feat(api): admin user management endpoints with audit log (0.38.0)
Adds /api/v1/admin/users list / DELETE / PATCH guarded by RequireAdmin, plus the audit-log substrate every future destructive admin endpoint will reuse. Safety properties: - Cannot self-delete or self-demote (409 conflict, message calls out "yourself" so the UI can render an explanation). - Cannot remove the last admin via either DELETE or demote. The check takes pg_advisory_xact_lock(ADMIN_INVARIANT_LOCK_KEY) and re-counts admins inside the same tx, closing the parallel-demote race that a bare "if count > 1" check would let through. The HTTP-serial path to this guard is structurally unreachable (the actor would have to be the lone admin demoting themselves, which the self-guard fires on first); the parallel race test exercises it via repo calls. Audit log (admin_audit table) records the action inside the same tx as the action itself, so a rolled-back action never leaves an orphan audit row. actor_user_id is ON DELETE SET NULL so the log outlives a later-deleted admin. target_id is not a FK because future audit kinds will target non-user rows.
This commit is contained in:
MechaCat02
368
backend/tests/api_admin_users.rs
Normal file
368
backend/tests/api_admin_users.rs
Normal file
@@ -0,0 +1,368 @@
|
||||
//! PR 2 (feat/admin-users-api) integration tests.
|
||||
//!
|
||||
//! Exercises list / delete / promote-demote on /api/v1/admin/users:
|
||||
//! pagination + search, the RequireAdmin gate, self-protection,
|
||||
//! last-admin invariant (including the parallel-demote race that
|
||||
//! `pg_advisory_xact_lock` + recount-inside-tx guards against), and
|
||||
//! that audit rows land in `admin_audit` only on successful commit.
|
||||
//!
|
||||
//! Note on the last-admin invariant: the *serial* path via HTTP is
|
||||
//! structurally unreachable — the only configuration that would hit the
|
||||
//! "would orphan admins" branch requires the actor to be the lone admin
|
||||
//! demoting themselves, which the self-guard fires on first. So the
|
||||
//! last-admin checks below call the repo directly to exercise the
|
||||
//! invariant; the HTTP race scenario is covered by
|
||||
//! `parallel_demotes_cannot_orphan_admins`.
|
||||
|
||||
mod common;
|
||||
|
||||
use axum::http::StatusCode;
|
||||
use axum::Router;
|
||||
use serde_json::json;
|
||||
use sqlx::PgPool;
|
||||
use tower::ServiceExt;
|
||||
use uuid::Uuid;
|
||||
|
||||
use mangalord::error::AppError;
|
||||
use mangalord::repo;
|
||||
|
||||
/// Register a user via the public API and immediately promote them via
|
||||
/// the repo. Returns (username, session cookie, user_id) — the common
|
||||
/// "I need a logged-in admin" prelude.
|
||||
async fn seed_admin(pool: &PgPool, app: &Router) -> (String, String, Uuid) {
|
||||
let (username, cookie) = common::register_user(app).await;
|
||||
let u = repo::user::find_by_username(pool, &username)
|
||||
.await
|
||||
.unwrap()
|
||||
.unwrap();
|
||||
repo::user::set_is_admin(pool, u.id, true).await.unwrap();
|
||||
(username, cookie, u.id)
|
||||
}
|
||||
|
||||
// ---- RequireAdmin gate -----------------------------------------------------
|
||||
|
||||
#[sqlx::test(migrations = "./migrations")]
|
||||
async fn list_requires_admin(pool: PgPool) {
|
||||
let h = common::harness(pool);
|
||||
let (_username, cookie) = common::register_user(&h.app).await;
|
||||
let resp = h
|
||||
.app
|
||||
.oneshot(common::get_with_cookie("/api/v1/admin/users", &cookie))
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(resp.status(), StatusCode::FORBIDDEN);
|
||||
}
|
||||
|
||||
#[sqlx::test(migrations = "./migrations")]
|
||||
async fn delete_requires_admin(pool: PgPool) {
|
||||
let h = common::harness(pool);
|
||||
let (_username, cookie) = common::register_user(&h.app).await;
|
||||
let resp = h
|
||||
.app
|
||||
.oneshot(common::delete_with_cookie(
|
||||
&format!("/api/v1/admin/users/{}", Uuid::new_v4()),
|
||||
&cookie,
|
||||
))
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(resp.status(), StatusCode::FORBIDDEN);
|
||||
}
|
||||
|
||||
#[sqlx::test(migrations = "./migrations")]
|
||||
async fn patch_requires_admin(pool: PgPool) {
|
||||
let h = common::harness(pool);
|
||||
let (_username, cookie) = common::register_user(&h.app).await;
|
||||
let resp = h
|
||||
.app
|
||||
.oneshot(common::patch_json_with_cookie(
|
||||
&format!("/api/v1/admin/users/{}", Uuid::new_v4()),
|
||||
json!({ "is_admin": true }),
|
||||
&cookie,
|
||||
))
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(resp.status(), StatusCode::FORBIDDEN);
|
||||
}
|
||||
|
||||
// ---- list with search and pagination ---------------------------------------
|
||||
|
||||
#[sqlx::test(migrations = "./migrations")]
|
||||
async fn list_returns_paginated_users(pool: PgPool) {
|
||||
let h = common::harness(pool.clone());
|
||||
let (_admin_name, cookie, _) = seed_admin(&pool, &h.app).await;
|
||||
let _u1 = common::register_user(&h.app).await;
|
||||
let _u2 = common::register_user(&h.app).await;
|
||||
let _u3 = common::register_user(&h.app).await;
|
||||
|
||||
let resp = h
|
||||
.app
|
||||
.oneshot(common::get_with_cookie(
|
||||
"/api/v1/admin/users?limit=2&offset=0",
|
||||
&cookie,
|
||||
))
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(resp.status(), StatusCode::OK);
|
||||
let body = common::body_json(resp).await;
|
||||
let items = body["items"].as_array().expect("items array");
|
||||
assert_eq!(items.len(), 2, "limit=2 should cap the page");
|
||||
assert_eq!(body["page"]["limit"], 2);
|
||||
assert_eq!(body["page"]["offset"], 0);
|
||||
assert_eq!(body["page"]["total"], 4);
|
||||
assert!(items[0].get("is_admin").is_some());
|
||||
assert!(
|
||||
items[0].get("password_hash").is_none(),
|
||||
"password_hash must never leak even to other admins"
|
||||
);
|
||||
}
|
||||
|
||||
#[sqlx::test(migrations = "./migrations")]
|
||||
async fn list_filters_by_substring_search(pool: PgPool) {
|
||||
let h = common::harness(pool.clone());
|
||||
let (_admin_name, cookie, _) = seed_admin(&pool, &h.app).await;
|
||||
let resp = h
|
||||
.app
|
||||
.clone()
|
||||
.oneshot(common::post_json(
|
||||
"/api/v1/auth/register",
|
||||
json!({ "username": "zzzfindme01", "password": "hunter2hunter2" }),
|
||||
))
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(resp.status(), StatusCode::CREATED);
|
||||
|
||||
let resp = h
|
||||
.app
|
||||
.oneshot(common::get_with_cookie(
|
||||
"/api/v1/admin/users?search=zzzfindme",
|
||||
&cookie,
|
||||
))
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(resp.status(), StatusCode::OK);
|
||||
let body = common::body_json(resp).await;
|
||||
let items = body["items"].as_array().unwrap();
|
||||
assert_eq!(items.len(), 1, "search must narrow to the one match");
|
||||
assert_eq!(items[0]["username"], "zzzfindme01");
|
||||
assert_eq!(body["page"]["total"], 1);
|
||||
}
|
||||
|
||||
// ---- self-protection -------------------------------------------------------
|
||||
|
||||
#[sqlx::test(migrations = "./migrations")]
|
||||
async fn cannot_self_delete(pool: PgPool) {
|
||||
let h = common::harness(pool.clone());
|
||||
let (_username, cookie, actor_id) = seed_admin(&pool, &h.app).await;
|
||||
// Second admin so the last-admin guard isn't what triggers the conflict.
|
||||
let (_other, _, _) = seed_admin(&pool, &h.app).await;
|
||||
|
||||
let resp = h
|
||||
.app
|
||||
.oneshot(common::delete_with_cookie(
|
||||
&format!("/api/v1/admin/users/{actor_id}"),
|
||||
&cookie,
|
||||
))
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(resp.status(), StatusCode::CONFLICT);
|
||||
let body = common::body_json(resp).await;
|
||||
assert_eq!(body["error"]["code"], "conflict");
|
||||
assert!(
|
||||
body["error"]["message"]
|
||||
.as_str()
|
||||
.unwrap()
|
||||
.contains("yourself"),
|
||||
"message must call out the self-action; got {:?}",
|
||||
body["error"]["message"]
|
||||
);
|
||||
}
|
||||
|
||||
#[sqlx::test(migrations = "./migrations")]
|
||||
async fn cannot_self_demote(pool: PgPool) {
|
||||
let h = common::harness(pool.clone());
|
||||
let (_username, cookie, actor_id) = seed_admin(&pool, &h.app).await;
|
||||
let (_other, _, _) = seed_admin(&pool, &h.app).await;
|
||||
|
||||
let resp = h
|
||||
.app
|
||||
.oneshot(common::patch_json_with_cookie(
|
||||
&format!("/api/v1/admin/users/{actor_id}"),
|
||||
json!({ "is_admin": false }),
|
||||
&cookie,
|
||||
))
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(resp.status(), StatusCode::CONFLICT);
|
||||
let body = common::body_json(resp).await;
|
||||
assert!(body["error"]["message"]
|
||||
.as_str()
|
||||
.unwrap()
|
||||
.contains("yourself"));
|
||||
}
|
||||
|
||||
// ---- last-admin invariant (repo layer, see file header) --------------------
|
||||
|
||||
#[sqlx::test(migrations = "./migrations")]
|
||||
async fn last_admin_demote_refused_at_repo(pool: PgPool) {
|
||||
let h = common::harness(pool.clone());
|
||||
let (_a, _, a_id) = seed_admin(&pool, &h.app).await;
|
||||
let (_b, _, b_id) = seed_admin(&pool, &h.app).await;
|
||||
|
||||
// admins = {A, B}. Demote A via B (count 2 → 1) — allowed.
|
||||
let r = repo::user::admin_safe_set_is_admin(&pool, b_id, a_id, false)
|
||||
.await
|
||||
.expect("first demote succeeds");
|
||||
assert!(!r.is_admin);
|
||||
|
||||
// admins = {B}. Try to demote B via A (actor doesn't matter to the
|
||||
// repo — that's the HTTP gate's job). Last-admin guard kicks in.
|
||||
let err = repo::user::admin_safe_set_is_admin(&pool, a_id, b_id, false)
|
||||
.await
|
||||
.expect_err("second demote must be refused");
|
||||
match err {
|
||||
AppError::Conflict(m) => assert!(
|
||||
m.contains("last admin"),
|
||||
"expected last-admin conflict; got {m:?}"
|
||||
),
|
||||
other => panic!("expected Conflict, got {other:?}"),
|
||||
}
|
||||
}
|
||||
|
||||
#[sqlx::test(migrations = "./migrations")]
|
||||
async fn last_admin_delete_refused_at_repo(pool: PgPool) {
|
||||
let h = common::harness(pool.clone());
|
||||
let (_a, _, a_id) = seed_admin(&pool, &h.app).await;
|
||||
let (_b, _, b_id) = seed_admin(&pool, &h.app).await;
|
||||
|
||||
// admins = {A, B}. Delete A via B (count 2 → 1) — allowed.
|
||||
repo::user::admin_safe_delete(&pool, b_id, a_id)
|
||||
.await
|
||||
.expect("first delete succeeds");
|
||||
|
||||
// admins = {B}. Try to delete B via a fresh non-admin actor. Last-
|
||||
// admin guard kicks in.
|
||||
let (_c, _, c_id) = {
|
||||
let (cn, _ck) = common::register_user(&h.app).await;
|
||||
let c = repo::user::find_by_username(&pool, &cn).await.unwrap().unwrap();
|
||||
(cn, _ck, c.id)
|
||||
};
|
||||
let err = repo::user::admin_safe_delete(&pool, c_id, b_id)
|
||||
.await
|
||||
.expect_err("second delete must be refused");
|
||||
match err {
|
||||
AppError::Conflict(m) => assert!(
|
||||
m.contains("last admin"),
|
||||
"expected last-admin conflict; got {m:?}"
|
||||
),
|
||||
other => panic!("expected Conflict, got {other:?}"),
|
||||
}
|
||||
}
|
||||
|
||||
#[sqlx::test(migrations = "./migrations")]
|
||||
async fn parallel_demotes_cannot_orphan_admins(pool: PgPool) {
|
||||
// The race the advisory lock + recount exists to close: two parallel
|
||||
// demotes of two DIFFERENT admins, each reading `count = 2` and
|
||||
// committing, would land at zero admins. With the lock the second
|
||||
// demote sees count = 1 inside the tx and refuses.
|
||||
let h = common::harness(pool.clone());
|
||||
let (_a, _, a_id) = seed_admin(&pool, &h.app).await;
|
||||
let (_b, _, b_id) = seed_admin(&pool, &h.app).await;
|
||||
|
||||
let pool_x = pool.clone();
|
||||
let pool_y = pool.clone();
|
||||
let task_x = tokio::spawn(async move {
|
||||
repo::user::admin_safe_set_is_admin(&pool_x, a_id, b_id, false).await
|
||||
});
|
||||
let task_y = tokio::spawn(async move {
|
||||
repo::user::admin_safe_set_is_admin(&pool_y, b_id, a_id, false).await
|
||||
});
|
||||
let r_x = task_x.await.unwrap();
|
||||
let r_y = task_y.await.unwrap();
|
||||
|
||||
let outcomes = (r_x.is_ok(), r_y.is_ok());
|
||||
assert!(
|
||||
outcomes == (true, false) || outcomes == (false, true),
|
||||
"exactly one of the two parallel demotes must succeed; got {outcomes:?}"
|
||||
);
|
||||
|
||||
let (count,): (i64,) =
|
||||
sqlx::query_as("SELECT COUNT(*) FROM users WHERE is_admin = true")
|
||||
.fetch_one(&pool)
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(count, 1, "at least one admin must remain");
|
||||
}
|
||||
|
||||
// ---- audit log -------------------------------------------------------------
|
||||
|
||||
#[sqlx::test(migrations = "./migrations")]
|
||||
async fn promote_writes_audit_row(pool: PgPool) {
|
||||
let h = common::harness(pool.clone());
|
||||
let (_a_name, a_cookie, a_id) = seed_admin(&pool, &h.app).await;
|
||||
let (b_name, _b_cookie) = common::register_user(&h.app).await;
|
||||
let b = repo::user::find_by_username(&pool, &b_name)
|
||||
.await
|
||||
.unwrap()
|
||||
.unwrap();
|
||||
|
||||
let resp = h
|
||||
.app
|
||||
.oneshot(common::patch_json_with_cookie(
|
||||
&format!("/api/v1/admin/users/{}", b.id),
|
||||
json!({ "is_admin": true }),
|
||||
&a_cookie,
|
||||
))
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(resp.status(), StatusCode::OK);
|
||||
|
||||
let rows: Vec<(Option<Uuid>, String, String, Option<Uuid>)> = sqlx::query_as(
|
||||
"SELECT actor_user_id, action, target_kind, target_id FROM admin_audit",
|
||||
)
|
||||
.fetch_all(&pool)
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(rows.len(), 1);
|
||||
let (actor, action, kind, target) = rows.into_iter().next().unwrap();
|
||||
assert_eq!(actor, Some(a_id));
|
||||
assert_eq!(action, "promote_user");
|
||||
assert_eq!(kind, "user");
|
||||
assert_eq!(target, Some(b.id));
|
||||
}
|
||||
|
||||
#[sqlx::test(migrations = "./migrations")]
|
||||
async fn delete_writes_audit_row(pool: PgPool) {
|
||||
let h = common::harness(pool.clone());
|
||||
let (_a_name, a_cookie, a_id) = seed_admin(&pool, &h.app).await;
|
||||
let (b_name, _b_cookie) = common::register_user(&h.app).await;
|
||||
let b = repo::user::find_by_username(&pool, &b_name)
|
||||
.await
|
||||
.unwrap()
|
||||
.unwrap();
|
||||
|
||||
let resp = h
|
||||
.app
|
||||
.oneshot(common::delete_with_cookie(
|
||||
&format!("/api/v1/admin/users/{}", b.id),
|
||||
&a_cookie,
|
||||
))
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(resp.status(), StatusCode::NO_CONTENT);
|
||||
|
||||
let rows: Vec<(Option<Uuid>, String, String, Option<Uuid>, serde_json::Value)> =
|
||||
sqlx::query_as(
|
||||
"SELECT actor_user_id, action, target_kind, target_id, payload FROM admin_audit",
|
||||
)
|
||||
.fetch_all(&pool)
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(rows.len(), 1);
|
||||
let (actor, action, kind, target, payload) = rows.into_iter().next().unwrap();
|
||||
assert_eq!(actor, Some(a_id));
|
||||
assert_eq!(action, "delete_user");
|
||||
assert_eq!(kind, "user");
|
||||
assert_eq!(target, Some(b.id));
|
||||
assert_eq!(payload["username"], b_name);
|
||||
assert_eq!(payload["was_admin"], false);
|
||||
}
|
||||
Reference in New Issue
Block a user