internal/api/session_test.go - develop - githubmirror/photoprism

internal/api/session_test.go
468 строк18 KB
Michael Mayer
Tests: Add release-review regression tests #5647 #5638 #5666 #5699 #5733
21 июл 2026, 17:00
21 июл 2026, 17:00bcd8265
package api

import (
	"net/http"
	"strings"
	"testing"

	"github.com/stretchr/testify/assert"
	"github.com/tidwall/gjson"

	"github.com/photoprism/photoprism/internal/config"
	"github.com/photoprism/photoprism/internal/entity"
	"github.com/photoprism/photoprism/internal/form"
	"github.com/photoprism/photoprism/internal/photoprism/get"
	"github.com/photoprism/photoprism/pkg/http/header"
	"github.com/photoprism/photoprism/pkg/i18n"
	"github.com/photoprism/photoprism/pkg/rnd"
)

func TestSession(t *testing.T) {
	t.Run("Public", func(t *testing.T) {
		sess := get.Session().Public()
		assert.Equal(t, sess, Session("1.2.3.4", ""))
		assert.Equal(t, sess, Session("1.2.3.4", "1234ffc9b86a8fda0d908ebee84a43930cb8d1e3507f4aa0"))
	})
}

func TestGetSessionResponse(t *testing.T) {
	t.Run("Public", func(t *testing.T) {
		sess := get.Session().Public()
		conf := get.Config().ClientSession(sess)

		// Create response in public mode.
		result := GetSessionResponse(sess.AuthToken(), sess, conf)

		// Check response.
		assert.Equal(t, StatusSuccess, result["status"])
		assert.Equal(t, sess.ID, result["session_id"])
		assert.Equal(t, sess.AuthToken(), result["id"])
		assert.Equal(t, sess.AuthToken(), result["access_token"])
		assert.Equal(t, sess.AuthTokenType(), result["token_type"])
		assert.Equal(t, sess.ExpiresIn(), result["expires_in"])
		assert.Equal(t, sess.GetProvider().String(), result["provider"])
		assert.Equal(t, sess.GetUser(), result["user"])
		assert.Equal(t, sess.GetData(), result["data"])
		assert.Equal(t, conf, result["config"])
	})
	t.Run("NoAuthToken", func(t *testing.T) {
		sess := get.Session().Public()
		conf := get.Config().ClientSession(sess)

		// Create response without auth token.
		result := GetSessionResponse("", sess, conf)

		// Check response.
		assert.Equal(t, StatusSuccess, result["status"])
		assert.Equal(t, sess.ID, result["session_id"])
		assert.Nil(t, result["id"])
		assert.Nil(t, result["access_token"])
		assert.Nil(t, result["token_type"])
		assert.Equal(t, sess.ExpiresIn(), result["expires_in"])
		assert.Equal(t, sess.GetProvider().String(), result["provider"])
		assert.Equal(t, sess.GetUser(), result["user"])
		assert.Equal(t, sess.GetData(), result["data"])
		assert.Equal(t, conf, result["config"])
	})
	t.Run("RedactsGroups", func(t *testing.T) {
		sess := get.Session().Public()
		sess.SetData(sess.GetData().SetGroups([]string{"media-acme-admin"}))
		defer func() { sess.SetData(sess.GetData().SetGroups(nil)) }()
		conf := get.Config().ClientSession(sess)

		result := GetSessionResponse(sess.AuthToken(), sess, conf)

		if data, ok := result["data"].(*entity.SessionData); assert.True(t, ok) {
			assert.Nil(t, data.Groups, "session responses must not disclose the login-time group set")
		}
		assert.NotEmpty(t, sess.GetData().Groups, "the stored session data keeps the groups")
	})
}

func TestCreateSession(t *testing.T) {
	t.Run("Success", func(t *testing.T) {
		app, router, conf := NewApiTest()
		conf.SetAuthMode(config.AuthModePasswd)
		defer conf.SetAuthMode(config.AuthModePublic)

		CreateSession(router)

		r := PerformRequestWithBody(app, http.MethodPost, "/api/v1/session", `{"username": "admin", "password": "photoprism"}`)
		// t.Logf("Response Body: %s", r.Body.String())
		userName := gjson.Get(r.Body.String(), "user.Name").String()
		assert.Equal(t, "admin", userName)
		assert.Equal(t, http.StatusOK, r.Code)
	})
	t.Run("BadRequest", func(t *testing.T) {
		app, router, conf := NewApiTest()
		conf.SetAuthMode(config.AuthModePasswd)
		defer conf.SetAuthMode(config.AuthModePublic)

		CreateSession(router)

		r := PerformRequestWithBody(app, http.MethodPost, "/api/v1/session", `{"username": 123, "password": "xxx"}`)
		assert.Equal(t, http.StatusBadRequest, r.Code)
	})
	t.Run("RequestTooLarge", func(t *testing.T) {
		app, router, conf := NewApiTest()
		conf.SetAuthMode(config.AuthModePasswd)
		defer conf.SetAuthMode(config.AuthModePublic)

		CreateSession(router)

		body := `{"username":"` + strings.Repeat("a", 70*1024) + `","password":"photoprism"}`
		r := PerformRequestWithBody(app, http.MethodPost, "/api/v1/session", body)
		assert.Equal(t, http.StatusRequestEntityTooLarge, r.Code)
	})
	t.Run("PublicInvalidToken", func(t *testing.T) {
		app, router, conf := NewApiTest()
		conf.SetAuthMode(config.AuthModePasswd)
		defer conf.SetAuthMode(config.AuthModePublic)

		CreateSession(router)

		r := PerformRequestWithBody(app, http.MethodPost, "/api/v1/session", `{"username": "admin", "password": "photoprism", "token": "xxx"}`)
		assert.Equal(t, http.StatusNotFound, r.Code)
	})
	t.Run("AdminInvalidToken", func(t *testing.T) {
		app, router, conf := NewApiTest()
		conf.SetAuthMode(config.AuthModePasswd)
		defer conf.SetAuthMode(config.AuthModePublic)

		authToken := AuthenticateUser(app, router, "alice", "Alice123!")

		r := AuthenticatedRequestWithBody(app, http.MethodPost, "/api/v1/session", `{"token": "xxx"}`, authToken)
		assert.Equal(t, http.StatusNotFound, r.Code)
	})
	t.Run("VisitorInvalidToken", func(t *testing.T) {
		app, router, conf := NewApiTest()
		conf.SetAuthMode(config.AuthModePasswd)
		defer conf.SetAuthMode(config.AuthModePublic)

		CreateSession(router)

		r := AuthenticatedRequestWithBody(app, http.MethodPost, "/api/v1/session", `{"token": "xxx"}`, "345346")
		assert.Equal(t, http.StatusNotFound, r.Code)
	})
	t.Run("AdminValidToken", func(t *testing.T) {
		app, router, conf := NewApiTest()
		conf.SetAuthMode(config.AuthModePasswd)
		defer conf.SetAuthMode(config.AuthModePublic)

		authToken := AuthenticateUser(app, router, "alice", "Alice123!")

		r := AuthenticatedRequestWithBody(app, http.MethodPost, "/api/v1/session", `{"token": "1jxf3jfn2k"}`, authToken)
		assert.Equal(t, http.StatusOK, r.Code)
	})
	t.Run("PublicValidToken", func(t *testing.T) {
		app, router, _ := NewApiTest()

		CreateSession(router)

		r := PerformRequestWithBody(app, http.MethodPost, "/api/v1/session", `{"username": "admin", "password": "photoprism", "token": "1jxf3jfn2k"}`)
		assert.Equal(t, http.StatusOK, r.Code)
	})
	t.Run("PublicDemoForbidden", func(t *testing.T) {
		app, router, conf := NewApiTest()

		CreateSession(router)

		origDemo := conf.Options().Demo
		t.Cleanup(func() {
			conf.Options().Demo = origDemo
		})

		conf.Options().Demo = true

		r := PerformRequestWithBody(app, http.MethodPost, "/api/v1/session", `{"username": "admin", "password": "photoprism"}`)
		assert.Equal(t, http.StatusPaymentRequired, r.Code)
	})
	t.Run("AdminInvalidPassword", func(t *testing.T) {
		app, router, conf := NewApiTest()
		conf.SetAuthMode(config.AuthModePasswd)
		defer conf.SetAuthMode(config.AuthModePublic)

		CreateSession(router)

		r := PerformRequestWithBody(app, http.MethodPost, "/api/v1/session", form.AsJson(form.Login{
			Username: "admin",
			Password: "xxx",
		}))

		val := gjson.Get(r.Body.String(), "error")
		assert.Equal(t, i18n.Msg(i18n.ErrInvalidCredentials), val.String())
		assert.Equal(t, i18n.Source(i18n.ErrInvalidCredentials), gjson.Get(r.Body.String(), "messageId").String())
		assert.Equal(t, http.StatusUnauthorized, r.Code)
	})
	t.Run("AliceSuccess", func(t *testing.T) {
		app, router, conf := NewApiTest()
		conf.SetAuthMode(config.AuthModePasswd)
		defer conf.SetAuthMode(config.AuthModePublic)

		CreateSession(router)

		r := PerformRequestWithBody(app, http.MethodPost, "/api/v1/session", `{"username": "alice", "password": "Alice123!"}`)
		userEmail := gjson.Get(r.Body.String(), "user.Email")
		userName := gjson.Get(r.Body.String(), "user.Name")
		assert.Equal(t, "alice@example.com", userEmail.String())
		assert.Equal(t, "alice", userName.String())
		assert.Equal(t, http.StatusOK, r.Code)
	})
	t.Run("BobSuccess", func(t *testing.T) {
		app, router, conf := NewApiTest()
		conf.SetAuthMode(config.AuthModePasswd)
		defer conf.SetAuthMode(config.AuthModePublic)

		CreateSession(router)

		r := PerformRequestWithBody(app, http.MethodPost, "/api/v1/session", `{"username": "bob", "password": "Bobbob123!"}`)
		userEmail := gjson.Get(r.Body.String(), "user.Email")
		userName := gjson.Get(r.Body.String(), "user.Name")
		assert.Equal(t, "bob@example.com", userEmail.String())
		assert.Equal(t, "bob", userName.String())
		assert.Equal(t, http.StatusOK, r.Code)
	})
	t.Run("BobInvalidPassword", func(t *testing.T) {
		app, router, conf := NewApiTest()
		conf.SetAuthMode(config.AuthModePasswd)
		defer conf.SetAuthMode(config.AuthModePublic)

		CreateSession(router)

		r := PerformRequestWithBody(app, http.MethodPost, "/api/v1/session", `{"username": "bob", "password": "helloworld"}`)
		val := gjson.Get(r.Body.String(), "error")
		assert.Equal(t, i18n.Msg(i18n.ErrInvalidCredentials), val.String())
		assert.Equal(t, i18n.Source(i18n.ErrInvalidCredentials), gjson.Get(r.Body.String(), "messageId").String())
		assert.Equal(t, http.StatusUnauthorized, r.Code)
	})
	t.Run("TwoFaPasscodeRequired", func(t *testing.T) {
		app, router, conf := NewApiTest()
		conf.SetAuthMode(config.AuthModePasswd)
		defer conf.SetAuthMode(config.AuthModePublic)

		CreateSession(router)

		r := PerformRequestWithBody(app, http.MethodPost, "/api/v1/session", `{"username": "2fa", "password": "2fa-123!"}`)
		userEmail := gjson.Get(r.Body.String(), "user.Email")
		userName := gjson.Get(r.Body.String(), "user.Name")
		assert.Equal(t, "", userEmail.String())
		assert.Equal(t, "", userName.String())
		assert.Equal(t, http.StatusUnauthorized, r.Code)
		// Code 32 is a continuation request, not an error: the text is in "message", not "error".
		assert.Equal(t, int64(32), gjson.Get(r.Body.String(), "code").Int())
		assert.Equal(t, i18n.Msg(i18n.ErrPasscodeRequired), gjson.Get(r.Body.String(), "message").String())
		assert.Empty(t, gjson.Get(r.Body.String(), "error").String())
		assert.Equal(t, i18n.Source(i18n.ErrPasscodeRequired), gjson.Get(r.Body.String(), "messageId").String())
	})
	t.Run("TwoFaInvalidPasscode", func(t *testing.T) {
		app, router, conf := NewApiTest()
		conf.SetAuthMode(config.AuthModePasswd)
		defer conf.SetAuthMode(config.AuthModePublic)

		CreateSession(router)

		r := PerformRequestWithBody(app, http.MethodPost, "/api/v1/session", `{"username": "2fa", "password": "2fa-123!", "code": "123456"}`)

		userEmail := gjson.Get(r.Body.String(), "user.Email")
		userName := gjson.Get(r.Body.String(), "user.Name")
		assert.Equal(t, "", userEmail.String())
		assert.Equal(t, "", userName.String())
		assert.Equal(t, http.StatusUnauthorized, r.Code)
		// The wrong passcode carries messageId so the Web UI can render it in the user's language.
		assert.Equal(t, i18n.Source(i18n.ErrInvalidPasscode), gjson.Get(r.Body.String(), "messageId").String())
	})
	t.Run("TwoFaUseRecoveryCode", func(t *testing.T) {
		app, router, conf := NewApiTest()
		conf.SetAuthMode(config.AuthModePasswd)
		defer conf.SetAuthMode(config.AuthModePublic)

		CreateSession(router)

		r := PerformRequestWithBody(app, http.MethodPost, "/api/v1/session", `{"username": "2fa", "password": "2fa-123!", "code": "0wg68oc6jgo54"}`)

		userEmail := gjson.Get(r.Body.String(), "user.Email")
		userName := gjson.Get(r.Body.String(), "user.Name")
		assert.Equal(t, "2FA@example.com", userEmail.String())
		assert.Equal(t, "2fa", userName.String())
		assert.Equal(t, http.StatusOK, r.Code)
	})
}

func TestGetSession(t *testing.T) {
	t.Run("AdminWithoutAuthentication", func(t *testing.T) {
		app, router, conf := NewApiTest()
		conf.SetAuthMode(config.AuthModePasswd)
		defer conf.SetAuthMode(config.AuthModePublic)

		GetSession(router)
		authToken := AuthenticateAdmin(app, router)

		r := PerformRequest(app, http.MethodGet, "/api/v1/session/"+rnd.SessionID(authToken))
		assert.Equal(t, http.StatusUnauthorized, r.Code)
	})
	t.Run("AdminAuthenticatedRequest", func(t *testing.T) {
		app, router, conf := NewApiTest()
		conf.SetAuthMode(config.AuthModePasswd)
		defer conf.SetAuthMode(config.AuthModePublic)

		GetSession(router)
		authToken := AuthenticateAdmin(app, router)

		t.Logf("Auth Token: %s", authToken)
		r := AuthenticatedRequest(app, http.MethodGet, "/api/v1/session", authToken)
		t.Logf("Response Body: %s", r.Body.String())
		id := gjson.Get(r.Body.String(), "session_id").String()
		assert.Equal(t, rnd.SessionID(authToken), id)
		assert.Equal(t, http.StatusOK, r.Code)
		assert.Equal(t, header.CacheControlNoStore, r.Header().Get(header.CacheControl), "session responses must not be cached")
	})
	t.Run("AdminAuthenticatedRequestWithID", func(t *testing.T) {
		app, router, conf := NewApiTest()
		conf.SetAuthMode(config.AuthModePasswd)
		defer conf.SetAuthMode(config.AuthModePublic)

		GetSession(router)
		authToken := AuthenticateAdmin(app, router)

		t.Logf("Auth Token: %s", authToken)
		r := AuthenticatedRequest(app, http.MethodGet, "/api/v1/session/"+rnd.SessionID(authToken), authToken)
		t.Logf("Response Body: %s", r.Body.String())
		id := gjson.Get(r.Body.String(), "session_id").String()
		assert.Equal(t, rnd.SessionID(authToken), id)
		assert.Equal(t, http.StatusOK, r.Code)
	})
	t.Run("AdminAuthenticatedRequestSessionsWithID", func(t *testing.T) {
		app, router, conf := NewApiTest()
		conf.SetAuthMode(config.AuthModePasswd)
		defer conf.SetAuthMode(config.AuthModePublic)

		GetSession(router)
		authToken := AuthenticateAdmin(app, router)

		t.Logf("Auth Token: %s", authToken)
		r := AuthenticatedRequest(app, http.MethodGet, "/api/v1/sessions/"+rnd.SessionID(authToken), authToken)
		t.Logf("Response Body: %s", r.Body.String())
		id := gjson.Get(r.Body.String(), "session_id").String()
		assert.Equal(t, rnd.SessionID(authToken), id)
		assert.Equal(t, http.StatusOK, r.Code)
	})
}

func TestDeleteSession(t *testing.T) {
	t.Run("AdminWithoutAuthentication", func(t *testing.T) {
		app, router, conf := NewApiTest()
		conf.SetAuthMode(config.AuthModePasswd)
		defer conf.SetAuthMode(config.AuthModePublic)

		DeleteSession(router)
		authToken := AuthenticateAdmin(app, router)

		r := AuthenticatedRequest(app, http.MethodDelete, "/api/v1/session/"+rnd.SessionID(authToken), "")
		assert.Equal(t, http.StatusUnauthorized, r.Code)
	})
	t.Run("AdminAuthenticatedRequest", func(t *testing.T) {
		app, router, conf := NewApiTest()
		conf.SetAuthMode(config.AuthModePasswd)
		defer conf.SetAuthMode(config.AuthModePublic)

		DeleteSession(router)
		authToken := AuthenticateAdmin(app, router)

		r := AuthenticatedRequest(app, http.MethodDelete, "/api/v1/session", authToken)
		assert.Equal(t, http.StatusOK, r.Code)
	})
	t.Run("AdminAuthenticatedRequestWithID", func(t *testing.T) {
		app, router, conf := NewApiTest()
		conf.SetAuthMode(config.AuthModePasswd)
		defer conf.SetAuthMode(config.AuthModePublic)

		DeleteSession(router)
		authToken := AuthenticateAdmin(app, router)

		r := AuthenticatedRequest(app, http.MethodDelete, "/api/v1/session/"+rnd.SessionID(authToken), authToken)
		assert.Equal(t, http.StatusOK, r.Code)
	})
	t.Run("AdminAuthenticatedRequestSessionsWithID", func(t *testing.T) {
		app, router, conf := NewApiTest()
		conf.SetAuthMode(config.AuthModePasswd)
		defer conf.SetAuthMode(config.AuthModePublic)

		DeleteSession(router)
		authToken := AuthenticateAdmin(app, router)

		r := AuthenticatedRequest(app, http.MethodDelete, "/api/v1/sessions/"+rnd.SessionID(authToken), authToken)
		assert.Equal(t, http.StatusOK, r.Code)
	})
	t.Run("AdminAuthenticatedLogout", func(t *testing.T) {
		app, router, conf := NewApiTest()
		conf.SetAuthMode(config.AuthModePasswd)
		defer conf.SetAuthMode(config.AuthModePublic)

		DeleteSession(router)
		authToken := AuthenticateAdmin(app, router)

		r := AuthenticatedRequest(app, http.MethodDelete, "/api/v1/session", authToken)
		assert.Equal(t, http.StatusOK, r.Code)
	})
	t.Run("UserWithoutAuthentication", func(t *testing.T) {
		app, router, conf := NewApiTest()
		conf.SetAuthMode(config.AuthModePasswd)
		defer conf.SetAuthMode(config.AuthModePublic)

		DeleteSession(router)
		bobToken := "69be27ac5ca305b394046a83f6fda18167ca3d3f2dbe7ac1" // #nosec G101 test token

		r := PerformRequest(app, http.MethodDelete, "/api/v1/session/"+rnd.SessionID(bobToken))
		assert.Equal(t, http.StatusUnauthorized, r.Code)
	})
	t.Run("UserAuthenticatedRequest", func(t *testing.T) {
		app, router, conf := NewApiTest()
		conf.SetAuthMode(config.AuthModePasswd)
		defer conf.SetAuthMode(config.AuthModePublic)

		DeleteSession(router)
		authToken := AuthenticateUser(app, router, "alice", "Alice123!")

		r := AuthenticatedRequest(app, http.MethodDelete, "/api/v1/session/"+rnd.SessionID(authToken), authToken)
		t.Logf("Response Body: %s", r.Body.String())
		id := gjson.Get(r.Body.String(), "session_id").String()
		assert.Equal(t, rnd.SessionID(authToken), id)
		assert.Equal(t, http.StatusOK, r.Code)
	})
	t.Run("AliceSessionAsBob", func(t *testing.T) {
		app, router, conf := NewApiTest()
		conf.SetAuthMode(config.AuthModePasswd)
		defer conf.SetAuthMode(config.AuthModePublic)

		DeleteSession(router)
		bobToken := AuthenticateUser(app, router, "bob", "Bobbob123!")
		aliceToken := "69be27ac5ca305b394046a83f6fda18167ca3d3f2dbe7ac0" // #nosec G101 test token

		r := AuthenticatedRequest(app, http.MethodDelete, "/api/v1/session/"+rnd.SessionID(aliceToken), bobToken)
		assert.Equal(t, http.StatusForbidden, r.Code)
	})
	t.Run("BobSessionAsAlice", func(t *testing.T) {
		app, router, conf := NewApiTest()
		conf.SetAuthMode(config.AuthModePasswd)
		defer conf.SetAuthMode(config.AuthModePublic)

		DeleteSession(router)
		aliceToken := AuthenticateUser(app, router, "alice", "Alice123!")
		bobToken := "69be27ac5ca305b394046a83f6fda18167ca3d3f2dbe7ac1" // #nosec G101 test token

		r := AuthenticatedRequest(app, http.MethodDelete, "/api/v1/session/"+rnd.SessionID(bobToken), aliceToken)
		assert.Equal(t, http.StatusForbidden, r.Code)
	})
	t.Run("InvalidSession", func(t *testing.T) {
		app, router, conf := NewApiTest()
		conf.SetAuthMode(config.AuthModePasswd)
		defer conf.SetAuthMode(config.AuthModePublic)

		DeleteSession(router)
		authToken := AuthenticateUser(app, router, "alice", "Alice123!")
		deleteToken := "638bffc9b86a8fda0d908ebee84a43930cb8d1e3507f4aa0" // #nosec G101 test token

		r := AuthenticatedRequest(app, http.MethodDelete, "/api/v1/session/"+rnd.SessionID(deleteToken), authToken)
		assert.Equal(t, http.StatusForbidden, r.Code)
	})
}