
`29`		`- pub(crate) fn parse(kind: SecureTokenKind, plaintext: &str) -> Option<Self> {`
	`29`	`+ pub fn parse(kind: SecureTokenKind, plaintext: &str) -> Option<Self> {`
`30`	`30`	`// This will both reject tokens without a prefix and tokens of the wrong kind.`
`31`	`31`	`if SecureTokenKind::from_token(plaintext) != Some(kind) {`
`32`	`32`	`return None;`
`@@ -60,18 +60,18 @@ impl FromSql<Bytea, Pg> for SecureToken {`
`60`	`60`	`}`
`61`	`61`	`}`
`62`	`62`
`63`		`-pub(crate) struct NewSecureToken {`
	`63`	`+pub struct NewSecureToken {`
`64`	`64`	`plaintext: String,`
`65`	`65`	`inner: SecureToken,`
`66`	`66`	`}`
`67`	`67`
`68`	`68`	`impl NewSecureToken {`
`69`		`- pub(crate) fn plaintext(&self) -> &str {`
	`69`	`+ pub fn plaintext(&self) -> &str {`
`70`	`70`	`&self.plaintext`
`71`	`71`	`}`
`72`	`72`
`73`	`73`	`#[cfg(test)]`
`74`		`- pub(crate) fn into_inner(self) -> SecureToken {`
	`74`	`+ pub fn into_inner(self) -> SecureToken {`
`75`	`75`	`self.inner`
`76`	`76`	`}`
`77`	`77`	`}`
`@@ -120,7 +120,7 @@ secure_token_kind! {`
`120`	`120`	`/// NEVER CHANGE THE PREFIX OF EXISTING TOKEN TYPES!!! Doing so will implicitly revoke all the`
`121`	`121`	`/// tokens of that kind, distrupting production users.`
`122`	`122`	`#[derive(Debug, Copy, Clone, Eq, PartialEq, Hash)]`
`123`		`- pub(crate) enum SecureTokenKind {`
	`123`	`+ pub enum SecureTokenKind {`
`124`	`124`	`Api => "cio", // Crates.IO`
`125`	`125`	`Session => "ses", // Session tokens.`
`126`	`126`	`}`