Initial commit on Forgejo

Fresh repository history for elektrine/tarakan hosted at
https://git.elektrine.com/elektrine/tarakan.

test/tarakan_web/live/account_live/settings_test.exs

@@ -0,0 +1,434 @@
+defmodule TarakanWeb.AccountLive.SettingsTest do
+  use TarakanWeb.ConnCase, async: true
+
+  alias Tarakan.Accounts
+  import Phoenix.LiveViewTest
+  import Tarakan.AccountsFixtures
+
+  describe "Settings page" do
+    test "opens on the account panel", %{conn: conn} do
+      {:ok, view, html} =
+        conn
+        |> log_in_account(account_fixture())
+        |> live(~p"/accounts/settings")
+
+      assert html =~ "Save email"
+      assert html =~ "Save password"
+      assert html =~ "Connected code hosts"
+      assert html =~ "GitHub"
+      assert html =~ "GitLab"
+
+      assert has_element?(view, "#settings-tab-account[aria-current=page]")
+      refute has_element?(view, "#api-reference")
+      refute has_element?(view, "#ssh-key-form")
+    end
+
+    test "moves between panels from the rail", %{conn: conn} do
+      {:ok, view, _html} =
+        conn
+        |> log_in_account(account_fixture())
+        |> live(~p"/accounts/settings")
+
+      html =
+        view
+        |> element("#settings-tab-credentials")
+        |> render_click()
+
+      assert html =~ "Client credentials"
+      assert_patch(view, ~p"/accounts/settings/credentials")
+      assert has_element?(view, "#settings-tab-credentials[aria-current=page]")
+      refute has_element?(view, "#email_form")
+
+      view |> element("#settings-tab-ssh") |> render_click()
+      assert_patch(view, ~p"/accounts/settings/ssh-keys")
+      assert has_element?(view, "#ssh-key-form")
+
+      view |> element("#settings-tab-agents") |> render_click()
+      assert_patch(view, ~p"/accounts/settings/agents")
+      assert has_element?(view, "#settings-model-scoreboard", "None yet")
+    end
+
+    test "an unknown panel slug falls back to the account panel", %{conn: conn} do
+      {:ok, view, _html} =
+        conn
+        |> log_in_account(account_fixture())
+        |> live(~p"/accounts/settings/nonsense")
+
+      assert has_element?(view, "#email_form")
+      assert has_element?(view, "#settings-tab-account[aria-current=page]")
+    end
+
+    test "renders the API reference on the credentials panel", %{conn: conn} do
+      {:ok, view, html} =
+        conn
+        |> log_in_account(account_fixture())
+        |> live(~p"/accounts/settings/credentials")
+
+      assert has_element?(view, "#api-reference", "API reference")
+      assert has_element?(view, "#api-reference-base-url", "/api")
+      assert html =~ "/client-auth/exchange"
+      assert html =~ "/repositories"
+      assert html =~ "/jobs/:id/claim/renew"
+      assert html =~ "/:host/:owner/:name/reports"
+    end
+
+    test "marks an attached code-host identity as connected", %{conn: conn} do
+      {:ok, view, _html} =
+        conn
+        |> log_in_account(github_account_fixture())
+        |> live(~p"/accounts/settings")
+
+      assert has_element?(view, "#settings-github-identity", "Connected")
+      assert has_element?(view, "#settings-gitlab-identity", "Connect")
+    end
+
+    test "redirects if account is not logged in", %{conn: conn} do
+      assert {:error, redirect} = live(conn, ~p"/accounts/settings")
+
+      assert {:redirect, %{to: path, flash: flash}} = redirect
+      assert path == ~p"/accounts/log-in"
+      assert %{"error" => "You must log in to access this page."} = flash
+    end
+
+    test "generates and independently revokes a client credential", %{conn: conn} do
+      account = account_fixture()
+
+      {:ok, view, html} =
+        conn
+        |> log_in_account(account)
+        |> live(~p"/accounts/settings/credentials")
+
+      assert html =~ "Client credentials"
+      refute has_element?(view, "#api-token-value")
+
+      view
+      |> form("#api-credential-form", %{
+        "credential" => %{
+          "name" => "Task reader",
+          "scopes" => ["tasks:read"]
+        }
+      })
+      |> render_submit()
+
+      token =
+        view
+        |> element("#api-token-value")
+        |> render()
+        |> String.replace(~r/<[^>]+>/, "")
+        |> String.trim()
+
+      assert {:ok, fetched} = Accounts.fetch_account_by_api_token(token)
+      assert fetched.id == account.id
+
+      [credential] = Tarakan.Accounts.ApiCredentials.list(account)
+      assert credential.name == "Task reader"
+      assert credential.scopes == ["tasks:read"]
+      assert has_element?(view, "#api-credential-#{credential.id}")
+
+      view
+      |> element("#revoke-api-credential-#{credential.id}")
+      |> render_click()
+
+      assert :error = Accounts.fetch_account_by_api_token(token)
+      refute has_element?(view, "#revoke-api-credential-#{credential.id}")
+    end
+
+    test "can bind a least-privilege credential to one repository", %{conn: conn} do
+      account = github_account_fixture()
+      repository = github_repository_fixture(account)
+
+      {:ok, view, _html} =
+        conn
+        |> log_in_account(account)
+        |> live(~p"/accounts/settings/credentials")
+
+      view
+      |> form("#api-credential-form", %{
+        "credential" => %{
+          "name" => "Codex reader",
+          "repository" => "openai/codex",
+          "scopes" => ["tasks:read"]
+        }
+      })
+      |> render_submit()
+
+      token =
+        view
+        |> element("#api-token-value")
+        |> render()
+        |> String.replace(~r/<[^>]+>/, "")
+        |> String.trim()
+
+      assert {:ok, ^account, credential} =
+               Tarakan.Accounts.ApiCredentials.authenticate(token)
+
+      assert credential.repository_id == repository.id
+      assert credential.scopes == ["tasks:read"]
+    end
+
+    test "redirects if account is not in sudo mode", %{conn: conn} do
+      stale_at = DateTime.add(DateTime.utc_now(:second), -9 * 60, :minute)
+
+      {:ok, conn} =
+        conn
+        |> log_in_account(account_fixture(), token_authenticated_at: stale_at)
+        |> live(~p"/accounts/settings")
+        |> follow_redirect(conn, ~p"/accounts/log-in?return_to=%2Faccounts%2Fsettings")
+
+      assert conn.resp_body =~ "sign-in older than 2 hours for sensitive settings"
+    end
+
+    test "prompts unconfirmed accounts to confirm email instead of credential forms", %{
+      conn: conn
+    } do
+      conn = log_in_account(conn, unconfirmed_account_fixture())
+
+      {:ok, view, html} = live(conn, ~p"/accounts/settings")
+
+      assert has_element?(view, "#email-confirmation-required")
+      assert has_element?(view, "#settings-tab-account", "unconfirmed")
+      assert html =~ "Confirm your email to unlock credentials"
+      refute has_element?(view, "#password_form")
+
+      {:ok, view, _html} = live(conn, ~p"/accounts/settings/credentials")
+      refute has_element?(view, "#api-credential-form")
+
+      {:ok, view, _html} = live(conn, ~p"/accounts/settings/ssh-keys")
+      refute has_element?(view, "#ssh-key-form")
+    end
+  end
+
+  describe "SSH keys" do
+    @describetag :tmp_dir
+
+    defp generate_public_key(tmp_dir) do
+      path = Path.join(tmp_dir, "key-#{System.unique_integer([:positive])}")
+      {_output, 0} = System.cmd("ssh-keygen", ["-t", "ed25519", "-f", path, "-N", "", "-q"])
+      File.read!(path <> ".pub")
+    end
+
+    test "adds and removes a key", %{conn: conn, tmp_dir: tmp_dir} do
+      account = account_fixture()
+
+      {:ok, view, html} =
+        conn
+        |> log_in_account(account)
+        |> live(~p"/accounts/settings/ssh-keys")
+
+      assert html =~ "SSH keys"
+
+      view
+      |> form("#ssh-key-form",
+        ssh_key: %{name: "laptop", public_key: generate_public_key(tmp_dir)}
+      )
+      |> render_submit()
+
+      assert has_element?(view, "#ssh-key-list", "laptop")
+      assert has_element?(view, "#ssh-key-list", "SHA256:")
+
+      [key] = Tarakan.Accounts.SshKeys.list_for_account(account)
+
+      view
+      |> element("#delete-ssh-key-#{key.id}")
+      |> render_click()
+
+      refute has_element?(view, "#ssh-key-list")
+      assert Tarakan.Accounts.SshKeys.list_for_account(account) == []
+    end
+
+    test "rejects an invalid key inline", %{conn: conn} do
+      {:ok, view, _html} =
+        conn
+        |> log_in_account(account_fixture())
+        |> live(~p"/accounts/settings/ssh-keys")
+
+      html =
+        view
+        |> form("#ssh-key-form", ssh_key: %{name: "junk", public_key: "not a key"})
+        |> render_submit()
+
+      assert html =~ "is not a supported OpenSSH public key"
+    end
+  end
+
+  describe "update email form" do
+    setup %{conn: conn} do
+      account = account_fixture()
+      %{conn: log_in_account(conn, account), account: account}
+    end
+
+    test "updates the account email", %{conn: conn, account: account} do
+      new_email = unique_account_email()
+
+      {:ok, lv, _html} = live(conn, ~p"/accounts/settings")
+
+      result =
+        lv
+        |> form("#email_form", %{
+          "account" => %{"email" => new_email}
+        })
+        |> render_submit()
+
+      assert result =~ "A link to confirm your email"
+      assert Accounts.get_account_by_email(account.email)
+    end
+
+    test "renders errors with invalid data (phx-change)", %{conn: conn} do
+      {:ok, lv, _html} = live(conn, ~p"/accounts/settings")
+
+      result =
+        lv
+        |> element("#email_form")
+        |> render_change(%{
+          "action" => "update_email",
+          "account" => %{"email" => "with spaces"}
+        })
+
+      assert result =~ "Save email"
+      assert result =~ "must have the @ sign and no spaces"
+    end
+
+    test "renders errors with invalid data (phx-submit)", %{conn: conn, account: account} do
+      {:ok, lv, _html} = live(conn, ~p"/accounts/settings")
+
+      result =
+        lv
+        |> form("#email_form", %{
+          "account" => %{"email" => account.email}
+        })
+        |> render_submit()
+
+      assert result =~ "Save email"
+      assert result =~ "did not change"
+    end
+  end
+
+  describe "update password form" do
+    setup %{conn: conn} do
+      account = account_fixture()
+      %{conn: log_in_account(conn, account), account: account}
+    end
+
+    test "updates the account password", %{conn: conn, account: account} do
+      new_password = valid_account_password()
+
+      {:ok, lv, _html} = live(conn, ~p"/accounts/settings")
+
+      form =
+        form(lv, "#password_form", %{
+          "account" => %{
+            "password" => new_password,
+            "password_confirmation" => new_password
+          }
+        })
+
+      render_submit(form)
+
+      new_password_conn = follow_trigger_action(form, conn)
+
+      assert redirected_to(new_password_conn) == ~p"/accounts/settings"
+
+      assert get_session(new_password_conn, :account_token) != get_session(conn, :account_token)
+
+      assert Phoenix.Flash.get(new_password_conn.assigns.flash, :info) =~
+               "Password updated successfully"
+
+      assert Accounts.get_account_by_email_and_password(account.email, new_password)
+    end
+
+    test "renders errors with invalid data (phx-change)", %{conn: conn} do
+      {:ok, lv, _html} = live(conn, ~p"/accounts/settings")
+
+      result =
+        lv
+        |> element("#password_form")
+        |> render_change(%{
+          "account" => %{
+            "password" => "too short",
+            "password_confirmation" => "does not match"
+          }
+        })
+
+      assert result =~ "Save password"
+      assert result =~ "should be at least 15 character(s)"
+      assert result =~ "does not match password"
+    end
+
+    test "renders errors with invalid data (phx-submit)", %{conn: conn} do
+      {:ok, lv, _html} = live(conn, ~p"/accounts/settings")
+
+      result =
+        lv
+        |> form("#password_form", %{
+          "account" => %{
+            "password" => "too short",
+            "password_confirmation" => "does not match"
+          }
+        })
+        |> render_submit()
+
+      assert result =~ "Save password"
+      assert result =~ "should be at least 15 character(s)"
+      assert result =~ "does not match password"
+    end
+  end
+
+  describe "confirm email" do
+    setup %{conn: conn} do
+      account = account_fixture()
+      email = unique_account_email()
+
+      token =
+        extract_account_token(fn url ->
+          Accounts.deliver_account_update_email_instructions(
+            %{account | email: email},
+            account.email,
+            url
+          )
+        end)
+
+      %{conn: log_in_account(conn, account), token: token, email: email, account: account}
+    end
+
+    test "updates the account email once", %{
+      conn: conn,
+      account: account,
+      token: token,
+      email: email
+    } do
+      {:error, redirect} = live(conn, ~p"/accounts/settings/confirm-email/#{token}")
+
+      assert {:live_redirect, %{to: path, flash: flash}} = redirect
+      assert path == ~p"/accounts/settings"
+      assert %{"info" => message} = flash
+      assert message == "Email changed successfully."
+      refute Accounts.get_account_by_email(account.email)
+      assert Accounts.get_account_by_email(email)
+
+      # use confirm token again
+      {:error, redirect} = live(conn, ~p"/accounts/settings/confirm-email/#{token}")
+      assert {:live_redirect, %{to: path, flash: flash}} = redirect
+      assert path == ~p"/accounts/settings"
+      assert %{"error" => message} = flash
+      assert message == "Email change link is invalid or it has expired."
+    end
+
+    test "does not update email with invalid token", %{conn: conn, account: account} do
+      {:error, redirect} = live(conn, ~p"/accounts/settings/confirm-email/oops")
+      assert {:live_redirect, %{to: path, flash: flash}} = redirect
+      assert path == ~p"/accounts/settings"
+      assert %{"error" => message} = flash
+      assert message == "Email change link is invalid or it has expired."
+      assert Accounts.get_account_by_email(account.email)
+    end
+
+    test "redirects if account is not logged in", %{token: token} do
+      conn = build_conn()
+      {:error, redirect} = live(conn, ~p"/accounts/settings/confirm-email/#{token}")
+      assert {:redirect, %{to: path, flash: flash}} = redirect
+      assert path == ~p"/accounts/log-in"
+      assert %{"error" => message} = flash
+      assert message == "You must log in to access this page."
+    end
+  end
+end