Initial commit on Forgejo

Fresh repository history for elektrine/tarakan hosted at
https://git.elektrine.com/elektrine/tarakan.

test/tarakan_web/live/finding_vote_test.exs

@@ -0,0 +1,110 @@
+defmodule TarakanWeb.FindingVoteTest do
+  use TarakanWeb.ConnCase
+
+  import Phoenix.LiveViewTest
+
+  alias Tarakan.Accounts.Scope
+  alias Tarakan.Discussion
+
+  setup do
+    submitter = github_account_fixture()
+    repository = listed_github_repository_fixture(submitter)
+    scan = scan_fixture(repository, submitter, %{"findings_json" => findings_json_fixture(1)})
+    [finding] = scan.findings
+    %{finding: %{finding | scan: scan}, submitter: submitter}
+  end
+
+  test "a signed-in visitor upvotes a finding and the score updates", %{
+    conn: conn,
+    finding: finding
+  } do
+    conn = log_in_account(conn, account_fixture())
+    {:ok, view, _html} = live(conn, ~p"/findings/#{finding.public_id}")
+    canonical_id = finding.canonical_finding.id
+
+    view
+    |> element(~s(#vote-canonical_finding-#{canonical_id} button[phx-value-vote="1"]))
+    |> render_click()
+
+    assert has_element?(view, "#vote-canonical_finding-#{canonical_id}", "1")
+  end
+
+  test "the submitter cannot vote on their own finding", %{
+    conn: conn,
+    finding: finding,
+    submitter: submitter
+  } do
+    conn = log_in_account(conn, submitter)
+    {:ok, view, _html} = live(conn, ~p"/findings/#{finding.public_id}")
+    canonical_id = finding.canonical_finding.id
+
+    html =
+      view
+      |> element(~s(#vote-canonical_finding-#{canonical_id} button[phx-value-vote="1"]))
+      |> render_click()
+
+    assert html =~ "cannot vote on your own"
+    assert has_element?(view, "#vote-canonical_finding-#{canonical_id}", "0")
+  end
+
+  test "anonymous vote clicks are gated to login", %{conn: conn, finding: finding} do
+    {:ok, view, _html} = live(conn, ~p"/findings/#{finding.public_id}")
+    # Anonymous controls are disabled, so the buttons carry the disabled attr.
+    assert has_element?(
+             view,
+             ~s(#vote-canonical_finding-#{finding.canonical_finding.id} button[disabled])
+           )
+  end
+
+  test "a comment can be voted on", %{conn: conn, finding: finding} do
+    {:ok, comment} =
+      Discussion.create_comment(Scope.for_account(account_fixture()), finding, %{
+        "body" => "This looks exploitable."
+      })
+
+    conn = log_in_account(conn, account_fixture())
+    {:ok, view, _html} = live(conn, ~p"/findings/#{finding.public_id}")
+
+    view
+    |> element(~s(#vote-comment-#{comment.id} button[phx-value-vote="1"]))
+    |> render_click()
+
+    assert has_element?(view, "#vote-comment-#{comment.id}", "1")
+  end
+
+  test "malformed vote parameters are rejected without crashing", %{
+    conn: conn,
+    finding: finding
+  } do
+    conn = log_in_account(conn, account_fixture())
+    {:ok, view, _html} = live(conn, ~p"/findings/#{finding.public_id}")
+
+    html =
+      render_click(view, "vote", %{
+        "type" => "canonical_finding",
+        "id" => "1 OR 1=1",
+        "vote" => "1"
+      })
+
+    assert html =~ "could not be recorded"
+
+    html =
+      render_click(view, "vote", %{
+        "type" => "canonical_finding",
+        "id" => "#{finding.canonical_finding.id}",
+        "vote" => "1; DROP"
+      })
+
+    assert html =~ "could not be recorded"
+    assert has_element?(view, "#vote-canonical_finding-#{finding.canonical_finding.id}", "0")
+  end
+
+  test "only the canonical finding on the security page carries a vote control", %{
+    finding: finding
+  } do
+    conn = Phoenix.ConnTest.build_conn()
+    {:ok, view, _html} = live(conn, ~p"/github.com/openai/codex/security")
+    assert has_element?(view, "#vote-canonical_finding-#{finding.canonical_finding.id}")
+    refute has_element?(view, "#vote-finding-#{finding.id}")
+  end
+end