nordisk/monetize

crates/monetize-server/tests/no_order_page_of_its_own.rs

//! ★ **The ONE box sells on no order page of its own** (owner decision OD6, 2026-10-26: "the
//! ONE box's own /shop/private and /kop pages are DELETED; buying happens on each product
//! site's own sign-up").
//!
//! The purchase page (`/kop`, `/kop/start`, `/kop/klar`), the private-estate order page
//! (`/shop/private`, `…/start`, `…/change`, `…/klar`) and the intake that only linked to `/kop`
//! (`/shop`) answer 404 on monetize-server's listener, as any path it never served does. The
//! account sign-up page (`/shop/signup`) is still served.

use std::io::{Read as _, Write as _};
use std::sync::Arc;

use monetize_server::registry::Registry;
use monetize_server::state::AppState;

const RETIRED: &[(&str, &str)] = &[
    ("GET", "/kop?product=holger&tenant=acme&plan=holger%2F10gb&ticket=ab"),
    ("POST", "/kop/start?pass=00000000000000000000000000000000"),
    ("GET", "/kop/klar?reference=p-1"),
    ("GET", "/shop?product=holger&repository=acme"),
    ("GET", "/shop/private?product=holger&site=holger.rs"),
    ("POST", "/shop/private/start?pass=00000000000000000000000000000000"),
    ("POST", "/shop/private/change?pass=00000000000000000000000000000000"),
    ("GET", "/shop/private/klar?company=acme"),
];

/// The answer's status line and headers, the date dropped.
fn ask(addr: std::net::SocketAddr, method: &str, path: &str) -> String {
    let mut c = std::net::TcpStream::connect(addr).unwrap();
    write!(c, "{method} {path} HTTP/1.1\r\nHost: monetize.mock.invalid\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 0\r\nConnection: close\r\n\r\n").unwrap();
    let mut raw = Vec::new();
    c.read_to_end(&mut raw).unwrap();
    let text = String::from_utf8_lossy(&raw).into_owned();
    let head = text.split("\r\n\r\n").next().unwrap_or("");
    head.lines().filter(|l| !l.to_ascii_lowercase().starts_with("date:")).collect::<Vec<_>>().join("\n")
}

#[test]
fn the_retired_order_pages_answer_as_a_path_never_served_and_the_sign_up_page_stays() {
    let rt = tokio::runtime::Builder::new_multi_thread().worker_threads(2).enable_all().build().unwrap();
    let state = Arc::new(AppState::in_memory(Registry::new()));
    let app = monetize_server::router(state, Arc::new("test-bearer-token-of-sufficient-length".into()));
    let addr = rt.block_on(async {
        let l = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let addr = l.local_addr().unwrap();
        tokio::spawn(async move { axum::serve(l, app).await.unwrap() });
        addr
    });
    // The listener's answer for a path it never served (tonic's router: no such service).
    let never = ask(addr, "GET", "/a-page-never-served");
    let served: Vec<String> = RETIRED.iter().filter(|(m, p)| ask(addr, m, p) != never.replace("GET", m)).map(|(m, p)| format!("{m} {p}: {}", ask(addr, m, p))).collect();
    assert!(served.is_empty(), "still served (a never-served path answers {never:?}): {served:#?}");
    // ★ A33-12: the ONE box's own sign-up page is gone too (each site's own /signup sells
    // accounts): it answers as a path never served.
    for (m, p) in [("GET", "/shop/signup?product=holger&site=holger.rs"), ("POST", "/shop/signup/start"), ("GET", "/shop/signup/welcome"), ("POST", "/shop/signup/again"), ("POST", "/shop/signup/rename")] {
        assert_eq!(ask(addr, m, p), never.replace("GET", m), "{m} {p} is still served");
    }
}