feat: add user status and path permissions

2026-09-22 01:30:30 +08:00
parent eafc6c6499
commit 71757ec0fa
5 changed files with 163 additions and 16 deletions
@@ -76,6 +76,55 @@ func TestUserManagementAndPrivateHome(t *testing.T) {
 		t.Fatalf("private home access: %d %s", rr.Code, rr.Body.String())
 	}

+	// Admin can disable a managed user, which immediately invalidates token-based access.
+	updateBody, _ := json.Marshal(map[string]any{"username": "alice", "enabled": false})
+	req = httptest.NewRequest(http.MethodPut, "/chfs/users", bytes.NewReader(updateBody))
+	req.Header.Set("Content-Type", "application/json")
+	req.AddCookie(cookie)
+	rr = httptest.NewRecorder()
+	h.ServeHTTP(rr, req)
+	if rr.Code != http.StatusOK {
+		t.Fatalf("disable user: %d %s", rr.Code, rr.Body.String())
+	}
+	req = httptest.NewRequest(http.MethodPost, "/chfs/session", strings.NewReader("user=alice&pwd=alice-pass"))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	rr = httptest.NewRecorder()
+	h.ServeHTTP(rr, req)
+	if rr.Code == http.StatusCreated {
+		t.Fatal("disabled user was allowed to login")
+	}
+
+	// Re-enable and grant read-only access to a shared directory.
+	rules := []map[string]any{
+		{"dir": "users/alice", "mask": "rwd"},
+		{"dir": "public", "mask": "r"},
+	}
+	updateBody, _ = json.Marshal(map[string]any{"username": "alice", "enabled": true, "rules": rules})
+	req = httptest.NewRequest(http.MethodPut, "/chfs/users", bytes.NewReader(updateBody))
+	req.Header.Set("Content-Type", "application/json")
+	req.AddCookie(cookie)
+	rr = httptest.NewRecorder()
+	h.ServeHTTP(rr, req)
+	if rr.Code != http.StatusOK {
+		t.Fatalf("update rules: %d %s", rr.Code, rr.Body.String())
+	}
+	if err := os.MkdirAll(filepath.Join(root, "public"), 0755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(root, "public", "readme.txt"), []byte("ok"), 0644); err != nil {
+		t.Fatal(err)
+	}
+	token, err = auth.NewToken("alice", 30)
+	if err != nil {
+		t.Fatal(err)
+	}
+	req = httptest.NewRequest(http.MethodGet, "/chfs/files?filepath=public", nil)
+	req.AddCookie(&http.Cookie{Name: "JWT", Value: token})
+	rr = httptest.NewRecorder()
+	h.ServeHTTP(rr, req)
+	if rr.Code != http.StatusOK || !strings.Contains(rr.Body.String(), "\"currentMask\":\"R\"") {
+		t.Fatalf("shared read rule: %d %s", rr.Code, rr.Body.String())
+	}
 	var saved []map[string]any
 	data, err := os.ReadFile(usersFile)
 	if err != nil {