selfpost/internal/store/applications_test.go

package store

import (
	"errors"
	"testing"
)

func addTestDomain(t *testing.T, st *Store, name string) Domain {
	t.Helper()
	d, err := st.AddDomain(name, "selfpost")
	if err != nil {
		t.Fatalf("AddDomain(%q): %v", name, err)
	}
	return d
}

func TestAddApplicationWildcard(t *testing.T) {
	st := openTestStore(t)
	d := addTestDomain(t, st, "example.com")

	a, err := st.AddApplication(d.ID, "alerts", AddressModeWildcard, nil)
	if err != nil {
		t.Fatalf("AddApplication: %v", err)
	}
	if a.ID == 0 || a.Login != "alerts" || a.AddressMode != AddressModeWildcard {
		t.Fatalf("unexpected application: %+v", a)
	}
	if len(a.Addresses) != 0 {
		t.Errorf("wildcard app should have no addresses, got %v", a.Addresses)
	}

	got, err := st.GetApplication(a.ID)
	if err != nil {
		t.Fatalf("GetApplication: %v", err)
	}
	if got.Login != "alerts" || len(got.Addresses) != 0 {
		t.Fatalf("round-trip mismatch: %+v", got)
	}
}

// Logins are unique without regard to case, whatever the caller passed
// (idx_applications_login_nocase, migration 0008).
func TestAddApplicationRefusesALoginDifferingOnlyInCase(t *testing.T) {
	st := openTestStore(t)
	a := addTestDomain(t, st, "a.example")
	b := addTestDomain(t, st, "b.example")
	if _, err := st.AddApplication(a.ID, "Ops", AddressModeWildcard, nil); err != nil {
		t.Fatal(err)
	}
	if _, err := st.AddApplication(b.ID, "ops", AddressModeWildcard, nil); !errors.Is(err, ErrLoginExists) {
		t.Fatalf("ops beside Ops = %v, want ErrLoginExists", err)
	}
}

func TestAddApplicationListStoresAddresses(t *testing.T) {
	st := openTestStore(t)
	d := addTestDomain(t, st, "example.com")

	addrs := []string{"noreply@example.com", "alerts@example.com"}
	a, err := st.AddApplication(d.ID, "app1", AddressModeList, addrs)
	if err != nil {
		t.Fatalf("AddApplication: %v", err)
	}
	got, err := st.GetApplication(a.ID)
	if err != nil {
		t.Fatal(err)
	}
	// Addresses come back sorted.
	if len(got.Addresses) != 2 || got.Addresses[0] != "alerts@example.com" || got.Addresses[1] != "noreply@example.com" {
		t.Fatalf("addresses = %v", got.Addresses)
	}
}

func TestAddApplicationDuplicateLogin(t *testing.T) {
	st := openTestStore(t)
	d := addTestDomain(t, st, "example.com")
	d2 := addTestDomain(t, st, "other.com")

	if _, err := st.AddApplication(d.ID, "shared", AddressModeWildcard, nil); err != nil {
		t.Fatal(err)
	}
	// Same login under a different domain must still collide (global uniqueness).
	_, err := st.AddApplication(d2.ID, "shared", AddressModeWildcard, nil)
	if !errors.Is(err, ErrLoginExists) {
		t.Fatalf("duplicate login error = %v, want ErrLoginExists", err)
	}
}

func TestUpdateApplicationMode(t *testing.T) {
	st := openTestStore(t)
	d := addTestDomain(t, st, "example.com")
	a, err := st.AddApplication(d.ID, "app1", AddressModeList, []string{"a@example.com"})
	if err != nil {
		t.Fatal(err)
	}

	// list -> wildcard drops the addresses.
	if err := st.UpdateApplicationMode(a.ID, AddressModeWildcard, nil); err != nil {
		t.Fatalf("UpdateApplicationMode: %v", err)
	}
	got, _ := st.GetApplication(a.ID)
	if got.AddressMode != AddressModeWildcard || len(got.Addresses) != 0 {
		t.Fatalf("after wildcard switch: %+v", got)
	}

	// wildcard -> list adds a fresh set.
	if err := st.UpdateApplicationMode(a.ID, AddressModeList, []string{"b@example.com", "c@example.com"}); err != nil {
		t.Fatal(err)
	}
	got, _ = st.GetApplication(a.ID)
	if got.AddressMode != AddressModeList || len(got.Addresses) != 2 {
		t.Fatalf("after list switch: %+v", got)
	}
}

func TestUpdateApplicationModeNotFound(t *testing.T) {
	st := openTestStore(t)
	if err := st.UpdateApplicationMode(999, AddressModeWildcard, nil); !errors.Is(err, ErrApplicationNotFound) {
		t.Fatalf("UpdateApplicationMode(missing) = %v, want ErrApplicationNotFound", err)
	}
}

func TestDeleteApplication(t *testing.T) {
	st := openTestStore(t)
	d := addTestDomain(t, st, "example.com")
	a, err := st.AddApplication(d.ID, "app1", AddressModeList, []string{"a@example.com"})
	if err != nil {
		t.Fatal(err)
	}

	deleted, err := st.DeleteApplication(a.ID)
	if err != nil {
		t.Fatalf("DeleteApplication: %v", err)
	}
	if deleted.Login != "app1" {
		t.Errorf("deleted login = %q, want app1", deleted.Login)
	}
	assertCount(t, st, "applications", 0)
	assertCount(t, st, "application_addresses", 0)

	if _, err := st.DeleteApplication(a.ID); !errors.Is(err, ErrApplicationNotFound) {
		t.Fatalf("second delete = %v, want ErrApplicationNotFound", err)
	}
}

func TestListBindingsMixedModes(t *testing.T) {
	st := openTestStore(t)
	d1 := addTestDomain(t, st, "example.com")
	d2 := addTestDomain(t, st, "other.com")

	if _, err := st.AddApplication(d1.ID, "wild", AddressModeWildcard, nil); err != nil {
		t.Fatal(err)
	}
	if _, err := st.AddApplication(d1.ID, "listed", AddressModeList,
		[]string{"alerts@example.com", "noreply@example.com"}); err != nil {
		t.Fatal(err)
	}
	if _, err := st.AddApplication(d2.ID, "wild2", AddressModeWildcard, nil); err != nil {
		t.Fatal(err)
	}

	bindings, err := st.ListBindings()
	if err != nil {
		t.Fatalf("ListBindings: %v", err)
	}
	want := []Binding{
		{"@example.com", "wild"},
		{"@other.com", "wild2"},
		{"alerts@example.com", "listed"},
		{"noreply@example.com", "listed"},
	}
	if len(bindings) != len(want) {
		t.Fatalf("bindings = %+v, want %+v", bindings, want)
	}
	for i := range want {
		if bindings[i] != want[i] {
			t.Errorf("binding[%d] = %+v, want %+v", i, bindings[i], want[i])
		}
	}
}

func TestListLoginsByDomain(t *testing.T) {
	st := openTestStore(t)
	d := addTestDomain(t, st, "example.com")
	other := addTestDomain(t, st, "other.com")
	if _, err := st.AddApplication(d.ID, "a", AddressModeWildcard, nil); err != nil {
		t.Fatal(err)
	}
	if _, err := st.AddApplication(d.ID, "b", AddressModeWildcard, nil); err != nil {
		t.Fatal(err)
	}
	if _, err := st.AddApplication(other.ID, "c", AddressModeWildcard, nil); err != nil {
		t.Fatal(err)
	}

	logins, err := st.ListLoginsByDomain(d.ID)
	if err != nil {
		t.Fatal(err)
	}
	if len(logins) != 2 || logins[0] != "a" || logins[1] != "b" {
		t.Fatalf("logins = %v, want [a b]", logins)
	}
}

func TestApplicationAuthIPs(t *testing.T) {
	st := openTestStore(t)
	d := addTestDomain(t, st, "example.com")
	a, err := st.AddApplication(d.ID, "app1", AddressModeWildcard, nil)
	if err != nil {
		t.Fatal(err)
	}
	if a.AuthIPRestrict || len(a.AuthAllowedIPs) != 0 {
		t.Fatalf("new app should have no IP restriction: %+v", a)
	}

	if err := st.UpdateApplicationAuthIPs(a.ID, true, []string{"203.0.113.1", "2001:db8::1"}); err != nil {
		t.Fatalf("UpdateApplicationAuthIPs: %v", err)
	}
	got, err := st.GetApplication(a.ID)
	if err != nil {
		t.Fatal(err)
	}
	if !got.AuthIPRestrict || len(got.AuthAllowedIPs) != 2 {
		t.Fatalf("after update: %+v", got)
	}
	if !got.AllowsAuthFromIP("203.0.113.1") || !got.AllowsAuthFromIP("2001:0db8:0000:0000:0000:0000:0000:0001") {
		t.Fatal("listed IPs should match")
	}
	if got.AllowsAuthFromIP("198.51.100.7") {
		t.Fatal("unlisted IP must not match")
	}

	if err := st.UpdateApplicationAuthIPs(a.ID, false, nil); err != nil {
		t.Fatal(err)
	}
	got, _ = st.GetApplication(a.ID)
	if got.AuthIPRestrict || len(got.AuthAllowedIPs) != 0 {
		t.Fatalf("cleared restriction: %+v", got)
	}
	if !got.AllowsAuthFromIP("198.51.100.7") {
		t.Fatal("restriction off should allow any IP")
	}
}