69 lines
3.8 KiB
Go
69 lines
3.8 KiB
Go
package main
|
|
|
|
import (
|
|
"fmt"
|
|
"time"
|
|
|
|
"kra/internal/service/dto"
|
|
)
|
|
|
|
func verifyCatalog(admin, public, viewer *apiClient, f *fixtures, report *acceptanceReport) {
|
|
var category dto.LiveCategoryResponse
|
|
name := fmt.Sprintf("T%d", time.Now().UnixMilli()%100000000)
|
|
input := dto.LiveCategoryRequest{Name: name, Icon: "video", Sort: 2, Enabled: false}
|
|
must(admin.call("POST", "/live/admin/categories", input, &category))
|
|
if category.Enabled {
|
|
report.Findings = append(report.Findings, "Creating a category with enabled:false returns enabled:true")
|
|
}
|
|
input.Enabled = true
|
|
must(admin.call("PUT", fmt.Sprintf("/live/admin/categories/%d", category.ID), input, &category))
|
|
check(category.Enabled, "category update did not preserve enabled:true")
|
|
var room dto.LiveRoomResponse
|
|
roomInput := makeRoom("API Disabled Test", category.ID, f.Anchor.ID, "", false)
|
|
must(admin.call("POST", "/live/admin/rooms", roomInput, &room))
|
|
if room.Enabled {
|
|
report.Findings = append(report.Findings, "Creating a room with enabled:false returns enabled:true and exposes the room publicly")
|
|
}
|
|
must(admin.call("PATCH", adminRoomPath(room.ID)+"/status", dto.LiveStatusRequest{Enabled: false}, nil))
|
|
check(public.call("GET", roomPath(room.ID), nil, nil) != nil, "room remains public after disabling")
|
|
check(viewer.call("GET", adminRoomPath(room.ID), nil, nil) != nil, "PC viewer accessed an administration room")
|
|
roomInput.Enabled = true
|
|
roomInput.Intro = "Updated through API"
|
|
must(admin.call("PUT", adminRoomPath(room.ID), roomInput, &room))
|
|
check(room.Intro == roomInput.Intro && room.Enabled, "room update did not persist")
|
|
input.Enabled = false
|
|
must(admin.call("PUT", fmt.Sprintf("/live/admin/categories/%d", category.ID), input, nil))
|
|
check(public.call("GET", roomPath(room.ID), nil, nil) != nil, "room in a disabled category was exposed")
|
|
input.Enabled = true
|
|
must(admin.call("PUT", fmt.Sprintf("/live/admin/categories/%d", category.ID), input, nil))
|
|
must(admin.call("DELETE", adminRoomPath(room.ID), nil, nil))
|
|
check(public.call("GET", roomPath(room.ID), nil, nil) != nil, "deleted room remained public")
|
|
must(admin.call("DELETE", fmt.Sprintf("/live/admin/categories/%d", category.ID), nil, nil))
|
|
|
|
var gift dto.GiftResponse
|
|
giftInput := dto.GiftRequest{Name: name, Icon: "star", Price: 9, Tiers: []int{1, 10}, Enabled: true, Sort: 2}
|
|
must(admin.call("POST", "/live/admin/gifts", giftInput, &gift))
|
|
giftInput.Description = "Updated through API"
|
|
must(admin.call("PUT", fmt.Sprintf("/live/admin/gifts/%d", gift.ID), giftInput, &gift))
|
|
check(gift.Description == giftInput.Description, "gift update did not persist")
|
|
must(admin.call("PATCH", fmt.Sprintf("/live/admin/gifts/%d/status", gift.ID), dto.LiveStatusRequest{Enabled: false}, nil))
|
|
must(admin.call("DELETE", fmt.Sprintf("/live/admin/gifts/%d", gift.ID), nil, nil))
|
|
passed(report, "administrator category, room and gift CRUD; category/room disabling; client administration access denied")
|
|
}
|
|
|
|
func verifyDisabledAccount(admin, other *apiClient, f *fixtures, report *acceptanceReport) {
|
|
path := fmt.Sprintf("/live/admin/users/%d/status", f.Other.ID)
|
|
if err := admin.call("PATCH", path, dto.LiveStatusRequest{Enabled: false}, nil); err != nil {
|
|
report.Findings = append(report.Findings, "Administrator cannot disable the client user: "+err.Error())
|
|
return
|
|
}
|
|
defer func() {
|
|
must(admin.call("PATCH", path, dto.LiveStatusRequest{Enabled: true}, nil))
|
|
}()
|
|
check(admin.call("PATCH", fmt.Sprintf("/live/admin/users/%d/status", f.Admin.ID), dto.LiveStatusRequest{Enabled: false}, nil) != nil, "administrator disabled their own account")
|
|
_, err := login(f.Other, false)
|
|
check(err != nil, "disabled account could still log in")
|
|
check(other.call("GET", "/live/client/balance", nil, nil) != nil, "disabled account token remained authorized")
|
|
passed(report, "disabled user cannot log in or use an existing authenticated API token")
|
|
}
|