hanna/fabrica

test: cover profile queries, avatars, explore, and settings auth

99168ec · hanna committed on 2026-07-25

Add a store round-trip test for update_profile / set_avatar_mime and web
tests for the profile page, identicon fallback, the anonymous Explore
listing (no in-content sign-in button), and the settings auth redirect.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Signed by hannaSSH key fingerprint: SHA256:4g9cWhkAAw8gwqhJUcVbSnGEvdGwklW+1Aa/fMUu59k

crates/store/src/tests.rs +57 −0

crates/web/src/tests.rs +61 −0

+}
 #[tokio::test]
+async fn update_profile_and_avatar_round_trip() {
+    for fx in sqlite_fixtures().await {
+        let user = fx
+            .store
+            .create_user(sample_user("prof", "prof@example.com"))
+            .await
+            .unwrap();
+        let ok = fx
+            .store
+            .update_profile(
+                &user.id,
+                crate::ProfileUpdate {
+                    display_name: Some("Professor".to_string()),
+                    pronouns: Some("they/them".to_string()),
+                    bio: Some("Hello there.".to_string()),
+                    website: Some("https://example.com".to_string()),
+                    location: Some("Everywhere".to_string()),
+                    social_github: Some("prof".to_string()),
+                    social_mastodon: Some("@prof@example.social".to_string()),
+                },
+            )
+            .await
+            .unwrap();
+        assert!(ok);
+        let got = fx.store.user_by_id(&user.id).await.unwrap().unwrap();
+        assert_eq!(got.pronouns.as_deref(), Some("they/them"));
+        assert_eq!(got.bio.as_deref(), Some("Hello there."));
+        assert_eq!(got.social_mastodon.as_deref(), Some("@prof@example.social"));
+        assert!(got.avatar_mime.is_none(), "no avatar yet");
+        // Setting then clearing the avatar content type round-trips.
+        assert!(
+            fx.store
+                .set_avatar_mime(&user.id, Some("image/png"))
+                .await
+                .unwrap()
+        );
+        let got = fx.store.user_by_id(&user.id).await.unwrap().unwrap();
+        assert_eq!(got.avatar_mime.as_deref(), Some("image/png"));
+        assert!(fx.store.set_avatar_mime(&user.id, None).await.unwrap());
+        let got = fx.store.user_by_id(&user.id).await.unwrap().unwrap();
+        assert!(got.avatar_mime.is_none(), "avatar cleared");
+        // A missing user reports no update.
+        assert!(
+            !fx.store
+                .update_profile("nope", crate::ProfileUpdate::default())
+                .await
+                .unwrap()
+        );
+    }
+}
+#[tokio::test]
 async fn duplicate_username_conflicts_case_insensitively() {
     for fx in sqlite_fixtures().await {
         fx.store

     let res = app.oneshot(get("/nobody")).await.unwrap();
     assert_eq!(res.status(), StatusCode::NOT_FOUND);
+}
+#[tokio::test]
+async fn profile_page_renders_with_identity() {
+    let (_state, app) = app().await;
+    let res = app.oneshot(get("/ada")).await.unwrap();
+    assert_eq!(res.status(), StatusCode::OK);
+    let html = body_string(res).await;
+    // Display name in the heading and the "User · username" subtitle.
+    assert!(html.contains("Ada"), "display name shown");
+    assert!(html.contains("User · ada"), "profile subtitle shown");
+    assert!(html.contains("/avatar/ada"), "avatar image referenced");
+}
+#[tokio::test]
+async fn avatar_falls_back_to_identicon_svg() {
+    let (_state, app) = app().await;
+    let res = app.oneshot(get("/avatar/ada")).await.unwrap();
+    assert_eq!(res.status(), StatusCode::OK);
+    assert_eq!(
+        res.headers().get(header::CONTENT_TYPE).unwrap(),
+        "image/svg+xml; charset=utf-8"
+    );
+    let body = body_string(res).await;
+    assert!(body.starts_with("<svg"), "identicon is an SVG");
+}
+#[tokio::test]
+async fn explore_lists_public_repos_for_anonymous() {
+    let (state, app) = app().await;
+    let ada = state.store.user_by_username("ada").await.unwrap().unwrap();
+    state
+        .store
+        .create_repo(NewRepo {
+            owner_id: ada.id,
+            group_id: None,
+            name: "open".to_string(),
+            path: "open".to_string(),
+            description: None,
+            is_private: false,
+            default_branch: "main".to_string(),
+        })
+        .await
+        .unwrap();
+    let res = app.oneshot(get("/explore")).await.unwrap();
+    assert_eq!(res.status(), StatusCode::OK);
+    let html = body_string(res).await;
+    assert!(html.contains("Public repositories"), "explore heading");
+    assert!(html.contains("ada/open"), "public repo listed");
+    // The anonymous landing must not offer an in-content sign-in button.
+    assert!(!html.contains("btn-primary"), "no content sign-in button");
+}
+#[tokio::test]
+async fn settings_requires_authentication() {
+    let (_state, app) = app().await;
+    let res = app.oneshot(get("/settings")).await.unwrap();
+    // RequireUser redirects anonymous visitors to /login.
+    assert_eq!(res.status(), StatusCode::SEE_OTHER);
+    assert_eq!(res.headers().get(header::LOCATION).unwrap(), "/login");
+}