SocialPub/PrivaPub.Tests/Infrastructure/AdminCommandsTests.cs

using Microsoft.Extensions.DependencyInjection;

using MongoDB.Entities;

using PrivaPub.ClientModels;
using PrivaPub.Infrastructure.Cli;
using PrivaPub.Models.User;
using PrivaPub.Tests.Support;
using PrivaPub.Tests.Support.Host;

using System.Net;

namespace PrivaPub.Tests.Infrastructure
{
	[Trait("Category", "Integration")]
	public sealed class AdminCommandsTests : IAsyncLifetime
	{
		PrivaPubHost _host;

		public async ValueTask InitializeAsync()
		{
			Assert.SkipUnless(MongoFixture.Enabled, MongoFixture.Skip);
			_host = await PrivaPubHost.Shared();
		}

		public ValueTask DisposeAsync() => ValueTask.CompletedTask;

		static async Task<List<string>> StoredPolicies(Root root) =>
			(await DB.Default.Find<RootUser>().MatchID(root.Id).ExecuteFirstAsync(TestContext.Current.CancellationToken)).Policies.Order().ToList();

		async Task<HttpStatusCode> AdminRoute(Root root)
		{
			using var client = _host.As(root.Jwt);
			return (await client.GetAsync("/clientapi/admin/domainblocks/list", TestContext.Current.CancellationToken)).StatusCode;
		}

		[Fact]
		public async Task Promote_makes_an_admin_and_a_moderator()
		{
			var root = await _host.SignUp("promote");

			Assert.Equal(0, await AdminCommands.Run(new[] { "promote", root.UserName.ToUpperInvariant() }, _host.Services));
			Assert.Equal(0, await AdminCommands.Run(new[] { "promote", root.UserName }, _host.Services));

			Assert.Equal(new[] { Policies.IsAdmin, Policies.IsModerator, Policies.IsUser }.Order(), await StoredPolicies(root));
		}

		[Fact]
		public async Task Demote_leaves_a_plain_user()
		{
			var root = await _host.SignUp("demote");
			Assert.Equal(0, await AdminCommands.Run(new[] { "promote", root.UserName }, _host.Services));

			Assert.Equal(0, await AdminCommands.Run(new[] { "demote", root.UserName }, _host.Services));
			Assert.Equal(0, await AdminCommands.Run(new[] { "demote", root.UserName }, _host.Services));

			Assert.Equal(new[] { Policies.IsUser }, await StoredPolicies(root));
		}

		[Fact]
		public async Task An_unknown_root_exits_1()
		{
			Assert.Equal(1, await AdminCommands.Run(new[] { "promote", $"nobody{Guid.NewGuid():N}" }, _host.Services));
			Assert.Equal(1, await AdminCommands.Run(new[] { "demote", $"nobody{Guid.NewGuid():N}" }, _host.Services));
		}

		public static TheoryData<string[]> Misuses() => new()
		{
			Array.Empty<string>(),
			new[] { "promote" },
			new[] { "promote", "a", "b" },
			new[] { "delete", "a" },
			new[] { "PROMOTE", "a" }
		};

		[Theory]
		[MemberData(nameof(Misuses))]
		public async Task Misuse_exits_2(string[] args)
		{
			Assert.Equal(2, await AdminCommands.Run(args, _host.Services));
		}

		[Fact]
		public async Task A_token_follows_its_roots_policies_at_once()
		{
			var root = await _host.SignUp("policies");
			Assert.Equal(HttpStatusCode.Forbidden, await AdminRoute(root));

			Assert.Equal(0, await AdminCommands.Run(new[] { "promote", root.UserName }, _host.Services));
			Assert.Equal(HttpStatusCode.OK, await AdminRoute(root));
			using (var client = _host.As(root.Jwt))
			{
				var refreshed = await (await client.GetAsync("/clientapi/user/sniff/again", TestContext.Current.CancellationToken)).JsonBody();
				Assert.Contains(Policies.IsAdmin, refreshed["policies"]!.AsArray().Select(p => p!.GetValue<string>()));
			}

			Assert.Equal(0, await AdminCommands.Run(new[] { "demote", root.UserName }, _host.Services));
			Assert.Equal(HttpStatusCode.Forbidden, await AdminRoute(root));
		}

		async Task<HttpStatusCode> LogIn(string login, string password)
		{
			using var client = _host.Client();
			return (await client.PostJson("/clientapi/user/login", new { userName = login, password })).StatusCode;
		}

		[Fact]
		public async Task Create_root_makes_a_login_from_a_password_on_standard_input()
		{
			using var scope = _host.Services.CreateScope();
			var login = $"made{Guid.NewGuid():N}"[..20];
			var output = new StringWriter();

			Assert.Equal(0, await AdminCommands.Run(new[] { "create-root", login, "--admin" }, scope.ServiceProvider, new StringReader("Typed-On-Stdin-1\n"), output));
			Assert.Equal(1, await AdminCommands.Run(new[] { "create-root", login }, scope.ServiceProvider, new StringReader("Typed-On-Stdin-2\n"), new StringWriter()));
			Assert.Equal(1, await AdminCommands.Run(new[] { "create-root", $"weak{Guid.NewGuid():N}"[..20] }, scope.ServiceProvider, new StringReader("short\n"), new StringWriter()));
			Assert.Equal(2, await AdminCommands.Run(new[] { "create-root", login, "--root" }, scope.ServiceProvider, new StringReader("Typed-On-Stdin-3\n"), new StringWriter()));

			Assert.Equal(HttpStatusCode.OK, await LogIn(login, "Typed-On-Stdin-1"));
			var stored = await DB.Default.Find<RootUser>().Match(u => u.UserName == login).ExecuteFirstAsync(TestContext.Current.CancellationToken);
			Assert.Contains(Policies.IsAdmin, stored.Policies);
		}

		async Task<List<string>> PersonaIds(Root root)
		{
			using var client = _host.As(root.Jwt);
			return (await (await client.GetAsync("/clientapi/avatar/private/list", TestContext.Current.CancellationToken)).JsonItems())
				.Select(a => a!["id"]!.GetValue<string>()).ToList();
		}

		async Task<HttpStatusCode> VerifyCredentials(string mastodonToken)
		{
			using var client = _host.As(mastodonToken);
			return (await client.GetAsync("/api/v1/accounts/verify_credentials", TestContext.Current.CancellationToken)).StatusCode;
		}

		[Fact]
		public async Task Move_persona_gives_a_persona_to_another_login_and_ends_its_tokens()
		{
			using var scope = _host.Services.CreateScope();
			var giver = await _host.SignUp("giver");
			var taker = await _host.SignUp("taker");
			var persona = await _host.Persona(giver, "moved");
			var token = await _host.MastodonToken(persona);
			Assert.Equal(HttpStatusCode.OK, await VerifyCredentials(token));

			Assert.Equal(0, await AdminCommands.Run(new[] { "move-persona", "@" + persona.UserName, taker.UserName.ToUpperInvariant() }, scope.ServiceProvider, output: new StringWriter()));
			Assert.Equal(0, await AdminCommands.Run(new[] { "move-persona", persona.UserName, taker.UserName }, scope.ServiceProvider, output: new StringWriter()));

			Assert.Equal(HttpStatusCode.Unauthorized, await VerifyCredentials(token));
			Assert.DoesNotContain(persona.Id, await PersonaIds(giver));
			Assert.Contains(persona.Id, await PersonaIds(taker));
			Assert.Equal(1, await AdminCommands.Run(new[] { "move-persona", $"nobody{Guid.NewGuid():N}"[..20], taker.UserName }, scope.ServiceProvider));
			Assert.Equal(1, await AdminCommands.Run(new[] { "move-persona", persona.UserName, $"nobody{Guid.NewGuid():N}" }, scope.ServiceProvider));
		}

		[Fact]
		public async Task Delete_root_deletes_a_login_with_the_personas_it_still_has()
		{
			var cancellation = TestContext.Current.CancellationToken;
			using var scope = _host.Services.CreateScope();
			var root = await _host.SignUp("leaving");
			var persona = await _host.Persona(root, "leaving");
			var output = new StringWriter();

			Assert.Equal(0, await AdminCommands.Run(new[] { "delete-root", root.UserName }, scope.ServiceProvider, output: output));
			Assert.Equal(1, await AdminCommands.Run(new[] { "delete-root", root.UserName }, scope.ServiceProvider, output: new StringWriter()));

			Assert.Contains("@" + persona.UserName, output.ToString());
			Assert.NotEqual(HttpStatusCode.OK, await LogIn(root.UserName, root.Password));
			Assert.NotNull((await DB.Default.Find<RootUser>().OneAsync(root.Id, cancellation)).DeletedAt);
			Assert.NotNull((await DB.Default.Find<Avatar>().OneAsync(persona.Id, cancellation)).DeletionAt);
		}
	}
}