| 1 | package callstest |
| 2 | |
| 3 | import ( |
| 4 | "encoding/json" |
| 5 | "net/http" |
| 6 | "net/http/httptest" |
| 7 | "strings" |
| 8 | "testing" |
| 9 | ) |
| 10 | |
| 11 | func TestShareMeetingRequiresMemberAndKeepsInvitation(t *testing.T) { |
| 12 | x := newHarness(t, "paul@example.com", "bea@example.com") |
| 13 | creator := x.browser(t) |
| 14 | creator.signIn("paul@example.com") |
| 15 | sqid, token := createMeeting(t, creator, "Share this meeting", "") |
| 16 | member := x.browser(t) |
| 17 | member.signIn("bea@example.com") |
| 18 | route := "/m/" + sqid + "/share" |
| 19 | page := member.post(route, nil) |
| 20 | if page.Code != 200 || !strings.Contains(page.Body.String(), token) || page.Header().Get("Cache-Control") != "no-store" { |
| 21 | t.Fatalf("member share page: %d", page.Code) |
| 22 | } |
| 23 | req := httptest.NewRequest("POST", route, strings.NewReader(`{}`)) |
| 24 | req.Header.Set("Origin", testOrigin) |
| 25 | req.Header.Set("Accept", "application/json") |
| 26 | response := member.do(req) |
| 27 | var result struct { |
| 28 | URL string `json:"url"` |
| 29 | } |
| 30 | if response.Code != 200 || json.Unmarshal(response.Body.Bytes(), &result) != nil || result.URL != testOrigin+"/j/"+token { |
| 31 | t.Fatal("native share did not return the current invitation") |
| 32 | } |
| 33 | if response.Header().Get("Cache-Control") != "no-store" { |
| 34 | t.Fatal("native share may be cached") |
| 35 | } |
| 36 | outsider := x.browser(t) |
| 37 | outsider.get("/j/" + token) |
| 38 | outsider.signIn("guest@example.com") |
| 39 | if rec := outsider.get("/m/" + sqid + "/join"); rec.Code != 200 { |
| 40 | t.Fatalf("guest fixture: %d", rec.Code) |
| 41 | } |
| 42 | if rec := outsider.post(route, nil); rec.Code != http.StatusNotFound { |
| 43 | t.Fatalf("guest share: %d", rec.Code) |
| 44 | } |
| 45 | req = httptest.NewRequest("POST", route, nil) |
| 46 | req.Header.Set("Origin", "https://elsewhere.example") |
| 47 | if rec := member.do(req); rec.Code != http.StatusForbidden { |
| 48 | t.Fatalf("cross-site share: %d", rec.Code) |
| 49 | } |
| 50 | if rec := member.post("/m/not-a-meeting/share", nil); rec.Code != 404 { |
| 51 | t.Fatalf("missing meeting: %d", rec.Code) |
| 52 | } |
| 53 | creator.post("/meetings/"+sqid+"/end", nil) |
| 54 | if rec := member.post(route, nil); rec.Code != 404 { |
| 55 | t.Fatalf("ended share: %d", rec.Code) |
| 56 | } |
| 57 | } |
| 58 | |
amadan