77 lines
2.5 KiB
Go
77 lines
2.5 KiB
Go
package auth
|
|
|
|
import (
|
|
"bytes"
|
|
"encoding/json"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
|
|
"gitea.perlbach24.de/scripte/nexarch/internal/user"
|
|
)
|
|
|
|
// Akzeptanzkriterium 2: Passwortaenderung verlangt das aktuelle Passwort.
|
|
func TestChangePassword_RequiresCurrentPassword(t *testing.T) {
|
|
pool := setupTenantDB(t, "changepw_test_wrong")
|
|
store := user.NewTenantUserStore(pool)
|
|
u := createUserWithPassword(t, store, "nutzer@example.com", "altes-passwort")
|
|
|
|
issuer := NewTokenIssuer("test-session-secret")
|
|
sessionToken, err := issuer.Issue(u.ID, "acme")
|
|
if err != nil {
|
|
t.Fatalf("session-token ausstellen: %v", err)
|
|
}
|
|
|
|
h := NewChangePasswordHandler(store)
|
|
body, _ := json.Marshal(map[string]string{"current_password": "falsches-altes-passwort", "new_password": "neues-passwort"})
|
|
req := httptest.NewRequest(http.MethodPost, "/account/change-password", bytes.NewReader(body))
|
|
req.AddCookie(&http.Cookie{Name: CookieName, Value: sessionToken})
|
|
rec := httptest.NewRecorder()
|
|
|
|
RequireAuth(issuer, h.ChangePassword)(rec, req)
|
|
|
|
if rec.Code != http.StatusBadRequest {
|
|
t.Fatalf("status = %d, want 400 (falsches aktuelles passwort)", rec.Code)
|
|
}
|
|
|
|
creds, err := store.GetByIDForAuth(req.Context(), u.ID)
|
|
if err != nil {
|
|
t.Fatalf("credentials laden: %v", err)
|
|
}
|
|
if !VerifyPassword(creds.PasswordHash, "altes-passwort") {
|
|
t.Fatal("passwort haette NICHT geaendert werden duerfen")
|
|
}
|
|
}
|
|
|
|
func TestChangePassword_SucceedsWithCorrectCurrentPassword(t *testing.T) {
|
|
pool := setupTenantDB(t, "changepw_test_ok")
|
|
store := user.NewTenantUserStore(pool)
|
|
u := createUserWithPassword(t, store, "nutzer2@example.com", "altes-passwort")
|
|
|
|
issuer := NewTokenIssuer("test-session-secret")
|
|
sessionToken, err := issuer.Issue(u.ID, "acme")
|
|
if err != nil {
|
|
t.Fatalf("session-token ausstellen: %v", err)
|
|
}
|
|
|
|
h := NewChangePasswordHandler(store)
|
|
body, _ := json.Marshal(map[string]string{"current_password": "altes-passwort", "new_password": "neues-sicheres-passwort"})
|
|
req := httptest.NewRequest(http.MethodPost, "/account/change-password", bytes.NewReader(body))
|
|
req.AddCookie(&http.Cookie{Name: CookieName, Value: sessionToken})
|
|
rec := httptest.NewRecorder()
|
|
|
|
RequireAuth(issuer, h.ChangePassword)(rec, req)
|
|
|
|
if rec.Code != http.StatusOK {
|
|
t.Fatalf("status = %d, want 200, body: %s", rec.Code, rec.Body.String())
|
|
}
|
|
|
|
creds, err := store.GetByIDForAuth(req.Context(), u.ID)
|
|
if err != nil {
|
|
t.Fatalf("credentials laden: %v", err)
|
|
}
|
|
if !VerifyPassword(creds.PasswordHash, "neues-sicheres-passwort") {
|
|
t.Fatal("neues passwort wurde nicht uebernommen")
|
|
}
|
|
}
|