feat: account deletion endpoints

crates/bootstrap/tests/account_deletion_test.rs

@@ -0,0 +1,223 @@
+//! Account deletion over HTTP: JSON and classic endpoints on the real wiring.
+
+mod support;
+
+use axum::{
+    body::Body,
+    http::{Method, Request, header},
+};
+use support::{PASSWORD, Session, get, json_request, send};
+
+async fn promote(pool: &sqlx::SqlitePool, user_id: &str) {
+    sqlx::query("UPDATE users SET role = 'admin' WHERE id = ?")
+        .bind(user_id)
+        .execute(pool)
+        .await
+        .unwrap();
+}
+
+fn delete_json(uri: &str, token: &str, password: &str) -> Request<Body> {
+    json_request(
+        Method::DELETE,
+        uri,
+        Some(token),
+        serde_json::json!({ "password": password }),
+    )
+}
+
+fn classic_post(uri: &str, cookie: &str, password: &str) -> Request<Body> {
+    let csrf = cookie
+        .split(';')
+        .find_map(|c| c.trim().strip_prefix("csrf="))
+        .unwrap();
+    Request::builder()
+        .method(Method::POST)
+        .uri(uri)
+        .header(header::CONTENT_TYPE, "application/x-www-form-urlencoded")
+        .header(header::COOKIE, cookie)
+        .body(Body::from(format!("password={password}&_csrf={csrf}")))
+        .unwrap()
+}
+
+fn location(headers: &axum::http::HeaderMap) -> String {
+    headers
+        .get(header::LOCATION)
+        .map(|v| v.to_str().unwrap().to_string())
+        .unwrap_or_default()
+}
+
+async fn two_users() -> (axum::Router, sqlx::SqlitePool, Session, Session) {
+    let (router, pool) = support::server().await;
+    let alice = support::register(&router, "alice", "alice@example.com").await;
+    let bob = support::register(&router, "bob", "bob@example.com").await;
+    (router, pool, alice, bob)
+}
+
+#[tokio::test]
+async fn self_delete_with_a_wrong_password_is_refused_and_keeps_the_account() {
+    let (router, _pool, alice, _bob) = two_users().await;
+    let (status, _, body) = send(
+        &router,
+        delete_json("/api/v1/users/me", &alice.token, "nope"),
+    )
+    .await;
+    assert_eq!(status, 401, "{body}");
+    let (status, _, _) = send(&router, get(&format!("/users/{}", alice.user_id), None)).await;
+    assert_eq!(status, 200);
+}
+
+#[tokio::test]
+async fn self_delete_removes_the_account_and_revokes_the_token() {
+    let (router, _pool, alice, _bob) = two_users().await;
+    let (status, _, body) = send(
+        &router,
+        delete_json("/api/v1/users/me", &alice.token, PASSWORD),
+    )
+    .await;
+    assert_eq!(status, 204, "{body}");
+
+    let req = Request::builder()
+        .uri("/api/v1/profile")
+        .header(header::AUTHORIZATION, format!("Bearer {}", alice.token))
+        .body(Body::empty())
+        .unwrap();
+    let (status, _, _) = send(&router, req).await;
+    assert_eq!(status, 401, "token of a deleted account");
+
+    for uri in [
+        format!("/users/{}", alice.user_id),
+        format!("/users/{}?embed=true", alice.user_id),
+    ] {
+        let (status, _, _) = send(&router, get(&uri, None)).await;
+        assert_eq!(status, 404, "{uri}");
+    }
+}
+
+#[tokio::test]
+async fn a_standard_user_cannot_delete_someone_else() {
+    let (router, _pool, alice, bob) = two_users().await;
+    let uri = format!("/api/v1/users/{}", bob.user_id);
+    let (status, _, body) = send(&router, delete_json(&uri, &alice.token, PASSWORD)).await;
+    assert_eq!(status, 403, "{body}");
+    let (status, _, _) = send(&router, get(&format!("/users/{}", bob.user_id), None)).await;
+    assert_eq!(status, 200);
+}
+
+#[tokio::test]
+async fn an_admin_deletes_another_account() {
+    let (router, pool, alice, bob) = two_users().await;
+    promote(&pool, &alice.user_id).await;
+    let uri = format!("/api/v1/users/{}", bob.user_id);
+
+    let (status, _, _) = send(&router, delete_json(&uri, &alice.token, "nope")).await;
+    assert_eq!(status, 401, "wrong admin password");
+
+    let (status, _, body) = send(&router, delete_json(&uri, &alice.token, PASSWORD)).await;
+    assert_eq!(status, 204, "{body}");
+
+    for uri in [
+        format!("/users/{}", bob.user_id),
+        format!("/users/{}?embed=true", bob.user_id),
+    ] {
+        let (status, _, _) = send(&router, get(&uri, None)).await;
+        assert_eq!(status, 404, "{uri}");
+    }
+    let (status, _, _) = send(&router, delete_json(&uri, &alice.token, PASSWORD)).await;
+    assert_eq!(status, 404, "already deleted");
+
+    #[cfg(feature = "federation")]
+    {
+        let req = Request::builder()
+            .uri(format!("/users/{}", bob.user_id))
+            .header(header::ACCEPT, "application/activity+json")
+            .body(Body::empty())
+            .unwrap();
+        let (status, _, _) = send(&router, req).await;
+        assert_eq!(status, 410, "actor endpoint of a deleted account");
+    }
+}
+
+#[tokio::test]
+async fn the_last_admin_cannot_be_deleted() {
+    let (router, pool, alice, _bob) = two_users().await;
+    promote(&pool, &alice.user_id).await;
+    let (status, _, body) = send(
+        &router,
+        delete_json("/api/v1/users/me", &alice.token, PASSWORD),
+    )
+    .await;
+    assert_eq!(status, 409, "{body}");
+    let (status, _, _) = send(&router, get(&format!("/users/{}", alice.user_id), None)).await;
+    assert_eq!(status, 200);
+}
+
+#[tokio::test]
+async fn classic_self_delete_logs_out_and_redirects_home() {
+    let (router, _pool, alice, _bob) = two_users().await;
+
+    let (status, headers, _) = send(
+        &router,
+        classic_post("/settings/account/delete", &alice.cookie, "nope"),
+    )
+    .await;
+    assert_eq!(status, 303);
+    assert!(
+        location(&headers).starts_with("/settings/profile?error="),
+        "{headers:?}"
+    );
+    assert!(
+        support::cookie_value(&headers, "token").is_none(),
+        "a wrong password must not log out"
+    );
+
+    let (status, headers, _) = send(
+        &router,
+        classic_post("/settings/account/delete", &alice.cookie, PASSWORD),
+    )
+    .await;
+    assert_eq!(status, 303);
+    assert_eq!(location(&headers), "/");
+    assert_eq!(
+        support::cookie_value(&headers, "token").as_deref(),
+        Some("")
+    );
+
+    let (status, _, _) = send(&router, get(&format!("/users/{}", alice.user_id), None)).await;
+    assert_eq!(status, 404);
+}
+
+#[tokio::test]
+async fn classic_self_delete_requires_the_csrf_token() {
+    let (router, _pool, alice, _bob) = two_users().await;
+    let req = Request::builder()
+        .method(Method::POST)
+        .uri("/settings/account/delete")
+        .header(header::CONTENT_TYPE, "application/x-www-form-urlencoded")
+        .header(header::COOKIE, &alice.cookie)
+        .body(Body::from(format!("password={PASSWORD}&_csrf=wrong")))
+        .unwrap();
+    let (status, _, _) = send(&router, req).await;
+    assert_eq!(status, 403);
+}
+
+#[tokio::test]
+async fn classic_admin_delete_redirects_to_the_member_list() {
+    let (router, pool, alice, bob) = two_users().await;
+    let uri = format!("/users/{}/delete", bob.user_id);
+
+    let (status, headers, _) = send(&router, classic_post(&uri, &alice.cookie, PASSWORD)).await;
+    assert_eq!(status, 303);
+    assert!(
+        location(&headers).contains("error="),
+        "non-admin: {headers:?}"
+    );
+
+    promote(&pool, &alice.user_id).await;
+    let (status, headers, _) = send(&router, classic_post(&uri, &alice.cookie, PASSWORD)).await;
+    assert_eq!(status, 303);
+    assert_eq!(location(&headers), "/users");
+    assert!(support::cookie_value(&headers, "token").is_none());
+
+    let (status, _, _) = send(&router, get(&format!("/users/{}", bob.user_id), None)).await;
+    assert_eq!(status, 404);
+}