test: rewrite system_settings tests to use real handlers and add regular user support

cmd/server/tests/system_settings_test.go

@@ -8,79 +8,47 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 // TestSystemSettingsHandler tests the system-wide scan settings endpoints
 func TestSystemSettingsHandler(t *testing.T) {
+	setup := setupTestServer(t)
+
 	t.Run("GET /api/libraries/scan-settings - Get settings without auth", func(t *testing.T) {
 		req := httptest.NewRequest("GET", "/api/libraries/scan-settings", nil)
-		rr := httptest.NewRecorder()
+		rec := httptest.NewRecorder()
 
-		handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			authHeader := r.Header.Get("Authorization")
-			if authHeader == "" {
-				w.WriteHeader(http.StatusUnauthorized)
-				w.Write([]byte(`{"message":"missing or malformed jwt"}`))
-				return
-			}
-
-			w.WriteHeader(http.StatusOK)
-		})
-
-		handler.ServeHTTP(rr, req)
-		assert.Equal(t, http.StatusUnauthorized, rr.Code)
+		setup.Server.Config.Handler.ServeHTTP(rec, req)
+		assert.Equal(t, http.StatusUnauthorized, rec.Code)
 	})
 
 	t.Run("GET /api/libraries/scan-settings - Get settings as non-admin", func(t *testing.T) {
+		token := loginRegularUser(t, setup.Server, setup.DB)
+
 		req := httptest.NewRequest("GET", "/api/libraries/scan-settings", nil)
-		req.Header.Set("Authorization", "Bearer valid-user-token")
-		rr := httptest.NewRecorder()
+		req.Header.Set("Authorization", "Bearer "+token)
+		rec := httptest.NewRecorder()
 
-		handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			userRole := r.Header.Get("X-User-Role")
-			if userRole != "admin" {
-				w.WriteHeader(http.StatusForbidden)
-				w.Write([]byte(`{"error":"admin access required"}`))
-				return
-			}
-
-			w.WriteHeader(http.StatusOK)
-		})
-
-		handler.ServeHTTP(rr, req)
-		assert.Equal(t, http.StatusForbidden, rr.Code)
+		setup.Server.Config.Handler.ServeHTTP(rec, req)
+		assert.Equal(t, http.StatusForbidden, rec.Code)
 	})
 
 	t.Run("GET /api/libraries/scan-settings - Get settings as admin", func(t *testing.T) {
+		token := loginAdminUser(t, setup.Server, setup.DB)
+
 		req := httptest.NewRequest("GET", "/api/libraries/scan-settings", nil)
-		req.Header.Set("Authorization", "Bearer valid-admin-token")
-		rr := httptest.NewRecorder()
+		req.Header.Set("Authorization", "Bearer "+token)
+		rec := httptest.NewRecorder()
 
-		expectedResponse := map[string]interface{}{
-			"scan_frequency_minutes": 60,
-			"auto_scan_enabled":      true,
-		}
-
-		handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			userRole := r.Header.Get("X-User-Role")
-			if userRole != "admin" {
-				w.WriteHeader(http.StatusForbidden)
-				return
-			}
-
-			w.Header().Set("Content-Type", "application/json")
-			w.WriteHeader(http.StatusOK)
-			json.NewEncoder(w).Encode(expectedResponse)
-		})
-
-		handler.ServeHTTP(rr, req)
-		assert.Equal(t, http.StatusOK, rr.Code)
+		setup.Server.Config.Handler.ServeHTTP(rec, req)
+		assert.Equal(t, http.StatusOK, rec.Code)
 
 		var response map[string]interface{}
-		err := json.NewDecoder(rr.Body).Decode(&response)
-		assert.NoError(t, err)
-		assert.Equal(t, float64(60), response["scan_frequency_minutes"])
-		assert.Equal(t, true, response["auto_scan_enabled"])
+		err := json.NewDecoder(rec.Body).Decode(&response)
+		require.NoError(t, err)
+		assert.Contains(t, response, "scan_frequency_minutes")
+		assert.Contains(t, response, "auto_scan_enabled")
 	})
 
 	t.Run("PUT /api/libraries/scan-settings - Update without auth", func(t *testing.T) {
@@ -92,24 +60,15 @@ func TestSystemSettingsHandler(t *testing.T) {
 
 		req := httptest.NewRequest("PUT", "/api/libraries/scan-settings", bytes.NewBuffer(jsonData))
 		req.Header.Set("Content-Type", "application/json")
-		rr := httptest.NewRecorder()
+		rec := httptest.NewRecorder()
 
-		handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			authHeader := r.Header.Get("Authorization")
-			if authHeader == "" {
-				w.WriteHeader(http.StatusUnauthorized)
-				w.Write([]byte(`{"message":"missing or malformed jwt"}`))
-				return
-			}
-
-			w.WriteHeader(http.StatusOK)
-		})
-
-		handler.ServeHTTP(rr, req)
-		assert.Equal(t, http.StatusUnauthorized, rr.Code)
+		setup.Server.Config.Handler.ServeHTTP(rec, req)
+		assert.Equal(t, http.StatusUnauthorized, rec.Code)
 	})
 
 	t.Run("PUT /api/libraries/scan-settings - Update as non-admin", func(t *testing.T) {
+		token := loginRegularUser(t, setup.Server, setup.DB)
+
 		payload := map[string]interface{}{
 			"scan_frequency_minutes": 30,
 			"auto_scan_enabled":      true,
@@ -118,25 +77,16 @@ func TestSystemSettingsHandler(t *testing.T) {
 
 		req := httptest.NewRequest("PUT", "/api/libraries/scan-settings", bytes.NewBuffer(jsonData))
 		req.Header.Set("Content-Type", "application/json")
-		req.Header.Set("Authorization", "Bearer valid-user-token")
-		rr := httptest.NewRecorder()
+		req.Header.Set("Authorization", "Bearer "+token)
+		rec := httptest.NewRecorder()
 
-		handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			userRole := r.Header.Get("X-User-Role")
-			if userRole != "admin" {
-				w.WriteHeader(http.StatusForbidden)
-				w.Write([]byte(`{"error":"admin access required"}`))
-				return
-			}
-
-			w.WriteHeader(http.StatusOK)
-		})
-
-		handler.ServeHTTP(rr, req)
-		assert.Equal(t, http.StatusForbidden, rr.Code)
+		setup.Server.Config.Handler.ServeHTTP(rec, req)
+		assert.Equal(t, http.StatusForbidden, rec.Code)
 	})
 
 	t.Run("PUT /api/libraries/scan-settings - Update with invalid frequency", func(t *testing.T) {
+		token := loginAdminUser(t, setup.Server, setup.DB)
+
 		testCases := []struct {
 			name                 string
 			scanFrequencyMinutes int
@@ -157,27 +107,18 @@ func TestSystemSettingsHandler(t *testing.T) {
 
 				req := httptest.NewRequest("PUT", "/api/libraries/scan-settings", bytes.NewBuffer(jsonData))
 				req.Header.Set("Content-Type", "application/json")
-				req.Header.Set("Authorization", "Bearer valid-admin-token")
-				rr := httptest.NewRecorder()
+				req.Header.Set("Authorization", "Bearer "+token)
+				rec := httptest.NewRecorder()
 
-				handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-					userRole := r.Header.Get("X-User-Role")
-					if userRole != "admin" {
-						w.WriteHeader(http.StatusForbidden)
-						return
-					}
-
-					w.WriteHeader(http.StatusBadRequest)
-					w.Write([]byte(`{"error":"invalid request"}`))
-				})
-
-				handler.ServeHTTP(rr, req)
-				assert.Equal(t, http.StatusBadRequest, rr.Code)
+				setup.Server.Config.Handler.ServeHTTP(rec, req)
+				assert.Equal(t, http.StatusBadRequest, rec.Code)
 			})
 		}
 	})
 
 	t.Run("PUT /api/libraries/scan-settings - Update with missing required field", func(t *testing.T) {
+		token := loginAdminUser(t, setup.Server, setup.DB)
+
 		payload := map[string]interface{}{
 			"auto_scan_enabled": true,
 		}
@@ -185,25 +126,16 @@ func TestSystemSettingsHandler(t *testing.T) {
 
 		req := httptest.NewRequest("PUT", "/api/libraries/scan-settings", bytes.NewBuffer(jsonData))
 		req.Header.Set("Content-Type", "application/json")
-		req.Header.Set("Authorization", "Bearer valid-admin-token")
-		rr := httptest.NewRecorder()
+		req.Header.Set("Authorization", "Bearer "+token)
+		rec := httptest.NewRecorder()
 
-		handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			userRole := r.Header.Get("X-User-Role")
-			if userRole != "admin" {
-				w.WriteHeader(http.StatusForbidden)
-				return
-			}
-
-			w.WriteHeader(http.StatusBadRequest)
-			w.Write([]byte(`{"error":"invalid request"}`))
-		})
-
-		handler.ServeHTTP(rr, req)
-		assert.Equal(t, http.StatusBadRequest, rr.Code)
+		setup.Server.Config.Handler.ServeHTTP(rec, req)
+		assert.Equal(t, http.StatusBadRequest, rec.Code)
 	})
 
 	t.Run("PUT /api/libraries/scan-settings - Update with valid data", func(t *testing.T) {
+		token := loginAdminUser(t, setup.Server, setup.DB)
+
 		testCases := []struct {
 			name                 string
 			scanFrequencyMinutes int
@@ -226,61 +158,33 @@ func TestSystemSettingsHandler(t *testing.T) {
 
 				req := httptest.NewRequest("PUT", "/api/libraries/scan-settings", bytes.NewBuffer(jsonData))
 				req.Header.Set("Content-Type", "application/json")
-				req.Header.Set("Authorization", "Bearer valid-admin-token")
-				rr := httptest.NewRecorder()
+				req.Header.Set("Authorization", "Bearer "+token)
+				rec := httptest.NewRecorder()
 
-				expectedResponse := map[string]interface{}{
-					"scan_frequency_minutes": tc.scanFrequencyMinutes,
-					"auto_scan_enabled":      tc.autoScanEnabled,
-					"message":                "scan settings updated successfully",
-				}
-
-				handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-					userRole := r.Header.Get("X-User-Role")
-					if userRole != "admin" {
-						w.WriteHeader(http.StatusForbidden)
-						return
-					}
-
-					w.Header().Set("Content-Type", "application/json")
-					w.WriteHeader(http.StatusOK)
-					json.NewEncoder(w).Encode(expectedResponse)
-				})
-
-				handler.ServeHTTP(rr, req)
-				assert.Equal(t, http.StatusOK, rr.Code)
+				setup.Server.Config.Handler.ServeHTTP(rec, req)
+				assert.Equal(t, http.StatusOK, rec.Code)
 
 				var response map[string]interface{}
-				err := json.NewDecoder(rr.Body).Decode(&response)
-				assert.NoError(t, err)
+				err := json.NewDecoder(rec.Body).Decode(&response)
+				require.NoError(t, err)
 				assert.Equal(t, float64(tc.scanFrequencyMinutes), response["scan_frequency_minutes"])
 				assert.Equal(t, tc.autoScanEnabled, response["auto_scan_enabled"])
-				assert.Equal(t, "scan settings updated successfully", response["message"])
 			})
 		}
 	})
 
 	t.Run("PUT /api/libraries/scan-settings - Update with invalid JSON", func(t *testing.T) {
+		token := loginAdminUser(t, setup.Server, setup.DB)
+
 		invalidJSON := []byte(`{scan_frequency_minutes: 60, auto_scan_enabled: true}`)
 
 		req := httptest.NewRequest("PUT", "/api/libraries/scan-settings", bytes.NewBuffer(invalidJSON))
 		req.Header.Set("Content-Type", "application/json")
-		req.Header.Set("Authorization", "Bearer valid-admin-token")
-		rr := httptest.NewRecorder()
+		req.Header.Set("Authorization", "Bearer "+token)
+		rec := httptest.NewRecorder()
 
-		handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			userRole := r.Header.Get("X-User-Role")
-			if userRole != "admin" {
-				w.WriteHeader(http.StatusForbidden)
-				return
-			}
-
-			w.WriteHeader(http.StatusBadRequest)
-			w.Write([]byte(`{"error":"invalid request"}`))
-		})
-
-		handler.ServeHTTP(rr, req)
-		assert.Equal(t, http.StatusBadRequest, rr.Code)
+		setup.Server.Config.Handler.ServeHTTP(rec, req)
+		assert.Equal(t, http.StatusBadRequest, rec.Code)
 	})
 }
 
@@ -303,7 +207,6 @@ func TestSystemSettingsIntegration(t *testing.T) {
 		}
 
 		assert.Equal(t, false, settings["auto_scan_enabled"])
-		assert.Equal(t, "Scans should not run when auto_scan_enabled is false", "Scans should not run")
 	})
 
 	t.Run("Valid frequency range enforcement", func(t *testing.T) {