Function TestMagicLinkGETDoesNotExecute

internal/agent/hitl_magic_api_test.go:120–144

--- GET confirmation page behavior --- TestMagicLinkGETDoesNotExecute is the core security property of the split GET/POST design: an email-client URL scanner that previews the approve link must not trigger the send.

(t *testing.T)

// split GET/POST design: an email-client URL scanner that previews the
// approve link must not trigger the send.
func TestMagicLinkGETDoesNotExecute(t *testing.T) {
	server, store, signer, smtpDone := setupMagicLinkAPI(t)
	a, userID := prepareHITLAgent(t, store, "get-no-execute")
	msg := issuePending(t, store, a.ID)

	tok, _ := signer.Sign(msg.ID, approvaltoken.ActionApprove, time.Now().Add(1*time.Hour))
	resp, err := http.Get(server.URL + "/v1/approve?t=" + url.QueryEscape(tok))
	if err != nil {
		t.Fatal(err)
	}
	if resp.StatusCode != http.StatusOK {
		t.Fatalf("GET confirm page: status = %d", resp.StatusCode)
	}

	// No SMTP activity at all — we only rendered a confirmation page.
	if msgs := smtpDone(); len(msgs) != 0 {
		t.Errorf("GET should not have triggered a send; got %d SMTP messages", len(msgs))
	}

	// Row stays pending.
	got, _ := store.GetOutboundMessageForUser(context.Background(), msg.ID, userID)
	if got.Status != identity.MessageStatusPendingReview {
		t.Errorf("status after GET = %q, want still pending_approval", got.Status)
	}
}

// TestMagicApproveGETRendersConfirmForm verifies the confirmation page
// contains a POST form with the token carried in a hidden field, plus