v0.33.7

src/admin/tests.rs

@@ -1639,6 +1639,87 @@ mod tests {
         store.close().await;
     }
 
+    #[tokio::test]
+    async fn named_dashboard_presets_are_private_validated_and_persistent() {
+        let (router, store, _dir, secret, csrf) = fixture().await;
+        let cookie = format!("{}={secret}", auth::COOKIE_NAME);
+        let preset = DashboardPresetLayout {
+            dashboard_widgets: AdminPreferences::default().dashboard_widgets,
+            dashboard_hidden_widgets: default_hidden_dashboard_widgets(),
+            dashboard_widget_sizes: None,
+            dashboard_density: "compact".to_owned(),
+            overview_samples: 600,
+        };
+        let body = serde_json::to_string(&preset).unwrap();
+        let anon = router.clone().oneshot(
+            request("/api/dashboard-presets").body(Body::empty()).unwrap()
+        ).await.unwrap();
+        assert_eq!(anon.status(), StatusCode::UNAUTHORIZED);
+        let forbidden = router.clone().oneshot(
+            request("/api/dashboard-presets/Daily").method("PUT")
+                .header("cookie", &cookie)
+                .header("origin", "http://127.0.0.1:9090")
+                .header("x-rustproxy-request", "1")
+                .header("content-type", "application/json")
+                .body(Body::from(body.clone())).unwrap()
+        ).await.unwrap();
+        assert_eq!(forbidden.status(), StatusCode::FORBIDDEN);
+        let saved = router.clone().oneshot(
+            request("/api/dashboard-presets/Daily").method("PUT")
+                .header("cookie", &cookie)
+                .header("origin", "http://127.0.0.1:9090")
+                .header("x-rustproxy-request", "1")
+                .header("x-csrf-token", &csrf)
+                .header("content-type", "application/json")
+                .body(Body::from(body.clone())).unwrap()
+        ).await.unwrap();
+        assert_eq!(saved.status(), StatusCode::NO_CONTENT);
+        let listing = router.clone().oneshot(
+            request("/api/dashboard-presets")
+                .header("cookie", &cookie)
+                .body(Body::empty()).unwrap()
+        ).await.unwrap();
+        assert_eq!(listing.status(), StatusCode::OK);
+        let entries = json_body(listing).await;
+        assert_eq!(entries[0]["name"], "Daily");
+        assert_eq!(entries[0]["overview_samples"], 600);
+        assert_eq!(entries[0]["dashboard_widget_sizes"], Value::Null);
+        assert_eq!(store.list_admin_dashboard_presets("owner").await.unwrap().len(), 1);
+        assert!(store.list_admin_dashboard_presets("someone-else").await.unwrap().is_empty());
+        let rejected = router.clone().oneshot(
+            request("/api/dashboard-presets/Invalid").method("PUT")
+                .header("cookie", &cookie)
+                .header("origin", "http://127.0.0.1:9090")
+                .header("x-rustproxy-request", "1")
+                .header("x-csrf-token", &csrf)
+                .header("content-type", "application/json")
+                .body(Body::from(body.replace("\"overview_samples\":600", "\"overview_samples\":999"))).unwrap()
+        ).await.unwrap();
+        assert_eq!(rejected.status(), StatusCode::UNPROCESSABLE_ENTITY);
+        let renamed = router.clone().oneshot(
+            request("/api/dashboard-presets/Daily").method("PATCH")
+                .header("cookie", &cookie)
+                .header("origin", "http://127.0.0.1:9090")
+                .header("x-rustproxy-request", "1")
+                .header("x-csrf-token", &csrf)
+                .header("content-type", "application/json")
+                .body(Body::from(r#"{"name":"Nightly"}"#)).unwrap()
+        ).await.unwrap();
+        assert_eq!(renamed.status(), StatusCode::NO_CONTENT);
+        assert_eq!(store.list_admin_dashboard_presets("owner").await.unwrap()[0].0, "Nightly");
+        let deleted = router.oneshot(
+            request("/api/dashboard-presets/Nightly").method("DELETE")
+                .header("cookie", &cookie)
+                .header("origin", "http://127.0.0.1:9090")
+                .header("x-rustproxy-request", "1")
+                .header("x-csrf-token", &csrf)
+                .body(Body::empty()).unwrap()
+        ).await.unwrap();
+        assert_eq!(deleted.status(), StatusCode::NO_CONTENT);
+        assert!(store.list_admin_dashboard_presets("owner").await.unwrap().is_empty());
+        store.close().await;
+    }
+
     #[tokio::test]
     async fn admin_preferences_are_account_scoped_and_csrf_guarded() {
         let (router, store, _dir, secret, csrf) = fixture().await;
@@ -3010,6 +3091,7 @@ mod tests {
             "/api/system-info",
             "/api/config",
             "/api/preferences",
+            "/api/dashboard-presets",
             "/api/cache",
             "/api/cache/bans",
             "/api/audit",
@@ -3044,6 +3126,9 @@ mod tests {
             ("DELETE", "/api/cache/bans/1"),
             ("PUT", "/api/config/cache"),
             ("PUT", "/api/preferences"),
+            ("PUT", "/api/dashboard-presets/example"),
+            ("DELETE", "/api/dashboard-presets/example"),
+            ("PATCH", "/api/dashboard-presets/example"),
             ("POST", "/api/auth/logout-all"),
         ] {
             let no_session = request(path).method(method).body(Body::empty()).unwrap();