['user'],
+ name: string,
+ secret: string,
+) {
+ await user.type(await screen.findByLabelText(/username/i), name);
+ await user.type(screen.getByLabelText(/^password/i), secret);
+ await user.click(screen.getByRole('button', { name: 'Log in' }));
+}
+
+function acceptLogin() {
+ server.use(
+ http.post('*/pulp/api/v3/login/', () =>
+ HttpResponse.json(
+ { username: 'zoe', pulp_href: '/pulp/api/v3/users/1/' },
+ { status: 201 },
+ ),
+ ),
+ );
+}
+
// Two letters outside Latin-1, so a header encoded any other way than UTF-8 is
// told apart from a correct one.
const password = 'p\u0105\u0142-secret';
@@ -92,4 +120,92 @@ describe('login page', () => {
);
expect(screen.queryByText('Status page')).not.toBeInTheDocument();
});
+
+ it('a refused login for a user name with Polish letters shows the server message and raises no error', async () => {
+ // Polish letters outside Latin-1 in the user name: a header built any other
+ // way than from UTF-8 bytes throws before the request is sent.
+ const name = '\u017b\u00f3\u0142w-\u0107wik';
+ const unhandled: unknown[] = [];
+ const onUnhandled = (reason: unknown) => unhandled.push(reason);
+ process.on('unhandledRejection', onUnhandled);
+
+ const seen: { authorization: string | null }[] = [];
+ server.use(
+ http.post('*/pulp/api/v3/login/', ({ request }) => {
+ seen.push({ authorization: request.headers.get('authorization') });
+ return HttpResponse.json(
+ { detail: 'Invalid username/password.' },
+ { status: 401 },
+ );
+ }),
+ );
+
+ try {
+ const { user } = renderLogin();
+ await signIn(user, name, 'wrong');
+
+ await waitFor(() =>
+ expect(screen.getByText(/Invalid username\/password/)).toBeVisible(),
+ );
+ // Give a stray rejection the chance to surface before asserting.
+ await new Promise((resolve) => setTimeout(resolve, 20));
+ } finally {
+ process.off('unhandledRejection', onUnhandled);
+ }
+
+ expect(unhandled).toEqual([]);
+ expect(seen).toHaveLength(1);
+ expect(
+ Buffer.from(
+ (seen[0]?.authorization ?? '').slice('Basic '.length),
+ 'base64',
+ ).toString('utf8'),
+ ).toBe(`${name}:wrong`);
+ expect(screen.queryByText('Status page')).not.toBeInTheDocument();
+ });
+
+ it('an unreachable server shows that the server could not be reached', async () => {
+ server.use(http.post('*/pulp/api/v3/login/', () => HttpResponse.error()));
+
+ const { user } = renderLogin();
+ await signIn(user, 'zoe', 'secret');
+
+ await waitFor(() =>
+ expect(screen.getByText(/could not be reached/i)).toBeVisible(),
+ );
+ expect(screen.queryByText('Status page')).not.toBeInTheDocument();
+ });
+
+ it('the page offers no remember option and no plain-text storage warning', async () => {
+ renderLogin();
+
+ await screen.findByLabelText(/username/i);
+
+ expect(screen.queryByRole('checkbox')).not.toBeInTheDocument();
+ expect(screen.queryByText(/remember/i)).not.toBeInTheDocument();
+ expect(screen.queryByText(/plain.?text/i)).not.toBeInTheDocument();
+ expect(screen.queryByText(/stored/i)).not.toBeInTheDocument();
+ });
+
+ it('a protocol-relative next target is ignored and sign-in ends on the status page', async () => {
+ acceptLogin();
+
+ const { user } = renderLogin('/login/?next=//evil.example');
+ await signIn(user, 'zoe', 'secret');
+
+ await screen.findByText('Status page');
+ expect(screen.queryByTestId('location')).not.toBeInTheDocument();
+ });
+
+ it('a same-origin next path is honoured after sign-in', async () => {
+ acceptLogin();
+
+ const { user } = renderLogin('/login/?next=/file/repositories/');
+ await signIn(user, 'zoe', 'secret');
+
+ expect(await screen.findByTestId('location')).toHaveTextContent(
+ '/file/repositories/',
+ );
+ expect(screen.queryByText('Status page')).not.toBeInTheDocument();
+ });
});
diff --git a/src/user-context.test.tsx b/src/user-context.test.tsx
new file mode 100644
index 00000000..b62fd414
--- /dev/null
+++ b/src/user-context.test.tsx
@@ -0,0 +1,186 @@
+import { screen, waitFor } from '@testing-library/react';
+import { HttpResponse, http } from 'msw';
+import { useState } from 'react';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { renderWithProviders } from 'src/test-utils/render';
+import { server } from 'src/test-utils/server';
+import { useUserContext } from './user-context';
+
+const LOGIN_URL = '*/pulp/api/v3/login/';
+
+// Shows the session state and offers a logout button that reports how the
+// logout promise ended.
+function SessionProbe() {
+ const { status, user, logout } = useUserContext();
+ const [outcome, setOutcome] = useState('none');
+
+ return (
+ <>
+ {status}
+ {user?.username ?? 'nobody'}
+ {outcome}
+
+
+ );
+}
+
+// Starts the provider with the server reporting someone signed in.
+async function renderSignedIn() {
+ server.use(
+ http.get(LOGIN_URL, () =>
+ HttpResponse.json({
+ username: 'zoe',
+ pulp_href: '/pulp/api/v3/users/1/',
+ }),
+ ),
+ );
+ const rendered = renderWithProviders();
+ await waitFor(() =>
+ expect(screen.getByTestId('status')).toHaveTextContent('authenticated'),
+ );
+ return rendered;
+}
+
+describe('user context', () => {
+ afterEach(() => {
+ vi.restoreAllMocks();
+ });
+
+ it('on start it removes the legacy credentials keys from both storages without reading them and asks who is signed in', async () => {
+ window.localStorage.setItem('credentials', 'legacy-local-value');
+ window.sessionStorage.setItem('credentials', 'legacy-session-value');
+ const removed = [window.localStorage, window.sessionStorage].map(
+ (storage) => vi.spyOn(storage, 'removeItem'),
+ );
+
+ const asked: string[] = [];
+ server.use(
+ http.get(LOGIN_URL, ({ request }) => {
+ asked.push(`${request.method} ${new URL(request.url).pathname}`);
+ return HttpResponse.json(
+ { detail: 'Not authenticated.' },
+ { status: 401 },
+ );
+ }),
+ );
+
+ renderWithProviders();
+
+ await waitFor(() =>
+ expect(screen.getByTestId('status')).toHaveTextContent('anonymous'),
+ );
+
+ expect(window.localStorage.getItem('credentials')).toBeNull();
+ expect(window.sessionStorage.getItem('credentials')).toBeNull();
+ for (const spy of removed) {
+ expect(spy).toHaveBeenCalledWith('credentials');
+ }
+ expect(asked).toEqual(['GET /pulp/api/v3/login/']);
+ });
+
+ it('on start it never reads the legacy credentials key', async () => {
+ window.localStorage.setItem('credentials', 'legacy-local-value');
+ window.sessionStorage.setItem('credentials', 'legacy-session-value');
+ // The spies sit on the storage objects themselves, because the
+ // environment does not route calls through the Storage prototype.
+ const reads = [window.localStorage, window.sessionStorage].map((storage) =>
+ vi.spyOn(storage, 'getItem'),
+ );
+
+ renderWithProviders();
+ await waitFor(() =>
+ expect(screen.getByTestId('status')).not.toHaveTextContent('checking'),
+ );
+
+ for (const spy of reads) {
+ expect(spy.mock.calls.map(([key]) => key)).not.toContain('credentials');
+ }
+ });
+
+ it('a signed-in answer from the server makes the user authenticated', async () => {
+ await renderSignedIn();
+
+ expect(screen.getByTestId('user')).toHaveTextContent('zoe');
+ });
+
+ it('logout answered 204 ends signed out', async () => {
+ const { user } = await renderSignedIn();
+ server.use(
+ http.delete(LOGIN_URL, () => new HttpResponse(null, { status: 204 })),
+ );
+
+ await user.click(screen.getByRole('button', { name: 'Sign out' }));
+
+ await waitFor(() =>
+ expect(screen.getByTestId('status')).toHaveTextContent('anonymous'),
+ );
+ expect(screen.getByTestId('outcome')).toHaveTextContent('resolved');
+ expect(screen.getByTestId('user')).toHaveTextContent('nobody');
+ });
+
+ it('logout answered 401 ends signed out without a rejection', async () => {
+ const { user } = await renderSignedIn();
+ server.use(
+ http.delete(LOGIN_URL, () =>
+ HttpResponse.json({ detail: 'Not authenticated.' }, { status: 401 }),
+ ),
+ );
+
+ await user.click(screen.getByRole('button', { name: 'Sign out' }));
+
+ await waitFor(() =>
+ expect(screen.getByTestId('status')).toHaveTextContent('anonymous'),
+ );
+ expect(screen.getByTestId('outcome')).toHaveTextContent('resolved');
+ });
+
+ it('logout answered 403 keeps the user signed in and rejects with the server reason', async () => {
+ const { user } = await renderSignedIn();
+ server.use(
+ http.delete(LOGIN_URL, () =>
+ HttpResponse.json(
+ { detail: 'CSRF Failed: token missing.' },
+ { status: 403 },
+ ),
+ ),
+ );
+
+ await user.click(screen.getByRole('button', { name: 'Sign out' }));
+
+ await waitFor(() =>
+ expect(screen.getByTestId('outcome')).toHaveTextContent(
+ 'rejected: CSRF Failed: token missing.',
+ ),
+ );
+ expect(screen.getByTestId('status')).toHaveTextContent('authenticated');
+ expect(screen.getByTestId('user')).toHaveTextContent('zoe');
+ });
+
+ it('logout answered 500 keeps the user signed in and rejects with the server reason', async () => {
+ const { user } = await renderSignedIn();
+ server.use(
+ http.delete(LOGIN_URL, () =>
+ HttpResponse.json({ detail: 'Backend unavailable.' }, { status: 500 }),
+ ),
+ );
+
+ await user.click(screen.getByRole('button', { name: 'Sign out' }));
+
+ await waitFor(() =>
+ expect(screen.getByTestId('outcome')).toHaveTextContent(
+ 'rejected: Backend unavailable.',
+ ),
+ );
+ expect(screen.getByTestId('status')).toHaveTextContent('authenticated');
+ });
+});