snapshot of https://github.com/cortezaproject/corteza.git (2024.9.x, 2026-09-18; blobs > 131072B omitted)

server/tests/system/reminder_test.go

@@ -0,0 +1,356 @@
+package system
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"strconv"
+	"testing"
+	"time"
+
+	"github.com/cortezaproject/corteza/server/pkg/id"
+	"github.com/cortezaproject/corteza/server/store"
+	"github.com/cortezaproject/corteza/server/system/service"
+	"github.com/cortezaproject/corteza/server/system/types"
+	"github.com/cortezaproject/corteza/server/tests/helpers"
+	jsonpath "github.com/steinfletcher/apitest-jsonpath"
+)
+
+func (h helper) clearReminders() {
+	h.noError(store.TruncateReminders(context.Background(), service.DefaultStore))
+}
+
+func (h helper) makeReminder() *types.Reminder {
+	return h.reminder(h.cUser.ID, false)
+}
+
+func (h helper) makeReminderByUserID(userID uint64) *types.Reminder {
+	return h.reminder(userID, false)
+}
+
+func (h helper) makeDeletedReminder() *types.Reminder {
+	return h.reminder(h.cUser.ID, true)
+}
+
+func (h helper) reminder(userID uint64, deleted bool) *types.Reminder {
+	rm := &types.Reminder{Resource: "test:resource", AssignedTo: userID}
+	rm.ID = id.Next()
+	rm.CreatedAt = time.Now()
+	if deleted {
+		now := time.Now()
+		rm.DeletedAt = &now
+	}
+
+	h.noError(store.CreateReminder(context.Background(), service.DefaultStore, rm))
+	return rm
+}
+
+func (h helper) lookupReminderByID(ID uint64) *types.Reminder {
+	rm, err := store.LookupReminderByID(context.Background(), service.DefaultStore, ID)
+	h.noError(err)
+	return rm
+}
+
+func TestReminderCreate(t *testing.T) {
+	h := newHelper(t)
+	h.clearReminders()
+
+	h.apiInit().
+		Post("/reminder/").
+		Header("Accept", "application/json").
+		FormData("resource", "some:resource").
+		FormData("assignedTo", strconv.FormatUint(h.cUser.ID, 10)).
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertNoErrors).
+		Assert(jsonpath.Equal(`$.response.resource`, "some:resource")).
+		End()
+}
+
+func TestReminderAssign_forbidden(t *testing.T) {
+	h := newHelper(t)
+	h.clearReminders()
+
+	h.apiInit().
+		Post("/reminder/").
+		Header("Accept", "application/json").
+		FormData("resource", "some:resource").
+		FormData("assignedTo", "404").
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertError("reminder.errors.notAllowedToAssign")).
+		End()
+}
+
+func TestReminderAssign(t *testing.T) {
+	h := newHelper(t)
+	h.clearReminders()
+
+	helpers.AllowMe(h, types.ComponentRbacResource(), "reminder.assign")
+
+	h.apiInit().
+		Post("/reminder/").
+		Header("Accept", "application/json").
+		FormData("resource", "some:resource").
+		FormData("assignedTo", "404").
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertNoErrors).
+		Assert(jsonpath.Equal(`$.response.resource`, "some:resource")).
+		End()
+}
+
+func TestReminderRead(t *testing.T) {
+	h := newHelper(t)
+	h.clearReminders()
+
+	rm := h.makeReminder()
+
+	h.apiInit().
+		Get(fmt.Sprintf("/reminder/%d", rm.ID)).
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertNoErrors).
+		Assert(jsonpath.Equal(`$.response.resource`, rm.Resource)).
+		End()
+}
+
+// TestReminderReadForbidden checks only user themself can read reminder assigned to them
+func TestReminderReadForbidden(t *testing.T) {
+	h := newHelper(t)
+	h.clearReminders()
+
+	rm := h.makeReminderByUserID(id.Next())
+
+	h.apiInit().
+		Get(fmt.Sprintf("/reminder/%d", rm.ID)).
+		Header("Accept", "application/json").
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertError("reminder.errors.notAllowedToRead")).
+		End()
+}
+
+func TestReminderList(t *testing.T) {
+	h := newHelper(t)
+	h.clearReminders()
+
+	h.makeReminder()
+	h.makeDeletedReminder()
+	h.makeDeletedReminder()
+
+	h.apiInit().
+		Get("/reminder/").
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertNoErrors).
+		Assert(jsonpath.Len("$.response.set", 1)).
+		End()
+}
+
+func TestReminderListIncludeDeleted(t *testing.T) {
+	h := newHelper(t)
+	h.clearReminders()
+
+	h.makeReminder()
+	h.makeDeletedReminder()
+	h.makeDeletedReminder()
+
+	h.apiInit().
+		Get("/reminder/").
+		Query("includeDeleted", "true").
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertNoErrors).
+		Assert(jsonpath.Len("$.response.set", 3)).
+		End()
+}
+
+// TestReminderListForbidden checks reminders of other users are not listed
+func TestReminderListForbidden(t *testing.T) {
+	h := newHelper(t)
+	h.clearReminders()
+
+	h.makeReminder()
+	h.makeReminderByUserID(id.Next())
+
+	h.apiInit().
+		Get("/reminder/").
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertNoErrors).
+		Assert(jsonpath.Len("$.response.set", 1)).
+		End()
+}
+
+// TestReminderListAssignable checks users that can assign reminders can also
+// list reminders of other users
+func TestReminderListAssignable(t *testing.T) {
+	h := newHelper(t)
+	h.clearReminders()
+
+	helpers.AllowMe(h, types.ComponentRbacResource(), "reminder.assign")
+
+	h.makeReminder()
+	h.makeReminderByUserID(id.Next())
+
+	h.apiInit().
+		Get("/reminder/").
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertNoErrors).
+		Assert(jsonpath.Len("$.response.set", 2)).
+		End()
+}
+
+// TestReminderReadAssignable checks users that can assign reminders can also
+// read reminders of other users
+func TestReminderReadAssignable(t *testing.T) {
+	h := newHelper(t)
+	h.clearReminders()
+
+	helpers.AllowMe(h, types.ComponentRbacResource(), "reminder.assign")
+
+	rm := h.makeReminderByUserID(id.Next())
+
+	h.apiInit().
+		Get(fmt.Sprintf("/reminder/%d", rm.ID)).
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertNoErrors).
+		Assert(jsonpath.Equal(`$.response.resource`, rm.Resource)).
+		End()
+}
+
+// TestReminderDismissAssignable checks users that can assign reminders can also
+// dismiss reminders of other users
+func TestReminderDismissAssignable(t *testing.T) {
+	h := newHelper(t)
+	h.clearReminders()
+
+	helpers.AllowMe(h, types.ComponentRbacResource(), "reminder.assign")
+
+	rm := h.makeReminderByUserID(id.Next())
+
+	h.apiInit().
+		Patch(fmt.Sprintf("/reminder/%d/dismiss", rm.ID)).
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertNoErrors).
+		End()
+}
+
+// TestReminderSnoozeForbidden checks only user themself can snooze reminder
+// assigned to them
+func TestReminderSnoozeForbidden(t *testing.T) {
+	h := newHelper(t)
+	h.clearReminders()
+
+	rm := h.makeReminderByUserID(id.Next())
+
+	h.apiInit().
+		Patch(fmt.Sprintf("/reminder/%d/snooze", rm.ID)).
+		Header("Accept", "application/json").
+		FormData("remindAt", time.Now().Add(time.Hour).Format(time.RFC3339)).
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertError("reminder.errors.notAllowedToSnooze")).
+		End()
+}
+
+func TestReminderUpdateForbidden(t *testing.T) {
+	h := newHelper(t)
+	h.clearReminders()
+
+	rm := h.makeReminder()
+
+	h.apiInit().
+		Put(fmt.Sprintf("/reminder/%d", rm.ID)).
+		Header("Accept", "application/json").
+		FormData("resource", "changed:resource").
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertError("reminder.errors.notAllowedToAssign")).
+		End()
+}
+
+func TestReminderUpdate(t *testing.T) {
+	h := newHelper(t)
+	h.clearReminders()
+
+	helpers.AllowMe(h, types.ComponentRbacResource(), "reminder.assign")
+
+	rm := h.makeReminder()
+
+	h.apiInit().
+		Put(fmt.Sprintf("/reminder/%d", rm.ID)).
+		Header("Accept", "application/json").
+		FormData("resource", "changed:resource").
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertNoErrors).
+		Assert(jsonpath.Equal(`$.response.resource`, "changed:resource")).
+		End()
+}
+
+func TestReminderDelete(t *testing.T) {
+	h := newHelper(t)
+	h.clearReminders()
+
+	rm := h.makeReminder()
+
+	h.apiInit().
+		Delete(fmt.Sprintf("/reminder/%d", rm.ID)).
+		Header("Accept", "application/json").
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertNoErrors).
+		End()
+}
+
+func TestReminderDismiss(t *testing.T) {
+	h := newHelper(t)
+	h.clearReminders()
+
+	rm := h.makeReminder()
+
+	h.apiInit().
+		Patch(fmt.Sprintf("/reminder/%d/dismiss", rm.ID)).
+		Header("Accept", "application/json").
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertNoErrors).
+		End()
+}
+
+// TestReminderDismissForbidden checks only user themself can dismiss reminder assigned to them
+func TestReminderDismissForbidden(t *testing.T) {
+	h := newHelper(t)
+	h.clearReminders()
+
+	rm := h.makeReminderByUserID(id.Next())
+
+	h.apiInit().
+		Patch(fmt.Sprintf("/reminder/%d/dismiss", rm.ID)).
+		Header("Accept", "application/json").
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertError("reminder.errors.notAllowedToDismiss")).
+		End()
+}
+
+func TestReminderSnooze(t *testing.T) {
+	h := newHelper(t)
+	h.clearReminders()
+
+	rm := h.makeReminder()
+
+	h.apiInit().
+		Patch(fmt.Sprintf("/reminder/%d/snooze", rm.ID)).
+		Header("Accept", "application/json").
+		FormData("remindAt", time.Now().Format(time.RFC3339)).
+		Expect(t).
+		Status(http.StatusOK).
+		Assert(helpers.AssertNoErrors).
+		End()
+}