Skip to main content

max / makenotwork

8.7 KB · 292 lines History Blame Raw
1 //! Contact sharing and revocation workflow tests.
2 //!
3 //! Covers: revoke via API, verify creator can't see contact, re-purchase with
4 //! share_contact clears revocation, idempotent revoke, auth required, CSV export
5 //! email redaction.
6
7 use crate::harness::TestHarness;
8 use makenotwork::db;
9 use serde_json::Value;
10
11 /// Helper: create a seller with a published project + $10 item + 100% promo code.
12 /// Returns (seller_id, item_id) with the seller logged out.
13 async fn setup_seller_with_discountable_item(h: &mut TestHarness) -> (db::UserId, String) {
14 let seller_id = h.signup("seller", "seller@test.com", "password123").await;
15 h.grant_creator(seller_id).await;
16 h.client.post_form("/logout", "").await;
17 h.login("seller", "password123").await;
18
19 let resp = h
20 .client
21 .post_form("/api/projects", "slug=shop&title=Shop")
22 .await;
23 let project: Value = resp.json();
24 let project_id = project["id"].as_str().unwrap();
25
26 let resp = h
27 .client
28 .post_form(
29 &format!("/api/projects/{project_id}/items"),
30 "title=Product&item_type=digital&price_cents=1000",
31 )
32 .await;
33 assert!(
34 resp.status.is_success(),
35 "Create item failed: {} {}",
36 resp.status,
37 resp.text
38 );
39 let item: Value = resp.json();
40 let item_id = item["id"].as_str().unwrap().to_string();
41
42 // Publish both
43 h.client
44 .put_json(
45 &format!("/api/projects/{project_id}"),
46 r#"{"is_public": true}"#,
47 )
48 .await;
49 h.client
50 .put_form(&format!("/api/items/{item_id}"), "is_public=true")
51 .await;
52
53 // Create a 100% discount promo code (makes checkout free-claim path)
54 let resp = h
55 .client
56 .post_form(
57 "/api/promo-codes",
58 "code=FREE100&code_purpose=discount&discount_type=percentage&discount_value=100",
59 )
60 .await;
61 assert!(
62 resp.status.is_success(),
63 "Create promo code failed: {} {}",
64 resp.status,
65 resp.text
66 );
67
68 h.client.post_form("/logout", "").await;
69 (seller_id, item_id)
70 }
71
72 /// Buyer purchases the item via 100% discount promo code with share_contact.
73 async fn buyer_purchase_with_share_contact(h: &mut TestHarness, item_id: &str) {
74 let resp = h
75 .client
76 .post_form(
77 &format!("/stripe/checkout/{item_id}"),
78 "promo_code=FREE100&share_contact=true",
79 )
80 .await;
81 // 100% discount → free claim → redirect
82 assert!(
83 resp.status.is_redirection() || resp.status.is_success(),
84 "Purchase with share_contact failed: {} {}",
85 resp.status,
86 resp.text
87 );
88 }
89
90 #[tokio::test]
91 async fn revoke_hides_contact_from_seller() {
92 let mut h = TestHarness::new().await;
93
94 let (seller_id, item_id) = setup_seller_with_discountable_item(&mut h).await;
95
96 // Buyer: sign up and purchase with share_contact=true
97 let _buyer_id = h.signup("buyer", "buyer@test.com", "password123").await;
98 buyer_purchase_with_share_contact(&mut h, &item_id).await;
99
100 // Verify seller can see the contact
101 let contacts = db::transactions::get_seller_contacts(&h.db, seller_id)
102 .await
103 .unwrap();
104 assert_eq!(
105 contacts.len(),
106 1,
107 "Seller should see 1 contact before revocation"
108 );
109 assert_eq!(contacts[0].email, "buyer@test.com");
110
111 // Buyer revokes contact sharing
112 let resp = h
113 .client
114 .delete(&format!("/api/contacts/{}", *seller_id))
115 .await;
116 assert_eq!(
117 resp.status, 204,
118 "Revoke should return 204, got {}",
119 resp.status
120 );
121
122 // Verify seller can no longer see the contact
123 let contacts = db::transactions::get_seller_contacts(&h.db, seller_id)
124 .await
125 .unwrap();
126 assert!(
127 contacts.is_empty(),
128 "Seller should see 0 contacts after revocation"
129 );
130 }
131
132 #[tokio::test]
133 async fn repurchase_with_share_contact_clears_revocation() {
134 let mut h = TestHarness::new().await;
135
136 let (seller_id, item_id) = setup_seller_with_discountable_item(&mut h).await;
137
138 // Buyer: purchase with share_contact, then revoke
139 let _buyer_id = h.signup("buyer2", "buyer2@test.com", "password123").await;
140 buyer_purchase_with_share_contact(&mut h, &item_id).await;
141
142 let resp = h
143 .client
144 .delete(&format!("/api/contacts/{}", *seller_id))
145 .await;
146 assert_eq!(resp.status, 204);
147
148 // Confirm contact is hidden
149 let contacts = db::transactions::get_seller_contacts(&h.db, seller_id)
150 .await
151 .unwrap();
152 assert!(
153 contacts.is_empty(),
154 "Contact should be hidden after revocation"
155 );
156
157 // Seller creates a second item so buyer can re-purchase with share_contact
158 h.client.post_form("/logout", "").await;
159 h.login("seller", "password123").await;
160 let project_id = {
161 let resp = h.client.get("/api/projects").await;
162 let projects: Value = resp.json();
163 projects["data"][0]["id"].as_str().unwrap().to_string()
164 };
165 let resp = h
166 .client
167 .post_form(
168 &format!("/api/projects/{project_id}/items"),
169 "title=Product+2&item_type=digital&price_cents=1000",
170 )
171 .await;
172 assert!(
173 resp.status.is_success(),
174 "Create item 2 failed: {} {}",
175 resp.status,
176 resp.text
177 );
178 let item2: Value = resp.json();
179 let item2_id = item2["id"].as_str().unwrap().to_string();
180 h.client
181 .put_form(&format!("/api/items/{item2_id}"), "is_public=true")
182 .await;
183
184 // Switch back to buyer and re-purchase with share_contact
185 h.client.post_form("/logout", "").await;
186 h.login("buyer2", "password123").await;
187 buyer_purchase_with_share_contact(&mut h, &item2_id).await;
188
189 // Verify revocation is cleared, seller can see contact again
190 let contacts = db::transactions::get_seller_contacts(&h.db, seller_id)
191 .await
192 .unwrap();
193 assert_eq!(
194 contacts.len(),
195 1,
196 "Contact should reappear after re-purchase with share_contact"
197 );
198 assert_eq!(contacts[0].email, "buyer2@test.com");
199 }
200
201 #[tokio::test]
202 async fn export_redacts_email_after_revocation() {
203 let mut h = TestHarness::new().await;
204
205 let (seller_id, item_id) = setup_seller_with_discountable_item(&mut h).await;
206
207 // Buyer purchases with share_contact
208 let _buyer_id = h.signup("buyer3", "buyer3@test.com", "password123").await;
209 buyer_purchase_with_share_contact(&mut h, &item_id).await;
210
211 // Verify export shows email before revocation
212 let rows = db::transactions::get_seller_transactions_for_export(&h.db, seller_id)
213 .await
214 .unwrap();
215 assert!(!rows.is_empty(), "Export should have rows");
216 assert_eq!(
217 rows[0].buyer_email.as_deref(),
218 Some("buyer3@test.com"),
219 "Export should show buyer email before revocation"
220 );
221
222 // Revoke
223 let resp = h
224 .client
225 .delete(&format!("/api/contacts/{}", *seller_id))
226 .await;
227 assert_eq!(resp.status, 204);
228
229 // Verify export hides email after revocation (row still present, email NULL)
230 let rows = db::transactions::get_seller_transactions_for_export(&h.db, seller_id)
231 .await
232 .unwrap();
233 assert!(
234 !rows.is_empty(),
235 "Export should still have rows after revocation"
236 );
237 assert_eq!(
238 rows[0].buyer_email, None,
239 "Export should hide buyer email after revocation"
240 );
241 }
242
243 #[tokio::test]
244 async fn revoke_is_idempotent() {
245 let mut h = TestHarness::new().await;
246
247 let seller_id = h.signup("seller4", "seller4@test.com", "password123").await;
248 h.grant_creator(seller_id).await;
249 h.client.post_form("/logout", "").await;
250 let _buyer_id = h.signup("buyer4", "buyer4@test.com", "password123").await;
251
252 // Double revoke, both should succeed
253 let resp = h
254 .client
255 .delete(&format!("/api/contacts/{}", *seller_id))
256 .await;
257 assert_eq!(
258 resp.status, 204,
259 "First revoke should return 204, got {}",
260 resp.status
261 );
262
263 let resp = h
264 .client
265 .delete(&format!("/api/contacts/{}", *seller_id))
266 .await;
267 assert_eq!(
268 resp.status, 204,
269 "Second revoke should return 204, got {}",
270 resp.status
271 );
272 }
273
274 #[tokio::test]
275 async fn revoke_requires_auth() {
276 let mut h = TestHarness::new().await;
277
278 // Establish a session for CSRF but don't log in
279 h.client.fetch_csrf_token().await;
280
281 let fake_seller = uuid::Uuid::new_v4();
282 let resp = h
283 .client
284 .delete(&format!("/api/contacts/{fake_seller}"))
285 .await;
286 assert!(
287 resp.status == 401 || resp.status == 302 || resp.status == 303,
288 "Unauthenticated revoke should be rejected, got {}",
289 resp.status
290 );
291 }
292