57 lines
1.8 KiB
Go
57 lines
1.8 KiB
Go
package httpapi
|
|
|
|
import (
|
|
"encoding/json"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
|
|
"calllinesystem/server/internal/config"
|
|
"calllinesystem/server/internal/model"
|
|
)
|
|
|
|
func TestDisplayBatchDTOCannotSerializePersonalFields(t *testing.T) {
|
|
batch := model.CallBatch{BatchSequence: 7, Status: "CALLED", CalledAt: time.Unix(100, 0).UTC()}
|
|
view := newDisplayBatchDTO(batch, []displayTicketDTO{{
|
|
TicketNumber: "00042", DisplayNumber: "00042", Status: model.TicketCalled,
|
|
}})
|
|
body, err := json.Marshal(view)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
encoded := string(body)
|
|
for _, forbidden := range []string{"honorific", "phone", "phone_last4", "last_name", "ticket_id", "joined_at", "created_by"} {
|
|
if strings.Contains(encoded, forbidden) {
|
|
t.Fatalf("public display DTO leaked forbidden field %q: %s", forbidden, encoded)
|
|
}
|
|
}
|
|
if !strings.Contains(encoded, `"ticket_number":"00042"`) {
|
|
t.Fatalf("public ticket number missing: %s", encoded)
|
|
}
|
|
}
|
|
|
|
func TestPublicPhoneLookupIsDisabledInProduction(t *testing.T) {
|
|
server := &Server{config: config.Config{Environment: "production"}}
|
|
recorder := httptest.NewRecorder()
|
|
request := httptest.NewRequest("POST", "/api/public/status/search", strings.NewReader(`{"phone":"13800138000"}`))
|
|
|
|
server.publicStatusByPhone(recorder, request)
|
|
|
|
if recorder.Code != 404 {
|
|
t.Fatalf("production phone lookup status = %d, want 404", recorder.Code)
|
|
}
|
|
}
|
|
|
|
func TestPublicPhoneLookupRejectsInvalidPhone(t *testing.T) {
|
|
server := &Server{config: config.Config{Environment: "development"}}
|
|
recorder := httptest.NewRecorder()
|
|
request := httptest.NewRequest("POST", "/api/public/status/search", strings.NewReader(`{"phone":"123"}`))
|
|
|
|
server.publicStatusByPhone(recorder, request)
|
|
|
|
if recorder.Code != 422 {
|
|
t.Fatalf("invalid phone lookup status = %d, want 422", recorder.Code)
|
|
}
|
|
}
|