test: expand endpoint coverage with workspaces, global users, and unauthed routes

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

backend/tests/apps.rs

@@ -152,6 +152,42 @@ async fn test_app_endpoints(db: Pool<Postgres>) -> anyhow::Result<()> {
     let resp = authed_get(port, "get_latest_version", "u/test-user/test_app").await;
     assert_eq!(resp.status(), 200);
 
+    // --- public_app (unauthed, by secret) ---
+    let resp = client()
+        .get(format!(
+            "http://localhost:{port}/api/w/test-workspace/apps_u/public_app/{secret_id}"
+        ))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(
+        resp.status(),
+        200,
+        "public_app: {}",
+        resp.text().await?
+    );
+
+    // --- secret_of_latest_version ---
+    let resp = authed_get(port, "secret_of_latest_version", "u/test-user/test_app").await;
+    assert_eq!(resp.status(), 200);
+    let secret = resp.text().await?;
+    assert!(!secret.is_empty());
+
+    // --- list_paths_from_workspace_runnable ---
+    let resp = authed(client().get(format!(
+        "{base}/list_paths_from_workspace_runnable/script/u/test-user/test_app"
+    )))
+    .send()
+    .await
+    .unwrap();
+    assert_eq!(
+        resp.status(),
+        200,
+        "list_paths_from_workspace_runnable: {}",
+        resp.text().await?
+    );
+
+
     // --- history_update ---
     let app_body = authed_get(port, "get/p", "u/test-user/test_app").await;
     let app = app_body.json::<serde_json::Value>().await?;

backend/tests/fixtures/base.sql

@@ -18,7 +18,21 @@ INSERT INTO workspace_settings (workspace_id) VALUES
 INSERT INTO password(email, password_hash, login_type, super_admin, verified, name)
     VALUES ('test@windmill.dev', 'not-a-real-hash', 'password', true, true, 'Test User');
 
+INSERT INTO password(email, password_hash, login_type, super_admin, verified, name)
+    VALUES ('test2@windmill.dev', 'not-a-real-hash', 'password', false, true, 'Test User 2');
+
+INSERT INTO password(email, password_hash, login_type, super_admin, verified, name)
+    VALUES ('test3@windmill.dev', 'not-a-real-hash', 'password', false, true, 'Test User 3');
+
+INSERT INTO usr(workspace_id, email, username, is_admin, role) VALUES
+	('test-workspace', 'test2@windmill.dev', 'test-user-2', false, 'User');
+
+INSERT INTO usr(workspace_id, email, username, is_admin, role) VALUES
+	('test-workspace', 'test3@windmill.dev', 'test-user-3', false, 'User');
+
 insert INTO token(token, email, label, super_admin) VALUES ('SECRET_TOKEN', 'test@windmill.dev', 'test token', true);
+insert INTO token(token, email, label, super_admin) VALUES ('SECRET_TOKEN_2', 'test2@windmill.dev', 'test token 2', false);
+insert INTO token(token, email, label, super_admin) VALUES ('SECRET_TOKEN_3', 'test3@windmill.dev', 'test token 3', false);
 
 GRANT ALL PRIVILEGES ON TABLE workspace_key TO windmill_admin;
 GRANT ALL PRIVILEGES ON TABLE workspace_key TO windmill_user;

backend/tests/scripts.rs

@@ -257,6 +257,21 @@ async fn test_script_endpoints(db: Pool<Postgres>) -> anyhow::Result<()> {
         resp.status()
     );
 
+    // --- tokened_raw (global unauthed, token in URL) ---
+    let resp = client()
+        .get(format!(
+            "http://localhost:{port}/api/scripts_u/tokened_raw/test-workspace/SECRET_TOKEN/u/test-user/test_script.ts"
+        ))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(
+        resp.status(),
+        200,
+        "tokened_raw: {}",
+        resp.text().await?
+    );
+
     // --- archive by path ---
     let resp = authed(client().post(script_url(
         port,
@@ -300,5 +315,17 @@ async fn test_script_endpoints(db: Pool<Postgres>) -> anyhow::Result<()> {
     let resp = authed_get(port, "exists/p", "u/test-user/test_script").await;
     assert_eq!(resp.json::<bool>().await?, false);
 
+    // --- empty_ts (global unauthed) ---
+    let resp = client()
+        .get(format!(
+            "http://localhost:{port}/api/scripts_u/empty_ts/u/test-user/any_script"
+        ))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 200);
+    let body = resp.text().await?;
+    assert!(body.is_empty(), "expected empty string, got: {body}");
+
     Ok(())
 }

backend/tests/users.rs

@@ -23,6 +23,98 @@ async fn test_user_endpoints(db: Pool<Postgres>) -> anyhow::Result<()> {
     let port = server.addr.port();
     let base = format!("http://localhost:{port}/api/w/test-workspace/users");
 
+    // ===== Global (non-workspace) endpoints =====
+    let global_base = format!("http://localhost:{port}/api/users");
+
+    // --- global whoami ---
+    let resp = authed(client().get(format!("{global_base}/whoami")))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 200);
+    let body = resp.json::<serde_json::Value>().await?;
+    assert_eq!(body["email"], "test@windmill.dev");
+
+    // --- get_email ---
+    let resp = authed(client().get(format!("{global_base}/email")))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 200);
+    let email = resp.text().await?;
+    assert_eq!(email, "test@windmill.dev");
+
+    // --- exists_email ---
+    let resp = authed(client().get(format!(
+        "{global_base}/exists/test@windmill.dev"
+    )))
+    .send()
+    .await
+    .unwrap();
+    assert_eq!(resp.status(), 200);
+    assert_eq!(resp.json::<bool>().await?, true);
+
+    let resp = authed(client().get(format!(
+        "{global_base}/exists/nonexistent@windmill.dev"
+    )))
+    .send()
+    .await
+    .unwrap();
+    assert_eq!(resp.status(), 200);
+    assert_eq!(resp.json::<bool>().await?, false);
+
+    // --- list_as_super_admin ---
+    let resp = authed(client().get(format!("{global_base}/list_as_super_admin")))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 200);
+    let list = resp.json::<Vec<serde_json::Value>>().await?;
+    assert!(!list.is_empty());
+
+    // --- tokens/list ---
+    let resp = authed(client().get(format!("{global_base}/tokens/list")))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 200);
+    resp.json::<Vec<serde_json::Value>>().await?;
+
+    // --- tokens/create ---
+    let resp = authed(client().post(format!("{global_base}/tokens/create")))
+        .json(&json!({"label": "ephemeral-test-token"}))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 201);
+    let new_token = resp.text().await?;
+    assert!(!new_token.is_empty());
+
+    // --- tokens/delete ---
+    let token_prefix = &new_token[..std::cmp::min(new_token.len(), 10)];
+    let resp = authed(client().delete(format!(
+        "{global_base}/tokens/delete/{token_prefix}"
+    )))
+    .send()
+    .await
+    .unwrap();
+    assert_eq!(
+        resp.status(),
+        200,
+        "delete token: {}",
+        resp.text().await?
+    );
+
+    // --- list_invites ---
+    let resp = authed(client().get(format!("{global_base}/list_invites")))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 200);
+    resp.json::<Vec<serde_json::Value>>().await?;
+
+    // ===== Workspace-scoped endpoints =====
+
     // --- whoami ---
     let resp = authed(client().get(format!("{base}/whoami")))
         .send()
@@ -130,5 +222,42 @@ async fn test_user_endpoints(db: Pool<Postgres>) -> anyhow::Result<()> {
         .unwrap();
     assert_eq!(resp.status(), 200);
 
+    // --- delete workspace user (admin deletes test-user-2) ---
+    let resp = authed(client().delete(user_url(port, "delete", "test-user-2")))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(
+        resp.status(),
+        200,
+        "delete user: {}",
+        resp.text().await?
+    );
+
+    // verify deleted
+    let resp = authed(client().get(format!("{base}/list_usernames")))
+        .send()
+        .await
+        .unwrap();
+    let usernames = resp.json::<Vec<String>>().await?;
+    assert!(!usernames.contains(&"test-user-2".to_string()));
+
+    // --- leave workspace (test-user-3 leaves voluntarily) ---
+    let resp = client()
+        .post(format!("{base}/leave"))
+        .header("Authorization", "Bearer SECRET_TOKEN_3")
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 200, "leave: {}", resp.text().await?);
+
+    // verify left
+    let resp = authed(client().get(format!("{base}/list_usernames")))
+        .send()
+        .await
+        .unwrap();
+    let usernames = resp.json::<Vec<String>>().await?;
+    assert!(!usernames.contains(&"test-user-3".to_string()));
+
     Ok(())
 }

backend/tests/workspaces.rs

@@ -0,0 +1,201 @@
+use serde_json::json;
+use sqlx::{Pool, Postgres};
+
+mod common;
+use common::*;
+
+fn client() -> reqwest::Client {
+    reqwest::Client::new()
+}
+
+fn authed(builder: reqwest::RequestBuilder) -> reqwest::RequestBuilder {
+    builder.header("Authorization", "Bearer SECRET_TOKEN")
+}
+
+#[sqlx::test(fixtures("base"))]
+async fn test_workspace_endpoints(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let base = format!("http://localhost:{port}/api/w/test-workspace/workspaces");
+    let global_base = format!("http://localhost:{port}/api/workspaces");
+
+    // ===== Global endpoints =====
+
+    // --- list ---
+    let resp = authed(client().get(format!("{global_base}/list")))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 200);
+    let list = resp.json::<Vec<serde_json::Value>>().await?;
+    assert!(list.iter().any(|w| w["id"] == "test-workspace"));
+
+    // --- list_as_superadmin ---
+    let resp = authed(client().get(format!("{global_base}/list_as_superadmin")))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 200);
+    let list = resp.json::<Vec<serde_json::Value>>().await?;
+    assert!(list.iter().any(|w| w["id"] == "test-workspace"));
+
+    // --- users (user's workspaces) ---
+    let resp = authed(client().get(format!("{global_base}/users")))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 200);
+    let body = resp.json::<serde_json::Value>().await?;
+    let workspaces = body["workspaces"].as_array().unwrap();
+    assert!(workspaces.iter().any(|w| w["id"] == "test-workspace"));
+
+    // --- exists ---
+    let resp = authed(client().post(format!("{global_base}/exists")))
+        .json(&json!({"id": "test-workspace"}))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 200);
+    assert_eq!(resp.json::<bool>().await?, true);
+
+    let resp = authed(client().post(format!("{global_base}/exists")))
+        .json(&json!({"id": "nonexistent-workspace"}))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 200);
+    assert_eq!(resp.json::<bool>().await?, false);
+
+    // --- exists_username (validates username is available) ---
+    // existing username -> 400
+    let resp = authed(client().post(format!("{global_base}/exists_username")))
+        .json(&json!({"id": "test-workspace", "username": "test-user"}))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 400);
+
+    // available username -> 200
+    let resp = authed(client().post(format!("{global_base}/exists_username")))
+        .json(&json!({"id": "test-workspace", "username": "available-user"}))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 200);
+
+    // ===== Workspace-scoped endpoints =====
+
+    // --- get_settings ---
+    let resp = authed(client().get(format!("{base}/get_settings")))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 200);
+    let settings = resp.json::<serde_json::Value>().await?;
+    assert!(settings.is_object());
+
+    // --- get_deploy_to ---
+    let resp = authed(client().get(format!("{base}/get_deploy_to")))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 200);
+
+    // --- is_premium ---
+    let resp = authed(client().get(format!("{base}/is_premium")))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 200);
+
+    // --- default_app ---
+    let resp = authed(client().get(format!("{base}/default_app")))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 200);
+
+    // --- default_scripts ---
+    let resp = authed(client().get(format!("{base}/default_scripts")))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 200);
+
+    // --- list_pending_invites ---
+    let resp = authed(client().get(format!("{base}/list_pending_invites")))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 200);
+    resp.json::<Vec<serde_json::Value>>().await?;
+
+    // --- encryption_key ---
+    let resp = authed(client().get(format!("{base}/encryption_key")))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 200);
+
+    // --- get_dependency_map ---
+    let resp = authed(client().get(format!("{base}/get_dependency_map")))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 200);
+
+    // --- get_as_superadmin ---
+    let resp = authed(client().get(format!("{base}/get_as_superadmin")))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 200);
+    let body = resp.json::<serde_json::Value>().await?;
+    assert_eq!(body["id"], "test-workspace");
+
+    // --- invite_user + list_pending_invites + delete_invite ---
+    let resp = authed(client().post(format!("{base}/invite_user")))
+        .json(&json!({
+            "email": "invited@example.com",
+            "is_admin": false,
+            "operator": false
+        }))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 201, "invite_user: {}", resp.text().await?);
+
+    // verify invite shows in pending
+    let resp = authed(client().get(format!("{base}/list_pending_invites")))
+        .send()
+        .await
+        .unwrap();
+    let invites = resp.json::<Vec<serde_json::Value>>().await?;
+    assert!(
+        invites
+            .iter()
+            .any(|i| i["email"] == "invited@example.com"),
+        "invite not found: {:?}",
+        invites
+    );
+
+    // delete invite
+    let resp = authed(client().post(format!("{base}/delete_invite")))
+        .json(&json!({
+            "email": "invited@example.com",
+            "is_admin": false,
+            "operator": false
+        }))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(
+        resp.status(),
+        201,
+        "delete_invite: {}",
+        resp.text().await?
+    );
+
+    Ok(())
+}