A lexicon-driven AppView for ATProto.
happyview.dev
backfill
firehose
jetstream
atproto
appview
oauth
lexicon
test: fix dpop tests
+22
-4
+11
tests/common/app.rs
+11
tests/common/app.rs
···
169
169
let mut app = Self::new().await;
170
170
// Set a test encryption key (32 bytes)
171
171
app.state.config.token_encryption_key = Some([0x42u8; 32]);
172
+
// Seed a domain so the domain middleware doesn't reject requests with 421
173
+
app.state
174
+
.domain_cache
175
+
.insert(happyview::domain::Domain {
176
+
id: uuid::Uuid::new_v4().to_string(),
177
+
url: "http://127.0.0.1:0".to_string(),
178
+
is_primary: true,
179
+
created_at: now_rfc3339(),
180
+
updated_at: now_rfc3339(),
181
+
})
182
+
.await;
172
183
// Rebuild the router with the updated state
173
184
app.router = server::router(app.state.clone());
174
185
app
+11
-4
tests/dpop_auth.rs
+11
-4
tests/dpop_auth.rs
···
17
17
let mut builder = Request::builder()
18
18
.method("POST")
19
19
.uri(uri)
20
-
.header("content-type", "application/json");
20
+
.header("content-type", "application/json")
21
+
.header("host", "127.0.0.1");
21
22
for (name, value) in headers {
22
23
builder = builder.header(name, value);
23
24
}
···
28
29
29
30
/// Helper to make a DELETE request with headers
30
31
fn delete_with_headers(uri: &str, headers: Vec<(&str, &str)>) -> Request<Body> {
31
-
let mut builder = Request::builder().method("DELETE").uri(uri);
32
+
let mut builder = Request::builder()
33
+
.method("DELETE")
34
+
.uri(uri)
35
+
.header("host", "127.0.0.1");
32
36
for (name, value) in headers {
33
37
builder = builder.header(name, value);
34
38
}
···
267
271
let req = Request::builder()
268
272
.method("GET")
269
273
.uri("/xrpc/com.example.test.getStuff")
274
+
.header("host", "127.0.0.1")
270
275
.header("x-client-key", "hvc_fake")
271
276
.header("authorization", "Bearer hv_some-api-key")
272
277
.body(Body::empty())
···
275
280
let resp = app.router.clone().oneshot(req).await.unwrap();
276
281
assert_eq!(resp.status(), StatusCode::UNAUTHORIZED);
277
282
let body = response_json(resp).await;
278
-
let msg = body["message"].as_str().unwrap_or_default();
283
+
let msg = body["error"].as_str().unwrap_or_default();
279
284
assert!(
280
285
msg.contains("XRPC routes do not accept Bearer auth"),
281
286
"expected Bearer rejection message, got: {msg}"
···
292
297
let req = Request::builder()
293
298
.method("GET")
294
299
.uri("/xrpc/com.example.test.getStuff")
300
+
.header("host", "127.0.0.1")
295
301
.header("x-client-key", "hvc_fake")
296
302
.body(Body::empty())
297
303
.unwrap();
···
314
320
let req = Request::builder()
315
321
.method("POST")
316
322
.uri("/xrpc/com.example.test.createStuff")
323
+
.header("host", "127.0.0.1")
317
324
.header("x-client-key", "hvc_fake")
318
325
.header("content-type", "application/json")
319
326
.body(Body::from("{}"))
···
322
329
let resp = app.router.clone().oneshot(req).await.unwrap();
323
330
assert_eq!(resp.status(), StatusCode::UNAUTHORIZED);
324
331
let body = response_json(resp).await;
325
-
let msg = body["message"].as_str().unwrap_or_default();
332
+
let msg = body["error"].as_str().unwrap_or_default();
326
333
assert!(
327
334
msg.contains("DPoP authentication"),
328
335
"expected DPoP requirement message, got: {msg}"