1 
use axum::{
2 
    body::Body,
3 
    http::{Request, StatusCode},
4 
};
5 
use tower::ServiceExt;
6 

            

        

            

                7
            

            

                
            

            

                
use crate::common::create_test_app_state;

            

        

            

                8
            

            

                
            

            

                
use web::route::create_api_router;

            

        

            

                9
            

            

                
            

            

                

            

        

            

                10
            

            

                
            

            

                
// PUBLIC API ROUTES TESTS

            

        

            

                11
            

            

                
            

            

                
#[tokio::test]

            

        

            

                12
            

            

                3
            

            

                
async fn test_public_routes_accessible() {

            

        

            

                13
            

            

                2
            

            

                
    let app_state = create_test_app_state().await;

            

        

            

                14
            

            

                2
            

            

                
    let app = create_api_router(app_state.clone()).with_state(app_state);

            

        

            

                15
            

            

                
            

            

                

            

        

            

                16
            

            

                
            

            

                
    // Test version endpoint

            

        

            

                17
            

            

                2
            

            

                
    let response = app

            

        

            

                18
            

            

                2
            

            

                
        .clone()

            

        

            

                19
            

            

                2
            

            

                
        .oneshot(

            

        

            

                20
            

            

                2
            

            

                
            Request::builder()

            

        

            

                21
            

            

                2
            

            

                
                .uri("/version")

            

        

            

                22
            

            

                2
            

            

                
                .body(Body::empty())

            

        

            

                23
            

            

                2
            

            

                
                .unwrap(),

            

        

            

                24
            

            

                2
            

            

                
        )

            

        

            

                25
            

            

                2
            

            

                
        .await

            

        

            

                26
            

            

                2
            

            

                
        .unwrap();

            

        

            

                27
            

            

                
            

            

                

            

        

            

                28
            

            

                2
            

            

                
    assert_eq!(response.status(), StatusCode::OK);

            

        

            

                29
            

            

                
            

            

                

            

        

            

                30
            

            

                
            

            

                
    // Test logout endpoint (requires auth, so expect 401/403)

            

        

            

                31
            

            

                2
            

            

                
    let response = app

            

        

            

                32
            

            

                2
            

            

                
        .oneshot(

            

        

            

                33
            

            

                2
            

            

                
            Request::builder()

            

        

            

                34
            

            

                2
            

            

                
                .uri("/auth/logout")

            

        

            

                35
            

            

                2
            

            

                
                .body(Body::empty())

            

        

            

                36
            

            

                2
            

            

                
                .unwrap(),

            

        

            

                37
            

            

                2
            

            

                
        )

            

        

            

                38
            

            

                2
            

            

                
        .await

            

        

            

                39
            

            

                2
            

            

                
        .unwrap();

            

        

            

                40
            

            

                
            

            

                

            

        

            

                41
            

            

                
            

            

                
    // Logout requires authentication, so should return 401 or 403

            

        

            

                42
            

            

                3
            

            

                
    assert!(

            

        

            

                43
            

            

                3
            

            

                
        response.status() == StatusCode::UNAUTHORIZED || response.status() == StatusCode::FORBIDDEN

            

        

            

                44
            

            

                2
            

            

                
    );

            

        

            

                45
            

            

                2
            

            

                
}

            

        

            

                46
            

            

                
            

            

                

            

        

            

                47
            

            

                
            

            

                
#[tokio::test]

            

        

            

                48
            

            

                3
            

            

                
async fn test_protected_routes_require_auth() {

            

        

            

                49
            

            

                2
            

            

                
    let app_state = create_test_app_state().await;

            

        

            

                50
            

            

                2
            

            

                
    let app = create_api_router(app_state.clone()).with_state(app_state);

            

        

            

                51
            

            

                
            

            

                

            

        

            

                52
            

            

                2
            

            

                
    let protected_routes = vec!["/auth/refresh"];

            

        

            

                53
            

            

                
            

            

                

            

        

            

                54
            

            

                5
            

            

                
    for route in protected_routes {

            

        

            

                55
            

            

                3
            

            

                
        let response = app

            

        

            

                56
            

            

                3
            

            

                
            .clone()

            

        

            

                57
            

            

                3
            

            

                
            .oneshot(

            

        

            

                58
            

            

                3
            

            

                
                Request::builder()

            

        

            

                59
            

            

                3
            

            

                
                    .method("GET")

            

        

            

                60
            

            

                3
            

            

                
                    .uri(route)

            

        

            

                61
            

            

                3
            

            

                
                    .body(Body::empty())

            

        

            

                62
            

            

                3
            

            

                
                    .unwrap(),

            

        

            

                63
            

            

                3
            

            

                
            )

            

        

            

                64
            

            

                3
            

            

                
            .await

            

        

            

                65
            

            

                3
            

            

                
            .unwrap();

            

        

            

                66
            

            

                2
            

            

                

            

        

            

                67
            

            

                3
            

            

                
        assert!(

            

        

            

                68
            

            

                3
            

            

                
            response.status() == StatusCode::UNAUTHORIZED

            

        

            

                69
            

            

                2
            

            

                
                || response.status() == StatusCode::FORBIDDEN

            

        

            

                70
            

            

                2
            

            

                
                || response.status().is_server_error(),

            

        

            

                71
            

            

                2
            

            

                
            "Route {} should require authentication, got status: {}",

            

        

            

                72
            

            

                2
            

            

                
            route,

            

        

            

                73
            

            

                2
            

            

                
            response.status()

            

        

            

                74
            

            

                2
            

            

                
        );

            

        

            

                75
            

            

                2
            

            

                
    }

            

        

            

                76
            

            

                2
            

            

                
}