312 lines
11 KiB
Rust
312 lines
11 KiB
Rust
//! Account deletion over HTTP: JSON and classic endpoints on the real wiring.
|
|
|
|
mod support;
|
|
|
|
use axum::{
|
|
body::Body,
|
|
http::{Method, Request, header},
|
|
};
|
|
use support::{PASSWORD, Session, get, json_request, send};
|
|
|
|
async fn promote(pool: &sqlx::SqlitePool, user_id: &str) {
|
|
sqlx::query("UPDATE users SET role = 'admin' WHERE id = ?")
|
|
.bind(user_id)
|
|
.execute(pool)
|
|
.await
|
|
.unwrap();
|
|
}
|
|
|
|
fn delete_json(uri: &str, token: &str, password: &str) -> Request<Body> {
|
|
json_request(
|
|
Method::DELETE,
|
|
uri,
|
|
Some(token),
|
|
serde_json::json!({ "password": password }),
|
|
)
|
|
}
|
|
|
|
fn classic_post(uri: &str, cookie: &str, password: &str) -> Request<Body> {
|
|
let csrf = cookie
|
|
.split(';')
|
|
.find_map(|c| c.trim().strip_prefix("csrf="))
|
|
.unwrap();
|
|
Request::builder()
|
|
.method(Method::POST)
|
|
.uri(uri)
|
|
.header(header::CONTENT_TYPE, "application/x-www-form-urlencoded")
|
|
.header(header::COOKIE, cookie)
|
|
.body(Body::from(format!("password={password}&_csrf={csrf}")))
|
|
.unwrap()
|
|
}
|
|
|
|
fn location(headers: &axum::http::HeaderMap) -> String {
|
|
headers
|
|
.get(header::LOCATION)
|
|
.map(|v| v.to_str().unwrap().to_string())
|
|
.unwrap_or_default()
|
|
}
|
|
|
|
async fn two_users() -> (axum::Router, sqlx::SqlitePool, Session, Session) {
|
|
let (router, pool) = support::server().await;
|
|
let alice = support::register(&router, "alice", "alice@example.com").await;
|
|
let bob = support::register(&router, "bob", "bob@example.com").await;
|
|
(router, pool, alice, bob)
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn self_delete_with_a_wrong_password_is_refused_and_keeps_the_account() {
|
|
let (router, _pool, alice, _bob) = two_users().await;
|
|
let (status, _, body) = send(
|
|
&router,
|
|
delete_json("/api/v1/users/me", &alice.token, "nope"),
|
|
)
|
|
.await;
|
|
assert_eq!(status, 401, "{body}");
|
|
assert!(body.contains("\"INVALID_CREDENTIALS\""), "{body}");
|
|
let (status, _, _) = send(&router, get(&format!("/users/{}", alice.user_id), None)).await;
|
|
assert_eq!(status, 200);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn self_delete_removes_the_account_and_revokes_the_token() {
|
|
let (router, _pool, alice, _bob) = two_users().await;
|
|
let (status, _, body) = send(
|
|
&router,
|
|
delete_json("/api/v1/users/me", &alice.token, PASSWORD),
|
|
)
|
|
.await;
|
|
assert_eq!(status, 204, "{body}");
|
|
|
|
let req = Request::builder()
|
|
.uri("/api/v1/profile")
|
|
.header(header::AUTHORIZATION, format!("Bearer {}", alice.token))
|
|
.body(Body::empty())
|
|
.unwrap();
|
|
let (status, _, _) = send(&router, req).await;
|
|
assert_eq!(status, 401, "token of a deleted account");
|
|
|
|
for uri in [
|
|
format!("/users/{}", alice.user_id),
|
|
format!("/users/{}?embed=true", alice.user_id),
|
|
] {
|
|
let (status, _, _) = send(&router, get(&uri, None)).await;
|
|
assert_eq!(status, 404, "{uri}");
|
|
}
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn a_standard_user_cannot_delete_someone_else() {
|
|
let (router, _pool, alice, bob) = two_users().await;
|
|
let uri = format!("/api/v1/users/{}", bob.user_id);
|
|
let (status, _, body) = send(&router, delete_json(&uri, &alice.token, PASSWORD)).await;
|
|
assert_eq!(status, 403, "{body}");
|
|
let (status, _, _) = send(&router, get(&format!("/users/{}", bob.user_id), None)).await;
|
|
assert_eq!(status, 200);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn an_admin_deletes_another_account() {
|
|
let (router, pool, alice, bob) = two_users().await;
|
|
promote(&pool, &alice.user_id).await;
|
|
let uri = format!("/api/v1/users/{}", bob.user_id);
|
|
|
|
let (status, _, body) = send(&router, delete_json(&uri, &alice.token, "nope")).await;
|
|
assert_eq!(status, 401, "wrong admin password");
|
|
assert!(body.contains("\"INVALID_CREDENTIALS\""), "{body}");
|
|
|
|
let (status, _, body) = send(&router, delete_json(&uri, &alice.token, PASSWORD)).await;
|
|
assert_eq!(status, 204, "{body}");
|
|
|
|
for uri in [
|
|
format!("/users/{}", bob.user_id),
|
|
format!("/users/{}?embed=true", bob.user_id),
|
|
] {
|
|
let (status, _, _) = send(&router, get(&uri, None)).await;
|
|
assert_eq!(status, 404, "{uri}");
|
|
}
|
|
let (status, _, _) = send(&router, delete_json(&uri, &alice.token, PASSWORD)).await;
|
|
assert_eq!(status, 404, "already deleted");
|
|
|
|
#[cfg(feature = "federation")]
|
|
{
|
|
let req = Request::builder()
|
|
.uri(format!("/users/{}", bob.user_id))
|
|
.header(header::ACCEPT, "application/activity+json")
|
|
.body(Body::empty())
|
|
.unwrap();
|
|
let (status, _, _) = send(&router, req).await;
|
|
assert_eq!(status, 410, "actor endpoint of a deleted account");
|
|
}
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn the_last_admin_cannot_be_deleted() {
|
|
let (router, pool, alice, _bob) = two_users().await;
|
|
promote(&pool, &alice.user_id).await;
|
|
let (status, _, body) = send(
|
|
&router,
|
|
delete_json("/api/v1/users/me", &alice.token, PASSWORD),
|
|
)
|
|
.await;
|
|
assert_eq!(status, 409, "{body}");
|
|
let (status, _, _) = send(&router, get(&format!("/users/{}", alice.user_id), None)).await;
|
|
assert_eq!(status, 200);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn classic_self_delete_logs_out_and_redirects_home() {
|
|
let (router, _pool, alice, _bob) = two_users().await;
|
|
|
|
let (status, headers, _) = send(
|
|
&router,
|
|
classic_post("/settings/account/delete", &alice.cookie, "nope"),
|
|
)
|
|
.await;
|
|
assert_eq!(status, 303);
|
|
assert!(
|
|
location(&headers).starts_with("/settings/profile?error="),
|
|
"{headers:?}"
|
|
);
|
|
assert!(
|
|
support::cookie_value(&headers, "token").is_none(),
|
|
"a wrong password must not log out"
|
|
);
|
|
|
|
let (status, headers, _) = send(
|
|
&router,
|
|
classic_post("/settings/account/delete", &alice.cookie, PASSWORD),
|
|
)
|
|
.await;
|
|
assert_eq!(status, 303);
|
|
assert_eq!(location(&headers), "/");
|
|
assert_eq!(
|
|
support::cookie_value(&headers, "token").as_deref(),
|
|
Some("")
|
|
);
|
|
|
|
let (status, _, _) = send(&router, get(&format!("/users/{}", alice.user_id), None)).await;
|
|
assert_eq!(status, 404);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn classic_self_delete_requires_the_csrf_token() {
|
|
let (router, _pool, alice, _bob) = two_users().await;
|
|
let req = Request::builder()
|
|
.method(Method::POST)
|
|
.uri("/settings/account/delete")
|
|
.header(header::CONTENT_TYPE, "application/x-www-form-urlencoded")
|
|
.header(header::COOKIE, &alice.cookie)
|
|
.body(Body::from(format!("password={PASSWORD}&_csrf=wrong")))
|
|
.unwrap();
|
|
let (status, _, _) = send(&router, req).await;
|
|
assert_eq!(status, 403);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn classic_admin_delete_redirects_to_the_member_list() {
|
|
let (router, pool, alice, bob) = two_users().await;
|
|
let uri = format!("/users/{}/delete", bob.user_id);
|
|
|
|
let (status, headers, _) = send(&router, classic_post(&uri, &alice.cookie, PASSWORD)).await;
|
|
assert_eq!(status, 403, "non-admin: {headers:?}");
|
|
|
|
promote(&pool, &alice.user_id).await;
|
|
let (status, headers, _) = send(&router, classic_post(&uri, &alice.cookie, PASSWORD)).await;
|
|
assert_eq!(status, 303);
|
|
assert_eq!(location(&headers), "/users");
|
|
assert!(support::cookie_value(&headers, "token").is_none());
|
|
|
|
let (status, _, _) = send(&router, get(&format!("/users/{}", bob.user_id), None)).await;
|
|
assert_eq!(status, 404);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn classic_admin_delete_requires_the_csrf_token() {
|
|
let (router, pool, alice, bob) = two_users().await;
|
|
promote(&pool, &alice.user_id).await;
|
|
let req = Request::builder()
|
|
.method(Method::POST)
|
|
.uri(format!("/users/{}/delete", bob.user_id))
|
|
.header(header::CONTENT_TYPE, "application/x-www-form-urlencoded")
|
|
.header(header::COOKIE, &alice.cookie)
|
|
.body(Body::from(format!("password={PASSWORD}&_csrf=wrong")))
|
|
.unwrap();
|
|
let (status, _, _) = send(&router, req).await;
|
|
assert_eq!(status, 403);
|
|
let (status, _, _) = send(&router, get(&format!("/users/{}", bob.user_id), None)).await;
|
|
assert_eq!(status, 200, "target must survive a CSRF rejection");
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn a_non_admin_classic_delete_of_someone_else_is_forbidden() {
|
|
let (router, _pool, alice, bob) = two_users().await;
|
|
let uri = format!("/users/{}/delete", bob.user_id);
|
|
let (status, _, _) = send(&router, classic_post(&uri, &alice.cookie, PASSWORD)).await;
|
|
assert_eq!(status, 403);
|
|
let (status, _, _) = send(&router, get(&format!("/users/{}", bob.user_id), None)).await;
|
|
assert_eq!(status, 200);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn classic_admin_self_delete_logs_out_unless_last_admin() {
|
|
let (router, pool, alice, bob) = two_users().await;
|
|
promote(&pool, &alice.user_id).await;
|
|
let uri = format!("/users/{}/delete", alice.user_id);
|
|
|
|
// Sole admin: refused, redirected back with an error, still logged in.
|
|
let (status, headers, _) = send(&router, classic_post(&uri, &alice.cookie, PASSWORD)).await;
|
|
assert_eq!(status, 303);
|
|
assert!(location(&headers).contains("error="), "{headers:?}");
|
|
assert!(support::cookie_value(&headers, "token").is_none());
|
|
let (status, _, _) = send(&router, get(&format!("/users/{}", alice.user_id), None)).await;
|
|
assert_eq!(status, 200);
|
|
|
|
// With a second admin the self-delete goes through and ends the session.
|
|
promote(&pool, &bob.user_id).await;
|
|
let (status, headers, _) = send(&router, classic_post(&uri, &alice.cookie, PASSWORD)).await;
|
|
assert_eq!(status, 303);
|
|
assert_eq!(location(&headers), "/");
|
|
assert_eq!(
|
|
support::cookie_value(&headers, "token").as_deref(),
|
|
Some("")
|
|
);
|
|
let (status, _, _) = send(&router, get(&format!("/users/{}", alice.user_id), None)).await;
|
|
assert_eq!(status, 404);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn delete_forms_render_only_where_they_apply() {
|
|
let (router, pool, alice, bob) = two_users().await;
|
|
let own_delete = "action=\"/settings/account/delete\"";
|
|
let user_delete = |id: &str| format!("action=\"/users/{id}/delete\"");
|
|
|
|
let (_, _, body) = send(&router, get("/settings/profile", Some(&alice.cookie))).await;
|
|
assert!(body.contains(own_delete), "owner settings page");
|
|
|
|
// A non-admin viewing someone else, and anonymous viewers, see no form.
|
|
let bob_page = format!("/users/{}", bob.user_id);
|
|
let (_, _, body) = send(&router, get(&bob_page, Some(&alice.cookie))).await;
|
|
assert!(!body.contains(&user_delete(&bob.user_id)), "non-admin");
|
|
|
|
promote(&pool, &alice.user_id).await;
|
|
let (_, _, body) = send(&router, get(&bob_page, Some(&alice.cookie))).await;
|
|
assert!(body.contains(&user_delete(&bob.user_id)), "admin on other");
|
|
|
|
let (_, _, body) = send(
|
|
&router,
|
|
get(&format!("/users/{}", alice.user_id), Some(&alice.cookie)),
|
|
)
|
|
.await;
|
|
assert!(
|
|
!body.contains(&user_delete(&alice.user_id)),
|
|
"admin on self"
|
|
);
|
|
|
|
let (_, _, body) = send(
|
|
&router,
|
|
get(&format!("{bob_page}?embed=true"), Some(&alice.cookie)),
|
|
)
|
|
.await;
|
|
assert!(!body.contains("/delete"), "embed page");
|
|
}
|