big update in share links

src/db/mod.rs

@@ -157,7 +157,7 @@ pub fn verify_workspace_password(workspace: &Workspace, password: Option<&str>)
         &workspace.password_hash,
         password.filter(|value| !value.is_empty()),
     ) {
-        (None, _) => true,
+        (None, _) => false,
         (Some(hash), Some(password)) => PasswordHash::new(hash)
             .ok()
             .and_then(|parsed| {
@@ -433,7 +433,7 @@ pub fn verify_pad_password(pad: &Pad, password: Option<&str>) -> bool {
         &pad.password_hash,
         password.filter(|value| !value.is_empty()),
     ) {
-        (None, _) => true,
+        (None, _) => false,
         (Some(hash), Some(password)) => PasswordHash::new(hash)
             .ok()
             .and_then(|parsed| {
@@ -544,3 +544,57 @@ impl<'r> sqlx::FromRow<'r, AnyRow> for Pad {
         })
     }
 }
+
+#[cfg(test)]
+mod password_verification_tests {
+    use super::*;
+
+    fn workspace(password_hash: Option<String>) -> Workspace {
+        Workspace {
+            id: 1,
+            slug: "private-workspace".into(),
+            title: "Private workspace".into(),
+            password_hash,
+            created_at: String::new(),
+            updated_at: String::new(),
+            is_private: 1,
+        }
+    }
+
+    fn pad(password_hash: Option<String>) -> Pad {
+        Pad {
+            id: 1,
+            slug: "private-pad".into(),
+            title: "Private pad".into(),
+            content: String::new(),
+            password_hash,
+            created_at: String::new(),
+            updated_at: String::new(),
+            owner_map: "[]".into(),
+            is_private: 1,
+            created_by_guest_id: None,
+        }
+    }
+
+    #[test]
+    fn missing_password_does_not_grant_password_access() {
+        assert!(!verify_workspace_password(&workspace(None), None));
+        assert!(!verify_workspace_password(&workspace(None), Some("anything")));
+        assert!(!verify_pad_password(&pad(None), None));
+        assert!(!verify_pad_password(&pad(None), Some("anything")));
+    }
+
+    #[test]
+    fn configured_password_is_verified() {
+        let workspace = workspace(Some(hash_password("workspace-secret")));
+        assert!(verify_workspace_password(
+            &workspace,
+            Some("workspace-secret")
+        ));
+        assert!(!verify_workspace_password(&workspace, Some("wrong")));
+
+        let pad = pad(Some(hash_password("pad-secret")));
+        assert!(verify_pad_password(&pad, Some("pad-secret")));
+        assert!(!verify_pad_password(&pad, Some("wrong")));
+    }
+}