refactor: drop postgres leftovers, narrow bootstrap api

crates/bootstrap/tests/config_propagation_test.rs

@@ -0,0 +1,103 @@
+//! Configuration values reach the running app through the composition root.
+
+mod support;
+
+use axum::{
+    body::Body,
+    http::{Method, Request, header},
+};
+
+async fn server_with(config: config::AppConfig) -> axum::Router {
+    bootstrap::build_server_on(&config, support::memory_pool().await)
+        .await
+        .expect("server builds")
+}
+
+fn set_cookies(headers: &axum::http::HeaderMap) -> Vec<String> {
+    headers
+        .get_all(header::SET_COOKIE)
+        .iter()
+        .map(|v| v.to_str().unwrap().to_string())
+        .collect()
+}
+
+#[tokio::test]
+async fn registration_is_refused_when_allow_registration_is_false() {
+    let mut config = support::test_config();
+    config.server.allow_registration = false;
+    let router = server_with(config).await;
+
+    let form = Request::builder()
+        .method(Method::POST)
+        .uri("/register")
+        .header(header::CONTENT_TYPE, "application/x-www-form-urlencoded")
+        .body(Body::from(format!(
+            "email=a%40example.com&username=alice&password={}&_csrf=x",
+            support::PASSWORD
+        )))
+        .unwrap();
+    let (status, headers, _) = support::send(&router, form).await;
+    assert_eq!(status, 303, "classic form redirects away");
+    assert_eq!(headers.get(header::LOCATION).unwrap(), "/");
+    assert!(
+        support::cookie_value(&headers, "token").is_none(),
+        "no session issued"
+    );
+
+    let (status, _, _) = support::send(
+        &router,
+        support::json_request(
+            Method::POST,
+            "/api/v1/auth/register",
+            None,
+            serde_json::json!({
+                "email": "a@example.com",
+                "username": "alice",
+                "password": support::PASSWORD,
+            }),
+        ),
+    )
+    .await;
+    assert_eq!(status, 401, "JSON register is refused");
+}
+
+#[tokio::test]
+async fn secure_cookies_setting_marks_cookies_secure() {
+    for secure in [true, false] {
+        let mut config = support::test_config();
+        config.server.secure_cookies = secure;
+        let router = server_with(config).await;
+
+        let (status, headers, _) = support::send(&router, support::get("/register", None)).await;
+        assert_eq!(status, 200);
+        let cookies = set_cookies(&headers);
+        assert!(!cookies.is_empty(), "csrf cookie is set");
+        assert!(
+            cookies.iter().all(|c| c.contains("Secure") == secure),
+            "secure_cookies={secure}: {cookies:?}"
+        );
+
+        let csrf = support::cookie_value(&headers, "csrf").expect("csrf cookie");
+        let form = Request::builder()
+            .method(Method::POST)
+            .uri("/register")
+            .header(header::CONTENT_TYPE, "application/x-www-form-urlencoded")
+            .header(header::COOKIE, format!("csrf={csrf}"))
+            .body(Body::from(format!(
+                "email=a%40example.com&username=alice&password={}&_csrf={csrf}",
+                support::PASSWORD
+            )))
+            .unwrap();
+        let (status, headers, _) = support::send(&router, form).await;
+        assert_eq!(status, 303);
+        let token_cookie = set_cookies(&headers)
+            .into_iter()
+            .find(|c| c.starts_with("token="))
+            .expect("session cookie");
+        assert_eq!(
+            token_cookie.contains("Secure"),
+            secure,
+            "session cookie, secure_cookies={secure}: {token_cookie}"
+        );
+    }
+}

crates/bootstrap/tests/http_handlers/extractors_test.rs

@@ -359,3 +359,49 @@ async fn admin_user_surfaces_a_repository_error_as_500() {
         .unwrap();
     assert_eq!(resp.status(), StatusCode::INTERNAL_SERVER_ERROR);
 }
+
+async fn path_id_handler(
+    http_axum::extractors::PathId(id): http_axum::extractors::PathId<u32>,
+) -> String {
+    id.to_string()
+}
+
+async fn refusal_code(resp: axum::response::Response) -> String {
+    let bytes = axum::body::to_bytes(resp.into_body(), usize::MAX)
+        .await
+        .unwrap();
+    let v: serde_json::Value = serde_json::from_slice(&bytes).expect("refusal body is JSON");
+    v["code"].as_str().unwrap().to_string()
+}
+
+#[tokio::test]
+async fn path_extractor_on_a_route_without_params_is_refused_as_internal() {
+    let app = Router::new().route("/no-params", get(path_id_handler));
+    let resp = app
+        .oneshot(
+            Request::builder()
+                .uri("/no-params")
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), StatusCode::INTERNAL_SERVER_ERROR);
+    assert_eq!(refusal_code(resp).await, "INTERNAL");
+}
+
+#[tokio::test]
+async fn path_extractor_with_an_unparseable_param_is_refused_as_invalid_input() {
+    let app = Router::new().route("/items/{id}", get(path_id_handler));
+    let resp = app
+        .oneshot(
+            Request::builder()
+                .uri("/items/abc")
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), StatusCode::BAD_REQUEST);
+    assert_eq!(refusal_code(resp).await, "INVALID_INPUT");
+}