| 1 |
use crate::harness::TestHarness; |
| 2 |
|
| 3 |
#[tokio::test] |
| 4 |
async fn post_without_token_returns_403() { |
| 5 |
let mut h = TestHarness::new().await; |
| 6 |
let user_id = h.login_as("alice").await; |
| 7 |
let comm_id = h.create_community("Test", "test").await; |
| 8 |
let _cat_id = h.create_category(comm_id, "General", "general").await; |
| 9 |
h.add_membership(user_id, comm_id, "member").await; |
| 10 |
|
| 11 |
let resp = h |
| 12 |
.client |
| 13 |
.post_form_no_csrf("/p/test/general/new", "title=Hello&body=World") |
| 14 |
.await; |
| 15 |
|
| 16 |
assert_eq!(resp.status.as_u16(), 403); |
| 17 |
} |
| 18 |
|
| 19 |
#[tokio::test] |
| 20 |
async fn post_with_valid_token_succeeds() { |
| 21 |
let mut h = TestHarness::new().await; |
| 22 |
let user_id = h.login_as("bob").await; |
| 23 |
let comm_id = h.create_community("Test", "test").await; |
| 24 |
let _cat_id = h.create_category(comm_id, "General", "general").await; |
| 25 |
h.add_membership(user_id, comm_id, "member").await; |
| 26 |
|
| 27 |
|
| 28 |
h.client.get("/p/test/general/new").await; |
| 29 |
|
| 30 |
|
| 31 |
let resp = h |
| 32 |
.client |
| 33 |
.post_form("/p/test/general/new", "title=Hello&body=World") |
| 34 |
.await; |
| 35 |
|
| 36 |
|
| 37 |
assert!( |
| 38 |
resp.status.is_redirection() || resp.status.is_success(), |
| 39 |
"Expected success/redirect, got {}", |
| 40 |
resp.status |
| 41 |
); |
| 42 |
} |
| 43 |
|
| 44 |
#[tokio::test] |
| 45 |
async fn post_with_wrong_token_returns_403() { |
| 46 |
let mut h = TestHarness::new().await; |
| 47 |
let user_id = h.login_as("carol").await; |
| 48 |
let comm_id = h.create_community("Test", "test").await; |
| 49 |
let _cat_id = h.create_category(comm_id, "General", "general").await; |
| 50 |
h.add_membership(user_id, comm_id, "member").await; |
| 51 |
|
| 52 |
|
| 53 |
h.client.get("/p/test/general/new").await; |
| 54 |
|
| 55 |
let resp = h |
| 56 |
.client |
| 57 |
.post_form_with_token( |
| 58 |
"/p/test/general/new", |
| 59 |
"title=Hello&body=World", |
| 60 |
"totally-wrong-token", |
| 61 |
) |
| 62 |
.await; |
| 63 |
|
| 64 |
assert_eq!(resp.status.as_u16(), 403); |
| 65 |
} |
| 66 |
|
| 67 |
#[tokio::test] |
| 68 |
async fn csrf_token_stable_across_requests() { |
| 69 |
let mut h = TestHarness::new().await; |
| 70 |
h.login_as("dave").await; |
| 71 |
|
| 72 |
h.client.get("/").await; |
| 73 |
let token1 = h.client.csrf_token().unwrap().to_string(); |
| 74 |
|
| 75 |
h.client.get("/").await; |
| 76 |
let token2 = h.client.csrf_token().unwrap().to_string(); |
| 77 |
|
| 78 |
assert_eq!(token1, token2); |
| 79 |
} |
| 80 |
|