1 
use axum::{
2 
    body::Body,
3 
    http::{Request, StatusCode, header},
4 
};
5 
use tower::ServiceExt;
6 

            

        

            

                7
            

            

                
            

            

                
use crate::common::create_test_app_state;

            

        

            

                8
            

            

                
            

            

                
use web::route::create_admin_pages_router;

            

        

            

                9
            

            

                
            

            

                

            

        

            

                10
            

            

                
            

            

                
/// Registration is invite-only, so the page carrying the signup form must not

            

        

            

                11
            

            

                
            

            

                
/// be served to an anonymous visitor.

            

        

            

                12
            

            

                
            

            

                
///

            

        

            

                13
            

            

                
            

            

                
/// It used to be: `POST /api/auth/register` was admin-gated but `GET /register`

            

        

            

                14
            

            

                
            

            

                
/// was public, so a stranger was handed a form whose every submission is

            

        

            

                15
            

            

                
            

            

                
/// refused with 401.

            

        

            

                16
            

            

                
            

            

                
#[tokio::test]

            

        

            

                17
            

            

                1
            

            

                
async fn register_page_is_not_served_to_anonymous_visitors() {

            

        

            

                18
            

            

                1
            

            

                
    let app_state = create_test_app_state().await;

            

        

            

                19
            

            

                1
            

            

                
    let app = create_admin_pages_router(app_state.clone()).with_state(app_state.clone());

            

        

            

                20
            

            

                
            

            

                

            

        

            

                21
            

            

                1
            

            

                
    let response = app

            

        

            

                22
            

            

                1
            

            

                
        .oneshot(

            

        

            

                23
            

            

                1
            

            

                
            Request::builder()

            

        

            

                24
            

            

                1
            

            

                
                .method("GET")

            

        

            

                25
            

            

                1
            

            

                
                .uri("/register")

            

        

            

                26
            

            

                1
            

            

                
                .body(Body::empty())

            

        

            

                27
            

            

                1
            

            

                
                .unwrap(),

            

        

            

                28
            

            

                1
            

            

                
        )

            

        

            

                29
            

            

                1
            

            

                
        .await

            

        

            

                30
            

            

                1
            

            

                
        .expect("the router must answer");

            

        

            

                31
            

            

                
            

            

                

            

        

            

                32
            

            

                1
            

            

                
    assert_eq!(

            

        

            

                33
            

            

                1
            

            

                
        response.status(),

            

        

            

                34
            

            

                1
            

            

                
        StatusCode::UNAUTHORIZED,

            

        

            

                35
            

            

                1
            

            

                
        "an anonymous visitor must be refused the registration page"

            

        

            

                36
            

            

                1
            

            

                
    );

            

        

            

                37
            

            

                1
            

            

                
}

            

        

            

                38
            

            

                
            

            

                

            

        

            

                39
            

            

                
            

            

                
/// An HTML visitor is redirected rather than shown a JSON error, which is what

            

        

            

                40
            

            

                
            

            

                
/// `redirect_on_auth_error` is layered outside the auth pair to achieve.

            

        

            

                41
            

            

                
            

            

                
#[tokio::test]

            

        

            

                42
            

            

                1
            

            

                
async fn an_html_visitor_is_redirected_away_from_the_register_page() {

            

        

            

                43
            

            

                1
            

            

                
    let app_state = create_test_app_state().await;

            

        

            

                44
            

            

                1
            

            

                
    let app = create_admin_pages_router(app_state.clone()).with_state(app_state.clone());

            

        

            

                45
            

            

                
            

            

                

            

        

            

                46
            

            

                1
            

            

                
    let response = app

            

        

            

                47
            

            

                1
            

            

                
        .oneshot(

            

        

            

                48
            

            

                1
            

            

                
            Request::builder()

            

        

            

                49
            

            

                1
            

            

                
                .method("GET")

            

        

            

                50
            

            

                1
            

            

                
                .uri("/register")

            

        

            

                51
            

            

                1
            

            

                
                .header(header::ACCEPT, "text/html")

            

        

            

                52
            

            

                1
            

            

                
                .body(Body::empty())

            

        

            

                53
            

            

                1
            

            

                
                .unwrap(),

            

        

            

                54
            

            

                1
            

            

                
        )

            

        

            

                55
            

            

                1
            

            

                
        .await

            

        

            

                56
            

            

                1
            

            

                
        .expect("the router must answer");

            

        

            

                57
            

            

                
            

            

                

            

        

            

                58
            

            

                1
            

            

                
    assert!(

            

        

            

                59
            

            

                1
            

            

                
        response.status().is_redirection(),

            

        

            

                60
            

            

                1
            

            

                
        "an HTML visitor must be redirected, got {}",

            

        

            

                61
            

            

                1
            

            

                
        response.status()

            

        

            

                62
            

            

                1
            

            

                
    );

            

        

            

                63
            

            

                1
            

            

                
}