package todotest import ( "net/http" "net/url" "os" "slices" "strconv" "strings" "testing" ) func TestFirstVisitSetsListCookie(t *testing.T) { t.Parallel() b := newBrowser(t, newApp(t)) rec := b.get("/") if rec.Code != http.StatusOK { t.Fatalf("GET /: status %d", rec.Code) } cs := rec.Result().Cookies() if len(cs) != 1 { t.Fatalf("got %d cookies, want 1", len(cs)) } c := cs[0] if !c.HttpOnly || c.SameSite != http.SameSiteLaxMode || c.Path != "/" { t.Errorf("cookie %+v: want HttpOnly, SameSite=Lax, Path=/", c) } if len(c.Value) < 22 { // 128 bits in base64 t.Errorf("cookie value %q is too short to hold 128 random bits", c.Value) } // A second visit keeps the same list: no new cookie. if got := b.get("/").Result().Cookies(); len(got) != 0 { t.Errorf("second visit set cookies %v", got) } } func TestEmptyListHidesMainAndFooter(t *testing.T) { t.Parallel() body := newBrowser(t, newApp(t)).get("/").Body.String() for _, s := range []string{`class="main"`, `class="footer"`} { if strings.Contains(body, s) { t.Errorf("empty list renders %s", s) } } if !strings.Contains(body, `class="new-todo"`) { t.Error("page has no new-todo field") } if !strings.Contains(body, "the CARLOS bakeoff · Go + Rastrillo") { t.Error("footer doesn't name the setup") } } func TestAddTrimsAndRedirectsToFilter(t *testing.T) { t.Parallel() b := newBrowser(t, newApp(t)) for filter, want := range map[string]string{"all": "/", "active": "/active", "completed": "/completed", "": "/", "bogus": "/"} { rec := b.post("/todos", url.Values{"title": {" x "}, "filter": {filter}}) if rec.Code != http.StatusSeeOther || rec.Header().Get("Location") != want { t.Errorf("filter %q: %d to %q, want 303 to %q", filter, rec.Code, rec.Header().Get("Location"), want) } } b.add(" ") got := titles(b.get("/").Body.String()) if want := []string{"x", "x", "x", "x", "x"}; !slices.Equal(got, want) { t.Errorf("titles %q, want %q", got, want) } } func TestTitlesAreTextAndKeptExactly(t *testing.T) { t.Parallel() b := newBrowser(t, newApp(t)) b.add(` & "q"`) b.add("naïve 🚀 日本語") long := strings.Repeat("x", 10_000) b.add(long) rec := b.get("/") got := titles(rec.Body.String()) want := []string{"<img src=x onerror=alert(1)> & "q"", "naïve 🚀 日本語", long} if !slices.Equal(got, want) { t.Errorf("titles %q, want %q", got, want) } if n, _ := strconv.Atoi(rec.Header().Get("Content-Length")); n != rec.Body.Len() { t.Errorf("Content-Length %d, body %d bytes", n, rec.Body.Len()) } } func TestToggleEditDestroy(t *testing.T) { t.Parallel() b := newBrowser(t, newApp(t)) b.add("one") b.add("two") id := items(b.get("/").Body.String())[0].ID rec := b.post("/todos/"+id+"/toggle", url.Values{"filter": {"active"}}) if rec.Code != http.StatusSeeOther || rec.Header().Get("Location") != "/active" { t.Fatalf("toggle: %d to %q", rec.Code, rec.Header().Get("Location")) } if got := titles(b.get("/active").Body.String()); !slices.Equal(got, []string{"two"}) { t.Errorf("active after toggle: %q", got) } if got := titles(b.get("/completed").Body.String()); !slices.Equal(got, []string{"one"}) { t.Errorf("completed after toggle: %q", got) } if !strings.Contains(b.get("/").Body.String(), "1 item left") { t.Error("counter doesn't read 1 item left") } b.post("/todos/"+id+"/edit", url.Values{"title": {" uno "}, "filter": {"all"}}) if got := titles(b.get("/").Body.String()); !slices.Equal(got, []string{"uno", "two"}) { t.Errorf("after edit: %q", got) } b.post("/todos/"+id+"/edit", url.Values{"title": {" "}, "filter": {"all"}}) if got := titles(b.get("/").Body.String()); !slices.Equal(got, []string{"two"}) { t.Errorf("empty edit should delete: %q", got) } id2 := items(b.get("/").Body.String())[0].ID if rec := b.post("/todos/"+id2+"/destroy", url.Values{"filter": {"all"}}); rec.Code != http.StatusSeeOther { t.Fatalf("destroy: %d", rec.Code) } if got := titles(b.get("/").Body.String()); len(got) != 0 { t.Errorf("after destroy: %q", got) } } func TestEditView(t *testing.T) { t.Parallel() b := newBrowser(t, newApp(t)) b.add("one") id := items(b.get("/").Body.String())[0].ID body := b.get("/active?edit=" + id).Body.String() if it := items(body)[0]; it.Class != "editing" { t.Errorf("li class %q, want editing", it.Class) } if !strings.Contains(body, `
`) { t.Error("edit input isn't in a form posting to /todos//edit") } if !strings.Contains(body, `href="/active?edit=`+id+`"`) { t.Error("edit link doesn't keep the filter") } } func TestToggleAllAndClearCompleted(t *testing.T) { t.Parallel() b := newBrowser(t, newApp(t)) b.add("a") b.add("b") id := items(b.get("/").Body.String())[0].ID b.post("/todos/"+id+"/toggle", url.Values{}) b.post("/todos/toggle-all", url.Values{"filter": {"all"}}) body := b.get("/").Body.String() for _, it := range items(body) { if it.Class != "completed" { t.Errorf("after toggle-all, %s has class %q", it.Title, it.Class) } } if !strings.Contains(body, `class="toggle-all" type="checkbox" checked`) { t.Error("toggle-all isn't checked when everything is completed") } if !strings.Contains(body, `class="clear-completed"`) { t.Error("clear-completed hidden with completed items") } b.post("/todos/toggle-all", url.Values{"filter": {"all"}}) for _, it := range items(b.get("/").Body.String()) { if it.Class != "" { t.Errorf("after second toggle-all, %s has class %q", it.Title, it.Class) } } if strings.Contains(b.get("/").Body.String(), `class="clear-completed"`) { t.Error("clear-completed shown with nothing completed") } b.post("/todos/"+id+"/toggle", url.Values{}) b.post("/todos/clear-completed", url.Values{"filter": {"completed"}}) if got := titles(b.get("/").Body.String()); !slices.Equal(got, []string{"b"}) { t.Errorf("after clear-completed: %q", got) } } func TestListsAreSeparate(t *testing.T) { t.Parallel() h := newApp(t) alice, mallory := newBrowser(t, h), newBrowser(t, h) alice.add("mine") id := items(alice.get("/").Body.String())[0].ID if got := titles(mallory.get("/").Body.String()); len(got) != 0 { t.Fatalf("another visitor sees %q", got) } for _, action := range []string{"toggle", "edit", "destroy"} { rec := mallory.post("/todos/"+id+"/"+action, url.Values{"title": {"x"}, "filter": {"all"}}) if rec.Code != http.StatusNotFound { t.Errorf("%s on another list's item: %d, want 404", action, rec.Code) } } for _, path := range []string{"/todos/toggle-all", "/todos/clear-completed"} { mallory.post(path, url.Values{}) } if got := items(alice.get("/").Body.String()); len(got) != 1 || got[0].Title != "mine" || got[0].Class != "" { t.Errorf("alice's list changed: %+v", got) } for _, id := range []string{"999999", "abc", "-1"} { if rec := alice.post("/todos/"+id+"/toggle", url.Values{}); rec.Code != http.StatusNotFound { t.Errorf("toggle %s: %d, want 404", id, rec.Code) } } } func TestUnknownCookieGetsFreshList(t *testing.T) { t.Parallel() h := newApp(t) alice := newBrowser(t, h) alice.add("mine") var name string for n := range alice.cookies { name = n } for _, v := range []string{"%%%", "garbage", strings.Repeat("A", 43)} { b := newBrowser(t, h) b.cookies[name] = &http.Cookie{Name: name, Value: v} rec := b.get("/") if rec.Code != http.StatusOK || len(items(rec.Body.String())) != 0 { t.Errorf("cookie %q: status %d, items %v", v, rec.Code, items(rec.Body.String())) } } } func TestOriginCheck(t *testing.T) { t.Parallel() b := newBrowser(t, newApp(t)) form := url.Values{"title": {"x"}, "filter": {"all"}} if rec := b.post("/todos", form, "Origin", "https://evil.example"); rec.Code != http.StatusForbidden { t.Errorf("cross-site Origin: %d, want 403", rec.Code) } if rec := b.post("/todos", form, "Origin", "null"); rec.Code != http.StatusForbidden { t.Errorf("Origin null: %d, want 403", rec.Code) } if got := titles(b.get("/").Body.String()); len(got) != 0 { t.Fatalf("refused posts added %q", got) } // Sec-Fetch-Site can't vouch for a foreign Origin. for _, site := range []string{"same-origin", "none"} { if rec := b.post("/todos", form, "Origin", "https://evil.example", "Sec-Fetch-Site", site); rec.Code != http.StatusForbidden { t.Errorf("foreign Origin with Sec-Fetch-Site %s: %d, want 403", site, rec.Code) } } if got := titles(b.get("/").Body.String()); len(got) != 0 { t.Fatalf("refused posts added %q", got) } if rec := b.post("/todos", form, "Origin", testOrigin); rec.Code != http.StatusSeeOther { t.Errorf("own Origin: %d, want 303", rec.Code) } if rec := b.post("/todos", form); rec.Code != http.StatusSeeOther { t.Errorf("no Origin: %d, want 303", rec.Code) } } func TestFragmentForScript(t *testing.T) { t.Parallel() b := newBrowser(t, newApp(t)) rec := b.post("/todos", url.Values{"title": {"x"}, "filter": {"active"}}, "X-Todo-Fragment", "1") if rec.Code != http.StatusOK { t.Fatalf("fragment post: %d, want 200", rec.Code) } body := rec.Body.String() if strings.Contains(body, "`) { t.Error("fragment lost the filter") } } func TestStylesheetsServedByteForByte(t *testing.T) { t.Parallel() h := newApp(t) for _, name := range []string{"base.css", "index.css"} { want, err := os.ReadFile("../../../../shared/" + name) if err != nil { t.Fatal(err) } rec := newBrowser(t, h).get("/static/" + name) if rec.Code != http.StatusOK || rec.Body.String() != string(want) { t.Errorf("/static/%s: status %d, %d bytes, want shared/%s (%d bytes)", name, rec.Code, rec.Body.Len(), name, len(want)) } } } func TestOversizedEditChangesNothing(t *testing.T) { t.Parallel() b := newBrowser(t, newApp(t)) b.add("keep me") id := items(b.get("/").Body.String())[0].ID huge := strings.Repeat("x", 2<<20) rec := b.post("/todos/"+id+"/edit", url.Values{"title": {huge}, "filter": {"all"}}) if rec.Code != http.StatusRequestEntityTooLarge { t.Errorf("oversized edit: %d, want 413", rec.Code) } if got := titles(b.get("/").Body.String()); !slices.Equal(got, []string{"keep me"}) { t.Errorf("after oversized edit: %q", got) } if rec := b.post("/todos", url.Values{"title": {huge}}); rec.Code != http.StatusRequestEntityTooLarge { t.Errorf("oversized add: %d, want 413", rec.Code) } }