224 lines
7.2 KiB
Rust
224 lines
7.2 KiB
Rust
//! Account deletion over HTTP: JSON and classic endpoints on the real wiring.
|
|
|
|
mod support;
|
|
|
|
use axum::{
|
|
body::Body,
|
|
http::{Method, Request, header},
|
|
};
|
|
use support::{PASSWORD, Session, get, json_request, send};
|
|
|
|
async fn promote(pool: &sqlx::SqlitePool, user_id: &str) {
|
|
sqlx::query("UPDATE users SET role = 'admin' WHERE id = ?")
|
|
.bind(user_id)
|
|
.execute(pool)
|
|
.await
|
|
.unwrap();
|
|
}
|
|
|
|
fn delete_json(uri: &str, token: &str, password: &str) -> Request<Body> {
|
|
json_request(
|
|
Method::DELETE,
|
|
uri,
|
|
Some(token),
|
|
serde_json::json!({ "password": password }),
|
|
)
|
|
}
|
|
|
|
fn classic_post(uri: &str, cookie: &str, password: &str) -> Request<Body> {
|
|
let csrf = cookie
|
|
.split(';')
|
|
.find_map(|c| c.trim().strip_prefix("csrf="))
|
|
.unwrap();
|
|
Request::builder()
|
|
.method(Method::POST)
|
|
.uri(uri)
|
|
.header(header::CONTENT_TYPE, "application/x-www-form-urlencoded")
|
|
.header(header::COOKIE, cookie)
|
|
.body(Body::from(format!("password={password}&_csrf={csrf}")))
|
|
.unwrap()
|
|
}
|
|
|
|
fn location(headers: &axum::http::HeaderMap) -> String {
|
|
headers
|
|
.get(header::LOCATION)
|
|
.map(|v| v.to_str().unwrap().to_string())
|
|
.unwrap_or_default()
|
|
}
|
|
|
|
async fn two_users() -> (axum::Router, sqlx::SqlitePool, Session, Session) {
|
|
let (router, pool) = support::server().await;
|
|
let alice = support::register(&router, "alice", "alice@example.com").await;
|
|
let bob = support::register(&router, "bob", "bob@example.com").await;
|
|
(router, pool, alice, bob)
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn self_delete_with_a_wrong_password_is_refused_and_keeps_the_account() {
|
|
let (router, _pool, alice, _bob) = two_users().await;
|
|
let (status, _, body) = send(
|
|
&router,
|
|
delete_json("/api/v1/users/me", &alice.token, "nope"),
|
|
)
|
|
.await;
|
|
assert_eq!(status, 401, "{body}");
|
|
let (status, _, _) = send(&router, get(&format!("/users/{}", alice.user_id), None)).await;
|
|
assert_eq!(status, 200);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn self_delete_removes_the_account_and_revokes_the_token() {
|
|
let (router, _pool, alice, _bob) = two_users().await;
|
|
let (status, _, body) = send(
|
|
&router,
|
|
delete_json("/api/v1/users/me", &alice.token, PASSWORD),
|
|
)
|
|
.await;
|
|
assert_eq!(status, 204, "{body}");
|
|
|
|
let req = Request::builder()
|
|
.uri("/api/v1/profile")
|
|
.header(header::AUTHORIZATION, format!("Bearer {}", alice.token))
|
|
.body(Body::empty())
|
|
.unwrap();
|
|
let (status, _, _) = send(&router, req).await;
|
|
assert_eq!(status, 401, "token of a deleted account");
|
|
|
|
for uri in [
|
|
format!("/users/{}", alice.user_id),
|
|
format!("/users/{}?embed=true", alice.user_id),
|
|
] {
|
|
let (status, _, _) = send(&router, get(&uri, None)).await;
|
|
assert_eq!(status, 404, "{uri}");
|
|
}
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn a_standard_user_cannot_delete_someone_else() {
|
|
let (router, _pool, alice, bob) = two_users().await;
|
|
let uri = format!("/api/v1/users/{}", bob.user_id);
|
|
let (status, _, body) = send(&router, delete_json(&uri, &alice.token, PASSWORD)).await;
|
|
assert_eq!(status, 403, "{body}");
|
|
let (status, _, _) = send(&router, get(&format!("/users/{}", bob.user_id), None)).await;
|
|
assert_eq!(status, 200);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn an_admin_deletes_another_account() {
|
|
let (router, pool, alice, bob) = two_users().await;
|
|
promote(&pool, &alice.user_id).await;
|
|
let uri = format!("/api/v1/users/{}", bob.user_id);
|
|
|
|
let (status, _, _) = send(&router, delete_json(&uri, &alice.token, "nope")).await;
|
|
assert_eq!(status, 401, "wrong admin password");
|
|
|
|
let (status, _, body) = send(&router, delete_json(&uri, &alice.token, PASSWORD)).await;
|
|
assert_eq!(status, 204, "{body}");
|
|
|
|
for uri in [
|
|
format!("/users/{}", bob.user_id),
|
|
format!("/users/{}?embed=true", bob.user_id),
|
|
] {
|
|
let (status, _, _) = send(&router, get(&uri, None)).await;
|
|
assert_eq!(status, 404, "{uri}");
|
|
}
|
|
let (status, _, _) = send(&router, delete_json(&uri, &alice.token, PASSWORD)).await;
|
|
assert_eq!(status, 404, "already deleted");
|
|
|
|
#[cfg(feature = "federation")]
|
|
{
|
|
let req = Request::builder()
|
|
.uri(format!("/users/{}", bob.user_id))
|
|
.header(header::ACCEPT, "application/activity+json")
|
|
.body(Body::empty())
|
|
.unwrap();
|
|
let (status, _, _) = send(&router, req).await;
|
|
assert_eq!(status, 410, "actor endpoint of a deleted account");
|
|
}
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn the_last_admin_cannot_be_deleted() {
|
|
let (router, pool, alice, _bob) = two_users().await;
|
|
promote(&pool, &alice.user_id).await;
|
|
let (status, _, body) = send(
|
|
&router,
|
|
delete_json("/api/v1/users/me", &alice.token, PASSWORD),
|
|
)
|
|
.await;
|
|
assert_eq!(status, 409, "{body}");
|
|
let (status, _, _) = send(&router, get(&format!("/users/{}", alice.user_id), None)).await;
|
|
assert_eq!(status, 200);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn classic_self_delete_logs_out_and_redirects_home() {
|
|
let (router, _pool, alice, _bob) = two_users().await;
|
|
|
|
let (status, headers, _) = send(
|
|
&router,
|
|
classic_post("/settings/account/delete", &alice.cookie, "nope"),
|
|
)
|
|
.await;
|
|
assert_eq!(status, 303);
|
|
assert!(
|
|
location(&headers).starts_with("/settings/profile?error="),
|
|
"{headers:?}"
|
|
);
|
|
assert!(
|
|
support::cookie_value(&headers, "token").is_none(),
|
|
"a wrong password must not log out"
|
|
);
|
|
|
|
let (status, headers, _) = send(
|
|
&router,
|
|
classic_post("/settings/account/delete", &alice.cookie, PASSWORD),
|
|
)
|
|
.await;
|
|
assert_eq!(status, 303);
|
|
assert_eq!(location(&headers), "/");
|
|
assert_eq!(
|
|
support::cookie_value(&headers, "token").as_deref(),
|
|
Some("")
|
|
);
|
|
|
|
let (status, _, _) = send(&router, get(&format!("/users/{}", alice.user_id), None)).await;
|
|
assert_eq!(status, 404);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn classic_self_delete_requires_the_csrf_token() {
|
|
let (router, _pool, alice, _bob) = two_users().await;
|
|
let req = Request::builder()
|
|
.method(Method::POST)
|
|
.uri("/settings/account/delete")
|
|
.header(header::CONTENT_TYPE, "application/x-www-form-urlencoded")
|
|
.header(header::COOKIE, &alice.cookie)
|
|
.body(Body::from(format!("password={PASSWORD}&_csrf=wrong")))
|
|
.unwrap();
|
|
let (status, _, _) = send(&router, req).await;
|
|
assert_eq!(status, 403);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn classic_admin_delete_redirects_to_the_member_list() {
|
|
let (router, pool, alice, bob) = two_users().await;
|
|
let uri = format!("/users/{}/delete", bob.user_id);
|
|
|
|
let (status, headers, _) = send(&router, classic_post(&uri, &alice.cookie, PASSWORD)).await;
|
|
assert_eq!(status, 303);
|
|
assert!(
|
|
location(&headers).contains("error="),
|
|
"non-admin: {headers:?}"
|
|
);
|
|
|
|
promote(&pool, &alice.user_id).await;
|
|
let (status, headers, _) = send(&router, classic_post(&uri, &alice.cookie, PASSWORD)).await;
|
|
assert_eq!(status, 303);
|
|
assert_eq!(location(&headers), "/users");
|
|
assert!(support::cookie_value(&headers, "token").is_none());
|
|
|
|
let (status, _, _) = send(&router, get(&format!("/users/{}", bob.user_id), None)).await;
|
|
assert_eq!(status, 404);
|
|
}
|