http: regenerate setup link + force-logout

internal/server/http/users_test.go

@@ -7,6 +7,7 @@ import (
 	stdhttp "net/http"
 	"strings"
 	"testing"
+	"time"
 
 	"gitea.dcglab.co.uk/steve/restic-manager/internal/store"
 )
@@ -216,3 +217,61 @@ func TestAPIUserDisableRejectsLastAdmin(t *testing.T) {
 		t.Errorf("status: got %d want 409", res.StatusCode)
 	}
 }
+
+func TestAPIUserRegenerateSetup(t *testing.T) {
+	t.Parallel()
+	srv, ts, _ := rawTestServerWithUI(t)
+	adminID := makeUser(t, srv, "admin1", store.RoleAdmin)
+	target := makeUser(t, srv, "newbie", store.RoleViewer)
+	_ = srv.deps.Store.SetMustChangePassword(t.Context(), target, true)
+	_ = srv.deps.Store.SetSetupToken(t.Context(), store.SetupToken{
+		UserID: target, TokenHash: "old", ExpiresAt: time.Now().UTC().Add(time.Hour),
+		CreatedAt: time.Now().UTC(),
+	})
+	cookie := loginAs(t, srv, adminID)
+
+	req, _ := stdhttp.NewRequest("POST", ts.URL+"/api/users/"+target+"/regenerate-setup", nil)
+	req.AddCookie(cookie)
+	res, err := stdhttp.DefaultClient.Do(req)
+	if err != nil {
+		t.Fatalf("POST: %v", err)
+	}
+	defer res.Body.Close()
+	if res.StatusCode != stdhttp.StatusOK {
+		t.Errorf("status: got %d", res.StatusCode)
+	}
+	var got struct {
+		SetupURL string `json:"setup_url"`
+	}
+	_ = json.NewDecoder(res.Body).Decode(&got)
+	if !strings.Contains(got.SetupURL, "/setup?token=") {
+		t.Errorf("setup_url: %q", got.SetupURL)
+	}
+	if _, err := srv.deps.Store.LookupSetupToken(t.Context(), "old"); err == nil {
+		t.Error("old token should be replaced")
+	}
+}
+
+func TestAPIUserForceLogout(t *testing.T) {
+	t.Parallel()
+	srv, ts, _ := rawTestServerWithUI(t)
+	adminID := makeUser(t, srv, "admin1", store.RoleAdmin)
+	target := makeUser(t, srv, "victim", store.RoleOperator)
+	loginAs(t, srv, target) // create a session for the victim
+	cookie := loginAs(t, srv, adminID)
+
+	req, _ := stdhttp.NewRequest("POST", ts.URL+"/api/users/"+target+"/force-logout", nil)
+	req.AddCookie(cookie)
+	res, err := stdhttp.DefaultClient.Do(req)
+	if err != nil {
+		t.Fatalf("POST: %v", err)
+	}
+	defer res.Body.Close()
+	if res.StatusCode != stdhttp.StatusOK {
+		t.Errorf("status: got %d", res.StatusCode)
+	}
+	rr, _ := srv.deps.Store.DeleteSessionsByUserID(t.Context(), target)
+	if rr != 0 {
+		t.Errorf("expected 0 remaining sessions, got %d", rr)
+	}
+}