raisfast/tests/api/user.rs

use super::*;

#[tokio::test]
async fn get_me_success() {
    let (mut app, _) = test_app().await;
    let (access, _) = register_and_login(&mut app, "me@test.com", "meuser", "Password123").await;
    let (status, body): (StatusCode, Value) =
        send(&mut app, get_auth("/api/v1/users/me", &access)).await;
    assert!(status.is_success());
    assert_eq!(body["data"]["email"], "me@test.com");
}

#[tokio::test]
async fn get_me_unauthorized() {
    let (mut app, _) = test_app().await;
    let (status, _): (StatusCode, Value) = send(&mut app, get_req("/api/v1/users/me")).await;
    assert_eq!(status, StatusCode::UNAUTHORIZED);
}

#[tokio::test]
async fn update_me_success() {
    let (mut app, _) = test_app().await;
    let (access, _) = register_and_login(&mut app, "upd@test.com", "upduser", "Password123").await;
    let (status, body): (StatusCode, Value) = send(
        &mut app,
        put_json_auth(
            "/api/v1/users/me",
            json!({"username": "newname", "bio": "hello", "website": "https://example.com"}),
            &access,
        ),
    )
    .await;
    assert!(status.is_success(), "{status} {body:?}");
    assert_eq!(body["data"]["username"], "newname");
    assert_eq!(body["data"]["bio"], "hello");
}

#[tokio::test]
async fn change_password_success() {
    let (mut app, _) = test_app().await;
    let (access, _) = register_and_login(&mut app, "cpw@test.com", "cpwuser", "OldPass123").await;
    let (status, _): (StatusCode, Value) = send(
        &mut app,
        put_json_auth(
            "/api/v1/users/me/password",
            json!({"old_password": "OldPass123", "new_password": "NewPass456"}),
            &access,
        ),
    )
    .await;
    assert!(status.is_success());

    let (s, _): (StatusCode, Value) = send(
        &mut app,
        post_json(
            "/api/v1/auth/login",
            json!({"email": "cpw@test.com", "password": "NewPass456"}),
        ),
    )
    .await;
    assert!(s.is_success(), "新密码应可登录");
}

#[tokio::test]
async fn change_password_wrong_old() {
    let (mut app, _) = test_app().await;
    let (access, _) = register_and_login(&mut app, "bpw@test.com", "bpwuser", "Password123").await;
    let (status, body): (StatusCode, Value) = send(
        &mut app,
        put_json_auth(
            "/api/v1/users/me/password",
            json!({"old_password": "Wrong123", "new_password": "NewPass456"}),
            &access,
        ),
    )
    .await;
    assert_eq!(status, StatusCode::BAD_REQUEST);
    assert_eq!(body["code"], 40000);
}

#[tokio::test]
async fn get_user_by_id() {
    let (mut app, state) = test_app().await;
    let _ = register_and_login(&mut app, "pub@test.com", "pubuser", "Password123").await;
    let user_id: String = sqlx::query_scalar("SELECT id FROM users WHERE email = 'pub@test.com'")
        .fetch_one(&state.pool)
        .await
        .unwrap();
    let (status, body): (StatusCode, Value) =
        send(&mut app, get_req(&format!("/api/v1/users/{user_id}"))).await;
    assert!(status.is_success());
    assert_eq!(body["data"]["email"], "pub@test.com");
}

#[tokio::test]
async fn get_user_not_found() {
    let (mut app, _) = test_app().await;
    let fake = uuid::Uuid::now_v7().to_string();
    let (status, _): (StatusCode, Value) =
        send(&mut app, get_req(&format!("/api/v1/users/{fake}"))).await;
    assert_eq!(status, StatusCode::NOT_FOUND);
}

#[tokio::test]
async fn list_users_admin_only() {
    let (mut app, state) = test_app().await;
    let admin_id = create_admin(&state.pool).await;
    let admin_token = make_token(&admin_id, "admin");
    let (reader_tok, _) =
        register_and_login(&mut app, "reader@test.com", "reader", "Password123").await;

    let (s, _): (StatusCode, Value) = send(&mut app, get_auth("/api/v1/users", &reader_tok)).await;
    assert_eq!(s, StatusCode::FORBIDDEN);

    let (status, body): (StatusCode, Value) =
        send(&mut app, get_auth("/api/v1/users", &admin_token)).await;
    assert!(status.is_success());
    assert!(body["data"]["items"].is_array());
    assert!(body["data"]["total"].is_number());
}