Testing

package main

import (
	"log"
	"net/http"

	corego "github.com/berkkaradalan/CoreGo"
	"github.com/berkkaradalan/CoreGo/auth"
	"github.com/berkkaradalan/CoreGo/web"
)

// registerRoutes adds the application's routes; main and the tests share it.
func registerRoutes(core *corego.Core) {
	api := core.Server().Group("/api", core.RequireAuth())
	api.Get("/hello", func(c *web.Context) error {
		return c.JSON(http.StatusOK, map[string]string{"hello": auth.MustUser(c).Name})
	})
}

func main() {
	core, err := corego.New(&corego.Config{Auth: &corego.AuthOptions{}})
	if err != nil {
		log.Fatal(err)
	}
	registerRoutes(core)
	if err := core.Run(); err != nil {
		log.Fatal(err)
	}
}

package main

import (
	"context"
	"encoding/json"
	"fmt"
	"log/slog"
	"net/http"
	"net/http/httptest"
	"net/url"
	"regexp"
	"strings"
	"testing"
	"time"

	corego "github.com/berkkaradalan/CoreGo"
	"github.com/berkkaradalan/CoreGo/auth/authhttp"
	"github.com/berkkaradalan/CoreGo/mail"
)

// newTestApp starts the application on the in-memory auth store with a
// capturing mail sender. No database, SMTP server or network is needed.
func newTestApp(t *testing.T) (*corego.Core, *mail.CaptureSender) {
	t.Helper()
	// Keep databases and auth switches configured in the shell or in .env
	// out of the tests.
	t.Setenv("MONGODB_CONNECTION_URL", "")
	t.Setenv("POSTGRES_CONNECTION_URL", "")
	t.Setenv("COREGO_REQUIRE_VERIFIED_EMAIL", "")
	t.Setenv("COREGO_AUTH_COOKIE", "")

	capture := mail.NewCaptureSender()
	core, err := corego.New(&corego.Config{
		Auth: &corego.AuthOptions{
			Store:      corego.StoreMemory,
			MailSender: capture,
			// Every test request comes from the same address; do not let
			// the per-IP (and per-email) limits of the auth routes get in the way.
			HTTP: authhttp.Config{RateLimit: authhttp.RateLimitConfig{Disabled: true}},
		},
		Server: corego.ServerOptions{DisableRequestLog: true},
		Logger: slog.New(slog.DiscardHandler),
	})
	if err != nil {
		t.Fatal(err)
	}
	t.Cleanup(func() { core.Close() })
	registerRoutes(core)
	return core, capture
}

// call sends one request and decodes a JSON response into out (unless out is nil).
func call(t *testing.T, core *corego.Core, method, path, token, body string, out any) int {
	t.Helper()
	req := httptest.NewRequest(method, path, strings.NewReader(body))
	if body != "" {
		req.Header.Set("Content-Type", "application/json")
	}
	if token != "" {
		req.Header.Set("Authorization", "Bearer "+token)
	}
	rec := httptest.NewRecorder()
	core.Server().ServeHTTP(rec, req)
	if out != nil {
		if err := json.Unmarshal(rec.Body.Bytes(), out); err != nil {
			t.Fatalf("%s %s: decode %q: %v", method, path, rec.Body.String(), err)
		}
	}
	return rec.Code
}

const ada = `{"name":"Ada","email":"ada@example.com","password":"analytical-engine"}`

func TestHelloNeedsASession(t *testing.T) {
	core, _ := newTestApp(t)

	if code := call(t, core, "GET", "/api/hello", "", "", nil); code != http.StatusUnauthorized {
		t.Fatalf("anonymous request: status %d, want 401", code)
	}

	var signup struct {
		Token string `json:"token"`
	}
	if code := call(t, core, "POST", "/auth/signup", "", ada, &signup); code != http.StatusCreated {
		t.Fatalf("signup: status %d", code)
	}

	var hello map[string]string
	code := call(t, core, "GET", "/api/hello", signup.Token, "", &hello)
	if code != http.StatusOK || hello["hello"] != "Ada" {
		t.Fatalf("hello: status %d, body %v", code, hello)
	}
}

func TestSignUpSendsAWorkingVerificationLink(t *testing.T) {
	core, capture := newTestApp(t)
	call(t, core, "POST", "/auth/signup", "", ada, nil)

	// Auth emails are delivered in the background; Shutdown waits for them.
	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
	defer cancel()
	if err := core.Auth.Shutdown(ctx); err != nil {
		t.Fatal(err)
	}

	msg, ok := capture.Last()
	if !ok || msg.To[0] != "ada@example.com" {
		t.Fatalf("no verification email for ada: %+v", msg)
	}
	link, err := url.Parse(regexp.MustCompile(`https?://\S+`).FindString(msg.Text))
	if err != nil {
		t.Fatal(err)
	}
	body := fmt.Sprintf(`{"email":%q,"token":%q}`, link.Query().Get("email"), link.Query().Get("token"))
	if code := call(t, core, "POST", "/auth/verify-email", "", body, nil); code != http.StatusNoContent {
		t.Fatalf("verify: status %d, want 204", code)
	}
}

go test ./...

capture := mail.NewCaptureSender()
// ... run the code that sends ...
msgs := capture.Messages() // copies, in send order
last, ok := capture.Last()
capture.Reset()

// signedInAs stands in for RequireAuth in handler tests.
func signedInAs(user *auth.User) web.MiddlewareFunc {
	return func(next web.HandlerFunc) web.HandlerFunc {
		return func(c *web.Context) error {
			session := &auth.Session{ID: "test-session", UserID: user.ID}
			ctx := auth.ContextWithSession(c.Request().Context(), session, user)
			c.SetRequest(c.Request().WithContext(ctx))
			return next(c)
		}
	}
}

func TestProfile(t *testing.T) {
	s := web.New()
	s.Get("/profile", profileHandler, signedInAs(&auth.User{ID: "u1", Name: "Ada"}))

	rec := httptest.NewRecorder()
	s.ServeHTTP(rec, httptest.NewRequest("GET", "/profile", nil))
	if rec.Code != http.StatusOK || !strings.Contains(rec.Body.String(), "Ada") {
		t.Fatalf("got %d %s", rec.Code, rec.Body.String())
	}
}

go build ./... && go vet ./...
go test ./...
go test -race ./...
gofmt -l .        # must print nothing

docker run -d --rm --name corego-test-mongo -p 27017:27017 mongo:7
docker run -d --rm --name corego-test-postgres -p 5432:5432 \
  -e POSTGRES_USER=corego -e POSTGRES_PASSWORD=corego -e POSTGRES_DB=corego_test \
  postgres:17

COREGO_TEST_MONGO_URL=mongodb://127.0.0.1:27017 \
COREGO_TEST_POSTGRES_URL=postgres://corego:corego@127.0.0.1:5432/corego_test \
  go test -race ./...

docker rm -f corego-test-mongo corego-test-postgres