initial commit

tests/integration/auth_unclaimed_claim_flow_test.go

@@ -0,0 +1,139 @@
+/*
+ * Copyright (C) 2026 Fluxer Contributors
+ *
+ * This file is part of Fluxer.
+ *
+ * Fluxer is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * Fluxer is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with Fluxer. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+package integration
+
+import (
+	"fmt"
+	"net/http"
+	"testing"
+	"time"
+)
+
+func TestAuthUnclaimedClaimFlow(t *testing.T) {
+	client := newTestClient(t)
+
+	account := createTestAccount(t, client)
+	clearTestEmails(t, client)
+	unclaimAccount(t, client, account.UserID)
+
+	t.Run("unclaimed users cannot change tag or settings", func(t *testing.T) {
+		resp, err := client.patchJSONWithAuth("/users/@me", map[string]any{
+			"username": fmt.Sprintf("forbidden-%d", time.Now().UnixNano()),
+		}, account.Token)
+		if err != nil {
+			t.Fatalf("failed to attempt username change: %v", err)
+		}
+		defer resp.Body.Close()
+		if resp.StatusCode == http.StatusOK {
+			t.Fatalf("expected username change to be rejected for unclaimed user")
+		}
+	})
+
+	t.Run("unclaimed users claim via email code and password", func(t *testing.T) {
+		startResp, err := client.postJSONWithAuth("/users/@me/email-change/start", map[string]any{}, account.Token)
+		if err != nil {
+			t.Fatalf("failed to start email change: %v", err)
+		}
+		assertStatus(t, startResp, http.StatusOK)
+		var start emailChangeStartResponse
+		decodeJSONResponse(t, startResp, &start)
+		startResp.Body.Close()
+
+		if start.RequireOriginal {
+			t.Fatalf("unclaimed users should not require original email verification")
+		}
+		if start.OriginalProof == nil || *start.OriginalProof == "" {
+			t.Fatalf("expected original_proof in start response for unclaimed user")
+		}
+		originalProof := *start.OriginalProof
+
+		newEmail := fmt.Sprintf("integration-claim-%d@example.com", time.Now().UnixNano())
+		reqNewResp, err := client.postJSONWithAuth("/users/@me/email-change/request-new", map[string]any{
+			"ticket":         start.Ticket,
+			"new_email":      newEmail,
+			"original_proof": originalProof,
+		}, account.Token)
+		if err != nil {
+			t.Fatalf("failed to request new email: %v", err)
+		}
+		assertStatus(t, reqNewResp, http.StatusOK)
+		var reqNew emailChangeRequestNewResponse
+		decodeJSONResponse(t, reqNewResp, &reqNew)
+		reqNewResp.Body.Close()
+
+		newEmailData := waitForEmail(t, client, "email_change_new", newEmail)
+		newCode := newEmailData.Metadata["code"]
+		if newCode == "" {
+			t.Fatalf("expected verification code in email metadata")
+		}
+
+		verifyNewResp, err := client.postJSONWithAuth("/users/@me/email-change/verify-new", map[string]any{
+			"ticket":         start.Ticket,
+			"code":           newCode,
+			"original_proof": originalProof,
+		}, account.Token)
+		if err != nil {
+			t.Fatalf("failed to verify new email: %v", err)
+		}
+		assertStatus(t, verifyNewResp, http.StatusOK)
+		var verify emailChangeVerifyNewResponse
+		decodeJSONResponse(t, verifyNewResp, &verify)
+		verifyNewResp.Body.Close()
+
+		newPassword := uniquePassword()
+		finalResp, err := client.patchJSONWithAuth("/users/@me", map[string]any{
+			"email_token":  verify.EmailToken,
+			"new_password": newPassword,
+		}, account.Token)
+		if err != nil {
+			t.Fatalf("failed to finalize claim: %v", err)
+		}
+		assertStatus(t, finalResp, http.StatusOK)
+		var updated struct {
+			Email                 string  `json:"email"`
+			PasswordLastChangedAt *string `json:"password_last_changed_at"`
+		}
+		decodeJSONResponse(t, finalResp, &updated)
+		finalResp.Body.Close()
+
+		if updated.Email != newEmail {
+			t.Fatalf("expected email to update to %s, got %s", newEmail, updated.Email)
+		}
+		if updated.PasswordLastChangedAt == nil || *updated.PasswordLastChangedAt == "" {
+			t.Fatalf("expected password to be set during claim")
+		}
+
+		getResp, err := client.getWithAuth("/users/@me", account.Token)
+		if err != nil {
+			t.Fatalf("failed to check session after claim: %v", err)
+		}
+		assertStatus(t, getResp, http.StatusOK)
+		var me userPrivateResponse
+		decodeJSONResponse(t, getResp, &me)
+		getResp.Body.Close()
+
+		if me.Email != newEmail {
+			t.Fatalf("expected /users/@me to reflect new email, got %s", me.Email)
+		}
+		if !me.Verified {
+			t.Fatalf("expected email to be verified after claim flow")
+		}
+	})
+}