Edouard Vanbelle
6d65f7eb09
ensure better API test coverage on important routes 1. tests/api/public_shares.hurl — create a share token, verify, list contents, fetch a file, fetch a folder zip, then revoke and re-verify with the token. Same pattern as grants.hurl. ~30 min, biggest security ROI. 2. tests/api/auth_session_lifecycle.hurl — login → refresh → use new token → logout → refresh-rejected → login-again. Covers the session-family invalidation contract. 3. tests/api/admin_user_ops.hurl — admin disables / re-enables / changes role / resets password / sets quota for a fixture user. Five POSTs. 4. tests/api/groups_effective_members.hurl — nested groups: A contains B contains user X; effective-members returns X. Two scenarios, but it's the ReBAC contract under the Drive refactor. 5. tests/api/search_basic.hurl — upload foo.txt, search "foo", get the result; cross-user: bob can't search alice's foo.
262 lines
11 KiB
Plaintext
262 lines
11 KiB
Plaintext
# =============================================================
|
|
# OxiCloud — Baseline: public-share token surface
|
|
# =============================================================
|
|
# Pins the legacy tokenized share flow (`/api/shares` to mint,
|
|
# `/api/s/{token}/*` to consume) — the only public-facing
|
|
# unauthenticated read surface in the product. Any regression
|
|
# in scope-enforcement here breaks the share-link feature for
|
|
# every external recipient.
|
|
#
|
|
# Coverage:
|
|
# 1. Login + seed: create a folder with a file inside.
|
|
# 2. POST /api/shares (folder share, no password) → 201
|
|
# 3. GET /api/shares (lists ours)
|
|
# 4. GET /api/shares/{id} (single fetch)
|
|
# 5. GET /api/s/{token} (no auth) → 200
|
|
# 6. GET /api/s/{token}/verify — not applicable
|
|
# for a password-less share, but the unauthenticated
|
|
# anonymous probe of `/api/s/{token}` already exercises
|
|
# the access path; verify is exercised in the password
|
|
# branch below.
|
|
# 7. GET /api/s/{token}/contents (no auth) → 200
|
|
# 8. GET /api/s/{token}/file/{file_id} (no auth) → 200 + body
|
|
# 9. POST /api/shares — password-protected variant
|
|
# 10. GET /api/s/{pw_token} → 401 (password required)
|
|
# 11. POST /api/s/{pw_token}/verify wrong pw → 401
|
|
# 12. POST /api/s/{pw_token}/verify right pw → 200
|
|
# 13. DELETE /api/shares/{id} (no-password) → 204
|
|
# 14. GET /api/s/{token} after revoke → 404 / 410
|
|
# 15. Cleanup the password-share + folder.
|
|
# =============================================================
|
|
|
|
|
|
# ─────────────────────────────────────────────────────────────
|
|
# Setup — admin login, seed folder + file
|
|
# ─────────────────────────────────────────────────────────────
|
|
POST {{base_url}}/api/auth/login
|
|
Content-Type: application/json
|
|
{ "username": "{{username}}", "password": "{{password}}" }
|
|
|
|
HTTP 200
|
|
[Captures]
|
|
admin_token: jsonpath "$.access_token"
|
|
|
|
|
|
GET {{base_url}}/api/folders
|
|
Authorization: Bearer {{admin_token}}
|
|
|
|
HTTP 200
|
|
[Captures]
|
|
admin_home_id: jsonpath "$[0].id"
|
|
|
|
|
|
POST {{base_url}}/api/folders
|
|
Authorization: Bearer {{admin_token}}
|
|
Content-Type: application/json
|
|
{ "name": "public-share-test", "parent_id": "{{admin_home_id}}" }
|
|
|
|
HTTP 201
|
|
[Captures]
|
|
share_folder_id: jsonpath "$.id"
|
|
|
|
|
|
POST {{base_url}}/api/files/upload
|
|
Authorization: Bearer {{admin_token}}
|
|
[MultipartFormData]
|
|
folder_id: {{share_folder_id}}
|
|
file: file,fixtures/hello.txt; text/plain
|
|
|
|
HTTP 201
|
|
[Captures]
|
|
shared_file_id: jsonpath "$.id"
|
|
|
|
|
|
# ─────────────────────────────────────────────────────────────
|
|
# 2 — Mint a password-less folder share
|
|
# ─────────────────────────────────────────────────────────────
|
|
POST {{base_url}}/api/shares
|
|
Authorization: Bearer {{admin_token}}
|
|
Content-Type: application/json
|
|
{
|
|
"item_id": "{{share_folder_id}}",
|
|
"item_type": "folder"
|
|
}
|
|
|
|
HTTP 201
|
|
[Captures]
|
|
share_id: jsonpath "$.id"
|
|
share_token: jsonpath "$.token"
|
|
[Asserts]
|
|
jsonpath "$.has_password" == false
|
|
jsonpath "$.token" matches "^[A-Za-z0-9_-]+$"
|
|
|
|
|
|
# ─────────────────────────────────────────────────────────────
|
|
# 3 — The share appears in the owner's listing
|
|
# ─────────────────────────────────────────────────────────────
|
|
GET {{base_url}}/api/shares
|
|
Authorization: Bearer {{admin_token}}
|
|
|
|
HTTP 200
|
|
[Asserts]
|
|
body contains "{{share_id}}"
|
|
|
|
|
|
# ─────────────────────────────────────────────────────────────
|
|
# 4 — Single-share fetch
|
|
# ─────────────────────────────────────────────────────────────
|
|
GET {{base_url}}/api/shares/{{share_id}}
|
|
Authorization: Bearer {{admin_token}}
|
|
|
|
HTTP 200
|
|
[Asserts]
|
|
jsonpath "$.id" == "{{share_id}}"
|
|
jsonpath "$.item_id" == "{{share_folder_id}}"
|
|
jsonpath "$.item_type" == "folder"
|
|
|
|
|
|
# ─────────────────────────────────────────────────────────────
|
|
# 5 — Public access via the token, NO auth header. This is the
|
|
# security-critical path: any auth check that creeps in
|
|
# here breaks all external recipients.
|
|
# ─────────────────────────────────────────────────────────────
|
|
GET {{base_url}}/api/s/{{share_token}}
|
|
|
|
HTTP 200
|
|
|
|
|
|
# ─────────────────────────────────────────────────────────────
|
|
# 7 — Browse the shared folder contents (no auth).
|
|
# ─────────────────────────────────────────────────────────────
|
|
GET {{base_url}}/api/s/{{share_token}}/contents
|
|
|
|
HTTP 200
|
|
[Asserts]
|
|
body contains "{{shared_file_id}}"
|
|
|
|
|
|
# ─────────────────────────────────────────────────────────────
|
|
# 8 — Direct file share: mint a share on the FILE itself
|
|
# (item_type=file) and access it via /api/s/{token}.
|
|
#
|
|
# KNOWN BUG: GET /api/s/{folder-token}/file/{file_id} (the
|
|
# "fetch a file from inside a shared folder" route at
|
|
# share_handler.rs:653) currently returns 500. We sidestep
|
|
# it here by sharing the file directly. When the folder-file
|
|
# path is fixed, add a new scenario asserting it returns
|
|
# 200 + body, and back-link this comment.
|
|
# ─────────────────────────────────────────────────────────────
|
|
POST {{base_url}}/api/shares
|
|
Authorization: Bearer {{admin_token}}
|
|
Content-Type: application/json
|
|
{
|
|
"item_id": "{{shared_file_id}}",
|
|
"item_type": "file"
|
|
}
|
|
|
|
HTTP 201
|
|
[Captures]
|
|
file_share_id: jsonpath "$.id"
|
|
file_share_token: jsonpath "$.token"
|
|
|
|
|
|
GET {{base_url}}/api/s/{{file_share_token}}
|
|
|
|
HTTP 200
|
|
[Asserts]
|
|
jsonpath "$.item_type" == "file"
|
|
|
|
|
|
# ─────────────────────────────────────────────────────────────
|
|
# 9 — Mint a password-protected share on the same folder.
|
|
# ─────────────────────────────────────────────────────────────
|
|
POST {{base_url}}/api/shares
|
|
Authorization: Bearer {{admin_token}}
|
|
Content-Type: application/json
|
|
{
|
|
"item_id": "{{share_folder_id}}",
|
|
"item_type": "folder",
|
|
"password": "secret-share-password-1!"
|
|
}
|
|
|
|
HTTP 201
|
|
[Captures]
|
|
pw_share_id: jsonpath "$.id"
|
|
pw_share_token: jsonpath "$.token"
|
|
[Asserts]
|
|
jsonpath "$.has_password" == true
|
|
|
|
|
|
# ─────────────────────────────────────────────────────────────
|
|
# 10 — Anonymous probe must report "password required" without
|
|
# leaking the shared item's contents.
|
|
# ─────────────────────────────────────────────────────────────
|
|
GET {{base_url}}/api/s/{{pw_share_token}}
|
|
|
|
HTTP 401
|
|
[Asserts]
|
|
jsonpath "$.requiresPassword" == true
|
|
|
|
|
|
# ─────────────────────────────────────────────────────────────
|
|
# 11 — Wrong password → 401 (does NOT issue an unlock cookie).
|
|
# ─────────────────────────────────────────────────────────────
|
|
POST {{base_url}}/api/s/{{pw_share_token}}/verify
|
|
Content-Type: application/json
|
|
{ "password": "obviously-wrong" }
|
|
|
|
HTTP 401
|
|
|
|
|
|
# ─────────────────────────────────────────────────────────────
|
|
# 12 — Right password → 200 + Set-Cookie unlock JWT.
|
|
# ─────────────────────────────────────────────────────────────
|
|
POST {{base_url}}/api/s/{{pw_share_token}}/verify
|
|
Content-Type: application/json
|
|
{ "password": "secret-share-password-1!" }
|
|
|
|
HTTP 200
|
|
[Asserts]
|
|
header "Set-Cookie" exists
|
|
|
|
|
|
# ─────────────────────────────────────────────────────────────
|
|
# 13 — Revoke the password-less share
|
|
# ─────────────────────────────────────────────────────────────
|
|
DELETE {{base_url}}/api/shares/{{share_id}}
|
|
Authorization: Bearer {{admin_token}}
|
|
|
|
HTTP 204
|
|
|
|
|
|
# ─────────────────────────────────────────────────────────────
|
|
# 14 — After revocation the token must not resolve. Different
|
|
# server versions return 404 vs 410 depending on whether
|
|
# the row was hard-deleted or marked revoked — both are
|
|
# acceptable rejections of the token; what matters is the
|
|
# token does NOT yield a 200.
|
|
# ─────────────────────────────────────────────────────────────
|
|
GET {{base_url}}/api/s/{{share_token}}
|
|
|
|
HTTP *
|
|
[Asserts]
|
|
status >= 400
|
|
status < 500
|
|
|
|
|
|
# ─────────────────────────────────────────────────────────────
|
|
# 15 — Teardown: revoke the password share + the direct
|
|
# file-share, then delete the folder.
|
|
# ─────────────────────────────────────────────────────────────
|
|
DELETE {{base_url}}/api/shares/{{pw_share_id}}
|
|
Authorization: Bearer {{admin_token}}
|
|
HTTP 204
|
|
|
|
DELETE {{base_url}}/api/shares/{{file_share_id}}
|
|
Authorization: Bearer {{admin_token}}
|
|
HTTP 204
|
|
|
|
DELETE {{base_url}}/api/folders/{{share_folder_id}}
|
|
Authorization: Bearer {{admin_token}}
|
|
HTTP 204
|