268 lines
8.8 KiB
Rust
268 lines
8.8 KiB
Rust
//! Hesap ve hane ayarları: profil adı, şifre değiştirme (diğer oturumlar kapanır),
|
||
//! hane adı + bütçe varsayılanları, üye çıkarma, yetkiler.
|
||
|
||
mod common;
|
||
|
||
use std::time::Duration;
|
||
|
||
use axum::http::{Method, StatusCode};
|
||
use common::{Session, TestApp};
|
||
use serde_json::{Value, json};
|
||
|
||
async fn login(app: &TestApp, email: &str, password: &str) -> (StatusCode, Option<String>) {
|
||
let (st, _, cookie) = app
|
||
.send(
|
||
Method::POST,
|
||
"/auth/login",
|
||
None,
|
||
Some(json!({ "email": email, "password": password, "remember_me": true })),
|
||
)
|
||
.await;
|
||
(st, cookie)
|
||
}
|
||
|
||
async fn me(app: &TestApp, s: &Session) -> (StatusCode, Value) {
|
||
app.get("/auth/me", s).await
|
||
}
|
||
|
||
fn with_cookie(s: &Session, cookie: String) -> Session {
|
||
Session {
|
||
cookie,
|
||
household_id: s.household_id.clone(),
|
||
}
|
||
}
|
||
|
||
#[tokio::test]
|
||
async fn profile_name_and_password_change_closes_other_sessions() {
|
||
let app = TestApp::new().await;
|
||
let a = app.register("Ayse", None).await;
|
||
let (_, m) = me(&app, &a).await;
|
||
let email = m["user"]["email"].as_str().unwrap().to_string();
|
||
|
||
// Ad
|
||
let (st, m) = app
|
||
.patch("/auth/me", &a, json!({ "name": " Ayşe Ç. " }))
|
||
.await;
|
||
assert_eq!(
|
||
(st, m["user"]["name"].as_str()),
|
||
(StatusCode::OK, Some("Ayşe Ç."))
|
||
);
|
||
let (st, _) = app.patch("/auth/me", &a, json!({ "name": " " })).await;
|
||
assert_eq!(st, StatusCode::BAD_REQUEST);
|
||
|
||
// İkinci cihaz
|
||
let (st, other) = login(&app, &email, "test-sifre-123").await;
|
||
assert_eq!(st, StatusCode::OK);
|
||
let other = with_cookie(&a, other.unwrap());
|
||
tokio::time::sleep(Duration::from_millis(1100)).await; // iat saniye hassasiyetinde
|
||
|
||
// Yanlış mevcut şifre / kısa / aynı şifre
|
||
let pw = |cur: &str, new: &str| json!({ "current_password": cur, "new_password": new });
|
||
let (st, b) = app
|
||
.post(
|
||
"/auth/me/password",
|
||
&a,
|
||
pw("yanlis-sifre", "yeni-sifre-456"),
|
||
)
|
||
.await;
|
||
assert_eq!(st, StatusCode::BAD_REQUEST);
|
||
assert_eq!(b["error"]["message"], "Mevcut şifre hatalı");
|
||
let (st, _) = app
|
||
.post("/auth/me/password", &a, pw("test-sifre-123", "kisa"))
|
||
.await;
|
||
assert_eq!(st, StatusCode::BAD_REQUEST);
|
||
let (st, b) = app
|
||
.post(
|
||
"/auth/me/password",
|
||
&a,
|
||
pw("test-sifre-123", "test-sifre-123"),
|
||
)
|
||
.await;
|
||
assert_eq!(st, StatusCode::BAD_REQUEST, "{b}");
|
||
|
||
// Doğru → bu cihaz yeni çerezle devam, diğer cihaz düşer
|
||
let (st, _, cookie) = app
|
||
.send(
|
||
Method::POST,
|
||
"/auth/me/password",
|
||
Some(&a.cookie),
|
||
Some(pw("test-sifre-123", "yeni-sifre-456")),
|
||
)
|
||
.await;
|
||
assert_eq!(st, StatusCode::NO_CONTENT);
|
||
let fresh = with_cookie(&a, cookie.expect("yeni oturum çerezi"));
|
||
assert_eq!(me(&app, &fresh).await.0, StatusCode::OK);
|
||
assert_eq!(
|
||
me(&app, &other).await.0,
|
||
StatusCode::UNAUTHORIZED,
|
||
"diğer cihaz"
|
||
);
|
||
assert_eq!(me(&app, &a).await.0, StatusCode::UNAUTHORIZED, "eski çerez");
|
||
|
||
// Giriş: eski şifre geçmez, yeni geçer
|
||
assert_eq!(
|
||
login(&app, &email, "test-sifre-123").await.0,
|
||
StatusCode::UNAUTHORIZED
|
||
);
|
||
assert_eq!(
|
||
login(&app, &email, "yeni-sifre-456").await.0,
|
||
StatusCode::OK
|
||
);
|
||
|
||
app.cleanup().await;
|
||
}
|
||
|
||
#[tokio::test]
|
||
async fn wrong_current_password_is_rate_limited() {
|
||
let app = TestApp::new().await;
|
||
let a = app.register("Ayse", None).await;
|
||
let body = json!({ "current_password": "yanlis", "new_password": "yeni-sifre-456" });
|
||
for _ in 0..5 {
|
||
let (st, _) = app.post("/auth/me/password", &a, body.clone()).await;
|
||
assert_eq!(st, StatusCode::BAD_REQUEST);
|
||
}
|
||
let (st, _) = app
|
||
.post(
|
||
"/auth/me/password",
|
||
&a,
|
||
json!({ "current_password": "test-sifre-123", "new_password": "yeni-sifre-456" }),
|
||
)
|
||
.await;
|
||
assert_eq!(st, StatusCode::TOO_MANY_REQUESTS, "doğru şifre de bekler");
|
||
app.cleanup().await;
|
||
}
|
||
|
||
#[tokio::test]
|
||
async fn household_settings_and_budget_default_split() {
|
||
let app = TestApp::new().await;
|
||
let owner = app.register("Sahip", None).await;
|
||
let (_, inv) = app.post("/household/invites", &owner, json!({})).await;
|
||
let member = app
|
||
.register("Uye", Some(inv["code"].as_str().unwrap()))
|
||
.await;
|
||
|
||
let (_, h) = app.get("/household", &owner).await;
|
||
assert_eq!(
|
||
h["settings"],
|
||
json!({ "budget_split_pct": { "needs": 50, "wants": 30, "culture": 10, "unexpected": 10 }, "budget_suggestion": "default" })
|
||
);
|
||
|
||
let update = json!({
|
||
"name": "Çakır Ailesi",
|
||
"budget_split_pct": { "needs": 60, "wants": 20, "culture": 10, "unexpected": 10 },
|
||
"budget_suggestion": "avg3",
|
||
});
|
||
let (st, _) = app.patch("/household", &member, update.clone()).await;
|
||
assert_eq!(st, StatusCode::FORBIDDEN, "üye değiştiremez");
|
||
let (st, h) = app.patch("/household", &owner, update).await;
|
||
assert_eq!(st, StatusCode::OK, "{h}");
|
||
assert_eq!(h["name"], "Çakır Ailesi");
|
||
assert_eq!(h["settings"]["budget_split_pct"]["needs"], 60);
|
||
assert_eq!(h["settings"]["budget_suggestion"], "avg3");
|
||
let (_, m) = me(&app, &member).await;
|
||
assert_eq!(
|
||
m["household"]["name"], "Çakır Ailesi",
|
||
"üye de yeni adı görür"
|
||
);
|
||
|
||
// Toplam 100 değil / geçersiz yöntem
|
||
for bad in [
|
||
json!({ "budget_split_pct": { "needs": 60, "wants": 30, "culture": 10, "unexpected": 10 } }),
|
||
json!({ "budget_suggestion": "hepsi" }),
|
||
json!({ "name": "" }),
|
||
] {
|
||
let (st, b) = app.patch("/household", &owner, bad).await;
|
||
assert_eq!(st, StatusCode::BAD_REQUEST, "{b}");
|
||
}
|
||
|
||
// Varsayılan öneri yeni yüzdeleri kullanır: harcanabilir 100.000 → 60/20/10/10
|
||
let (_, p) = app
|
||
.post(
|
||
"/periods",
|
||
&owner,
|
||
json!({ "start_date": "2026-11-01", "end_date": "2026-12-01" }),
|
||
)
|
||
.await;
|
||
let pid = p["id"].as_str().unwrap();
|
||
app.post(
|
||
&format!("/periods/{pid}/plan-items"),
|
||
&owner,
|
||
json!({ "kind": "income", "name": "Maaş", "amount": 100_000 }),
|
||
)
|
||
.await;
|
||
let (_, sug) = app
|
||
.get(
|
||
&format!("/periods/{pid}/budget/suggestion?method=default"),
|
||
&owner,
|
||
)
|
||
.await;
|
||
assert_eq!(
|
||
sug["amounts"],
|
||
json!({ "needs": 60_000, "wants": 20_000, "culture": 10_000, "unexpected": 10_000 })
|
||
);
|
||
|
||
app.cleanup().await;
|
||
}
|
||
|
||
#[tokio::test]
|
||
async fn owner_removes_member_who_can_be_invited_again() {
|
||
let app = TestApp::new().await;
|
||
let owner = app.register("Sahip", None).await;
|
||
let (_, inv) = app.post("/household/invites", &owner, json!({})).await;
|
||
let member = app
|
||
.register("Uye", Some(inv["code"].as_str().unwrap()))
|
||
.await;
|
||
let (_, mm) = me(&app, &member).await;
|
||
let member_id = mm["user"]["id"].as_str().unwrap().to_string();
|
||
let member_email = mm["user"]["email"].as_str().unwrap().to_string();
|
||
let (_, om) = me(&app, &owner).await;
|
||
let owner_id = om["user"]["id"].as_str().unwrap().to_string();
|
||
|
||
// Üye kimseyi çıkaramaz; sahip kendini çıkaramaz; başka hane bulunamaz
|
||
let (st, _) = app
|
||
.delete(&format!("/household/members/{owner_id}"), &member)
|
||
.await;
|
||
assert_eq!(st, StatusCode::FORBIDDEN);
|
||
let (st, _) = app
|
||
.delete(&format!("/household/members/{owner_id}"), &owner)
|
||
.await;
|
||
assert_eq!(st, StatusCode::BAD_REQUEST);
|
||
let stranger = app.register("Yabanci", None).await;
|
||
let (st, _) = app
|
||
.delete(&format!("/household/members/{member_id}"), &stranger)
|
||
.await;
|
||
assert_eq!(st, StatusCode::NOT_FOUND);
|
||
|
||
// Çıkar → oturumu anında düşer, listede yok, giriş yapamaz
|
||
let (st, _) = app
|
||
.delete(&format!("/household/members/{member_id}"), &owner)
|
||
.await;
|
||
assert_eq!(st, StatusCode::NO_CONTENT);
|
||
assert_eq!(me(&app, &member).await.0, StatusCode::UNAUTHORIZED);
|
||
let (_, h) = app.get("/household", &owner).await;
|
||
assert_eq!(h["members"].as_array().unwrap().len(), 1);
|
||
assert_eq!(
|
||
login(&app, &member_email, "test-sifre-123").await.0,
|
||
StatusCode::UNAUTHORIZED
|
||
);
|
||
|
||
// Aynı e-posta yeni davetle yeniden katılabilir
|
||
let (_, inv) = app.post("/household/invites", &owner, json!({})).await;
|
||
let (st, b, _) = app
|
||
.send(
|
||
Method::POST,
|
||
"/auth/register",
|
||
None,
|
||
Some(json!({
|
||
"name": "Uye",
|
||
"email": member_email,
|
||
"password": "test-sifre-123",
|
||
"invite_code": inv["code"],
|
||
})),
|
||
)
|
||
.await;
|
||
assert_eq!(st, StatusCode::CREATED, "{b}");
|
||
|
||
app.cleanup().await;
|
||
}
|