papercrate/backend/tests/api_tokens_flow.rs

mod common;

use anyhow::Result;
use axum::body::Body;
use axum::http::{header, Method, Request, StatusCode};
use base64::engine::general_purpose::STANDARD as BASE64;
use base64::Engine;
use common::{acquire_db_lock, body_to_vec, TestApp};
use diesel::prelude::*;
use papercrate::models::{ApiCapability, ApiToken};
use papercrate::routes::webdav;
use papercrate::schema::api_tokens;
use serde::Deserialize;
use serde_json::json;
use tower::ServiceExt;
use uuid::Uuid;

const LEGACY_WEBDAV_CAPS: &[&str] = &[
    "documents:edit",
    "documents:read",
    "documents:upload",
    "documents:write",
    "folders:edit",
    "folders:read",
    "folders:write",
    "webdav:read",
];

const OWNER_CAPS: &[&str] = &[
    "correspondents:edit",
    "correspondents:read",
    "correspondents:write",
    "documents:edit",
    "documents:read",
    "documents:upload",
    "documents:write",
    "folders:edit",
    "folders:read",
    "folders:write",
    "profile:read",
    "profile:write",
    "tags:edit",
    "tags:read",
    "tags:write",
    "webdav:read",
    "webdav:write",
    "capability_sets:read",
    "capability_sets:write",
];

#[derive(Debug, Deserialize)]
struct TokenInfo {
    id: Uuid,
    label: Option<String>,
    last_used_at: Option<String>,
    revoked_at: Option<String>,
    capabilities: Vec<ApiCapability>,
}

#[derive(Debug, Deserialize)]
struct CreateTokenResponse {
    token: String,
    #[serde(rename = "token_info")]
    info: TokenInfo,
}

#[derive(Debug, Deserialize)]
struct LoginResponseView {
    access_token: String,
    token_type: String,
    expires_in: i64,
    tenant: TenantView,
}

#[derive(Debug, Deserialize)]
struct TenantView {
    id: Uuid,
    name: String,
}

#[tokio::test]
async fn api_token_crud_flow() -> Result<()> {
    let _guard = acquire_db_lock().await;
    let app = TestApp::new().await?;

    let username = "alice";
    let password = "correct horse battery";
    app.insert_user(username, password, "admin").await?;
    let access_token = app.login_token(username, password).await?;

    let created = create_token(
        &app,
        &access_token,
        json!({ "label": "dav", "capabilities": LEGACY_WEBDAV_CAPS }),
    )
    .await?;
    let token_id = created.info.id;
    assert_eq!(created.info.label.as_deref(), Some("dav"));
    assert!(created.info.last_used_at.is_none());
    assert_capabilities(&created.info.capabilities, LEGACY_WEBDAV_CAPS);

    let regenerated = regenerate_token(&app, &access_token, token_id).await?;
    assert_eq!(regenerated.info.id, token_id);
    assert_ne!(regenerated.token, created.token);
    assert!(regenerated.info.last_used_at.is_none());

    let updated = update_token_capabilities(
        &app,
        &access_token,
        token_id,
        json!({ "capabilities": OWNER_CAPS }),
    )
    .await?;
    assert_capabilities(&updated.capabilities, OWNER_CAPS);

    let listed = list_tokens(&app, &access_token).await?;
    assert_eq!(listed.len(), 1);
    assert_eq!(listed[0].id, token_id);

    let tenant_id_for_token = app
        .with_conn(move |conn| {
            let tenant_id = api_tokens::table
                .find(token_id)
                .select(api_tokens::tenant_id)
                .first::<Uuid>(conn)?;
            Ok::<_, anyhow::Error>(tenant_id)
        })
        .await?;

    let exchange = exchange_token(&app, &regenerated.token).await?;
    assert_eq!(exchange.token_type, "Bearer");
    assert!(!exchange.access_token.is_empty());
    assert!(exchange.expires_in > 0);
    assert_eq!(exchange.tenant.id, tenant_id_for_token);
    assert!(!exchange.tenant.name.is_empty());

    delete_token(&app, &access_token, token_id).await?;

    let listed_after = list_tokens(&app, &access_token).await?;
    assert_eq!(listed_after.len(), 1);
    assert_eq!(listed_after[0].id, token_id);
    assert!(listed_after[0].revoked_at.is_some());

    app.cleanup().await?;
    Ok(())
}

#[tokio::test]
async fn webdav_basic_auth_uses_api_tokens() -> Result<()> {
    let _guard = acquire_db_lock().await;
    let app = TestApp::new().await?;

    let username = "bruce";
    let password = "wayne";
    app.insert_user(username, password, "admin").await?;
    let access_token = app.login_token(username, password).await?;

    let created = create_token(
        &app,
        &access_token,
        json!({ "label": "webdav", "capabilities": LEGACY_WEBDAV_CAPS }),
    )
    .await?;
    let token_id = created.info.id;

    let router = webdav::create_router().with_state(app.state.clone());
    let original_secret = created.token.clone();
    let auth_header = format!(
        "Basic {}",
        BASE64.encode(format!("{}:{}", username, original_secret))
    );

    let propfind = Method::from_bytes(b"PROPFIND")?;
    let success_request = Request::builder()
        .method(propfind.clone())
        .uri("/")
        .header(header::AUTHORIZATION, auth_header.clone())
        .header("depth", "0")
        .body(Body::empty())?;
    let response = router.clone().oneshot(success_request).await?;
    assert_eq!(response.status(), StatusCode::MULTI_STATUS);

    let used = app
        .with_conn(move |conn| {
            let record = api_tokens::table.find(token_id).first::<ApiToken>(conn)?;
            Ok::<_, anyhow::Error>(record.last_used_at)
        })
        .await?;
    assert!(used.is_some());

    let regenerated = regenerate_token(&app, &access_token, token_id).await?;
    assert_ne!(regenerated.token, original_secret);

    let unused_after_regen = app
        .with_conn(move |conn| {
            let record = api_tokens::table.find(token_id).first::<ApiToken>(conn)?;
            Ok::<_, anyhow::Error>(record.last_used_at)
        })
        .await?;
    assert!(unused_after_regen.is_none());

    let old_secret_request = Request::builder()
        .method(propfind.clone())
        .uri("/")
        .header(
            header::AUTHORIZATION,
            format!(
                "Basic {}",
                BASE64.encode(format!("{}:{}", username, original_secret))
            ),
        )
        .header("depth", "0")
        .body(Body::empty())?;
    let old_secret_response = router.clone().oneshot(old_secret_request).await?;
    assert_eq!(old_secret_response.status(), StatusCode::UNAUTHORIZED);

    let new_secret_header = format!(
        "Basic {}",
        BASE64.encode(format!("{}:{}", username, regenerated.token))
    );

    let success_request = Request::builder()
        .method(propfind.clone())
        .uri("/")
        .header(header::AUTHORIZATION, new_secret_header.clone())
        .header("depth", "0")
        .body(Body::empty())?;
    let response = router.clone().oneshot(success_request).await?;
    assert_eq!(response.status(), StatusCode::MULTI_STATUS);

    // Token without webdav_read cannot authenticate.
    let limited_token = create_token(
        &app,
        &access_token,
        json!({
            "label": "limited",
            "capabilities": ["documents:read"]
        }),
    )
    .await?;

    let limited_header = format!(
        "Basic {}",
        BASE64.encode(format!("{}:{}", username, limited_token.token))
    );

    let limited_request = Request::builder()
        .method(propfind.clone())
        .uri("/")
        .header(header::AUTHORIZATION, limited_header.clone())
        .header("depth", "0")
        .body(Body::empty())?;
    let limited_response = router.clone().oneshot(limited_request).await?;
    assert_eq!(limited_response.status(), StatusCode::UNAUTHORIZED);

    let _ = app
        .patch_json(
            &format!("/api/profile/api-tokens/{}", limited_token.info.id),
            &json!({
                "capabilities": ["documents:read", "webdav:read"]
            }),
            Some(&access_token),
        )
        .await?;

    let upgraded_request = Request::builder()
        .method(propfind.clone())
        .uri("/")
        .header(header::AUTHORIZATION, limited_header)
        .header("depth", "0")
        .body(Body::empty())?;
    let upgraded_response = router.clone().oneshot(upgraded_request).await?;
    assert_eq!(upgraded_response.status(), StatusCode::MULTI_STATUS);

    delete_token(&app, &access_token, token_id).await?;

    let failure_request = Request::builder()
        .method(propfind)
        .uri("/")
        .header(header::AUTHORIZATION, new_secret_header)
        .header("depth", "0")
        .body(Body::empty())?;
    let failure_response = router.oneshot(failure_request).await?;
    assert_eq!(failure_response.status(), StatusCode::UNAUTHORIZED);

    app.cleanup().await?;
    Ok(())
}

async fn create_token(
    app: &TestApp,
    access_token: &str,
    payload: serde_json::Value,
) -> Result<CreateTokenResponse> {
    let response = app
        .post_json("/api/profile/api-tokens", &payload, Some(access_token))
        .await?;
    assert_eq!(response.status(), StatusCode::CREATED);
    let body = body_to_vec(response.into_body()).await?;
    Ok(serde_json::from_slice(&body)?)
}

async fn regenerate_token(
    app: &TestApp,
    access_token: &str,
    token_id: Uuid,
) -> Result<CreateTokenResponse> {
    let response = app
        .post_json(
            &format!("/api/profile/api-tokens/{token_id}/regenerate"),
            &json!({}),
            Some(access_token),
        )
        .await?;
    assert_eq!(response.status(), StatusCode::OK);
    let body = body_to_vec(response.into_body()).await?;
    Ok(serde_json::from_slice(&body)?)
}

async fn update_token_capabilities(
    app: &TestApp,
    access_token: &str,
    token_id: Uuid,
    payload: serde_json::Value,
) -> Result<TokenInfo> {
    let response = app
        .patch_json(
            &format!("/api/profile/api-tokens/{token_id}"),
            &payload,
            Some(access_token),
        )
        .await?;
    assert_eq!(response.status(), StatusCode::OK);
    let body = body_to_vec(response.into_body()).await?;
    Ok(serde_json::from_slice(&body)?)
}

async fn list_tokens(app: &TestApp, access_token: &str) -> Result<Vec<TokenInfo>> {
    let response = app
        .get("/api/profile/api-tokens", Some(access_token))
        .await?;
    assert_eq!(response.status(), StatusCode::OK);
    let body = body_to_vec(response.into_body()).await?;
    Ok(serde_json::from_slice(&body)?)
}

async fn delete_token(app: &TestApp, access_token: &str, token_id: Uuid) -> Result<()> {
    let response = app
        .delete(
            &format!("/api/profile/api-tokens/{token_id}"),
            Some(access_token),
        )
        .await?;
    assert_eq!(response.status(), StatusCode::NO_CONTENT);
    Ok(())
}

fn assert_capabilities(actual: &[ApiCapability], expected: &[&str]) {
    assert_eq!(actual.len(), expected.len());
    for capability in expected {
        assert!(
            actual
                .iter()
                .any(|candidate| candidate.as_str() == *capability),
            "capability '{}' not present",
            capability
        );
    }
}
async fn exchange_token(app: &TestApp, api_token: &str) -> Result<LoginResponseView> {
    let response = app
        .post_json(
            "/api/auth/exchange-api-token",
            &json!({ "api_token": api_token }),
            None,
        )
        .await?;
    assert_eq!(response.status(), StatusCode::OK);
    let body = body_to_vec(response.into_body()).await?;
    Ok(serde_json::from_slice(&body)?)
}