feat: PATCH /v1/user/me — профиль и смена пароля. Refs EventHub/EventHubBack#48

2026-07-19 23:26:34 +03:00
parent 5b638de450
commit 0934e2c413
6 changed files with 652 additions and 25 deletions
@@ -43,6 +43,7 @@
  client_get/2,
  client_post/3,
  client_put/3,
+  client_patch/3,
  client_delete/2,
  admin_patch/3]).
 -export([verify_user/2]).
@@ -314,6 +315,12 @@ client_put(Path, Token, BodyMap) ->
  {ok, 200, _, RespBody} = client_request(put, Path, Token, Body),
  jsx:decode(list_to_binary(RespBody), [return_maps]).

+-spec client_patch(binary(), binary(), map()) -> jsx:json_term().
+client_patch(Path, Token, BodyMap) ->
+  Body = jsx:encode(BodyMap),
+  {ok, 200, _, RespBody} = client_request(patch, Path, Token, Body),
+  jsx:decode(list_to_binary(RespBody), [return_maps]).
+
 -spec client_delete(binary(), binary()) -> jsx:json_term().
 client_delete(Path, Token) ->
  {ok, 200, _, Body} = client_request(delete, Path, Token),
@@ -1,13 +1,8 @@
 %%%-------------------------------------------------------------------
-%%% @doc Тесты клиентского API для получения профиля текущего пользователя.
+%%% @doc Тесты клиентского API профиля текущего пользователя.
 %%%
-%%% Покрывает эндпоинты:
-%%%   GET /v1/user/me
-%%%
-%%% Проверяет:
-%%%   - успешное получение профиля с валидным токеном
-%%%   - ошибку 401 при отсутствии токена
-%%%   - наличие ключевых полей в ответе
+%%% GET   /v1/user/me
+%%% PATCH /v1/user/me
 %%% @end
 %%%-------------------------------------------------------------------
 -module(user_me_tests).
@@ -15,27 +10,36 @@

 -export([test/0]).

-%%%===================================================================
-%%% Главная тестовая функция
-%%%===================================================================
-
 -spec test() -> ok.
 test() ->
  ct:pal("=== User Profile (me) Tests ==="),
-  Token = api_test_runner:get_user_token(),
+  Email = api_test_runner:unique_email(<<"meuser">>),
+  Pass0 = <<"oldpass1">>,
+  Token = api_test_runner:register_and_login(Email, Pass0),

  test_get_me_success(Token),
  test_get_me_unauthorized(),
+  test_patch_language(Token),
+  test_patch_profile_fields(Token),
+  test_patch_avatar_and_preferences(Token),
+  test_patch_null_clears(Token),
+  test_patch_invalid_language(Token),
+  test_patch_empty_body(Token),
+  test_patch_invalid_json(Token),
+  test_patch_unknown_field(Token),
+  test_patch_forbid_email(Token),
+  test_patch_unauthorized(),
+  test_patch_password_wrong_current(Token, Pass0),
+  test_patch_password_ok(Token, Pass0, <<"newpass2">>, Email),
+  test_patch_password_pair_required(Token),

  ct:pal("=== All user me tests passed ==="),
  ok.

 %%%===================================================================
-%%% Тестовые функции
+%%% GET
 %%%===================================================================

-%% @doc Успешное получение профиля: 200 OK, возвращает данные пользователя.
-spec test_get_me_success(binary()) -> ok.
 test_get_me_success(Token) ->
  ct:pal("  TEST: Get current user profile"),
  User = api_test_runner:client_get(<<"/v1/user/me">>, Token),
@@ -46,10 +50,120 @@ test_get_me_success(Token) ->
  ?assert(maps:is_key(<<"status">>, User)),
  ct:pal("    OK: got profile for ~s", [maps:get(<<"email">>, User)]).

-%% @doc Отсутствие токена: 401 Unauthorized.
-spec test_get_me_unauthorized() -> ok.
 test_get_me_unauthorized() ->
  ct:pal("  TEST: Get profile without token"),
  Resp = api_test_runner:client_request(get, <<"/v1/user/me">>, <<>>),
  ?assertMatch({ok, 401, _, _}, Resp),
-  ct:pal("    OK: got 401 unauthorized").
+  ct:pal("    OK: got 401 unauthorized").
+
+%%%===================================================================
+%%% PATCH
+%%%===================================================================
+
+test_patch_language(Token) ->
+  ct:pal("  TEST: PATCH language"),
+  User = api_test_runner:client_patch(<<"/v1/user/me">>, Token,
+    #{language => <<"en">>}),
+  ?assertEqual(<<"en">>, maps:get(<<"language">>, User)),
+  ct:pal("    OK").
+
+test_patch_profile_fields(Token) ->
+  ct:pal("  TEST: PATCH nickname/timezone/phone"),
+  User = api_test_runner:client_patch(<<"/v1/user/me">>, Token,
+    #{nickname => <<"Nick">>, timezone => <<"Europe/Moscow">>, phone => <<"+7000">>}),
+  ?assertEqual(<<"Nick">>, maps:get(<<"nickname">>, User)),
+  ?assertEqual(<<"Europe/Moscow">>, maps:get(<<"timezone">>, User)),
+  ?assertEqual(<<"+7000">>, maps:get(<<"phone">>, User)),
+  ct:pal("    OK").
+
+test_patch_avatar_and_preferences(Token) ->
+  ct:pal("  TEST: PATCH avatar_url and preferences"),
+  User = api_test_runner:client_patch(<<"/v1/user/me">>, Token,
+    #{avatar_url => <<"https://cdn.example/a.png">>,
+      preferences => #{<<"theme">> => <<"dark">>, <<"notify">> => true}}),
+  ?assertEqual(<<"https://cdn.example/a.png">>, maps:get(<<"avatar_url">>, User)),
+  Prefs = maps:get(<<"preferences">>, User),
+  ?assertEqual(<<"dark">>, maps:get(<<"theme">>, Prefs)),
+  ?assertEqual(true, maps:get(<<"notify">>, Prefs)),
+  ct:pal("    OK").
+
+test_patch_null_clears(Token) ->
+  ct:pal("  TEST: PATCH null clears optional fields"),
+  User = api_test_runner:client_patch(<<"/v1/user/me">>, Token,
+    #{nickname => null, phone => null, avatar_url => null,
+      timezone => null, preferences => null}),
+  ?assertEqual(<<>>, maps:get(<<"nickname">>, User)),
+  ?assertEqual(<<>>, maps:get(<<"phone">>, User)),
+  ?assertEqual(<<>>, maps:get(<<"avatar_url">>, User)),
+  ?assertEqual(<<>>, maps:get(<<"timezone">>, User)),
+  ?assertEqual(#{}, maps:get(<<"preferences">>, User)),
+  ct:pal("    OK").
+
+test_patch_invalid_language(Token) ->
+  ct:pal("  TEST: PATCH invalid language -> 400"),
+  Body = jsx:encode(#{language => <<"de">>}),
+  Resp = api_test_runner:client_request(patch, <<"/v1/user/me">>, Token, Body),
+  ?assertMatch({ok, 400, _, _}, Resp),
+  ct:pal("    OK").
+
+test_patch_empty_body(Token) ->
+  ct:pal("  TEST: PATCH empty body -> 400"),
+  Resp = api_test_runner:client_request(patch, <<"/v1/user/me">>, Token, <<"{}">>),
+  ?assertMatch({ok, 400, _, _}, Resp),
+  ct:pal("    OK").
+
+test_patch_invalid_json(Token) ->
+  ct:pal("  TEST: PATCH invalid JSON -> 400"),
+  Resp = api_test_runner:client_request(patch, <<"/v1/user/me">>, Token, <<"{not-json">>),
+  ?assertMatch({ok, 400, _, _}, Resp),
+  ct:pal("    OK").
+
+test_patch_unknown_field(Token) ->
+  ct:pal("  TEST: PATCH unknown field -> 400"),
+  Body = jsx:encode(#{email => <<"hack@x.com">>}),
+  Resp = api_test_runner:client_request(patch, <<"/v1/user/me">>, Token, Body),
+  ?assertMatch({ok, 400, _, _}, Resp),
+  ct:pal("    OK").
+
+test_patch_forbid_email(Token) ->
+  ct:pal("  TEST: PATCH role -> 400"),
+  Body = jsx:encode(#{role => <<"bot">>}),
+  Resp = api_test_runner:client_request(patch, <<"/v1/user/me">>, Token, Body),
+  ?assertMatch({ok, 400, _, _}, Resp),
+  ct:pal("    OK").
+
+test_patch_unauthorized() ->
+  ct:pal("  TEST: PATCH without token -> 401"),
+  Body = jsx:encode(#{language => <<"ru">>}),
+  Resp = api_test_runner:client_request(patch, <<"/v1/user/me">>, <<>>, Body),
+  ?assertMatch({ok, 401, _, _}, Resp),
+  ct:pal("    OK").
+
+test_patch_password_wrong_current(Token, Current) ->
+  ct:pal("  TEST: PATCH password wrong current -> 403"),
+  Body = jsx:encode(#{current_password => <<"nope">>, password => <<"x", Current/binary>>}),
+  Resp = api_test_runner:client_request(patch, <<"/v1/user/me">>, Token, Body),
+  ?assertMatch({ok, 403, _, _}, Resp),
+  ct:pal("    OK").
+
+test_patch_password_ok(Token, OldPass, NewPass, Email) ->
+  ct:pal("  TEST: PATCH password ok"),
+  User = api_test_runner:client_patch(<<"/v1/user/me">>, Token,
+    #{current_password => OldPass, password => NewPass}),
+  ?assert(maps:is_key(<<"id">>, User)),
+  %% login with new password
+  Login = api_test_runner:client_request(post, <<"/v1/login">>, <<>>,
+    jsx:encode(#{email => Email, password => NewPass})),
+  ?assertMatch({ok, 200, _, _}, Login),
+  %% old password fails
+  OldLogin = api_test_runner:client_request(post, <<"/v1/login">>, <<>>,
+    jsx:encode(#{email => Email, password => OldPass})),
+  ?assertMatch({ok, 401, _, _}, OldLogin),
+  ct:pal("    OK").
+
+test_patch_password_pair_required(Token) ->
+  ct:pal("  TEST: PATCH password without current -> 400"),
+  Body = jsx:encode(#{password => <<"alone">>}),
+  Resp = api_test_runner:client_request(patch, <<"/v1/user/me">>, Token, Body),
+  ?assertMatch({ok, 400, _, _}, Resp),
+  ct:pal("    OK").
@@ -0,0 +1,143 @@
+%%%-------------------------------------------------------------------
+%%% @doc EUnit: logic_user:update_me/2 (PATCH /v1/user/me).
+%%% @end
+%%%-------------------------------------------------------------------
+-module(logic_user_tests).
+-include_lib("eunit/include/eunit.hrl").
+-include("records.hrl").
+
+-define(TABLES, [user]).
+-define(PASS, <<"oldpass1">>).
+-define(PASS2, <<"newpass2">>).
+
+setup() ->
+  eh_test_support:start_mnesia(),
+  eh_test_support:ensure_tables(?TABLES),
+  case mnesia:add_table_index(user, email) of
+    {atomic, ok} -> ok;
+    {aborted, {already_exists, user, email}} -> ok;
+    {aborted, Reason} -> error({add_index_failed, Reason})
+  end,
+  ok.
+
+cleanup(_) ->
+  eh_test_support:clear_tables(?TABLES),
+  eh_test_support:delete_tables(?TABLES),
+  eh_test_support:stop_mnesia(),
+  ok.
+
+logic_user_update_me_test_() ->
+  {foreach, fun setup/0, fun cleanup/1, [
+    {"Success profile fields", fun test_success_profile_fields/0},
+    {"Language validation", fun test_language_validation/0},
+    {"Unknown field", fun test_unknown_field/0},
+    {"Password pair required", fun test_password_pair_required/0},
+    {"Wrong password", fun test_wrong_password/0},
+    {"Successful password change", fun test_password_change_ok/0},
+    {"Empty body", fun test_empty_body/0},
+    {"Non-active user forbidden", fun test_non_active_forbidden/0}
+  ]}.
+
+%%%===================================================================
+%%% Helpers
+%%%===================================================================
+
+seed_active_user() ->
+  {ok, Hash} = logic_auth:hash_password(?PASS),
+  User = eh_test_support:make_user(#{
+    id => <<"me_user_1">>,
+    email => <<"me@test.local">>,
+    password_hash => Hash,
+    status => active,
+    nickname => <<"oldnick">>,
+    language => <<"ru">>,
+    timezone => <<"UTC">>,
+    phone => <<"+1000">>,
+    avatar_url => <<"http://old/avatar.png">>,
+    preferences => #{<<"theme">> => <<"light">>}
+  }),
+  ok = mnesia:dirty_write(User),
+  User.
+
+%%%===================================================================
+%%% Cases
+%%%===================================================================
+
+test_success_profile_fields() ->
+  User = seed_active_user(),
+  Body = #{
+    <<"language">> => <<"en">>,
+    <<"nickname">> => <<"Nick">>,
+    <<"timezone">> => <<"Europe/Moscow">>,
+    <<"phone">> => <<"+7000">>,
+    <<"avatar_url">> => <<"http://cdn/a.png">>,
+    <<"preferences">> => #{<<"theme">> => <<"dark">>}
+  },
+  {ok, Updated} = logic_user:update_me(User#user.id, Body),
+  ?assertEqual(<<"en">>, Updated#user.language),
+  ?assertEqual(<<"Nick">>, Updated#user.nickname),
+  ?assertEqual(<<"Europe/Moscow">>, Updated#user.timezone),
+  ?assertEqual(<<"+7000">>, Updated#user.phone),
+  ?assertEqual(<<"http://cdn/a.png">>, Updated#user.avatar_url),
+  ?assertEqual(#{<<"theme">> => <<"dark">>}, Updated#user.preferences).
+
+test_language_validation() ->
+  User = seed_active_user(),
+  ?assertEqual({error, invalid_language},
+    logic_user:update_me(User#user.id, #{<<"language">> => <<"de">>})),
+  ?assertEqual({error, invalid_language},
+    logic_user:update_me(User#user.id, #{<<"language">> => <<"RU">>})),
+  {ok, Ok} = logic_user:update_me(User#user.id, #{<<"language">> => <<"en">>}),
+  ?assertEqual(<<"en">>, Ok#user.language).
+
+test_unknown_field() ->
+  User = seed_active_user(),
+  ?assertEqual({error, unknown_field},
+    logic_user:update_me(User#user.id, #{<<"email">> => <<"x@y.z">>})),
+  ?assertEqual({error, unknown_field},
+    logic_user:update_me(User#user.id, #{<<"role">> => <<"bot">>})).
+
+test_password_pair_required() ->
+  User = seed_active_user(),
+  ?assertEqual({error, password_pair_required},
+    logic_user:update_me(User#user.id, #{<<"password">> => ?PASS2})),
+  ?assertEqual({error, password_pair_required},
+    logic_user:update_me(User#user.id, #{<<"current_password">> => ?PASS})).
+
+test_wrong_password() ->
+  User = seed_active_user(),
+  ?assertEqual({error, wrong_password},
+    logic_user:update_me(User#user.id, #{
+      <<"current_password">> => <<"nope">>,
+      <<"password">> => ?PASS2
+    })).
+
+test_password_change_ok() ->
+  User = seed_active_user(),
+  {ok, Updated} = logic_user:update_me(User#user.id, #{
+    <<"current_password">> => ?PASS,
+    <<"password">> => ?PASS2
+  }),
+  ?assertEqual({ok, true}, logic_auth:verify_password(?PASS2, Updated#user.password_hash)),
+  ?assertEqual({ok, false}, logic_auth:verify_password(?PASS, Updated#user.password_hash)).
+
+test_empty_body() ->
+  User = seed_active_user(),
+  ?assertEqual({error, empty_body}, logic_user:update_me(User#user.id, #{})),
+  ?assertEqual({error, invalid_json}, logic_user:update_me(User#user.id, not_a_map)).
+
+test_non_active_forbidden() ->
+  {ok, Hash} = logic_auth:hash_password(?PASS),
+  Frozen = eh_test_support:make_user(#{
+    id => <<"me_frozen">>,
+    email => <<"frozen@test.local">>,
+    password_hash => Hash,
+    status => frozen
+  }),
+  ok = mnesia:dirty_write(Frozen),
+  ?assertEqual({error, forbidden},
+    logic_user:update_me(Frozen#user.id, #{<<"nickname">> => <<"x">>})),
+  Pending = Frozen#user{id = <<"me_pending">>, email = <<"pending@test.local">>, status = pending},
+  ok = mnesia:dirty_write(Pending),
+  ?assertEqual({error, forbidden},
+    logic_user:update_me(Pending#user.id, #{<<"nickname">> => <<"x">>})).