Close all 25 codex audit findings and add KMP contract tests
Remediate all P0-S priority findings from cross-platform architecture audit: - Add input validation and authorization checks across handlers - Harden social auth (Apple/Google) token validation - Add document ownership verification and file type validation - Add rate limiting config and CORS origin restrictions - Add subscription tier enforcement in handlers - Add OpenAPI 3.0.3 spec (81 schemas, 104 operations) - Add URL-level contract test (KMP API routes match spec paths) - Add model-level contract test (65 schemas, 464 fields validated) - Add CI workflow for backend tests Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Trey t
213
internal/handlers/document_handler_test.go
Normal file
213
internal/handlers/document_handler_test.go
Normal file
@@ -0,0 +1,213 @@
|
||||
package handlers
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"net/http"
|
||||
"testing"
|
||||
|
||||
"github.com/labstack/echo/v4"
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
|
||||
"github.com/treytartt/casera-api/internal/models"
|
||||
"github.com/treytartt/casera-api/internal/repositories"
|
||||
"github.com/treytartt/casera-api/internal/services"
|
||||
"github.com/treytartt/casera-api/internal/testutil"
|
||||
"gorm.io/gorm"
|
||||
)
|
||||
|
||||
func setupDocumentHandler(t *testing.T) (*DocumentHandler, *echo.Echo, *gorm.DB) {
|
||||
db := testutil.SetupTestDB(t)
|
||||
documentRepo := repositories.NewDocumentRepository(db)
|
||||
residenceRepo := repositories.NewResidenceRepository(db)
|
||||
documentService := services.NewDocumentService(documentRepo, residenceRepo)
|
||||
handler := NewDocumentHandler(documentService, nil) // nil storage for JSON-only tests
|
||||
e := testutil.SetupTestRouter()
|
||||
return handler, e, db
|
||||
}
|
||||
|
||||
func TestDocumentHandler_ListDocuments(t *testing.T) {
|
||||
handler, e, db := setupDocumentHandler(t)
|
||||
user := testutil.CreateTestUser(t, db, "owner", "owner@test.com", "password")
|
||||
residence := testutil.CreateTestResidence(t, db, user.ID, "Test House")
|
||||
testutil.CreateTestDocument(t, db, residence.ID, user.ID, "Test Doc")
|
||||
|
||||
authGroup := e.Group("/api/documents")
|
||||
authGroup.Use(testutil.MockAuthMiddleware(user))
|
||||
authGroup.GET("/", handler.ListDocuments)
|
||||
|
||||
t.Run("successful list", func(t *testing.T) {
|
||||
w := testutil.MakeRequest(e, "GET", "/api/documents/", nil, "test-token")
|
||||
testutil.AssertStatusCode(t, w, http.StatusOK)
|
||||
|
||||
var response []map[string]interface{}
|
||||
err := json.Unmarshal(w.Body.Bytes(), &response)
|
||||
require.NoError(t, err)
|
||||
assert.Len(t, response, 1)
|
||||
assert.Equal(t, "Test Doc", response[0]["title"])
|
||||
})
|
||||
}
|
||||
|
||||
func TestDocumentHandler_CreateDocument(t *testing.T) {
|
||||
handler, e, db := setupDocumentHandler(t)
|
||||
user := testutil.CreateTestUser(t, db, "owner", "owner@test.com", "password")
|
||||
residence := testutil.CreateTestResidence(t, db, user.ID, "Test House")
|
||||
|
||||
authGroup := e.Group("/api/documents")
|
||||
authGroup.Use(testutil.MockAuthMiddleware(user))
|
||||
authGroup.POST("/", handler.CreateDocument)
|
||||
|
||||
t.Run("successful creation via JSON", func(t *testing.T) {
|
||||
body := map[string]interface{}{
|
||||
"title": "Warranty Doc",
|
||||
"residence_id": residence.ID,
|
||||
}
|
||||
w := testutil.MakeRequest(e, "POST", "/api/documents/", body, "test-token")
|
||||
testutil.AssertStatusCode(t, w, http.StatusCreated)
|
||||
|
||||
var response map[string]interface{}
|
||||
err := json.Unmarshal(w.Body.Bytes(), &response)
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, "Warranty Doc", response["title"])
|
||||
})
|
||||
|
||||
t.Run("creation without residence access", func(t *testing.T) {
|
||||
otherUser := testutil.CreateTestUser(t, db, "other", "other@test.com", "password")
|
||||
otherResidence := testutil.CreateTestResidence(t, db, otherUser.ID, "Other House")
|
||||
|
||||
body := map[string]interface{}{
|
||||
"title": "Unauthorized Doc",
|
||||
"residence_id": otherResidence.ID,
|
||||
}
|
||||
w := testutil.MakeRequest(e, "POST", "/api/documents/", body, "test-token")
|
||||
testutil.AssertStatusCode(t, w, http.StatusForbidden)
|
||||
})
|
||||
}
|
||||
|
||||
func TestDocumentHandler_GetDocument(t *testing.T) {
|
||||
handler, e, db := setupDocumentHandler(t)
|
||||
user := testutil.CreateTestUser(t, db, "owner", "owner@test.com", "password")
|
||||
residence := testutil.CreateTestResidence(t, db, user.ID, "Test House")
|
||||
doc := testutil.CreateTestDocument(t, db, residence.ID, user.ID, "Test Doc")
|
||||
|
||||
authGroup := e.Group("/api/documents")
|
||||
authGroup.Use(testutil.MockAuthMiddleware(user))
|
||||
authGroup.GET("/:id/", handler.GetDocument)
|
||||
|
||||
t.Run("successful get", func(t *testing.T) {
|
||||
w := testutil.MakeRequest(e, "GET", fmt.Sprintf("/api/documents/%d/", doc.ID), nil, "test-token")
|
||||
testutil.AssertStatusCode(t, w, http.StatusOK)
|
||||
|
||||
var response map[string]interface{}
|
||||
err := json.Unmarshal(w.Body.Bytes(), &response)
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, "Test Doc", response["title"])
|
||||
})
|
||||
|
||||
t.Run("document not found", func(t *testing.T) {
|
||||
w := testutil.MakeRequest(e, "GET", "/api/documents/99999/", nil, "test-token")
|
||||
testutil.AssertStatusCode(t, w, http.StatusNotFound)
|
||||
})
|
||||
}
|
||||
|
||||
func TestDocumentHandler_DeleteDocumentImage(t *testing.T) {
|
||||
handler, e, db := setupDocumentHandler(t)
|
||||
user := testutil.CreateTestUser(t, db, "owner", "owner@test.com", "password")
|
||||
residence := testutil.CreateTestResidence(t, db, user.ID, "Test House")
|
||||
doc := testutil.CreateTestDocument(t, db, residence.ID, user.ID, "Test Doc")
|
||||
|
||||
// Create a document image directly
|
||||
img := &models.DocumentImage{
|
||||
DocumentID: doc.ID,
|
||||
ImageURL: "https://example.com/img.jpg",
|
||||
Caption: "Test image",
|
||||
}
|
||||
require.NoError(t, db.Create(img).Error)
|
||||
|
||||
authGroup := e.Group("/api/documents")
|
||||
authGroup.Use(testutil.MockAuthMiddleware(user))
|
||||
authGroup.DELETE("/:id/images/:imageId/", handler.DeleteDocumentImage)
|
||||
|
||||
t.Run("successful delete", func(t *testing.T) {
|
||||
w := testutil.MakeRequest(e, "DELETE", fmt.Sprintf("/api/documents/%d/images/%d/", doc.ID, img.ID), nil, "test-token")
|
||||
testutil.AssertStatusCode(t, w, http.StatusOK)
|
||||
|
||||
var response map[string]interface{}
|
||||
err := json.Unmarshal(w.Body.Bytes(), &response)
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, "Test Doc", response["title"])
|
||||
|
||||
// Verify image is deleted
|
||||
images := response["images"].([]interface{})
|
||||
assert.Len(t, images, 0)
|
||||
})
|
||||
|
||||
t.Run("image not found", func(t *testing.T) {
|
||||
w := testutil.MakeRequest(e, "DELETE", fmt.Sprintf("/api/documents/%d/images/99999/", doc.ID), nil, "test-token")
|
||||
testutil.AssertStatusCode(t, w, http.StatusNotFound)
|
||||
})
|
||||
|
||||
t.Run("document not found", func(t *testing.T) {
|
||||
w := testutil.MakeRequest(e, "DELETE", "/api/documents/99999/images/1/", nil, "test-token")
|
||||
testutil.AssertStatusCode(t, w, http.StatusNotFound)
|
||||
})
|
||||
|
||||
t.Run("access denied", func(t *testing.T) {
|
||||
otherUser := testutil.CreateTestUser(t, db, "other", "other@test.com", "password")
|
||||
otherResidence := testutil.CreateTestResidence(t, db, otherUser.ID, "Other House")
|
||||
otherDoc := testutil.CreateTestDocument(t, db, otherResidence.ID, otherUser.ID, "Other Doc")
|
||||
|
||||
otherImg := &models.DocumentImage{
|
||||
DocumentID: otherDoc.ID,
|
||||
ImageURL: "https://example.com/other.jpg",
|
||||
}
|
||||
require.NoError(t, db.Create(otherImg).Error)
|
||||
|
||||
w := testutil.MakeRequest(e, "DELETE", fmt.Sprintf("/api/documents/%d/images/%d/", otherDoc.ID, otherImg.ID), nil, "test-token")
|
||||
testutil.AssertStatusCode(t, w, http.StatusForbidden)
|
||||
})
|
||||
}
|
||||
|
||||
func TestDocumentHandler_UploadDocumentImage_NoStorage(t *testing.T) {
|
||||
handler, e, db := setupDocumentHandler(t)
|
||||
user := testutil.CreateTestUser(t, db, "owner", "owner@test.com", "password")
|
||||
residence := testutil.CreateTestResidence(t, db, user.ID, "Test House")
|
||||
doc := testutil.CreateTestDocument(t, db, residence.ID, user.ID, "Test Doc")
|
||||
|
||||
authGroup := e.Group("/api/documents")
|
||||
authGroup.Use(testutil.MockAuthMiddleware(user))
|
||||
authGroup.POST("/:id/images/", handler.UploadDocumentImage)
|
||||
|
||||
t.Run("document not found", func(t *testing.T) {
|
||||
// Send a plain request (no multipart) - will fail at parse
|
||||
w := testutil.MakeRequest(e, "POST", "/api/documents/99999/images/", nil, "test-token")
|
||||
// Should get 400 because no multipart form
|
||||
assert.True(t, w.Code == http.StatusBadRequest || w.Code == http.StatusNotFound,
|
||||
"expected 400 or 404, got %d", w.Code)
|
||||
})
|
||||
|
||||
_ = doc // used to set up test data
|
||||
}
|
||||
|
||||
func TestDocumentHandler_DeleteDocument(t *testing.T) {
|
||||
handler, e, db := setupDocumentHandler(t)
|
||||
user := testutil.CreateTestUser(t, db, "owner", "owner@test.com", "password")
|
||||
residence := testutil.CreateTestResidence(t, db, user.ID, "Test House")
|
||||
doc := testutil.CreateTestDocument(t, db, residence.ID, user.ID, "Test Doc")
|
||||
|
||||
authGroup := e.Group("/api/documents")
|
||||
authGroup.Use(testutil.MockAuthMiddleware(user))
|
||||
authGroup.DELETE("/:id/", handler.DeleteDocument)
|
||||
|
||||
t.Run("successful delete", func(t *testing.T) {
|
||||
w := testutil.MakeRequest(e, "DELETE", fmt.Sprintf("/api/documents/%d/", doc.ID), nil, "test-token")
|
||||
testutil.AssertStatusCode(t, w, http.StatusOK)
|
||||
})
|
||||
|
||||
t.Run("document not found after delete", func(t *testing.T) {
|
||||
// Already soft-deleted above
|
||||
w := testutil.MakeRequest(e, "DELETE", fmt.Sprintf("/api/documents/%d/", doc.ID), nil, "test-token")
|
||||
testutil.AssertStatusCode(t, w, http.StatusNotFound)
|
||||
})
|
||||
}
|
||||
Reference in New Issue
Block a user