Updpdate

tests/api/messages/conversations.py

@@ -0,0 +1,101 @@
+# retoor <retoor@molodetz.nl>
+
+import time
+import requests
+from tests.conftest import BASE_URL
+from devplacepy.database import get_table
+
+JSON = {"Accept": "application/json"}
+_counter = [0]
+
+
+def _unique(prefix="mconv"):
+    _counter[0] += 1
+    return f"{prefix}{int(time.time() * 1000)}{_counter[0]}"
+
+
+def _signup():
+    name = _unique()
+    s = requests.Session()
+    s.post(
+        f"{BASE_URL}/auth/signup",
+        data={
+            "username": name,
+            "email": f"{name}@t.dev",
+            "password": "secret123",
+            "confirm_password": "secret123",
+        },
+        allow_redirects=True,
+    )
+    return s, name
+
+
+def _uid(name):
+    return get_table("users").find_one(username=name)["uid"]
+
+
+def test_conversations_requires_auth_401_for_json(app_server):
+    r = requests.get(
+        f"{BASE_URL}/messages/conversations", headers=JSON, allow_redirects=False
+    )
+    assert r.status_code == 401
+
+
+def test_conversations_requires_auth_redirects_browser(app_server):
+    r = requests.get(f"{BASE_URL}/messages/conversations", allow_redirects=False)
+    assert r.status_code == 303
+
+
+def test_conversations_matches_messages_page_shape(app_server):
+    sender, _ = _signup()
+    _, other_name = _signup()
+    other_uid = _uid(other_name)
+
+    sent = sender.post(
+        f"{BASE_URL}/messages/send",
+        headers=JSON,
+        data={"receiver_uid": other_uid, "content": "hello from parity test"},
+    )
+    assert sent.status_code == 200, sent.text[:300]
+
+    page = sender.get(f"{BASE_URL}/messages", headers=JSON)
+    assert page.status_code == 200, page.text[:300]
+    page_conversations = page.json()["conversations"]
+
+    flat = sender.get(f"{BASE_URL}/messages/conversations")
+    assert flat.status_code == 200, flat.text[:300]
+    flat_conversations = flat.json()["conversations"]
+
+    assert page_conversations == flat_conversations
+
+    match = next(
+        c for c in flat_conversations if c["other_user"]["uid"] == other_uid
+    )
+    assert match["last_message"] == "hello from parity test"
+    assert match["unread"] is False
+
+
+def test_conversations_excludes_blocked_user(app_server):
+    viewer, _ = _signup()
+    blocked, blocked_name = _signup()
+    blocked_uid = _uid(blocked_name)
+
+    reply = viewer.post(
+        f"{BASE_URL}/messages/send",
+        headers=JSON,
+        data={"receiver_uid": blocked_uid, "content": "before block"},
+    )
+    assert reply.status_code == 200, reply.text[:300]
+
+    before = viewer.get(f"{BASE_URL}/messages/conversations")
+    assert any(
+        c["other_user"]["uid"] == blocked_uid for c in before.json()["conversations"]
+    )
+
+    viewer.post(f"{BASE_URL}/block/{blocked_name}", allow_redirects=False)
+
+    after = viewer.get(f"{BASE_URL}/messages/conversations")
+    assert after.status_code == 200
+    assert not any(
+        c["other_user"]["uid"] == blocked_uid for c in after.json()["conversations"]
+    )

tests/api/messages/send.py

@@ -1,9 +1,11 @@
 # retoor <retoor@molodetz.nl>
 
+import io
 import time
 from datetime import datetime, timezone
 import pytest
 import requests
+from PIL import Image
 from tests.conftest import BASE_URL
 from devplacepy.database import get_table, refresh_snapshot, set_setting
 from devplacepy.utils import generate_uid, make_combined_slug
@@ -127,3 +129,40 @@ def test_message_send_recorded(seeded_db):
     ).json()["data"]
     admin = _admin(seeded_db)
     assert _find(admin, "message.send", lambda e: e.get("target_uid") == msg["uid"]) is not None
+
+
+def _png_bytes():
+    buf = io.BytesIO()
+    Image.new("RGB", (4, 4), (0, 128, 255)).save(buf, "PNG")
+    return buf.getvalue()
+
+
+def _upload(session, name="attach.png"):
+    r = session.post(
+        f"{BASE_URL}/uploads/upload", files={"file": (name, _png_bytes(), "image/png")}
+    )
+    assert r.status_code == 201, r.text
+    return r.json()["uid"]
+
+
+def test_send_attachment_only_empty_content_succeeds(seeded_db):
+    s, _ = _member()
+    receiver = _db_user("bob_test")["uid"]
+    attachment_uid = _upload(s)
+
+    r = s.post(
+        f"{BASE_URL}/messages/send",
+        headers=JSON_audit_log,
+        data={
+            "content": "",
+            "receiver_uid": receiver,
+            "attachment_uids": attachment_uid,
+        },
+    )
+    assert r.status_code == 200, r.text[:300]
+    msg = r.json()["data"]
+    assert msg["uid"]
+
+    refresh_snapshot()
+    row = get_table("messages").find_one(uid=msg["uid"])
+    assert row["content"] == ""

tests/api/messages/wsticket.py

@@ -0,0 +1,110 @@
+# retoor <retoor@molodetz.nl>
+
+import asyncio
+import json
+import time
+
+import pytest
+import requests
+import websockets
+
+from tests.conftest import BASE_URL, PORT
+from devplacepy.database import get_table, refresh_snapshot, set_setting
+
+WS_URL = f"ws://127.0.0.1:{PORT}/messages/ws"
+JSON = {"Accept": "application/json"}
+_counter = [0]
+
+
+@pytest.fixture(scope="module", autouse=True)
+def _wsticket_settings(app_server):
+    for key, value in {
+        "rate_limit_per_minute": "1000000",
+        "rate_limit_window_seconds": "60",
+        "registration_open": "1",
+        "maintenance_mode": "0",
+    }.items():
+        set_setting(key, value)
+    yield
+
+
+def _unique(prefix="wst"):
+    _counter[0] += 1
+    return f"{prefix}{int(time.time() * 1000)}{_counter[0]}"
+
+
+def _signup():
+    name = _unique()
+    s = requests.Session()
+    s.post(
+        f"{BASE_URL}/auth/signup",
+        data={
+            "username": name,
+            "email": f"{name}@t.dev",
+            "password": "secret123",
+            "confirm_password": "secret123",
+        },
+        allow_redirects=True,
+    )
+    return s, name
+
+
+def _uid(name):
+    refresh_snapshot()
+    return get_table("users").find_one(username=name)["uid"]
+
+
+async def _recv_until(ws, frame_type, timeout=5.0):
+    deadline = asyncio.get_event_loop().time() + timeout
+    while True:
+        remaining = deadline - asyncio.get_event_loop().time()
+        if remaining <= 0:
+            raise AssertionError(f"timed out waiting for {frame_type}")
+        raw = await asyncio.wait_for(ws.recv(), timeout=remaining)
+        frame = json.loads(raw)
+        if frame.get("type") == frame_type:
+            return frame
+
+
+def test_ws_ticket_requires_auth_401_for_json(app_server):
+    r = requests.post(
+        f"{BASE_URL}/messages/ws-ticket", headers=JSON, allow_redirects=False
+    )
+    assert r.status_code == 401
+
+
+def test_ws_ticket_requires_auth_redirects_browser(app_server):
+    r = requests.post(f"{BASE_URL}/messages/ws-ticket", allow_redirects=False)
+    assert r.status_code == 303
+
+
+def test_ws_ticket_issued_for_logged_in_session(app_server):
+    session, _ = _signup()
+    r = session.post(f"{BASE_URL}/messages/ws-ticket", headers=JSON)
+    assert r.status_code == 200, r.text[:300]
+    data = r.json()
+    assert data["ticket"]
+    assert data["expires_in"] == 30
+
+
+def test_ws_ticket_single_use_and_authenticates_owner(app_server):
+    session, name = _signup()
+    owner_uid = _uid(name)
+
+    ticket = session.post(f"{BASE_URL}/messages/ws-ticket", headers=JSON).json()[
+        "ticket"
+    ]
+
+    async def first_connect():
+        async with websockets.connect(f"{WS_URL}?ticket={ticket}") as ws:
+            ready = await _recv_until(ws, "ready")
+            assert ready["user_uid"] == owner_uid
+
+    asyncio.run(first_connect())
+
+    async def second_connect():
+        async with websockets.connect(f"{WS_URL}?ticket={ticket}") as ws:
+            with pytest.raises(websockets.exceptions.ConnectionClosed):
+                await asyncio.wait_for(ws.recv(), timeout=3.0)
+
+    asyncio.run(second_connect())

tests/e2e/messages.py

@@ -176,7 +176,7 @@ def test_send_message_appears_in_thread(alice):
         f"{BASE_URL}/messages?with_uid={bob['uid']}", wait_until="domcontentloaded"
     )
     msg = f"Hello bob {int(time.time() * 1000)}"
-    page.fill("input[name='content']", msg)
+    page.fill("textarea[name='content']", msg)
     page.locator(".messages-send-btn").click()
     page.wait_for_url("**/messages**", wait_until="domcontentloaded")
     page.locator(f".message-bubble:has-text('{msg}')").first.wait_for(state="visible")
@@ -290,3 +290,56 @@ def test_messages_page_is_noindex(alice):
     meta = page.locator('meta[name="robots"]')
     content = meta.get_attribute("content")
     assert content and "noindex" in content
+
+
+def test_optimistic_send_pending_then_reconciles_no_double_render(alice, bob):
+    page_a, user_a = alice
+    page_b, user_b = bob
+    uid_a = get_table("users").find_one(username=user_a["username"])["uid"]
+    uid_b = get_table("users").find_one(username=user_b["username"])["uid"]
+
+    page_a.goto(
+        f"{BASE_URL}/messages?with_uid={uid_b}", wait_until="domcontentloaded"
+    )
+    page_b.goto(
+        f"{BASE_URL}/messages?with_uid={uid_a}", wait_until="domcontentloaded"
+    )
+
+    msg = f"Optimistic hello {int(time.time() * 1000)}"
+    textarea = page_a.locator(".messages-input-area textarea[name='content']")
+    textarea.wait_for(state="visible")
+    textarea.fill(msg)
+    page_a.locator(".messages-send-btn").click()
+
+    pending = page_a.locator(f".message-bubble.mine.pending:has-text('{msg}')")
+    pending.wait_for(state="visible", timeout=5000)
+    client_id = pending.get_attribute("data-client-id")
+    assert client_id
+
+    reconciled = page_a.locator(
+        f".message-bubble.mine[data-client-id='{client_id}'][data-msg-uid]:not(.pending)"
+    )
+    reconciled.wait_for(state="visible", timeout=6000)
+
+    received = page_b.locator(f".message-bubble.theirs:has-text('{msg}')")
+    received.wait_for(state="visible", timeout=6000)
+    assert received.count() == 1
+
+
+def test_mobile_single_pane_back_button(mobile_page):
+    page, user = mobile_page
+    bob = get_table("users").find_one(username="bob_test")
+    page.goto(
+        f"{BASE_URL}/messages?with_uid={bob['uid']}", wait_until="domcontentloaded"
+    )
+
+    thread = page.locator(".messages-main")
+    conv_list = page.locator(".messages-list")
+    thread.wait_for(state="visible")
+    expect(conv_list).to_be_hidden()
+
+    page.locator("#messages-back-btn").click()
+
+    expect(conv_list).to_be_visible()
+    expect(thread).to_be_hidden()
+    assert page.url == f"{BASE_URL}/messages"

tests/e2e/notifications/index.py

@@ -440,7 +440,7 @@ def test_message_notification(app_server, browser, seeded_db):
     pb.goto(f"{BASE_URL}/messages?search=alice_test", wait_until="domcontentloaded")
     pb.wait_for_timeout(2000)
 
-    msg_input = pb.locator("input[name='content']").first
+    msg_input = pb.locator("textarea[name='content']").first
     msg_input.wait_for(state="visible", timeout=10000)
     msg_input.fill("Hello from bob_test!")
     pb.locator("button[type='submit']").last.click()
@@ -753,7 +753,7 @@ def test_message_notification_click_opens_conversation(app_server, browser, seed
 
     pb.goto(f"{BASE_URL}/messages?search=alice_test", wait_until="domcontentloaded")
     pb.wait_for_timeout(2000)
-    msg_input = pb.locator("input[name='content']").first
+    msg_input = pb.locator("textarea[name='content']").first
     msg_input.wait_for(state="visible", timeout=10000)
     msg_input.fill("Click-through message from bob")
     pb.locator("button[type='submit']").last.click()

tests/unit/services/messaging/tickets.py

@@ -0,0 +1,47 @@
+# retoor <retoor@molodetz.nl>
+
+from datetime import datetime, timedelta, timezone
+
+from devplacepy.database import get_table
+from devplacepy.utils import generate_uid
+from devplacepy.services.messaging.tickets import issue_ticket, redeem_ticket
+
+
+def _user_uid():
+    uid = generate_uid()
+    get_table("users").insert(
+        {
+            "uid": uid,
+            "username": f"tkt_{uid[:8]}",
+            "email": f"{uid[:8]}@tkt.dev",
+            "password_hash": "x",
+            "role": "Member",
+            "is_active": True,
+            "created_at": datetime.now(timezone.utc).isoformat(),
+        }
+    )
+    return uid
+
+
+def test_ticket_redeems_once(local_db):
+    user_uid = _user_uid()
+    token = issue_ticket(user_uid)
+
+    assert redeem_ticket(token) == user_uid
+    assert redeem_ticket(token) is None
+
+
+def test_expired_ticket_never_used_still_rejected(local_db):
+    user_uid = _user_uid()
+    token = issue_ticket(user_uid)
+
+    expired_at = (datetime.now(timezone.utc) - timedelta(seconds=5)).isoformat()
+    tickets = get_table("ws_tickets")
+    row = tickets.find_one(token=token)
+    tickets.update({"uid": row["uid"], "expires_at": expired_at}, ["uid"])
+
+    assert redeem_ticket(token) is None
+
+
+def test_redeem_unknown_token_returns_none(local_db):
+    assert redeem_ticket("not-a-real-token") is None