papercrate/backend/tests/webdav_flow.rs

mod common;

use anyhow::Result;
use axum::body::Body;
use axum::http::{header, Method, Request, StatusCode};
use base64::engine::general_purpose::STANDARD as BASE64;
use base64::Engine;
use common::{acquire_db_lock, body_to_vec, TestApp};
use diesel::prelude::*;
use papercrate::models::WebdavToken;
use papercrate::routes::webdav;
use papercrate::schema::webdav_tokens;
use serde::Deserialize;
use serde_json::json;
use tower::ServiceExt;
use uuid::Uuid;

#[derive(Deserialize)]
struct TokenInfo {
    id: Uuid,
    label: Option<String>,
    last_used_at: Option<String>,
    revoked_at: Option<String>,
}

#[derive(Deserialize)]
struct CreateTokenResponse {
    token: String,
    #[serde(rename = "token_info")]
    info: TokenInfo,
}

#[tokio::test]
async fn webdav_token_api_crud() -> Result<()> {
    let _guard = acquire_db_lock().await;
    let app = TestApp::new().await?;

    let username = "alice";
    let password = "correct horse battery";
    app.insert_user(username, password, "admin").await?;
    let access_token = app.login_token(username, password).await?;

    let create_response = app
        .post_json(
            "/api/profile/webdav-tokens",
            &json!({ "label": "dav" }),
            Some(&access_token),
        )
        .await?;
    assert_eq!(create_response.status(), StatusCode::CREATED);
    let create_body = body_to_vec(create_response.into_body()).await?;
    let created: CreateTokenResponse = serde_json::from_slice(&create_body)?;
    let token_id = created.info.id;
    assert_eq!(created.info.label.as_deref(), Some("dav"));
    assert!(created.info.last_used_at.is_none());

    let regenerate_response = app
        .post_json(
            &format!("/api/profile/webdav-tokens/{token_id}/regenerate"),
            &json!({}),
            Some(&access_token),
        )
        .await?;
    assert_eq!(regenerate_response.status(), StatusCode::OK);
    let regenerate_body = body_to_vec(regenerate_response.into_body()).await?;
    let regenerated: CreateTokenResponse = serde_json::from_slice(&regenerate_body)?;
    assert_eq!(regenerated.info.id, token_id);
    assert_ne!(regenerated.token, created.token);
    assert!(regenerated.info.last_used_at.is_none());

    let list_response = app
        .get("/api/profile/webdav-tokens", Some(&access_token))
        .await?;
    assert_eq!(list_response.status(), StatusCode::OK);
    let list_body = body_to_vec(list_response.into_body()).await?;
    let listed: Vec<TokenInfo> = serde_json::from_slice(&list_body)?;
    assert_eq!(listed.len(), 1);
    assert_eq!(listed[0].id, token_id);

    let delete_response = app
        .delete(
            &format!("/api/profile/webdav-tokens/{token_id}"),
            Some(&access_token),
        )
        .await?;
    assert_eq!(delete_response.status(), StatusCode::NO_CONTENT);

    let list_after = app
        .get("/api/profile/webdav-tokens", Some(&access_token))
        .await?;
    let list_after_body = body_to_vec(list_after.into_body()).await?;
    let listed_after: Vec<TokenInfo> = serde_json::from_slice(&list_after_body)?;
    assert_eq!(listed_after.len(), 1);
    assert_eq!(listed_after[0].id, token_id);
    assert!(listed_after[0].revoked_at.is_some());

    app.cleanup().await?;
    Ok(())
}

#[tokio::test]
async fn webdav_basic_auth_uses_tokens() -> Result<()> {
    let _guard = acquire_db_lock().await;
    let app = TestApp::new().await?;

    let username = "bruce";
    let password = "wayne";
    app.insert_user(username, password, "admin").await?;
    let access_token = app.login_token(username, password).await?;

    let create_response = app
        .post_json(
            "/api/profile/webdav-tokens",
            &json!({ "label": "webdav" }),
            Some(&access_token),
        )
        .await?;
    let create_body = body_to_vec(create_response.into_body()).await?;
    let created: CreateTokenResponse = serde_json::from_slice(&create_body)?;
    let token_id = created.info.id;

    let router = webdav::create_router().with_state(app.state.clone());
    let original_secret = created.token.clone();
    let auth_header = format!(
        "Basic {}",
        BASE64.encode(format!("{}:{}", username, original_secret))
    );

    let propfind = Method::from_bytes(b"PROPFIND")?;
    let success_request = Request::builder()
        .method(propfind.clone())
        .uri("/")
        .header(header::AUTHORIZATION, auth_header.clone())
        .header("depth", "0")
        .body(Body::empty())?;
    let response = router.clone().oneshot(success_request).await?;
    assert_eq!(response.status(), StatusCode::MULTI_STATUS);

    let used = app
        .with_conn(move |conn| {
            let record = webdav_tokens::table
                .find(token_id)
                .first::<WebdavToken>(conn)?;
            Ok::<_, anyhow::Error>(record.last_used_at)
        })
        .await?;
    assert!(used.is_some());

    let regenerate_response = app
        .post_json(
            &format!("/api/profile/webdav-tokens/{token_id}/regenerate"),
            &json!({}),
            Some(&access_token),
        )
        .await?;
    assert_eq!(regenerate_response.status(), StatusCode::OK);
    let regenerate_body = body_to_vec(regenerate_response.into_body()).await?;
    let regenerated: CreateTokenResponse = serde_json::from_slice(&regenerate_body)?;
    assert_ne!(regenerated.token, original_secret);

    let unused_after_regen = app
        .with_conn(move |conn| {
            let record = webdav_tokens::table
                .find(token_id)
                .first::<WebdavToken>(conn)?;
            Ok::<_, anyhow::Error>(record.last_used_at)
        })
        .await?;
    assert!(unused_after_regen.is_none());

    let old_secret_request = Request::builder()
        .method(propfind.clone())
        .uri("/")
        .header(
            header::AUTHORIZATION,
            format!(
                "Basic {}",
                BASE64.encode(format!("{}:{}", username, original_secret))
            ),
        )
        .header("depth", "0")
        .body(Body::empty())?;
    let old_secret_response = router.clone().oneshot(old_secret_request).await?;
    assert_eq!(old_secret_response.status(), StatusCode::UNAUTHORIZED);

    let new_secret_header = format!(
        "Basic {}",
        BASE64.encode(format!("{}:{}", username, regenerated.token))
    );

    let success_request = Request::builder()
        .method(propfind.clone())
        .uri("/")
        .header(header::AUTHORIZATION, new_secret_header.clone())
        .header("depth", "0")
        .body(Body::empty())?;
    let response = router.clone().oneshot(success_request).await?;
    assert_eq!(response.status(), StatusCode::MULTI_STATUS);

    let delete_response = app
        .delete(
            &format!("/api/profile/webdav-tokens/{token_id}"),
            Some(&access_token),
        )
        .await?;
    assert_eq!(delete_response.status(), StatusCode::NO_CONTENT);

    let failure_request = Request::builder()
        .method(propfind)
        .uri("/")
        .header(header::AUTHORIZATION, new_secret_header)
        .header("depth", "0")
        .body(Body::empty())?;
    let response = router.oneshot(failure_request).await?;
    assert_eq!(response.status(), StatusCode::UNAUTHORIZED);

    app.cleanup().await?;
    Ok(())
}