Initial commit on Forgejo

Fresh repository history for elektrine/tarakan-client hosted at
https://git.elektrine.com/elektrine/tarakan-client.

cmd/tarakan/auth_test.go

@@ -0,0 +1,107 @@
+package main
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/atomine-elektrine/tarakan-client/internal/api"
+)
+
+func TestLoginSavesTokenForFutureRuns(t *testing.T) {
+	t.Setenv("XDG_CONFIG_HOME", t.TempDir())
+	t.Setenv("TARAKAN_URL", "")
+	t.Setenv("TARAKAN_API_TOKEN", "")
+	var stdout, stderr bytes.Buffer
+
+	code := run(
+		[]string{"login", "--url", "https://tarakan.example", "--token", "persistent-secret"},
+		strings.NewReader(""),
+		&stdout,
+		&stderr,
+	)
+	if code != 0 {
+		t.Fatalf("code = %d, stderr = %q", code, stderr.String())
+	}
+	cfg := api.LoadConfig("", "")
+	if cfg.BaseURL != "https://tarakan.example" || cfg.Token != "persistent-secret" {
+		t.Fatalf("saved cfg = %#v", cfg)
+	}
+	if strings.Contains(stdout.String(), "persistent-secret") {
+		t.Fatalf("login output exposed token: %q", stdout.String())
+	}
+}
+
+func TestWebLoginSavesExchangedTokenAndLogoutRemovesIt(t *testing.T) {
+	t.Setenv("XDG_CONFIG_HOME", t.TempDir())
+	t.Setenv("TARAKAN_API_TOKEN", "")
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		switch r.URL.Path {
+		case "/api/client-auth/start":
+			if got := r.Header.Get("Authorization"); got != "" {
+				t.Errorf("public login request sent Authorization header %q", got)
+			}
+			w.WriteHeader(http.StatusCreated)
+			_ = json.NewEncoder(w).Encode(map[string]any{
+				"device_code":               "trkd_abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQ",
+				"user_code":                 "ABCD-EFGH",
+				"verification_uri_complete": serverURL(r) + "/client/authorize/ABCD-EFGH",
+				"expires_in":                60,
+				"interval":                  1,
+			})
+		case "/api/client-auth/exchange":
+			if got := r.Header.Get("Authorization"); got != "" {
+				t.Errorf("public login request sent Authorization header %q", got)
+			}
+			_ = json.NewEncoder(w).Encode(map[string]any{
+				"token":      "browser-issued-secret",
+				"token_type": "Bearer",
+				"expires_at": "2026-08-12T00:00:00Z",
+				"scopes":     []string{"tasks:read"},
+			})
+		case "/api/client-auth/session":
+			if r.Method != http.MethodDelete {
+				t.Errorf("logout method = %s", r.Method)
+			}
+			if got := r.Header.Get("Authorization"); got != "Bearer browser-issued-secret" {
+				t.Errorf("logout Authorization = %q", got)
+			}
+			w.WriteHeader(http.StatusNoContent)
+		default:
+			http.NotFound(w, r)
+		}
+	}))
+	defer server.Close()
+	t.Setenv("TARAKAN_URL", server.URL)
+	var stdout, stderr bytes.Buffer
+
+	if code := run([]string{"login", "--no-browser"}, strings.NewReader(""), &stdout, &stderr); code != 0 {
+		t.Fatalf("login code = %d, stderr = %q", code, stderr.String())
+	}
+	if got := api.LoadConfig("", "").Token; got != "browser-issued-secret" {
+		t.Fatalf("saved token = %q", got)
+	}
+	if !strings.Contains(stdout.String(), "ABCD-EFGH") || !strings.Contains(stdout.String(), "/client/authorize/") {
+		t.Fatalf("login output = %q", stdout.String())
+	}
+	if strings.Contains(stdout.String(), "browser-issued-secret") {
+		t.Fatalf("login output exposed token: %q", stdout.String())
+	}
+
+	stdout.Reset()
+	stderr.Reset()
+	if code := run([]string{"logout"}, strings.NewReader(""), &stdout, &stderr); code != 0 {
+		t.Fatalf("logout code = %d, stderr = %q", code, stderr.String())
+	}
+	if got := api.LoadConfig("", "").Token; got != "" {
+		t.Fatalf("token after logout = %q", got)
+	}
+}
+
+func serverURL(r *http.Request) string {
+	return "http://" + r.Host
+}