improvements

src/tests/api.rs

@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2026 Mateusz Gruszczyński @linuxiarz.pl
+ * Source-Available Code / Dual-Licensed.
+ *
+ * Free for non-commercial and evaluation use under terms of BSL/GPLv3.
+ * Commercial or production use requires a valid paid license.
+ * See LICENSE file in repository root for details.
+ */
+
+use super::*;
+
+fn headers_with_guest_id(guest_id: &str) -> HeaderMap {
+    let mut headers = HeaderMap::new();
+    headers.insert(
+        header::COOKIE,
+        HeaderValue::from_str(&format!("rustpad_guest_id={guest_id}"))
+            .expect("valid cookie header"),
+    );
+    headers
+}
+
+#[test]
+fn guest_owner_requires_the_original_browser_identifier() {
+    let owner_id = "0123456789abcdef0123456789abcdef";
+    let owner_headers = headers_with_guest_id(owner_id);
+    let visitor_headers = headers_with_guest_id("fedcba9876543210fedcba9876543210");
+
+    assert!(guest_owner_is_requester(&owner_headers, Some(owner_id)));
+    assert!(!guest_owner_is_requester(&visitor_headers, Some(owner_id)));
+    assert!(!guest_owner_is_requester(&HeaderMap::new(), Some(owner_id)));
+}
+
+#[test]
+fn invalid_guest_identifier_does_not_grant_ownership() {
+    let headers = headers_with_guest_id("too-short");
+    assert!(!guest_owner_is_requester(&headers, Some("too-short")));
+}
+
+#[test]
+fn only_an_owner_can_set_the_first_password() {
+    assert!(can_set_resource_password(false, true, false));
+    assert!(can_set_resource_password(false, false, true));
+    assert!(!can_set_resource_password(false, false, false));
+    assert!(!can_set_resource_password(true, true, true));
+}
+
+#[test]
+fn settings_allow_owner_or_verified_password_holder() {
+    assert!(can_manage_resource_settings(true, false, false));
+    assert!(can_manage_resource_settings(false, true, false));
+    assert!(can_manage_resource_settings(false, false, true));
+    assert!(!can_manage_resource_settings(false, false, false));
+}