popertots
c2aa0b93cb
Add DELETE /api/admin/bookings/reserve to release admin walk-in/call-in reservations. New handler AdminCancelReservationHandler targets only RESERVATION:admin:% entries (partitioned from user RESERVATION:user:% by WHERE clause). Includes 12 tests covering walkin + callin success, isolation, no-op, unauth, empty ctx, walkin+callin coexistence, anon untouched, response format parity, overlapping reservations deleted, user reservations untouched, and idempotent double-cancel. Inverse-isolation tests in cancel_reservation_test.go prove the user-side DELETE /api/bookings/reserve does not touch admin or anon reservations.
450 lines
15 KiB
Go
450 lines
15 KiB
Go
//go:build test && dev
|
|
// +build test,dev
|
|
|
|
package bookings
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"fmt"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
"time"
|
|
|
|
"crussell/clock"
|
|
"crussell/mw"
|
|
"crussell/testutils"
|
|
"crussell/testutils/fixtures"
|
|
"crussell/testutils/jwt"
|
|
|
|
"github.com/go-chi/chi/v5"
|
|
)
|
|
|
|
// cancelReservationRequest creates and serves a DELETE /api/bookings/reserve request.
|
|
// The ctx carries the test transaction from SetupTestTx so the handler's
|
|
// db.Conn.Exec call routes through the same transaction.
|
|
// If userID is non-empty, it sets up the auth context (simulating RequireAuth).
|
|
func cancelReservationRequest(ctx context.Context, userID, role, token string) *httptest.ResponseRecorder {
|
|
req := httptest.NewRequest("DELETE", "/api/bookings/reserve", nil)
|
|
if token != "" {
|
|
req.Header.Set("Authorization", "Bearer "+token)
|
|
}
|
|
// Start with the test transaction context so db.Conn.Exec routes through it
|
|
rctx := chi.NewRouteContext()
|
|
reqCtx := context.WithValue(ctx, chi.RouteCtxKey, rctx)
|
|
if userID != "" {
|
|
reqCtx = context.WithValue(reqCtx, mw.UserIDKey, userID)
|
|
reqCtx = context.WithValue(reqCtx, mw.UserRoleKey, role)
|
|
}
|
|
req = req.WithContext(reqCtx)
|
|
|
|
w := httptest.NewRecorder()
|
|
http.HandlerFunc(CancelReservationHandler).ServeHTTP(w, req)
|
|
return w
|
|
}
|
|
|
|
// TestCancelReservation_Success creates a reservation for the user, cancels it,
|
|
// and verifies the time_blocker is deleted from the database.
|
|
func TestCancelReservation_Success(t *testing.T) {
|
|
t.Parallel()
|
|
ctx, tx := testutils.SetupTestTx(t)
|
|
|
|
userID, err := fixtures.CreateTestUser(tx)
|
|
if err != nil {
|
|
t.Fatalf("failed to create user: %v", err)
|
|
}
|
|
|
|
token := jwt.GenerateUserToken(userID)
|
|
startTime := clock.Now().Add(24 * time.Hour).Truncate(24 * time.Hour).Add(10 * time.Hour)
|
|
|
|
// Create a reservation for this user
|
|
_, err = tx.Exec(ctx, fmt.Sprintf(`
|
|
INSERT INTO time_blockers (start_time, duration_minutes, description, created_by)
|
|
VALUES ($1, 60, 'RESERVATION:user:%s:12345', $2)
|
|
`, userID), startTime, userID)
|
|
if err != nil {
|
|
t.Fatalf("failed to create reservation: %v", err)
|
|
}
|
|
|
|
// Verify reservation exists before cancel
|
|
var countBefore int
|
|
err = tx.QueryRow(ctx,
|
|
`SELECT COUNT(*) FROM time_blockers WHERE description LIKE 'RESERVATION:user:%' AND created_by = $1`,
|
|
userID,
|
|
).Scan(&countBefore)
|
|
if err != nil {
|
|
t.Fatalf("failed to count reservations before: %v", err)
|
|
}
|
|
if countBefore != 1 {
|
|
t.Fatalf("expected 1 reservation before cancel, got %d", countBefore)
|
|
}
|
|
|
|
// Call CancelReservationHandler
|
|
w := cancelReservationRequest(ctx, userID, "verified_email", token)
|
|
|
|
if w.Code != http.StatusOK {
|
|
t.Errorf("expected status 200, got %d. body: %s", w.Code, w.Body.String())
|
|
}
|
|
|
|
// Parse response
|
|
var resp map[string]string
|
|
if err := json.Unmarshal(w.Body.Bytes(), &resp); err != nil {
|
|
t.Fatalf("failed to parse response: %v", err)
|
|
}
|
|
if resp["status"] != "reservation cancelled" {
|
|
t.Errorf("expected status 'reservation cancelled', got %q", resp["status"])
|
|
}
|
|
|
|
// Verify reservation was deleted
|
|
var countAfter int
|
|
err = tx.QueryRow(ctx,
|
|
`SELECT COUNT(*) FROM time_blockers WHERE description LIKE 'RESERVATION:user:%' AND created_by = $1`,
|
|
userID,
|
|
).Scan(&countAfter)
|
|
if err != nil {
|
|
t.Fatalf("failed to count reservations after: %v", err)
|
|
}
|
|
if countAfter != 0 {
|
|
t.Errorf("expected 0 reservations after cancel, got %d", countAfter)
|
|
}
|
|
}
|
|
|
|
// TestCancelReservation_NoActiveReservation verifies that calling cancel
|
|
// without an active reservation returns 200 (idempotent, no error).
|
|
func TestCancelReservation_NoActiveReservation(t *testing.T) {
|
|
t.Parallel()
|
|
ctx, tx := testutils.SetupTestTx(t)
|
|
|
|
userID, err := fixtures.CreateTestUser(tx)
|
|
if err != nil {
|
|
t.Fatalf("failed to create user: %v", err)
|
|
}
|
|
|
|
token := jwt.GenerateUserToken(userID)
|
|
|
|
// Verify no reservations exist
|
|
var countBefore int
|
|
err = tx.QueryRow(ctx,
|
|
`SELECT COUNT(*) FROM time_blockers WHERE description LIKE 'RESERVATION:user:%' AND created_by = $1`,
|
|
userID,
|
|
).Scan(&countBefore)
|
|
if err != nil {
|
|
t.Fatalf("failed to count reservations before: %v", err)
|
|
}
|
|
if countBefore != 0 {
|
|
t.Fatalf("expected 0 reservations before cancel, got %d", countBefore)
|
|
}
|
|
|
|
// Call CancelReservationHandler
|
|
w := cancelReservationRequest(ctx, userID, "verified_email", token)
|
|
|
|
if w.Code != http.StatusOK {
|
|
t.Errorf("expected status 200 (idempotent), got %d. body: %s", w.Code, w.Body.String())
|
|
}
|
|
|
|
// Verify still no reservations
|
|
var countAfter int
|
|
err = tx.QueryRow(ctx,
|
|
`SELECT COUNT(*) FROM time_blockers WHERE description LIKE 'RESERVATION:user:%' AND created_by = $1`,
|
|
userID,
|
|
).Scan(&countAfter)
|
|
if err != nil {
|
|
t.Fatalf("failed to count reservations after: %v", err)
|
|
}
|
|
if countAfter != 0 {
|
|
t.Errorf("expected 0 reservations after cancel, got %d", countAfter)
|
|
}
|
|
}
|
|
|
|
// TestCancelReservation_Unauthenticated verifies that calling the handler
|
|
// without a valid user in context returns 401 Unauthorized.
|
|
func TestCancelReservation_Unauthenticated(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
w := cancelReservationRequest(context.Background(), "", "", "")
|
|
|
|
if w.Code != http.StatusUnauthorized {
|
|
t.Errorf("expected status 401 for unauthenticated request, got %d. body: %s", w.Code, w.Body.String())
|
|
}
|
|
}
|
|
|
|
// TestCancelReservation_EmptyUserIDInContext verifies that having a context
|
|
// with an empty userID string is treated as unauthenticated.
|
|
func TestCancelReservation_EmptyUserIDInContext(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
w := cancelReservationRequest(context.Background(), "", "verified_email", "")
|
|
|
|
if w.Code != http.StatusUnauthorized {
|
|
t.Errorf("expected status 401 for empty userID in context, got %d. body: %s", w.Code, w.Body.String())
|
|
}
|
|
}
|
|
|
|
// TestCancelReservation_DeletesOnlyOwnUserReservation verifies that cancelling
|
|
// only deletes the requesting user's reservation, not another user's.
|
|
func TestCancelReservation_DeletesOnlyOwnUserReservation(t *testing.T) {
|
|
t.Parallel()
|
|
ctx, tx := testutils.SetupTestTx(t)
|
|
|
|
user1ID, err := fixtures.CreateTestUser(tx)
|
|
if err != nil {
|
|
t.Fatalf("failed to create user1: %v", err)
|
|
}
|
|
user2ID, err := fixtures.CreateTestUser(tx)
|
|
if err != nil {
|
|
t.Fatalf("failed to create user2: %v", err)
|
|
}
|
|
|
|
token1 := jwt.GenerateUserToken(user1ID)
|
|
startTime := clock.Now().Add(24 * time.Hour).Truncate(24 * time.Hour).Add(10 * time.Hour)
|
|
|
|
// Create reservation for user1
|
|
_, err = tx.Exec(ctx, fmt.Sprintf(`
|
|
INSERT INTO time_blockers (start_time, duration_minutes, description, created_by)
|
|
VALUES ($1, 60, 'RESERVATION:user:%s:11111', $2)
|
|
`, user1ID), startTime, user1ID)
|
|
if err != nil {
|
|
t.Fatalf("failed to create user1 reservation: %v", err)
|
|
}
|
|
|
|
// Create reservation for user2
|
|
_, err = tx.Exec(ctx, fmt.Sprintf(`
|
|
INSERT INTO time_blockers (start_time, duration_minutes, description, created_by)
|
|
VALUES ($1, 60, 'RESERVATION:user:%s:22222', $2)
|
|
`, user2ID), startTime, user2ID)
|
|
if err != nil {
|
|
t.Fatalf("failed to create user2 reservation: %v", err)
|
|
}
|
|
|
|
// Call CancelReservationHandler as user1
|
|
w := cancelReservationRequest(ctx, user1ID, "verified_email", token1)
|
|
|
|
if w.Code != http.StatusOK {
|
|
t.Errorf("expected status 200, got %d. body: %s", w.Code, w.Body.String())
|
|
}
|
|
|
|
// Verify user1's reservation is gone
|
|
var user1Count int
|
|
err = tx.QueryRow(ctx,
|
|
`SELECT COUNT(*) FROM time_blockers WHERE description LIKE 'RESERVATION:user:%' AND created_by = $1`,
|
|
user1ID,
|
|
).Scan(&user1Count)
|
|
if err != nil {
|
|
t.Fatalf("failed to count user1 reservations: %v", err)
|
|
}
|
|
if user1Count != 0 {
|
|
t.Errorf("expected user1 reservations to be deleted, got %d", user1Count)
|
|
}
|
|
|
|
// Verify user2's reservation still exists
|
|
var user2Count int
|
|
err = tx.QueryRow(ctx,
|
|
`SELECT COUNT(*) FROM time_blockers WHERE description LIKE 'RESERVATION:user:%' AND created_by = $1`,
|
|
user2ID,
|
|
).Scan(&user2Count)
|
|
if err != nil {
|
|
t.Fatalf("failed to count user2 reservations: %v", err)
|
|
}
|
|
if user2Count != 1 {
|
|
t.Errorf("expected user2 reservation to survive, got %d", user2Count)
|
|
}
|
|
}
|
|
|
|
// TestCancelReservation_CleanIdempotent verifies calling cancel twice
|
|
// is safe (second call also succeeds, no error).
|
|
func TestCancelReservation_CleanIdempotent(t *testing.T) {
|
|
t.Parallel()
|
|
ctx, tx := testutils.SetupTestTx(t)
|
|
|
|
userID, err := fixtures.CreateTestUser(tx)
|
|
if err != nil {
|
|
t.Fatalf("failed to create user: %v", err)
|
|
}
|
|
|
|
token := jwt.GenerateUserToken(userID)
|
|
startTime := clock.Now().Add(24 * time.Hour).Truncate(24 * time.Hour).Add(10 * time.Hour)
|
|
|
|
// Create a reservation for this user
|
|
_, err = tx.Exec(ctx, fmt.Sprintf(`
|
|
INSERT INTO time_blockers (start_time, duration_minutes, description, created_by)
|
|
VALUES ($1, 60, 'RESERVATION:user:%s:99999', $2)
|
|
`, userID), startTime, userID)
|
|
if err != nil {
|
|
t.Fatalf("failed to create reservation: %v", err)
|
|
}
|
|
|
|
// First cancel
|
|
w1 := cancelReservationRequest(ctx, userID, "verified_email", token)
|
|
if w1.Code != http.StatusOK {
|
|
t.Fatalf("first cancel: expected 200, got %d. body: %s", w1.Code, w1.Body.String())
|
|
}
|
|
|
|
// Second cancel (no reservation left)
|
|
w2 := cancelReservationRequest(ctx, userID, "verified_email", token)
|
|
if w2.Code != http.StatusOK {
|
|
t.Errorf("second cancel (idempotent): expected 200, got %d. body: %s", w2.Code, w2.Body.String())
|
|
}
|
|
|
|
// Verify no reservations remain
|
|
var count int
|
|
err = tx.QueryRow(ctx,
|
|
`SELECT COUNT(*) FROM time_blockers WHERE description LIKE 'RESERVATION:user:%' AND created_by = $1`,
|
|
userID,
|
|
).Scan(&count)
|
|
if err != nil {
|
|
t.Fatalf("failed to count reservations: %v", err)
|
|
}
|
|
if count != 0 {
|
|
t.Errorf("expected 0 reservations after two cancels, got %d", count)
|
|
}
|
|
}
|
|
|
|
// TestCancelReservation_DoesNotTouchAnonReservations verifies that the user
|
|
// cancel handler only targets RESERVATION:user:% — it must NEVER touch
|
|
// RESERVATION:anon:% entries (which belong to the pre-auth reservation flow
|
|
// with a hashed-IP created_by = NULL).
|
|
//
|
|
// Anon reservations are cleaned up by the next reserve attempt via the
|
|
// pre-overlap DELETE in reserve.go. A separate endpoint (or TTL) handles
|
|
// them — user cancel must not interfere.
|
|
func TestCancelReservation_DoesNotTouchAnonReservations(t *testing.T) {
|
|
t.Parallel()
|
|
ctx, tx := testutils.SetupTestTx(t)
|
|
|
|
userID, err := fixtures.CreateTestUser(tx)
|
|
if err != nil {
|
|
t.Fatalf("failed to create user: %v", err)
|
|
}
|
|
|
|
token := jwt.GenerateUserToken(userID)
|
|
userStart := clock.Now().Add(24 * time.Hour).Truncate(24 * time.Hour).Add(10 * time.Hour)
|
|
anonStart := clock.Now().Add(24 * time.Hour).Truncate(24 * time.Hour).Add(14 * time.Hour)
|
|
|
|
// Create a user reservation
|
|
_, err = tx.Exec(ctx, fmt.Sprintf(`
|
|
INSERT INTO time_blockers (start_time, duration_minutes, description, created_by)
|
|
VALUES ($1, 60, 'RESERVATION:user:%s:11111', $2)
|
|
`, userID), userStart, userID)
|
|
if err != nil {
|
|
t.Fatalf("failed to create user reservation: %v", err)
|
|
}
|
|
|
|
// Create an anon reservation (created_by = NULL, description RESERVATION:anon:%)
|
|
_, err = tx.Exec(ctx, `
|
|
INSERT INTO time_blockers (start_time, duration_minutes, description, created_by)
|
|
VALUES ($1, 60, 'RESERVATION:anon:abc12345:22222', NULL)
|
|
`, anonStart)
|
|
if err != nil {
|
|
t.Fatalf("failed to create anon reservation: %v", err)
|
|
}
|
|
|
|
// Call user cancel
|
|
w := cancelReservationRequest(ctx, userID, "verified_email", token)
|
|
if w.Code != http.StatusOK {
|
|
t.Fatalf("expected status 200, got %d. body: %s", w.Code, w.Body.String())
|
|
}
|
|
|
|
// Verify user reservation is gone
|
|
var userCount int
|
|
err = tx.QueryRow(ctx,
|
|
`SELECT COUNT(*) FROM time_blockers WHERE description LIKE 'RESERVATION:user:%' AND created_by = $1`,
|
|
userID,
|
|
).Scan(&userCount)
|
|
if err != nil {
|
|
t.Fatalf("failed to count user reservations: %v", err)
|
|
}
|
|
if userCount != 0 {
|
|
t.Errorf("expected user reservation to be deleted, got %d", userCount)
|
|
}
|
|
|
|
// Verify anon reservation is untouched
|
|
var anonCount int
|
|
err = tx.QueryRow(ctx,
|
|
`SELECT COUNT(*) FROM time_blockers WHERE description LIKE 'RESERVATION:anon:%'`,
|
|
).Scan(&anonCount)
|
|
if err != nil {
|
|
t.Fatalf("failed to count anon reservations: %v", err)
|
|
}
|
|
if anonCount != 1 {
|
|
t.Errorf("expected anon reservation to survive user cancel (separate flow), got %d", anonCount)
|
|
}
|
|
}
|
|
|
|
// TestCancelReservation_DoesNotTouchAdminReservations verifies that the user
|
|
// cancel handler only targets RESERVATION:user:% — it must NEVER touch
|
|
// RESERVATION:admin:% entries (which belong to the admin walk-in/call-in
|
|
// reservation flow with the admin's user ID as created_by).
|
|
//
|
|
// This is the inverse guarantee of TestAdminCancelReservation_DoesNotDeleteUserReservations
|
|
// and verifies the two endpoints are properly partitioned by the WHERE clause.
|
|
func TestCancelReservation_DoesNotTouchAdminReservations(t *testing.T) {
|
|
t.Parallel()
|
|
ctx, tx := testutils.SetupTestTx(t)
|
|
|
|
userID, err := fixtures.CreateTestUser(tx)
|
|
if err != nil {
|
|
t.Fatalf("failed to create user: %v", err)
|
|
}
|
|
|
|
adminID, err := fixtures.CreateTestAdminUser(tx)
|
|
if err != nil {
|
|
t.Fatalf("failed to create admin: %v", err)
|
|
}
|
|
defer fixtures.DeleteUser(tx, adminID)
|
|
|
|
token := jwt.GenerateUserToken(userID)
|
|
userStart := clock.Now().Add(24 * time.Hour).Truncate(24 * time.Hour).Add(10 * time.Hour)
|
|
adminStart := clock.Now().Add(24 * time.Hour).Truncate(24 * time.Hour).Add(14 * time.Hour)
|
|
|
|
// Create a user reservation
|
|
_, err = tx.Exec(ctx, fmt.Sprintf(`
|
|
INSERT INTO time_blockers (start_time, duration_minutes, description, created_by)
|
|
VALUES ($1, 60, 'RESERVATION:user:%s:33333', $2)
|
|
`, userID), userStart, userID)
|
|
if err != nil {
|
|
t.Fatalf("failed to create user reservation: %v", err)
|
|
}
|
|
|
|
// Create an admin reservation
|
|
_, err = tx.Exec(ctx, `
|
|
INSERT INTO time_blockers (start_time, duration_minutes, description, created_by)
|
|
VALUES ($1, 60, 'RESERVATION:admin:walkin:guest:44444', $2)
|
|
`, adminStart, adminID)
|
|
if err != nil {
|
|
t.Fatalf("failed to create admin reservation: %v", err)
|
|
}
|
|
|
|
// Call user cancel as the user (NOT as the admin)
|
|
w := cancelReservationRequest(ctx, userID, "verified_email", token)
|
|
if w.Code != http.StatusOK {
|
|
t.Fatalf("expected status 200, got %d. body: %s", w.Code, w.Body.String())
|
|
}
|
|
|
|
// Verify user reservation is gone
|
|
var userCount int
|
|
err = tx.QueryRow(ctx,
|
|
`SELECT COUNT(*) FROM time_blockers WHERE description LIKE 'RESERVATION:user:%' AND created_by = $1`,
|
|
userID,
|
|
).Scan(&userCount)
|
|
if err != nil {
|
|
t.Fatalf("failed to count user reservations: %v", err)
|
|
}
|
|
if userCount != 0 {
|
|
t.Errorf("expected user reservation to be deleted, got %d", userCount)
|
|
}
|
|
|
|
// Verify admin reservation is untouched
|
|
var adminCount int
|
|
err = tx.QueryRow(ctx,
|
|
`SELECT COUNT(*) FROM time_blockers WHERE description LIKE 'RESERVATION:admin:%' AND created_by = $1`,
|
|
adminID,
|
|
).Scan(&adminCount)
|
|
if err != nil {
|
|
t.Fatalf("failed to count admin reservations: %v", err)
|
|
}
|
|
if adminCount != 1 {
|
|
t.Errorf("expected admin reservation to survive user cancel (different endpoint), got %d", adminCount)
|
|
}
|
|
}
|