Brummel
661ea6215e
Introduce a `preview_lines` setting in `users.toml` to control the number of visible lines for the analysis preview in the case list. This feature extracts the first paragraph of the `document.md` file, strips markdown formatting, and displays it, capped by the configured `preview_lines`. The actual line clamping is handled client-side via CSS `line-clamp`.
261 lines
7.6 KiB
Rust
261 lines
7.6 KiB
Rust
use std::collections::HashMap;
|
|
use std::sync::Arc;
|
|
|
|
use axum::body::Body;
|
|
use axum::http::{Request, StatusCode, header};
|
|
use tower::util::ServiceExt;
|
|
|
|
use doctate_server::config::{Config, User};
|
|
|
|
fn make_user(slug: &str, password_plain: &str) -> User {
|
|
User {
|
|
slug: slug.into(),
|
|
api_key: format!("key-{slug}"),
|
|
web_password: bcrypt::hash(password_plain, 4).unwrap(),
|
|
role: "doctor".into(),
|
|
whisper: Default::default(),
|
|
retention: Default::default(),
|
|
window_hours: 72,
|
|
preview_lines: 2,
|
|
}
|
|
}
|
|
|
|
fn test_config_with_users(users: Vec<User>) -> Arc<Config> {
|
|
let data_path = std::env::temp_dir().join(format!(
|
|
"doctate-login-test-{}-{}",
|
|
std::process::id(),
|
|
uuid::Uuid::new_v4()
|
|
));
|
|
let api_keys: HashMap<String, String> = users
|
|
.iter()
|
|
.map(|u| (u.api_key.clone(), u.slug.clone()))
|
|
.collect();
|
|
Arc::new(Config {
|
|
data_path,
|
|
users,
|
|
api_keys,
|
|
..Config::test_default()
|
|
})
|
|
}
|
|
|
|
async fn body_to_string(response: axum::response::Response) -> String {
|
|
let bytes = axum::body::to_bytes(response.into_body(), usize::MAX)
|
|
.await
|
|
.unwrap();
|
|
String::from_utf8(bytes.to_vec()).unwrap()
|
|
}
|
|
|
|
/// Extract the session cookie (name=value) from a Set-Cookie response.
|
|
fn extract_session_cookie(resp: &axum::response::Response) -> Option<String> {
|
|
for v in resp.headers().get_all(header::SET_COOKIE).iter() {
|
|
let s = v.to_str().ok()?;
|
|
if let Some(pair) = s.split(';').next()
|
|
&& pair.starts_with("session=")
|
|
{
|
|
return Some(pair.to_string());
|
|
}
|
|
}
|
|
None
|
|
}
|
|
|
|
fn login_request(slug: &str, password: &str) -> Request<Body> {
|
|
let body = format!("slug={slug}&password={password}");
|
|
Request::builder()
|
|
.method("POST")
|
|
.uri("/web/login")
|
|
.header(header::CONTENT_TYPE, "application/x-www-form-urlencoded")
|
|
.body(Body::from(body))
|
|
.unwrap()
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn login_success_sets_session_cookie_and_redirects() {
|
|
let config = test_config_with_users(vec![make_user("dr_a", "secret")]);
|
|
let app = doctate_server::create_router(config);
|
|
|
|
let resp = app.oneshot(login_request("dr_a", "secret")).await.unwrap();
|
|
assert_eq!(
|
|
resp.status(),
|
|
StatusCode::SEE_OTHER.as_u16(),
|
|
"got {:?}",
|
|
resp.status()
|
|
);
|
|
|
|
let loc = resp
|
|
.headers()
|
|
.get(header::LOCATION)
|
|
.unwrap()
|
|
.to_str()
|
|
.unwrap();
|
|
assert_eq!(loc, "/web/cases");
|
|
|
|
let cookie = extract_session_cookie(&resp).expect("no session cookie");
|
|
assert!(cookie.starts_with("session="));
|
|
assert!(
|
|
cookie.len() > "session=".len() + 20,
|
|
"token looks too short: {cookie}"
|
|
);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn login_wrong_password_shows_error() {
|
|
let config = test_config_with_users(vec![make_user("dr_a", "secret")]);
|
|
let app = doctate_server::create_router(config);
|
|
|
|
let resp = app.oneshot(login_request("dr_a", "wrong")).await.unwrap();
|
|
assert_eq!(resp.status(), StatusCode::OK);
|
|
assert!(extract_session_cookie(&resp).is_none());
|
|
let body = body_to_string(resp).await;
|
|
assert!(body.contains("Login fehlgeschlagen"), "got: {body}");
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn login_unknown_user_shows_error() {
|
|
let config = test_config_with_users(vec![make_user("dr_a", "secret")]);
|
|
let app = doctate_server::create_router(config);
|
|
|
|
let resp = app
|
|
.oneshot(login_request("ghost", "anything"))
|
|
.await
|
|
.unwrap();
|
|
assert_eq!(resp.status(), StatusCode::OK);
|
|
assert!(extract_session_cookie(&resp).is_none());
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn cases_without_cookie_redirects_to_login() {
|
|
let config = test_config_with_users(vec![make_user("dr_a", "secret")]);
|
|
let app = doctate_server::create_router(config);
|
|
|
|
let resp = app
|
|
.oneshot(
|
|
Request::builder()
|
|
.uri("/web/cases")
|
|
.body(Body::empty())
|
|
.unwrap(),
|
|
)
|
|
.await
|
|
.unwrap();
|
|
assert_eq!(resp.status(), StatusCode::FOUND);
|
|
assert_eq!(
|
|
resp.headers()
|
|
.get(header::LOCATION)
|
|
.unwrap()
|
|
.to_str()
|
|
.unwrap(),
|
|
"/web/login"
|
|
);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn cases_with_valid_cookie_shows_only_own_cases() {
|
|
let config = test_config_with_users(vec![make_user("dr_a", "s"), make_user("dr_b", "s")]);
|
|
// Seed fixtures: dr_a has an open case, dr_b has one too.
|
|
let case_a = config
|
|
.data_path
|
|
.join("dr_a/11111111-1111-1111-1111-111111111111");
|
|
let case_b = config
|
|
.data_path
|
|
.join("dr_b/22222222-2222-2222-2222-222222222222");
|
|
std::fs::create_dir_all(&case_a).unwrap();
|
|
std::fs::create_dir_all(&case_b).unwrap();
|
|
std::fs::write(case_a.join("2026-04-14T10-00-00Z.m4a"), b"x").unwrap();
|
|
std::fs::write(case_b.join("2026-04-14T11-00-00Z.m4a"), b"x").unwrap();
|
|
|
|
let app = doctate_server::create_router(config);
|
|
|
|
// Log in as dr_a.
|
|
let login = app
|
|
.clone()
|
|
.oneshot(login_request("dr_a", "s"))
|
|
.await
|
|
.unwrap();
|
|
let cookie = extract_session_cookie(&login).unwrap();
|
|
|
|
let resp = app
|
|
.oneshot(
|
|
Request::builder()
|
|
.uri("/web/cases")
|
|
.header(header::COOKIE, &cookie)
|
|
.body(Body::empty())
|
|
.unwrap(),
|
|
)
|
|
.await
|
|
.unwrap();
|
|
assert_eq!(resp.status(), StatusCode::OK);
|
|
let body = body_to_string(resp).await;
|
|
assert!(body.contains("11111111"), "own case missing: {body}");
|
|
assert!(!body.contains("22222222"), "foreign case leaked: {body}");
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn case_detail_of_foreign_case_returns_404() {
|
|
let config = test_config_with_users(vec![make_user("dr_a", "s"), make_user("dr_b", "s")]);
|
|
let case_b = config
|
|
.data_path
|
|
.join("dr_b/22222222-2222-2222-2222-222222222222");
|
|
std::fs::create_dir_all(&case_b).unwrap();
|
|
std::fs::write(case_b.join("2026-04-14T11-00-00Z.m4a"), b"x").unwrap();
|
|
|
|
let app = doctate_server::create_router(config);
|
|
|
|
let login = app
|
|
.clone()
|
|
.oneshot(login_request("dr_a", "s"))
|
|
.await
|
|
.unwrap();
|
|
let cookie = extract_session_cookie(&login).unwrap();
|
|
|
|
let resp = app
|
|
.oneshot(
|
|
Request::builder()
|
|
.uri("/web/cases/22222222-2222-2222-2222-222222222222")
|
|
.header(header::COOKIE, &cookie)
|
|
.body(Body::empty())
|
|
.unwrap(),
|
|
)
|
|
.await
|
|
.unwrap();
|
|
assert_eq!(resp.status(), StatusCode::NOT_FOUND);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn logout_clears_session() {
|
|
let config = test_config_with_users(vec![make_user("dr_a", "s")]);
|
|
let app = doctate_server::create_router(config);
|
|
|
|
let login = app
|
|
.clone()
|
|
.oneshot(login_request("dr_a", "s"))
|
|
.await
|
|
.unwrap();
|
|
let cookie = extract_session_cookie(&login).unwrap();
|
|
|
|
let logout = app
|
|
.clone()
|
|
.oneshot(
|
|
Request::builder()
|
|
.method("POST")
|
|
.uri("/web/logout")
|
|
.header(header::COOKIE, &cookie)
|
|
.body(Body::empty())
|
|
.unwrap(),
|
|
)
|
|
.await
|
|
.unwrap();
|
|
assert_eq!(logout.status(), StatusCode::SEE_OTHER.as_u16());
|
|
|
|
// Same cookie must no longer be accepted.
|
|
let resp = app
|
|
.oneshot(
|
|
Request::builder()
|
|
.uri("/web/cases")
|
|
.header(header::COOKIE, &cookie)
|
|
.body(Body::empty())
|
|
.unwrap(),
|
|
)
|
|
.await
|
|
.unwrap();
|
|
assert_eq!(resp.status(), StatusCode::FOUND);
|
|
}
|