add auth + remote nrepl

integration-test/integration_test.bb

@@ -18,6 +18,17 @@
 (defn head* [base-url]
   (http/head base-url {:throw false}))
 
+;; The login redirect points at Gitea; we want to see it, not follow it.
+(def no-redirect-client (http/client {:follow-redirects :never}))
+
+(defn get-no-redirect* [url]
+  (http/get url {:throw false :client no-redirect-client}))
+
+(defn post-json* [url body]
+  (http/post url {:throw false
+                  :headers {"Content-Type" "application/json"}
+                  :body body}))
+
 (defn wait-for-server [{:keys [base-url max-retries retry-delay-ms]}]
   (println (str "=== Waiting for server at " base-url " ==="))
   (loop [i 1]
@@ -122,6 +133,30 @@
       (assert-eq "Non-numeric x" 400 (:status (get* (str base-url "/api/add?x=abc&y=3"))))
       (println)
 
+      (println "Test 11: GET /auth/login redirects to Gitea's authorize page")
+      (let [resp (get-no-redirect* (str base-url "/auth/login"))
+            location (get (:headers resp) "location" "")]
+        (assert-eq "HTTP status" 302 (:status resp))
+        (assert-contains "Location" "/login/oauth/authorize?" location)
+        (assert-contains "Location has the client id" "client_id=integration-client" location)
+        (assert-contains "Location has a state" "state=" location)
+        (assert-contains "Session cookie is HttpOnly" "HttpOnly" (str (get (:headers resp) "set-cookie" ""))))
+      (println)
+
+      (println "Test 12: GET /auth/callback with no login in progress returns 400")
+      (assert-eq "HTTP status" 400 (:status (get-no-redirect* (str base-url "/auth/callback?code=x&state=y"))))
+      (println)
+
+      (println "Test 13: GET /auth/me without a session returns 401")
+      (assert-eq "HTTP status" 401 (:status (get* (str base-url "/auth/me"))))
+      (println)
+
+      (println "Test 14: POST /nrepl without a session returns 401 and starts nothing")
+      (assert-eq "Valid body" 401 (:status (post-json* (str base-url "/nrepl") "{\"enabled\":true}")))
+      (assert-eq "Invalid body (auth is checked first)" 401 (:status (post-json* (str base-url "/nrepl") "nope")))
+      (assert-eq "A query-string admin flag is no bypass" 401 (:status (post-json* (str base-url "/nrepl?admin=true") "{\"enabled\":true}")))
+      (println)
+
       (println "================================")
       (println (format "  Results: %d passed, %d failed" @pass @fail))
       (println "================================")