Function TestDeleteUserHandler

overlord/admin_api_test.go:303–377

TestDeleteUserHandler tests the deleteUserHandler function

(t *testing.T)

// TestDeleteUserHandler tests the deleteUserHandler function
func TestDeleteUserHandler(t *testing.T) {
	ovl, cleanup := setupTestOverlord(t)
	defer cleanup()

	// Get the router with proper configuration
	router := ovl.registerRoutes()

	// Login to get a JWT token
	adminJWTToken, err := loginAs(router, adminUsername)
	if err != nil {
		t.Fatalf("Failed to login: %v", err)
	}

	// Create a new test user to be deleted.
	err = ovl.dbManager.CreateUser("usertobedeleted", "userpass", false)
	if err != nil {
		t.Fatalf("Failed to create test user: %v", err)
	}

	// Test with admin user
	req := createAuthRequest(adminJWTToken, "DELETE", "/api/users/usertobedeleted", nil)
	rr := httptest.NewRecorder()

	router.ServeHTTP(rr, req)

	// Check response
	if rr.Code != http.StatusOK {
		t.Errorf("Expected status code 200, got %d", rr.Code)
	}

	// Verify the user was deleted
	exists, _ := userExists(ovl.dbManager, "usertobedeleted")
	if exists {
		t.Errorf("User 'usertobedeleted' should have been deleted from the database")
	}

	// Test deleting the admin user (should be prevented)
	req = createAuthRequest(adminJWTToken, "DELETE", "/api/users/admin", nil)
	rr = httptest.NewRecorder()

	router.ServeHTTP(rr, req)

	// Check response (should be bad request - cannot delete admin)
	if rr.Code != http.StatusBadRequest {
		t.Errorf("Expected status code 400, got %d", rr.Code)
	}

	// Verify admin still exists
	exists, _ = userExists(ovl.dbManager, "admin")
	if !exists {
		t.Errorf("User 'admin' should still exist in the database")
	}

	// Test with non-admin user (should be forbidden by middleware)
	userJWTToken, err := loginAs(router, testUsername)
	if err != nil {
		t.Fatalf("Failed to login: %v", err)
	}