DebTik/internal/api/update_handlers_test.go

package api

import (
	"context"
	"net/http"
	"net/http/httptest"
	"proxmox-router/internal/auth"
	"strings"
	"testing"
)

func TestUpdateConfigValidationAndPrivileges(t *testing.T) {
	for _, tc := range []struct {
		repo, branch string
		valid        bool
	}{
		{"http://gogs.example/team/router.git", "master", true},
		{"ssh://git@example.com/team/router.git", "release/1", true},
		{"file:///etc/passwd", "main", false},
		{"https://user:password@example.com/router.git", "main", false},
		{"https://example.com/router.git", "../bad", false},
		{"https://example.com/router.git", "-option", false},
	} {
		if got := validUpdateConfig(updateConfig{Repository: tc.repo, Branch: tc.branch}); got != tc.valid {
			t.Fatalf("%s %s: got %v", tc.repo, tc.branch, got)
		}
	}
	s := &Server{}
	body := `{"repository":"https://example.com/router.git","branch":"main"}`
	for _, role := range []auth.Role{auth.RoleRead, auth.RoleWrite} {
		r := httptest.NewRequest("POST", "/api/update/config", strings.NewReader(body))
		r = r.WithContext(context.WithValue(r.Context(), sessionContextKey, &auth.Session{Role: role}))
		w := httptest.NewRecorder()
		s.handleUpdateConfig(w, r)
		if w.Code != http.StatusForbidden {
			t.Fatalf("%s changed update config: %d", role, w.Code)
		}
	}
}