mirror of
https://github.com/J3vb/OwnCord.git
synced 2026-09-03 03:50:00 +03:00
jevb
df998386d9
Admin panel redesign: - Rebuild frontend from mockup with Discord-style dark theme - Stat cards, section cards, role badges, modal system, toast notifications - All 7 sections: Dashboard, Users, Channels, Audit Log, Settings, Backups, Updates - Modals replace confirm()/prompt() for all destructive actions Live server logs (new): - RingBuffer + MultiHandler tees slog to stdout AND in-memory buffer - SSE endpoint at /admin/api/logs/stream streams logs in real-time - Log viewer with level filters (DEBUG/INFO/WARN/ERROR), search, auto-scroll, pause/resume, copy all, clear - Color-coded lines by level, source categorization from file paths Audit log improvements: - Search filter (actor, action, target, detail) - Action type dropdown filter - Copy All and Export CSV buttons - Instant client-side re-filtering Console output: - Switch from JSON to human-readable text format (slog.TextHandler) - Move startup banner before init logs so it appears first
76 lines
2.5 KiB
Go
76 lines
2.5 KiB
Go
package admin_test
|
|
|
|
// Additional tests to increase branch coverage on adminAuthMiddleware,
|
|
// ownerOnlyMiddleware, and related helpers.
|
|
|
|
import (
|
|
"net/http"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/owncord/server/admin"
|
|
"github.com/owncord/server/auth"
|
|
)
|
|
|
|
// ─── adminAuthMiddleware edge cases ──────────────────────────────────────────
|
|
|
|
// TestAdminAuthMiddleware_ExpiredSession verifies that a valid token whose
|
|
// session has expired is rejected with 401.
|
|
func TestAdminAuthMiddleware_ExpiredSession(t *testing.T) {
|
|
database := openAdminTestDB(t)
|
|
handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil)
|
|
|
|
// Create a user and session, then manually expire the session by setting
|
|
// expires_at to a past timestamp via the exported Exec helper.
|
|
uid, err := database.CreateUser("expireduser", "$2a$12$x", 1)
|
|
if err != nil {
|
|
t.Fatalf("CreateUser: %v", err)
|
|
}
|
|
token := "expired-session-token"
|
|
tokenHash := auth.HashToken(token)
|
|
if _, err := database.CreateSession(uid, tokenHash, "test", "127.0.0.1"); err != nil {
|
|
t.Fatalf("CreateSession: %v", err)
|
|
}
|
|
|
|
// Set expires_at to yesterday so the session is treated as expired.
|
|
pastTime := time.Now().Add(-24 * time.Hour).UTC().Format("2006-01-02T15:04:05Z")
|
|
if _, err := database.Exec(
|
|
`UPDATE sessions SET expires_at = ? WHERE token = ?`,
|
|
pastTime, tokenHash,
|
|
); err != nil {
|
|
t.Fatalf("UPDATE sessions expires_at: %v", err)
|
|
}
|
|
|
|
w := doRequest(t, handler, http.MethodGet, "/stats", token, nil)
|
|
|
|
if w.Code != http.StatusUnauthorized {
|
|
t.Errorf("expired session status = %d, want 401; body: %s", w.Code, w.Body.String())
|
|
}
|
|
}
|
|
|
|
// TestAdminAuthMiddleware_MissingBearer verifies that a request with no
|
|
// Authorization header returns 401.
|
|
func TestAdminAuthMiddleware_MissingBearer(t *testing.T) {
|
|
database := openAdminTestDB(t)
|
|
handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil)
|
|
|
|
w := doRequest(t, handler, http.MethodGet, "/stats", "", nil)
|
|
|
|
if w.Code != http.StatusUnauthorized {
|
|
t.Errorf("missing bearer status = %d, want 401", w.Code)
|
|
}
|
|
}
|
|
|
|
// TestAdminAuthMiddleware_InvalidToken verifies that a token not in the
|
|
// sessions table returns 401.
|
|
func TestAdminAuthMiddleware_InvalidToken(t *testing.T) {
|
|
database := openAdminTestDB(t)
|
|
handler := admin.NewAdminAPI(database, "1.0.0", nil, nil, nil)
|
|
|
|
w := doRequest(t, handler, http.MethodGet, "/stats", "completely-invalid-token", nil)
|
|
|
|
if w.Code != http.StatusUnauthorized {
|
|
t.Errorf("invalid token status = %d, want 401", w.Code)
|
|
}
|
|
}
|