From 7a56f6c703cd1c8b488aaa8da82bc8b816bfaa01 Mon Sep 17 00:00:00 2001 From: ayush00git Date: Sat, 12 Sep 2026 13:48:21 +0530 Subject: [PATCH] fix(tests): added resolve checks on GetPostByID checks --- test/helpers_test.go | 3 ++- test/post_get_test.go | 47 +++++++++++++++++++++++++++++++++++++++---- 2 files changed, 45 insertions(+), 5 deletions(-) diff --git a/test/helpers_test.go b/test/helpers_test.go index 7151976..d8b662a 100644 --- a/test/helpers_test.go +++ b/test/helpers_test.go @@ -148,7 +148,8 @@ func newPostRouter(db *gorm.DB, auth gin.HandlerFunc) *gin.Engine { e.GET("/api/posts/faculty", auth, h.GetFacultyPosts) e.GET("/api/posts/warden", auth, h.GetWardenPosts) e.GET("/api/posts/centrehead", auth, h.GetCentreheadPosts) - e.GET("/api/posts/:role/:post_id", auth, h.GetPostByID) + // public route, mirrors routes/post.go: no auth middleware. + e.GET("/api/posts/:role/:post_id", h.GetPostByID) e.POST("/api/posts/faculty/comment/:post_id", auth, h.FacultyPostComment) e.POST("/api/posts/warden/comment/:post_id", auth, h.WardenPostComment) diff --git a/test/post_get_test.go b/test/post_get_test.go index f639e9d..5810ba5 100644 --- a/test/post_get_test.go +++ b/test/post_get_test.go @@ -89,7 +89,7 @@ func TestFacultyPost_GetByID_NotFound(t *testing.T) { assertStatus(t, rec, 404) } -func TestFacultyPost_GetByID_WrongUser(t *testing.T) { +func TestFacultyPost_GetByID_OtherUserCanRead(t *testing.T) { db := newTestDB(t) f1 := seedFaculty(t, db, "fac1@iit.ac.in") f2 := seedFaculty(t, db, "fac2@iit.ac.in") @@ -103,10 +103,49 @@ func TestFacultyPost_GetByID_WrongUser(t *testing.T) { } db.Create(&post) - // User 2 tries to access User 1's post + // User 2 reads User 1's post: the route is public, so this succeeds. e := newPostRouter(db, authAs(f2.ID, f2.Email)) rec := doRequest(t, e, http.MethodGet, "/api/posts/faculty/1", nil) - // Should not find the post as it filters by user ID - assertStatus(t, rec, 404) + assertStatus(t, rec, 200) +} + +func TestFacultyPost_GetByID_Unauthenticated(t *testing.T) { + db := newTestDB(t) + f := seedFaculty(t, db, "fac.public@iit.ac.in") + + post := models.FacultyPost{ + FacultyID: f.ID, + Place: models.PlaceDepartmental, + TypeOfPost: models.TypeCivil, + Title: "Title 1", + Description: "Desc 1", + } + db.Create(&post) + + // No session at all: still readable, and the author comes back without secrets. + e := newPostRouter(db, noAuth()) + rec := doRequest(t, e, http.MethodGet, "/api/posts/faculty/1", nil) + + assertStatus(t, rec, 200) + + var res struct { + Post struct { + ID uint `json:"id"` + Author struct { + Name string `json:"name"` + Email string `json:"email"` + Password string `json:"password"` + } `json:"Author"` + } `json:"post"` + } + if err := json.Unmarshal(rec.Body.Bytes(), &res); err != nil { + t.Fatalf("failed to decode body: %v", err) + } + if res.Post.Author.Email != f.Email { + t.Fatalf("expected author email %q, got %q", f.Email, res.Post.Author.Email) + } + if res.Post.Author.Password != "" { + t.Fatalf("author password hash must not be returned, got %q", res.Post.Author.Password) + } }