Function TestDoBasicAuthRequiresAdminRole

internal/web/auth_test.go:19–76

(t *testing.T)

)

func TestDoBasicAuthRequiresAdminRole(t *testing.T) {
	const password = "correct-password"

	setupAuthTestUsers(t, password, map[string]string{
		"adminuser":  users.RoleAdmin,
		"moduser":    users.RoleMod,
		"normaluser": users.RoleUser,
	})

	tests := []struct {
		name       string
		username   string
		wantStatus int
		wantCalled bool
	}{
		{
			name:       "admin accepted",
			username:   "adminuser",
			wantStatus: http.StatusOK,
			wantCalled: true,
		},
		{
			name:       "mod accepted",
			username:   "moduser",
			wantStatus: http.StatusOK,
			wantCalled: true,
		},
		{
			name:       "user rejected",
			username:   "normaluser",
			wantStatus: http.StatusUnauthorized,
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			resetAuthStateForTest()
			called := false
			handler := doBasicAuth(func(w http.ResponseWriter, r *http.Request) {
				called = true
				w.WriteHeader(http.StatusOK)
			})

			req := httptest.NewRequest(http.MethodGet, "/admin/", nil)
			req.SetBasicAuth(tt.username, password)
			rec := httptest.NewRecorder()

			handler(rec, req)

			if rec.Code != tt.wantStatus {
				t.Fatalf("status = %d, want %d", rec.Code, tt.wantStatus)
			}
			if called != tt.wantCalled {
				t.Fatalf("handler called = %t, want %t", called, tt.wantCalled)
			}
		})
	}
}