IAM-08: benutzerprofil-login-oberflaeche (login+2fa/passwort-reset/profil-backend-handler + web/account next.js-frontend auf shl-01)

internal/auth/profile_test.go

@@ -0,0 +1,48 @@
+package auth
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"gitea.perlbach24.de/scripte/nexarch/internal/user"
+)
+
+func TestProfileMe_ReturnsOwnData(t *testing.T) {
+	pool := setupTenantDB(t, "profile_test_me")
+	store := user.NewTenantUserStore(pool)
+	u := createUserWithPassword(t, store, "profil@example.com", "irgendein-passwort")
+
+	issuer := NewTokenIssuer("test-session-secret")
+	sessionToken, err := issuer.Issue(u.ID, "acme")
+	if err != nil {
+		t.Fatalf("session-token ausstellen: %v", err)
+	}
+
+	h := NewProfileHandler(store)
+	req := httptest.NewRequest(http.MethodGet, "/account/me", nil)
+	req.AddCookie(&http.Cookie{Name: CookieName, Value: sessionToken})
+	rec := httptest.NewRecorder()
+
+	RequireAuth(issuer, h.Me)(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200, body: %s", rec.Code, rec.Body.String())
+	}
+}
+
+func TestProfileMe_RejectsWithoutSession(t *testing.T) {
+	pool := setupTenantDB(t, "profile_test_noauth")
+	store := user.NewTenantUserStore(pool)
+
+	issuer := NewTokenIssuer("test-session-secret")
+	h := NewProfileHandler(store)
+	req := httptest.NewRequest(http.MethodGet, "/account/me", nil)
+	rec := httptest.NewRecorder()
+
+	RequireAuth(issuer, h.Me)(rec, req)
+
+	if rec.Code != http.StatusUnauthorized {
+		t.Fatalf("status = %d, want 401 ohne session-cookie", rec.Code)
+	}
+}