Initial commit of Descrybe v2 without local scratch artifacts.

Drop one-shot tmp/axe scripts and agent i18n scratch so the Gitea tree is deployable.
2026-08-09 22:47:43 +02:00
commit 8580c996c3
1285 changed files with 325780 additions and 0 deletions
@@ -0,0 +1,84 @@
+package httpapi
+
+import (
+	"bytes"
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/google/uuid"
+)
+
+func TestPutCompanySettingsRejectsUnknownKey(t *testing.T) {
+	t.Parallel()
+	s := &Server{}
+	cid := uuid.MustParse("11111111-1111-1111-1111-111111111111")
+	uid := uuid.MustParse("aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa")
+	ctx := context.WithValue(context.Background(), ctxUserID, uid)
+	ctx = context.WithValue(ctx, ctxCompanyID, cid)
+	ctx = context.WithValue(ctx, ctxRole, "admin")
+
+	req := httptest.NewRequest(
+		http.MethodPut,
+		"/api/company/settings",
+		bytes.NewBufferString(`{"settings":{"prefs.theme":"dark","language":"en"}}`),
+	)
+	req = req.WithContext(ctx)
+	rec := httptest.NewRecorder()
+	s.handlePutCompanySettings(rec, req)
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("status = %d body=%s, want 400", rec.Code, rec.Body.String())
+	}
+	if !strings.Contains(rec.Body.String(), "unknown settings key") {
+		t.Fatalf("body = %s, want unknown settings key", rec.Body.String())
+	}
+}
+
+func TestPutCompanySettingsRejectsInvalidLanguage(t *testing.T) {
+	t.Parallel()
+	s := &Server{}
+	cid := uuid.MustParse("11111111-1111-1111-1111-111111111111")
+	uid := uuid.MustParse("aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa")
+	ctx := context.WithValue(context.Background(), ctxUserID, uid)
+	ctx = context.WithValue(ctx, ctxCompanyID, cid)
+	ctx = context.WithValue(ctx, ctxRole, "admin")
+
+	req := httptest.NewRequest(
+		http.MethodPut,
+		"/api/company/settings",
+		bytes.NewBufferString(`{"settings":{"language":"not-a-lang"}}`),
+	)
+	req = req.WithContext(ctx)
+	rec := httptest.NewRecorder()
+	s.handlePutCompanySettings(rec, req)
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("status = %d body=%s, want 400", rec.Code, rec.Body.String())
+	}
+	if !strings.Contains(rec.Body.String(), "unsupported language") {
+		t.Fatalf("body = %s, want unsupported language", rec.Body.String())
+	}
+}
+
+func TestPutCompanySettingsForbiddenForMember(t *testing.T) {
+	t.Parallel()
+	s := &Server{}
+	cid := uuid.MustParse("11111111-1111-1111-1111-111111111111")
+	uid := uuid.MustParse("aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa")
+	ctx := context.WithValue(context.Background(), ctxUserID, uid)
+	ctx = context.WithValue(ctx, ctxCompanyID, cid)
+	ctx = context.WithValue(ctx, ctxRole, "member")
+
+	req := httptest.NewRequest(
+		http.MethodPut,
+		"/api/company/settings",
+		bytes.NewBufferString(`{"settings":{"language":"en"}}`),
+	)
+	req = req.WithContext(ctx)
+	rec := httptest.NewRecorder()
+	s.handlePutCompanySettings(rec, req)
+	if rec.Code != http.StatusForbidden {
+		t.Fatalf("status = %d body=%s, want 403", rec.Code, rec.Body.String())
+	}
+}