mailgo/internal/web/handlers/admin_validation_test.go

package handlers

// 管理端输入校验回归测试（#23/#24）：用户名/域名格式白名单、密码最小
// 长度。含纯函数校验与 handler 层拒绝路径。

import (
	"html/template"
	"net/http"
	"net/http/httptest"
	"path/filepath"
	"strings"
	"testing"

	"mail_go/internal/db"
	"mail_go/internal/storage"
	"mail_go/internal/store"

	"github.com/gin-gonic/gin"
	"gorm.io/driver/sqlite"
	"gorm.io/gorm"
)

func TestUsernameReWhitelist(t *testing.T) {
	valid := []string{"alice", "a.b_c-d", "A1", "x", "user.01"}
	invalid := []string{"", "a@b", "a b", "a/b", "a\\b", "中文", "a:b"}
	for _, name := range valid {
		if !usernameRe.MatchString(name) {
			t.Fatalf("usernameRe(%q) = false, want true", name)
		}
	}
	for _, name := range invalid {
		if usernameRe.MatchString(name) {
			t.Fatalf("usernameRe(%q) = true, want false", name)
		}
	}
	if usernameRe.MatchString(strings.Repeat("a", 65)) {
		t.Fatal("usernameRe should reject 65-char username")
	}
}

func TestValidDomainName(t *testing.T) {
	valid := []string{"example.com", "localhost", "a-b.co", "A1.Example.COM", "mail.example.co.uk"}
	invalid := []string{
		"", "a@b", "a b", "-a.com", "a-.com", "a..com", ".a.com", "a.com.",
		"例え.jp", strings.Repeat("a", 64) + ".com", strings.Repeat("a", 254),
	}
	for _, name := range valid {
		if !validDomainName(name) {
			t.Fatalf("validDomainName(%q) = false, want true", name)
		}
	}
	for _, name := range invalid {
		if validDomainName(name) {
			t.Fatalf("validDomainName(%q) = true, want false", name)
		}
	}
}

func newAdminTestHandler(t *testing.T) (*AdminHandler, *store.Stores) {
	t.Helper()
	gdb, err := gorm.Open(sqlite.Open(filepath.Join(t.TempDir(), "test.db")), &gorm.Config{})
	if err != nil {
		t.Fatal(err)
	}
	if err := gdb.AutoMigrate(&db.User{}, &db.Domain{}, &db.Message{}, &db.Attachment{}, &db.Mailbox{}, &db.MailboxState{}); err != nil {
		t.Fatal(err)
	}
	stores := store.NewStores(gdb)
	if err := stores.Users.Create(&db.User{ID: 1, Username: "admin", Domain: db.Domain{Name: "example.com"}, DomainID: 1, IsAdmin: true}); err != nil {
		t.Fatal(err)
	}
	attStorage := storage.NewAttachmentStorage(t.TempDir())
	return NewAdminHandler(stores, attStorage, filepath.Join(t.TempDir(), "tls"), "", nil, 30, nil, nil), stores
}

func newAdminTestRouter(h *AdminHandler) *gin.Engine {
	gin.SetMode(gin.TestMode)
	r := gin.New()
	tmpl := template.Must(template.New("").Funcs(testTemplateFuncs()).ParseGlob(filepath.Join("..", "templates", "*.html")))
	template.Must(tmpl.ParseGlob(filepath.Join("..", "templates", "admin", "*.html")))
	r.SetHTMLTemplate(tmpl)
	r.Use(func(c *gin.Context) {
		c.Set("userID", uint(1))
		c.Set("currentUser", &db.User{ID: 1, Username: "admin", Domain: db.Domain{Name: "example.com"}, IsAdmin: true})
		c.Next()
	})
	r.POST("/admin/users", h.CreateUser)
	r.POST("/admin/users/:id", h.UpdateUser)
	r.POST("/admin/domains", h.CreateDomain)
	return r
}

func postForm(r *gin.Engine, path, form string) *httptest.ResponseRecorder {
	w := httptest.NewRecorder()
	req := httptest.NewRequest(http.MethodPost, path, strings.NewReader(form))
	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
	r.ServeHTTP(w, req)
	return w
}

func TestCreateUserRejectsInvalidUsername(t *testing.T) {
	h, stores := newAdminTestHandler(t)
	r := newAdminTestRouter(h)

	w := postForm(r, "/admin/users", "username=a@b&password=secret123&domain_id=1")
	if w.Code != http.StatusBadRequest {
		t.Fatalf("status = %d, want 400", w.Code)
	}
	if _, total, _ := stores.Users.ListAll(1, 100); total != 1 {
		t.Fatalf("user count = %d, want 1 (not created)", total)
	}
}

func TestCreateUserRejectsShortPassword(t *testing.T) {
	h, stores := newAdminTestHandler(t)
	r := newAdminTestRouter(h)

	w := postForm(r, "/admin/users", "username=bob&password=short&domain_id=1")
	if w.Code != http.StatusBadRequest {
		t.Fatalf("status = %d, want 400", w.Code)
	}
	if _, total, _ := stores.Users.ListAll(1, 100); total != 1 {
		t.Fatalf("user count = %d, want 1 (not created)", total)
	}
}

func TestCreateUserAcceptsValidInput(t *testing.T) {
	h, stores := newAdminTestHandler(t)
	r := newAdminTestRouter(h)

	w := postForm(r, "/admin/users", "username=bob&password=secret123&domain_id=1")
	if w.Code != http.StatusFound {
		t.Fatalf("status = %d, want 302", w.Code)
	}
	if _, total, _ := stores.Users.ListAll(1, 100); total != 2 {
		t.Fatalf("user count = %d, want 2", total)
	}
}

func TestUpdateUserRejectsInvalidUsername(t *testing.T) {
	h, stores := newAdminTestHandler(t)
	r := newAdminTestRouter(h)

	w := postForm(r, "/admin/users/1", "username=a@b")
	if w.Code != http.StatusBadRequest {
		t.Fatalf("status = %d, want 400", w.Code)
	}
	u, err := stores.Users.GetByID(1)
	if err != nil {
		t.Fatal(err)
	}
	if u.Username != "admin" {
		t.Fatalf("username = %q, want unchanged admin", u.Username)
	}
}

func TestCreateDomainRejectsInvalidName(t *testing.T) {
	h, stores := newAdminTestHandler(t)
	r := newAdminTestRouter(h)

	w := postForm(r, "/admin/domains", "name=a@b")
	if w.Code != http.StatusBadRequest {
		t.Fatalf("status = %d, want 400", w.Code)
	}
	if _, total, _ := stores.Domains.List(1, 100); total != 1 {
		t.Fatalf("domain count = %d, want 1 (not created)", total)
	}
}

func TestCreateDomainAcceptsValidName(t *testing.T) {
	h, stores := newAdminTestHandler(t)
	r := newAdminTestRouter(h)

	w := postForm(r, "/admin/domains", "name=corp.example.net")
	if w.Code != http.StatusFound {
		t.Fatalf("status = %d, want 302", w.Code)
	}
	if _, total, _ := stores.Domains.List(1, 100); total != 2 {
		t.Fatalf("domain count = %d, want 2", total)
	}
}