Function TestAllSessionDeleteInvalidation

rest/session_test.go:605–662

(t *testing.T)

}

func TestAllSessionDeleteInvalidation(t *testing.T) {
	rt := NewRestTester(t, nil)
	defer rt.Close()

	const username = "user1"

	rt.CreateUser(username, []string{"*"})

	const numSessions = 3
	cookies := make([]string, numSessions)
	for i := 0; i < 3; i++ {
		response := rt.SendUserRequest(http.MethodPost, "/{{.db}}/_session", "", username)
		RequireStatus(t, response, http.StatusOK)
		cookie := response.Header().Get("Set-Cookie")
		require.NotEqual(t, "", cookie)
		cookies[i] = cookie
	}
	// Create a doc as the first user, with session auth, channel-restricted to first user
	firstCookieHeaders := map[string]string{
		"Cookie": cookies[0],
	}
	response := rt.SendRequestWithHeaders(http.MethodPut, "/{{.keyspace}}/doc1", `{"hi": "there"}`, firstCookieHeaders)
	RequireStatus(t, response, http.StatusCreated)

	// make sure all sessions work to GET doc
	for _, cookie := range cookies {
		cookieHeaders := map[string]string{
			"Cookie": cookie,
		}

		response = rt.SendRequestWithHeaders(http.MethodGet, "/{{.keyspace}}/doc1", "", cookieHeaders)
		RequireStatus(t, response, http.StatusOK)
	}

	// make sure password works to GET doc
	response = rt.SendUserRequest(http.MethodGet, "/{{.keyspace}}/doc1", "", username)
	RequireStatus(t, response, http.StatusOK)

	// DELETE all sessions for a user
	response = rt.SendAdminRequest("DELETE", fmt.Sprintf("/{{.db}}/_user/%s/_session", username), "")
	RequireStatus(t, response, http.StatusOK)

	// make sure all sessions are invalid
	for _, cookie := range cookies {
		cookieHeaders := map[string]string{
			"Cookie": cookie,
		}

		response = rt.SendRequestWithHeaders(http.MethodGet, "/{{.keyspace}}/doc1", "", cookieHeaders)
		RequireStatus(t, response, http.StatusUnauthorized)
		require.Contains(t, response.Body.String(), "Session no longer valid")
	}

	// make sure password still works
	response = rt.SendUserRequest(http.MethodGet, "/{{.keyspace}}/doc1", "", username)
	RequireStatus(t, response, http.StatusOK)

}