code refactor

Reviewed-on: #26

crates/bootstrap/tests/account_deletion_test.rs

@@ -0,0 +1,404 @@
+mod support;
+
+use axum::{
+    body::Body,
+    http::{Method, Request, header},
+};
+use support::{PASSWORD, Session, get, json_request, send};
+
+async fn promote(pool: &sqlx::SqlitePool, user_id: &str) {
+    sqlx::query("UPDATE users SET role = 'admin' WHERE id = ?")
+        .bind(user_id)
+        .execute(pool)
+        .await
+        .unwrap();
+}
+
+fn delete_json(uri: &str, token: &str, password: &str) -> Request<Body> {
+    json_request(
+        Method::DELETE,
+        uri,
+        Some(token),
+        serde_json::json!({ "password": password }),
+    )
+}
+
+fn classic_post(uri: &str, cookie: &str, password: &str) -> Request<Body> {
+    let csrf = cookie
+        .split(';')
+        .find_map(|c| c.trim().strip_prefix("csrf="))
+        .unwrap();
+    Request::builder()
+        .method(Method::POST)
+        .uri(uri)
+        .header(header::CONTENT_TYPE, "application/x-www-form-urlencoded")
+        .header(header::COOKIE, cookie)
+        .body(Body::from(format!("password={password}&_csrf={csrf}")))
+        .unwrap()
+}
+
+fn location(headers: &axum::http::HeaderMap) -> String {
+    headers
+        .get(header::LOCATION)
+        .map(|v| v.to_str().unwrap().to_string())
+        .unwrap_or_default()
+}
+
+async fn two_users() -> (axum::Router, sqlx::SqlitePool, Session, Session) {
+    let (router, pool) = support::server().await;
+    let alice = support::register(&router, "alice", "alice@example.com").await;
+    let bob = support::register(&router, "bob", "bob@example.com").await;
+    (router, pool, alice, bob)
+}
+
+#[tokio::test]
+async fn self_delete_with_a_wrong_password_is_refused_and_keeps_the_account() {
+    let (router, _pool, alice, _bob) = two_users().await;
+    let (status, _, body) = send(
+        &router,
+        delete_json("/api/v1/users/me", &alice.token, "nope"),
+    )
+    .await;
+    assert_eq!(status, 401, "{body}");
+    assert!(body.contains("\"INVALID_CREDENTIALS\""), "{body}");
+    let (status, _, _) = send(&router, get(&format!("/users/{}", alice.user_id), None)).await;
+    assert_eq!(status, 200);
+}
+
+#[tokio::test]
+async fn self_delete_removes_the_account_and_revokes_the_token() {
+    let (router, _pool, alice, _bob) = two_users().await;
+    let (status, _, body) = send(
+        &router,
+        delete_json("/api/v1/users/me", &alice.token, PASSWORD),
+    )
+    .await;
+    assert_eq!(status, 204, "{body}");
+
+    let req = Request::builder()
+        .uri("/api/v1/profile")
+        .header(header::AUTHORIZATION, format!("Bearer {}", alice.token))
+        .body(Body::empty())
+        .unwrap();
+    let (status, _, _) = send(&router, req).await;
+    assert_eq!(status, 401, "token of a deleted account");
+
+    for uri in [
+        format!("/users/{}", alice.user_id),
+        format!("/users/{}?embed=true", alice.user_id),
+    ] {
+        let (status, _, _) = send(&router, get(&uri, None)).await;
+        assert_eq!(status, 404, "{uri}");
+    }
+}
+
+#[tokio::test]
+async fn a_standard_user_cannot_delete_someone_else() {
+    let (router, _pool, alice, bob) = two_users().await;
+    let uri = format!("/api/v1/users/{}", bob.user_id);
+    let (status, _, body) = send(&router, delete_json(&uri, &alice.token, PASSWORD)).await;
+    assert_eq!(status, 403, "{body}");
+    let (status, _, _) = send(&router, get(&format!("/users/{}", bob.user_id), None)).await;
+    assert_eq!(status, 200);
+}
+
+#[tokio::test]
+async fn an_admin_deletes_another_account() {
+    let (router, pool, alice, bob) = two_users().await;
+    promote(&pool, &alice.user_id).await;
+    let uri = format!("/api/v1/users/{}", bob.user_id);
+
+    let (status, _, body) = send(&router, delete_json(&uri, &alice.token, "nope")).await;
+    assert_eq!(status, 401, "wrong admin password");
+    assert!(body.contains("\"INVALID_CREDENTIALS\""), "{body}");
+
+    let (status, _, body) = send(&router, delete_json(&uri, &alice.token, PASSWORD)).await;
+    assert_eq!(status, 204, "{body}");
+
+    for uri in [
+        format!("/users/{}", bob.user_id),
+        format!("/users/{}?embed=true", bob.user_id),
+    ] {
+        let (status, _, _) = send(&router, get(&uri, None)).await;
+        assert_eq!(status, 404, "{uri}");
+    }
+    let (status, _, _) = send(&router, delete_json(&uri, &alice.token, PASSWORD)).await;
+    assert_eq!(status, 404, "already deleted");
+
+    #[cfg(feature = "federation")]
+    {
+        let req = Request::builder()
+            .uri(format!("/users/{}", bob.user_id))
+            .header(header::ACCEPT, "application/activity+json")
+            .body(Body::empty())
+            .unwrap();
+        let (status, _, _) = send(&router, req).await;
+        assert_eq!(status, 410, "actor endpoint of a deleted account");
+    }
+}
+
+#[tokio::test]
+async fn the_last_admin_cannot_be_deleted() {
+    let (router, pool, alice, _bob) = two_users().await;
+    promote(&pool, &alice.user_id).await;
+    let (status, _, body) = send(
+        &router,
+        delete_json("/api/v1/users/me", &alice.token, PASSWORD),
+    )
+    .await;
+    assert_eq!(status, 409, "{body}");
+    let (status, _, _) = send(&router, get(&format!("/users/{}", alice.user_id), None)).await;
+    assert_eq!(status, 200);
+}
+
+#[tokio::test]
+async fn classic_self_delete_logs_out_and_redirects_home() {
+    let (router, _pool, alice, _bob) = two_users().await;
+
+    let (status, headers, _) = send(
+        &router,
+        classic_post("/settings/account/delete", &alice.cookie, "nope"),
+    )
+    .await;
+    assert_eq!(status, 303);
+    assert!(
+        location(&headers).starts_with("/settings/profile?error="),
+        "{headers:?}"
+    );
+    assert!(
+        support::cookie_value(&headers, "token").is_none(),
+        "a wrong password must not log out"
+    );
+
+    let (status, headers, _) = send(
+        &router,
+        classic_post("/settings/account/delete", &alice.cookie, PASSWORD),
+    )
+    .await;
+    assert_eq!(status, 303);
+    assert_eq!(location(&headers), "/");
+    assert_eq!(
+        support::cookie_value(&headers, "token").as_deref(),
+        Some("")
+    );
+
+    let (status, _, _) = send(&router, get(&format!("/users/{}", alice.user_id), None)).await;
+    assert_eq!(status, 404);
+}
+
+#[tokio::test]
+async fn classic_self_delete_requires_the_csrf_token() {
+    let (router, _pool, alice, _bob) = two_users().await;
+    let req = Request::builder()
+        .method(Method::POST)
+        .uri("/settings/account/delete")
+        .header(header::CONTENT_TYPE, "application/x-www-form-urlencoded")
+        .header(header::COOKIE, &alice.cookie)
+        .body(Body::from(format!("password={PASSWORD}&_csrf=wrong")))
+        .unwrap();
+    let (status, _, _) = send(&router, req).await;
+    assert_eq!(status, 403);
+}
+
+#[tokio::test]
+async fn classic_admin_delete_redirects_to_the_member_list() {
+    let (router, pool, alice, bob) = two_users().await;
+    let uri = format!("/users/{}/delete", bob.user_id);
+
+    let (status, headers, _) = send(&router, classic_post(&uri, &alice.cookie, PASSWORD)).await;
+    assert_eq!(status, 403, "non-admin: {headers:?}");
+
+    promote(&pool, &alice.user_id).await;
+    let (status, headers, _) = send(&router, classic_post(&uri, &alice.cookie, PASSWORD)).await;
+    assert_eq!(status, 303);
+    assert_eq!(location(&headers), "/users");
+    assert!(support::cookie_value(&headers, "token").is_none());
+
+    let (status, _, _) = send(&router, get(&format!("/users/{}", bob.user_id), None)).await;
+    assert_eq!(status, 404);
+}
+
+#[tokio::test]
+async fn classic_admin_delete_requires_the_csrf_token() {
+    let (router, pool, alice, bob) = two_users().await;
+    promote(&pool, &alice.user_id).await;
+    let req = Request::builder()
+        .method(Method::POST)
+        .uri(format!("/users/{}/delete", bob.user_id))
+        .header(header::CONTENT_TYPE, "application/x-www-form-urlencoded")
+        .header(header::COOKIE, &alice.cookie)
+        .body(Body::from(format!("password={PASSWORD}&_csrf=wrong")))
+        .unwrap();
+    let (status, _, _) = send(&router, req).await;
+    assert_eq!(status, 403);
+    let (status, _, _) = send(&router, get(&format!("/users/{}", bob.user_id), None)).await;
+    assert_eq!(status, 200, "target must survive a CSRF rejection");
+}
+
+#[tokio::test]
+async fn a_non_admin_classic_delete_of_someone_else_is_forbidden() {
+    let (router, _pool, alice, bob) = two_users().await;
+    let uri = format!("/users/{}/delete", bob.user_id);
+    let (status, _, _) = send(&router, classic_post(&uri, &alice.cookie, PASSWORD)).await;
+    assert_eq!(status, 403);
+    let (status, _, _) = send(&router, get(&format!("/users/{}", bob.user_id), None)).await;
+    assert_eq!(status, 200);
+}
+
+#[tokio::test]
+async fn classic_admin_self_delete_logs_out_unless_last_admin() {
+    let (router, pool, alice, bob) = two_users().await;
+    promote(&pool, &alice.user_id).await;
+    let uri = format!("/users/{}/delete", alice.user_id);
+
+    let (status, headers, _) = send(&router, classic_post(&uri, &alice.cookie, PASSWORD)).await;
+    assert_eq!(status, 303);
+    assert!(location(&headers).contains("error="), "{headers:?}");
+    assert!(support::cookie_value(&headers, "token").is_none());
+    let (status, _, _) = send(&router, get(&format!("/users/{}", alice.user_id), None)).await;
+    assert_eq!(status, 200);
+
+    promote(&pool, &bob.user_id).await;
+    let (status, headers, _) = send(&router, classic_post(&uri, &alice.cookie, PASSWORD)).await;
+    assert_eq!(status, 303);
+    assert_eq!(location(&headers), "/");
+    assert_eq!(
+        support::cookie_value(&headers, "token").as_deref(),
+        Some("")
+    );
+    let (status, _, _) = send(&router, get(&format!("/users/{}", alice.user_id), None)).await;
+    assert_eq!(status, 404);
+}
+
+#[tokio::test]
+async fn delete_forms_render_only_where_they_apply() {
+    let (router, pool, alice, bob) = two_users().await;
+    let own_delete = "action=\"/settings/account/delete\"";
+    let user_delete = |id: &str| format!("action=\"/users/{id}/delete\"");
+
+    let (_, _, body) = send(&router, get("/settings/profile", Some(&alice.cookie))).await;
+    assert!(body.contains(own_delete), "owner settings page");
+
+    let bob_page = format!("/users/{}", bob.user_id);
+    let (_, _, body) = send(&router, get(&bob_page, None)).await;
+    assert!(!body.contains(&user_delete(&bob.user_id)), "anonymous");
+    let (_, _, body) = send(&router, get(&bob_page, Some(&alice.cookie))).await;
+    assert!(!body.contains(&user_delete(&bob.user_id)), "non-admin");
+
+    promote(&pool, &alice.user_id).await;
+    let (_, _, body) = send(&router, get(&bob_page, Some(&alice.cookie))).await;
+    assert!(body.contains(&user_delete(&bob.user_id)), "admin on other");
+
+    let (_, _, body) = send(
+        &router,
+        get(&format!("/users/{}", alice.user_id), Some(&alice.cookie)),
+    )
+    .await;
+    assert!(
+        !body.contains(&user_delete(&alice.user_id)),
+        "admin on self"
+    );
+
+    let (_, _, body) = send(
+        &router,
+        get(&format!("{bob_page}?embed=true"), Some(&alice.cookie)),
+    )
+    .await;
+    assert!(!body.contains("/delete"), "embed page");
+}
+
+const SERVICE_ACTOR: &str = "00000000-0000-4000-8000-000000000000";
+
+#[tokio::test]
+async fn the_service_actor_is_not_deletable_and_offers_no_delete_ui() {
+    let (router, pool, alice, bob) = two_users().await;
+    promote(&pool, &alice.user_id).await;
+    promote(&pool, &bob.user_id).await;
+
+    let page = format!("/users/{SERVICE_ACTOR}");
+    let (status, _, body) = send(&router, get(&page, Some(&alice.cookie))).await;
+    assert_eq!(status, 200, "{body}");
+    assert!(
+        !body.contains(&format!("action=\"/users/{SERVICE_ACTOR}/delete\"")),
+        "admin sees a delete form for the service actor"
+    );
+
+    let uri = format!("/api/v1/users/{SERVICE_ACTOR}");
+    let (status, _, body) = send(&router, delete_json(&uri, &alice.token, PASSWORD)).await;
+    assert_eq!(status, 403, "{body}");
+
+    let req = Request::builder()
+        .uri(&uri)
+        .header(header::AUTHORIZATION, format!("Bearer {}", alice.token))
+        .body(Body::empty())
+        .unwrap();
+    let (status, _, body) = send(&router, req).await;
+    assert_eq!(status, 200, "{body}");
+    assert!(body.contains("\"is_service_account\":true"), "{body}");
+
+    let req = Request::builder()
+        .uri(format!("/api/v1/users/{}", bob.user_id))
+        .header(header::AUTHORIZATION, format!("Bearer {}", alice.token))
+        .body(Body::empty())
+        .unwrap();
+    let (_, _, body) = send(&router, req).await;
+    assert!(!body.contains("is_service_account"), "{body}");
+}
+
+#[tokio::test]
+async fn a_deleted_users_webhook_token_stops_ingesting_at_once() {
+    let (router, pool, alice, _bob) = two_users().await;
+    let (status, _, body) = send(
+        &router,
+        json_request(
+            Method::POST,
+            "/api/v1/settings/webhook-tokens",
+            Some(&alice.token),
+            serde_json::json!({ "provider": "jellyfin", "label": null }),
+        ),
+    )
+    .await;
+    assert_eq!(status, 200, "{body}");
+    let token = serde_json::from_str::<serde_json::Value>(&body).unwrap()["token"]
+        .as_str()
+        .unwrap()
+        .to_string();
+
+    let hook = |token: &str| {
+        Request::builder()
+            .method(Method::POST)
+            .uri("/api/v1/webhooks/jellyfin")
+            .header(header::AUTHORIZATION, format!("Bearer {token}"))
+            .header(header::CONTENT_TYPE, "application/json")
+            .body(Body::from(
+                serde_json::json!({
+                    "NotificationType": "PlaybackStop", "ItemType": "Movie",
+                    "Name": "Heat", "Year": 1995, "PlayedToCompletion": true,
+                    "Provider_tmdb": "949"
+                })
+                .to_string(),
+            ))
+            .unwrap()
+    };
+    let events = || async {
+        sqlx::query_scalar::<_, i64>("SELECT COUNT(*) FROM watch_events")
+            .fetch_one(&pool)
+            .await
+            .unwrap()
+    };
+
+    let (status, _, body) = send(&router, hook(&token)).await;
+    assert_eq!(status, 200, "live token: {body}");
+    assert_eq!(events().await, 1);
+
+    let (status, _, _) = send(
+        &router,
+        delete_json("/api/v1/users/me", &alice.token, PASSWORD),
+    )
+    .await;
+    assert_eq!(status, 204);
+
+    let (status, _, body) = send(&router, hook(&token)).await;
+    assert_eq!(status, 401, "{body}");
+    assert_eq!(events().await, 1, "no event ingested after deletion");
+}