lenso-api 0.1.28

HTTP API host crate for the Lenso backend framework.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112

use axum::body::Body;
use axum::http::{Request, StatusCode};
use lenso_api::build_router;
use platform_core::{AppConfig, AppContext, LoggingEventPublisher};
use std::sync::Arc;
use tower::ServiceExt;

fn app() -> axum::Router {
    let ctx = AppContext::new(
        AppConfig::from_env(),
        platform_core::DbPool::connect_lazy("postgres://localhost/lenso_test")
            .expect("lazy pool should build"),
        Arc::new(LoggingEventPublisher),
    );
    build_router(ctx)
}

/// A browser preflight for the config console's PUT must be allowed: the
/// `Access-Control-Allow-Methods` response header has to advertise PUT, or the
/// browser blocks the request before it ever reaches a handler.
#[tokio::test]
async fn preflight_allows_put_for_config_write() {
    let response = app()
        .oneshot(
            Request::builder()
                .method("OPTIONS")
                .uri("/admin/config/*/identity.password_reset_ttl_minutes")
                .header("origin", "http://localhost:5173")
                .header("access-control-request-method", "PUT")
                .header(
                    "access-control-request-headers",
                    "authorization,content-type",
                )
                .body(Body::empty())
                .expect("request builds"),
        )
        .await
        .expect("request completes");

    assert_eq!(response.status(), StatusCode::OK);
    let allow_methods = response
        .headers()
        .get("access-control-allow-methods")
        .and_then(|value| value.to_str().ok())
        .unwrap_or_default()
        .to_ascii_uppercase();
    assert!(
        allow_methods.contains("PUT"),
        "preflight must advertise PUT, got: {allow_methods:?}"
    );
}

#[tokio::test]
async fn preflight_allows_patch_for_remote_proxy() {
    let response = app()
        .oneshot(
            Request::builder()
                .method("OPTIONS")
                .uri("/modules/remote-crm/http/contacts/contact_1")
                .header("origin", "http://localhost:5173")
                .header("access-control-request-method", "PATCH")
                .header(
                    "access-control-request-headers",
                    "authorization,content-type",
                )
                .body(Body::empty())
                .expect("request builds"),
        )
        .await
        .expect("request completes");

    assert_eq!(response.status(), StatusCode::OK);
    let allow_methods = response
        .headers()
        .get("access-control-allow-methods")
        .and_then(|value| value.to_str().ok())
        .unwrap_or_default()
        .to_ascii_uppercase();
    assert!(
        allow_methods.contains("PATCH"),
        "preflight must advertise PATCH, got: {allow_methods:?}"
    );
}

/// The config console's DELETE (reset-to-default) must likewise be preflight-allowed.
#[tokio::test]
async fn preflight_allows_delete_for_config_reset() {
    let response = app()
        .oneshot(
            Request::builder()
                .method("OPTIONS")
                .uri("/admin/config/*/identity.password_reset_ttl_minutes")
                .header("origin", "http://localhost:5173")
                .header("access-control-request-method", "DELETE")
                .body(Body::empty())
                .expect("request builds"),
        )
        .await
        .expect("request completes");

    assert_eq!(response.status(), StatusCode::OK);
    let allow_methods = response
        .headers()
        .get("access-control-allow-methods")
        .and_then(|value| value.to_str().ok())
        .unwrap_or_default()
        .to_ascii_uppercase();
    assert!(
        allow_methods.contains("DELETE"),
        "preflight must advertise DELETE, got: {allow_methods:?}"
    );
}