Big changes

server/internal/api/release_test.go

@@ -0,0 +1,63 @@
+package api
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/ponzischeme89/memby/server/internal/config"
+)
+
+func TestReleasePublishAuth(t *testing.T) {
+	handler := func(w http.ResponseWriter, _ *http.Request) { w.WriteHeader(http.StatusNoContent) }
+
+	t.Run("disabled is hidden", func(t *testing.T) {
+		s := &Server{cfg: config.Config{}}
+		rec := httptest.NewRecorder()
+		s.releasePublishAuth(handler).ServeHTTP(
+			rec,
+			httptest.NewRequest(http.MethodPost, "/admin/api/release", nil),
+		)
+		if rec.Code != http.StatusNotFound {
+			t.Fatalf("got %d, want 404", rec.Code)
+		}
+	})
+
+	t.Run("valid bearer token is accepted", func(t *testing.T) {
+		s := &Server{cfg: config.Config{ReleasePublishToken: "release-secret"}}
+		rec := httptest.NewRecorder()
+		req := httptest.NewRequest(http.MethodPost, "/admin/api/release", nil)
+		req.Header.Set("Authorization", "Bearer release-secret")
+		s.releasePublishAuth(handler).ServeHTTP(rec, req)
+		if rec.Code != http.StatusNoContent {
+			t.Fatalf("got %d, want 204", rec.Code)
+		}
+	})
+}
+
+func TestReleaseDownloadOnlyServesVersionedAPKs(t *testing.T) {
+	dir := t.TempDir()
+	payload := []byte("PK signed apk")
+	if err := os.WriteFile(filepath.Join(dir, "memby-0.1.54.apk"), payload, 0o600); err != nil {
+		t.Fatal(err)
+	}
+	s := &Server{cfg: config.Config{ReleaseDir: dir}}
+
+	rec := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodGet, "/updates/memby-0.1.54.apk", nil)
+	req.SetPathValue("filename", "memby-0.1.54.apk")
+	s.handleReleaseDownload(rec, req)
+	if rec.Code != http.StatusOK || rec.Body.String() != string(payload) {
+		t.Fatalf("valid release response = %d %q", rec.Code, rec.Body.String())
+	}
+
+	rec = httptest.NewRecorder()
+	req = httptest.NewRequest(http.MethodGet, "/updates/../secrets", nil)
+	req.SetPathValue("filename", "../secrets")
+	s.handleReleaseDownload(rec, req)
+	if rec.Code != http.StatusNotFound {
+		t.Fatalf("invalid filename got %d, want 404", rec.Code)
+	}
+}