opengist/internal/web/handlers/gist/edit_test.go

package gist_test

import (
	"net/url"
	"testing"

	"github.com/stretchr/testify/require"
	"github.com/thomiceli/opengist/internal/db"
	webtest "github.com/thomiceli/opengist/internal/web/test"
)

func TestVisibility(t *testing.T) {
	s := webtest.Setup(t)
	defer webtest.Teardown(t)

	s.Register(t, "thomas")
	s.Register(t, "alice")

	t.Run("ChangeVisibility", func(t *testing.T) {
		_, _, username, identifier := s.CreateGist(t, "0")

		s.Login(t, "thomas")
		s.Request(t, "POST", "/"+username+"/"+identifier+"/visibility", url.Values{
			"private": {"2"},
		}, 302)

		gist, err := db.GetGist(username, identifier)
		require.NoError(t, err)
		require.Equal(t, db.PrivateVisibility, gist.Private)
	})

	t.Run("ChangeToUnlisted", func(t *testing.T) {
		_, _, username, identifier := s.CreateGist(t, "0")

		s.Login(t, "thomas")
		s.Request(t, "POST", "/"+username+"/"+identifier+"/visibility", url.Values{
			"private": {"1"},
		}, 302)

		gist, err := db.GetGist(username, identifier)
		require.NoError(t, err)
		require.Equal(t, db.UnlistedVisibility, gist.Private)
	})

	t.Run("OtherUserCannotChange", func(t *testing.T) {
		_, _, username, identifier := s.CreateGist(t, "0")

		s.Login(t, "alice")
		s.Request(t, "POST", "/"+username+"/"+identifier+"/visibility", nil, 403)

		gist, err := db.GetGist(username, identifier)
		require.NoError(t, err)
		require.Equal(t, db.PublicVisibility, gist.Private)
	})

	t.Run("NoAuth", func(t *testing.T) {
		_, _, username, identifier := s.CreateGist(t, "0")

		s.Logout()
		s.Request(t, "POST", "/"+username+"/"+identifier+"/visibility", nil, 302)

		gist, err := db.GetGist(username, identifier)
		require.NoError(t, err)
		require.Equal(t, db.PublicVisibility, gist.Private)
	})
}

func TestArchive(t *testing.T) {
	s := webtest.Setup(t)
	defer webtest.Teardown(t)

	s.Register(t, "thomas")
	s.Register(t, "alice")

	t.Run("OwnerCanArchiveAndUnarchive", func(t *testing.T) {
		_, _, username, identifier := s.CreateGist(t, "0")

		s.Login(t, "thomas")
		s.Request(t, "POST", "/"+username+"/"+identifier+"/archive", nil, 302)

		gist, err := db.GetGist(username, identifier)
		require.NoError(t, err)
		require.True(t, gist.Archived)

		// Toggling again unarchives the gist.
		s.Request(t, "POST", "/"+username+"/"+identifier+"/archive", nil, 302)

		gist, err = db.GetGist(username, identifier)
		require.NoError(t, err)
		require.False(t, gist.Archived)
	})

	t.Run("OtherUserCannotArchive", func(t *testing.T) {
		_, _, username, identifier := s.CreateGist(t, "0")

		s.Login(t, "alice")
		s.Request(t, "POST", "/"+username+"/"+identifier+"/archive", nil, 403)

		gist, err := db.GetGist(username, identifier)
		require.NoError(t, err)
		require.False(t, gist.Archived)
	})

	t.Run("CannotEditArchivedGist", func(t *testing.T) {
		_, _, username, identifier := s.CreateGist(t, "0")

		s.Login(t, "thomas")
		s.Request(t, "POST", "/"+username+"/"+identifier+"/archive", nil, 302)

		// Both the edit page and the edit submission are blocked while archived.
		s.Request(t, "GET", "/"+username+"/"+identifier+"/edit", nil, 403)
		s.Request(t, "POST", "/"+username+"/"+identifier+"/edit", url.Values{
			"title":   {"Changed"},
			"name":    {"file.txt"},
			"content": {"changed content"},
		}, 403)

		// The checkbox toggle is a write path too, so it must be blocked.
		s.Request(t, "PUT", "/"+username+"/"+identifier+"/checkbox", url.Values{
			"file":     {"file.txt"},
			"checkbox": {"0"},
		}, 403)
	})

	t.Run("CanEditAfterUnarchive", func(t *testing.T) {
		_, _, username, identifier := s.CreateGist(t, "0")

		s.Login(t, "thomas")
		// Archive then unarchive.
		s.Request(t, "POST", "/"+username+"/"+identifier+"/archive", nil, 302)
		s.Request(t, "POST", "/"+username+"/"+identifier+"/archive", nil, 302)

		// Editing works again once the gist is no longer archived.
		s.Request(t, "GET", "/"+username+"/"+identifier+"/edit", nil, 200)
		s.Request(t, "POST", "/"+username+"/"+identifier+"/edit", url.Values{
			"title":   {"Changed"},
			"name":    {"file.txt"},
			"content": {"changed content"},
		}, 302)
	})
}

func TestLegacyEditorUpdatesMetadata(t *testing.T) {
	s := webtest.Setup(t)
	defer webtest.Teardown(t)

	s.Register(t, "thomas")
	_, original, username, identifier := s.CreateGist(t, "0")

	s.Login(t, "thomas")
	s.Request(t, "POST", "/"+username+"/"+identifier+"/edit", url.Values{
		"_edit_metadata": {"1"},
		"title":          {"Updated from legacy UI"},
		"description":    {"Updated description"},
		"url":            {"legacy-url"},
		"topics":         {"legacy compatibility"},
		"name":           {"file.txt"},
		"content":        {"updated content"},
	}, 302)

	updated, err := db.GetGist(username, "legacy-url")
	require.NoError(t, err)
	require.Equal(t, original.ID, updated.ID)
	require.Equal(t, "Updated from legacy UI", updated.Title)
	require.Equal(t, "Updated description", updated.Description)
	require.ElementsMatch(t, []string{"legacy", "compatibility"}, updated.TopicsSlice())

	// A file-only edit from the new UI must keep metadata unchanged.
	s.Request(t, "POST", "/"+username+"/legacy-url/edit", url.Values{
		"name":    {"file.txt"},
		"content": {"new UI content"},
	}, 302)

	updated, err = db.GetGist(username, "legacy-url")
	require.NoError(t, err)
	require.Equal(t, "Updated from legacy UI", updated.Title)
	require.Equal(t, "Updated description", updated.Description)
	require.ElementsMatch(t, []string{"legacy", "compatibility"}, updated.TopicsSlice())
}