From d4e67d1c7b8d2089c66ce5346fb170edf6e7edc6 Mon Sep 17 00:00:00 2001 From: Trezy Date: Fri, 17 Apr 2026 08:57:38 -0500 Subject: [PATCH] test: fix dpop tests --- tests/common/app.rs | 11 +++++++++++ tests/dpop_auth.rs | 15 +++++++++++---- 2 files changed, 22 insertions(+), 4 deletions(-) diff --git a/tests/common/app.rs b/tests/common/app.rs index a254b4e..cc4bbfe 100644 --- a/tests/common/app.rs +++ b/tests/common/app.rs @@ -169,6 +169,17 @@ impl TestApp { let mut app = Self::new().await; // Set a test encryption key (32 bytes) app.state.config.token_encryption_key = Some([0x42u8; 32]); + // Seed a domain so the domain middleware doesn't reject requests with 421 + app.state + .domain_cache + .insert(happyview::domain::Domain { + id: uuid::Uuid::new_v4().to_string(), + url: "http://127.0.0.1:0".to_string(), + is_primary: true, + created_at: now_rfc3339(), + updated_at: now_rfc3339(), + }) + .await; // Rebuild the router with the updated state app.router = server::router(app.state.clone()); app diff --git a/tests/dpop_auth.rs b/tests/dpop_auth.rs index 0a02532..0533960 100644 --- a/tests/dpop_auth.rs +++ b/tests/dpop_auth.rs @@ -17,7 +17,8 @@ fn post_json_with_headers( let mut builder = Request::builder() .method("POST") .uri(uri) - .header("content-type", "application/json"); + .header("content-type", "application/json") + .header("host", "127.0.0.1"); for (name, value) in headers { builder = builder.header(name, value); } @@ -28,7 +29,10 @@ fn post_json_with_headers( /// Helper to make a DELETE request with headers fn delete_with_headers(uri: &str, headers: Vec<(&str, &str)>) -> Request { - let mut builder = Request::builder().method("DELETE").uri(uri); + let mut builder = Request::builder() + .method("DELETE") + .uri(uri) + .header("host", "127.0.0.1"); for (name, value) in headers { builder = builder.header(name, value); } @@ -267,6 +271,7 @@ async fn test_xrpc_rejects_bearer_auth() { let req = Request::builder() .method("GET") .uri("/xrpc/com.example.test.getStuff") + .header("host", "127.0.0.1") .header("x-client-key", "hvc_fake") .header("authorization", "Bearer hv_some-api-key") .body(Body::empty()) @@ -275,7 +280,7 @@ async fn test_xrpc_rejects_bearer_auth() { let resp = app.router.clone().oneshot(req).await.unwrap(); assert_eq!(resp.status(), StatusCode::UNAUTHORIZED); let body = response_json(resp).await; - let msg = body["message"].as_str().unwrap_or_default(); + let msg = body["error"].as_str().unwrap_or_default(); assert!( msg.contains("XRPC routes do not accept Bearer auth"), "expected Bearer rejection message, got: {msg}" @@ -292,6 +297,7 @@ async fn test_xrpc_allows_anonymous_queries() { let req = Request::builder() .method("GET") .uri("/xrpc/com.example.test.getStuff") + .header("host", "127.0.0.1") .header("x-client-key", "hvc_fake") .body(Body::empty()) .unwrap(); @@ -314,6 +320,7 @@ async fn test_xrpc_procedure_requires_dpop_auth() { let req = Request::builder() .method("POST") .uri("/xrpc/com.example.test.createStuff") + .header("host", "127.0.0.1") .header("x-client-key", "hvc_fake") .header("content-type", "application/json") .body(Body::from("{}")) @@ -322,7 +329,7 @@ async fn test_xrpc_procedure_requires_dpop_auth() { let resp = app.router.clone().oneshot(req).await.unwrap(); assert_eq!(resp.status(), StatusCode::UNAUTHORIZED); let body = response_json(resp).await; - let msg = body["message"].as_str().unwrap_or_default(); + let msg = body["error"].as_str().unwrap_or_default(); assert!( msg.contains("DPoP authentication"), "expected DPoP requirement message, got: {msg}" -- 2.51.2