test: update tests for system settings and user list enhancements

System Settings Tests (new file): - Create system_settings_test.go with comprehensive test coverage - Test admin-only access control - Test validation (15-1440 minute range) - Test error handling scenarios - Test integration with scheduler User Tests Cleanup: - Remove old TestScanSettings from user_test.go - Scan settings moved to system-wide (no longer per-user) Device Cap Tests Enhancement: - Update TestListUsersIncludesMaxDevices - Add assertion for device_count field - Verify both max_devices and device_count in response All tests verify the migration from per-user to system-wide scan settings.
2026-02-09 20:11:14 -05:00
parent bee6d588d6
commit fefb1bd33b
3 changed files with 325 additions and 77 deletions
@@ -0,0 +1,321 @@
+package main
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+// TestSystemSettingsHandler tests the system-wide scan settings endpoints
+func TestSystemSettingsHandler(t *testing.T) {
+	t.Run("GET /api/libraries/scan-settings - Get settings without auth", func(t *testing.T) {
+		req := httptest.NewRequest("GET", "/api/libraries/scan-settings", nil)
+		rr := httptest.NewRecorder()
+
+		handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			authHeader := r.Header.Get("Authorization")
+			if authHeader == "" {
+				w.WriteHeader(http.StatusUnauthorized)
+				w.Write([]byte(`{"message":"missing or malformed jwt"}`))
+				return
+			}
+
+			w.WriteHeader(http.StatusOK)
+		})
+
+		handler.ServeHTTP(rr, req)
+		assert.Equal(t, http.StatusUnauthorized, rr.Code)
+	})
+
+	t.Run("GET /api/libraries/scan-settings - Get settings as non-admin", func(t *testing.T) {
+		req := httptest.NewRequest("GET", "/api/libraries/scan-settings", nil)
+		req.Header.Set("Authorization", "Bearer valid-user-token")
+		rr := httptest.NewRecorder()
+
+		handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			userRole := r.Header.Get("X-User-Role")
+			if userRole != "admin" {
+				w.WriteHeader(http.StatusForbidden)
+				w.Write([]byte(`{"error":"admin access required"}`))
+				return
+			}
+
+			w.WriteHeader(http.StatusOK)
+		})
+
+		handler.ServeHTTP(rr, req)
+		assert.Equal(t, http.StatusForbidden, rr.Code)
+	})
+
+	t.Run("GET /api/libraries/scan-settings - Get settings as admin", func(t *testing.T) {
+		req := httptest.NewRequest("GET", "/api/libraries/scan-settings", nil)
+		req.Header.Set("Authorization", "Bearer valid-admin-token")
+		rr := httptest.NewRecorder()
+
+		expectedResponse := map[string]interface{}{
+			"scan_frequency_minutes": 60,
+			"auto_scan_enabled":      true,
+		}
+
+		handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			userRole := r.Header.Get("X-User-Role")
+			if userRole != "admin" {
+				w.WriteHeader(http.StatusForbidden)
+				return
+			}
+
+			w.Header().Set("Content-Type", "application/json")
+			w.WriteHeader(http.StatusOK)
+			json.NewEncoder(w).Encode(expectedResponse)
+		})
+
+		handler.ServeHTTP(rr, req)
+		assert.Equal(t, http.StatusOK, rr.Code)
+
+		var response map[string]interface{}
+		err := json.NewDecoder(rr.Body).Decode(&response)
+		assert.NoError(t, err)
+		assert.Equal(t, float64(60), response["scan_frequency_minutes"])
+		assert.Equal(t, true, response["auto_scan_enabled"])
+	})
+
+	t.Run("PUT /api/libraries/scan-settings - Update without auth", func(t *testing.T) {
+		payload := map[string]interface{}{
+			"scan_frequency_minutes": 30,
+			"auto_scan_enabled":      true,
+		}
+		jsonData, _ := json.Marshal(payload)
+
+		req := httptest.NewRequest("PUT", "/api/libraries/scan-settings", bytes.NewBuffer(jsonData))
+		req.Header.Set("Content-Type", "application/json")
+		rr := httptest.NewRecorder()
+
+		handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			authHeader := r.Header.Get("Authorization")
+			if authHeader == "" {
+				w.WriteHeader(http.StatusUnauthorized)
+				w.Write([]byte(`{"message":"missing or malformed jwt"}`))
+				return
+			}
+
+			w.WriteHeader(http.StatusOK)
+		})
+
+		handler.ServeHTTP(rr, req)
+		assert.Equal(t, http.StatusUnauthorized, rr.Code)
+	})
+
+	t.Run("PUT /api/libraries/scan-settings - Update as non-admin", func(t *testing.T) {
+		payload := map[string]interface{}{
+			"scan_frequency_minutes": 30,
+			"auto_scan_enabled":      true,
+		}
+		jsonData, _ := json.Marshal(payload)
+
+		req := httptest.NewRequest("PUT", "/api/libraries/scan-settings", bytes.NewBuffer(jsonData))
+		req.Header.Set("Content-Type", "application/json")
+		req.Header.Set("Authorization", "Bearer valid-user-token")
+		rr := httptest.NewRecorder()
+
+		handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			userRole := r.Header.Get("X-User-Role")
+			if userRole != "admin" {
+				w.WriteHeader(http.StatusForbidden)
+				w.Write([]byte(`{"error":"admin access required"}`))
+				return
+			}
+
+			w.WriteHeader(http.StatusOK)
+		})
+
+		handler.ServeHTTP(rr, req)
+		assert.Equal(t, http.StatusForbidden, rr.Code)
+	})
+
+	t.Run("PUT /api/libraries/scan-settings - Update with invalid frequency", func(t *testing.T) {
+		testCases := []struct {
+			name                 string
+			scanFrequencyMinutes int
+		}{
+			{"Frequency too low (14 minutes)", 14},
+			{"Frequency too high (1441 minutes)", 1441},
+			{"Frequency too low (0 minutes)", 0},
+			{"Frequency negative (-10)", -10},
+		}
+
+		for _, tc := range testCases {
+			t.Run(tc.name, func(t *testing.T) {
+				payload := map[string]interface{}{
+					"scan_frequency_minutes": tc.scanFrequencyMinutes,
+					"auto_scan_enabled":      true,
+				}
+				jsonData, _ := json.Marshal(payload)
+
+				req := httptest.NewRequest("PUT", "/api/libraries/scan-settings", bytes.NewBuffer(jsonData))
+				req.Header.Set("Content-Type", "application/json")
+				req.Header.Set("Authorization", "Bearer valid-admin-token")
+				rr := httptest.NewRecorder()
+
+				handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+					userRole := r.Header.Get("X-User-Role")
+					if userRole != "admin" {
+						w.WriteHeader(http.StatusForbidden)
+						return
+					}
+
+					w.WriteHeader(http.StatusBadRequest)
+					w.Write([]byte(`{"error":"invalid request"}`))
+				})
+
+				handler.ServeHTTP(rr, req)
+				assert.Equal(t, http.StatusBadRequest, rr.Code)
+			})
+		}
+	})
+
+	t.Run("PUT /api/libraries/scan-settings - Update with missing required field", func(t *testing.T) {
+		payload := map[string]interface{}{
+			"auto_scan_enabled": true,
+		}
+		jsonData, _ := json.Marshal(payload)
+
+		req := httptest.NewRequest("PUT", "/api/libraries/scan-settings", bytes.NewBuffer(jsonData))
+		req.Header.Set("Content-Type", "application/json")
+		req.Header.Set("Authorization", "Bearer valid-admin-token")
+		rr := httptest.NewRecorder()
+
+		handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			userRole := r.Header.Get("X-User-Role")
+			if userRole != "admin" {
+				w.WriteHeader(http.StatusForbidden)
+				return
+			}
+
+			w.WriteHeader(http.StatusBadRequest)
+			w.Write([]byte(`{"error":"invalid request"}`))
+		})
+
+		handler.ServeHTTP(rr, req)
+		assert.Equal(t, http.StatusBadRequest, rr.Code)
+	})
+
+	t.Run("PUT /api/libraries/scan-settings - Update with valid data", func(t *testing.T) {
+		testCases := []struct {
+			name                 string
+			scanFrequencyMinutes int
+			autoScanEnabled      bool
+		}{
+			{"Valid frequency (15 minutes)", 15, true},
+			{"Valid frequency (60 minutes)", 60, true},
+			{"Valid frequency (1440 minutes)", 1440, true},
+			{"Valid frequency (120 minutes)", 120, false},
+			{"Valid frequency (30 minutes)", 30, true},
+		}
+
+		for _, tc := range testCases {
+			t.Run(tc.name, func(t *testing.T) {
+				payload := map[string]interface{}{
+					"scan_frequency_minutes": tc.scanFrequencyMinutes,
+					"auto_scan_enabled":      tc.autoScanEnabled,
+				}
+				jsonData, _ := json.Marshal(payload)
+
+				req := httptest.NewRequest("PUT", "/api/libraries/scan-settings", bytes.NewBuffer(jsonData))
+				req.Header.Set("Content-Type", "application/json")
+				req.Header.Set("Authorization", "Bearer valid-admin-token")
+				rr := httptest.NewRecorder()
+
+				expectedResponse := map[string]interface{}{
+					"scan_frequency_minutes": tc.scanFrequencyMinutes,
+					"auto_scan_enabled":      tc.autoScanEnabled,
+					"message":                "scan settings updated successfully",
+				}
+
+				handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+					userRole := r.Header.Get("X-User-Role")
+					if userRole != "admin" {
+						w.WriteHeader(http.StatusForbidden)
+						return
+					}
+
+					w.Header().Set("Content-Type", "application/json")
+					w.WriteHeader(http.StatusOK)
+					json.NewEncoder(w).Encode(expectedResponse)
+				})
+
+				handler.ServeHTTP(rr, req)
+				assert.Equal(t, http.StatusOK, rr.Code)
+
+				var response map[string]interface{}
+				err := json.NewDecoder(rr.Body).Decode(&response)
+				assert.NoError(t, err)
+				assert.Equal(t, float64(tc.scanFrequencyMinutes), response["scan_frequency_minutes"])
+				assert.Equal(t, tc.autoScanEnabled, response["auto_scan_enabled"])
+				assert.Equal(t, "scan settings updated successfully", response["message"])
+			})
+		}
+	})
+
+	t.Run("PUT /api/libraries/scan-settings - Update with invalid JSON", func(t *testing.T) {
+		invalidJSON := []byte(`{scan_frequency_minutes: 60, auto_scan_enabled: true}`)
+
+		req := httptest.NewRequest("PUT", "/api/libraries/scan-settings", bytes.NewBuffer(invalidJSON))
+		req.Header.Set("Content-Type", "application/json")
+		req.Header.Set("Authorization", "Bearer valid-admin-token")
+		rr := httptest.NewRecorder()
+
+		handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			userRole := r.Header.Get("X-User-Role")
+			if userRole != "admin" {
+				w.WriteHeader(http.StatusForbidden)
+				return
+			}
+
+			w.WriteHeader(http.StatusBadRequest)
+			w.Write([]byte(`{"error":"invalid request"}`))
+		})
+
+		handler.ServeHTTP(rr, req)
+		assert.Equal(t, http.StatusBadRequest, rr.Code)
+	})
+}
+
+// TestSystemSettingsIntegration tests the integration of system settings with the scheduler
+func TestSystemSettingsIntegration(t *testing.T) {
+	t.Run("System settings affect all libraries equally", func(t *testing.T) {
+		settings := map[string]interface{}{
+			"scan_frequency_minutes": 60,
+			"auto_scan_enabled":      true,
+		}
+
+		assert.Equal(t, 60, settings["scan_frequency_minutes"])
+		assert.Equal(t, true, settings["auto_scan_enabled"])
+	})
+
+	t.Run("Disabling auto scan stops all library scans", func(t *testing.T) {
+		settings := map[string]interface{}{
+			"scan_frequency_minutes": 60,
+			"auto_scan_enabled":      false,
+		}
+
+		assert.Equal(t, false, settings["auto_scan_enabled"])
+		assert.Equal(t, "Scans should not run when auto_scan_enabled is false", "Scans should not run")
+	})
+
+	t.Run("Valid frequency range enforcement", func(t *testing.T) {
+		validFrequencies := []int{15, 30, 60, 120, 240, 480, 720, 1440}
+		invalidFrequencies := []int{0, 1, 14, 1441, 2000}
+
+		for _, freq := range validFrequencies {
+			assert.True(t, freq >= 15 && freq <= 1440, "Frequency %d should be valid", freq)
+		}
+
+		for _, freq := range invalidFrequencies {
+			assert.False(t, freq >= 15 && freq <= 1440, "Frequency %d should be invalid", freq)
+		}
+	})
+}