From 5fbbd990d6b42f5e7534cdb68fa5c368a4a69169 Mon Sep 17 00:00:00 2001
From: Jesper Jensen <jesper@jnsn.dev>
Date: Wed, 18 Feb 2026 18:34:02 +0100
Subject: Generate secrets for clients

---
 test/http.c | 68 ++++++++++++++++++++++++++++++++++++++++++++++++++++---------
 1 file changed, 58 insertions(+), 10 deletions(-)

(limited to 'test')

diff --git a/test/http.c b/test/http.c
index fa7755d..8309d5e 100644
--- a/test/http.c
+++ b/test/http.c
@@ -6,6 +6,7 @@
 #include <curl/curl.h>
 #include <stdlib.h>
 #include <string.h>
+#include <cjson/cJSON.h>
 
 // @PASTE Stolen from libcurl documentation
 struct memory {
@@ -83,6 +84,7 @@ int main(int argc, char **argv) {
 
 	}
 
+	char client_secret[CLIENT_SECRET_LEN] = {0};
 	{
 		curlRes = curl_easy_setopt(curl, CURLOPT_URL, "http://localhost:8080/api/client");
 		assert(curlRes == CURLE_OK);
@@ -124,12 +126,18 @@ int main(int argc, char **argv) {
 		assert(strcmp(ct, "application/json") == 0);
 
 		assert(body.size >= 0);
-		assert(strcmp(
-			body.body,
-			"{ "
-				"\"id\": \"1\" "
-			"}"
-		) == 0);
+		// Parse response to extract secret
+		cJSON *rootJson = cJSON_ParseWithLength(body.body, body.size);
+		assert(rootJson != NULL);
+		cJSON *idJson = cJSON_GetObjectItemCaseSensitive(rootJson, "id");
+		assert(cJSON_IsString(idJson));
+		assert(strcmp(idJson->valuestring, "1") == 0);
+		cJSON *secretJson = cJSON_GetObjectItemCaseSensitive(rootJson, "secret");
+		assert(cJSON_IsString(secretJson));
+		assert(strlen(secretJson->valuestring) == 32);
+		strncpy(client_secret, secretJson->valuestring, CLIENT_SECRET_LEN);
+		cJSON_Delete(rootJson);
+		free(body.body);
 		body = (struct memory){0};
 	}
 
@@ -146,9 +154,11 @@ int main(int argc, char **argv) {
 		curlRes = curl_easy_setopt(curl, CURLOPT_READFUNCTION, read_from_memory);
 		assert(curlRes == CURLE_OK);
 
+		char req_buf[256];
+		snprintf(req_buf, sizeof(req_buf), "{\"client\": \"client1\", \"secret\": \"%s\", \"event\": \"begin_backup\"}", client_secret);
 		struct memory req_body = {
-			.body = "{\"client\": \"client1\", \"event\": \"begin_backup\"}",
-			.size = strlen(req_body.body),
+			.body = req_buf,
+			.size = strlen(req_buf),
 		};
 		curlRes = curl_easy_setopt(curl, CURLOPT_READDATA, &req_body);
 		assert(curlRes == CURLE_OK);
@@ -192,9 +202,11 @@ int main(int argc, char **argv) {
 		curlRes = curl_easy_setopt(curl, CURLOPT_READFUNCTION, read_from_memory);
 		assert(curlRes == CURLE_OK);
 
+		char req_buf[256];
+		snprintf(req_buf, sizeof(req_buf), "{\"client\": \"client1\", \"secret\": \"%s\", \"event\": \"end_backup\"}", client_secret);
 		struct memory req_body = {
-			.body = "{\"client\": \"client1\", \"event\": \"end_backup\"}",
-			.size = strlen(req_body.body),
+			.body = req_buf,
+			.size = strlen(req_buf),
 		};
 		curlRes = curl_easy_setopt(curl, CURLOPT_READDATA, &req_body);
 		assert(curlRes == CURLE_OK);
@@ -223,5 +235,41 @@ int main(int argc, char **argv) {
 		body = (struct memory){0};
 	}
 
+	// Test: wrong secret should return 401
+	{
+		curlRes = curl_easy_setopt(curl, CURLOPT_URL, "http://localhost:8080/api/report");
+		assert(curlRes == CURLE_OK);
+
+		curlRes = curl_easy_setopt(curl, CURLOPT_UPLOAD, 1L);
+		assert(curlRes == CURLE_OK);
+
+		curlRes = curl_easy_setopt(curl, CURLOPT_POST, 1L);
+		assert(curlRes == CURLE_OK);
+
+		curlRes = curl_easy_setopt(curl, CURLOPT_READFUNCTION, read_from_memory);
+		assert(curlRes == CURLE_OK);
+
+		struct memory req_body = {
+			.body = "{\"client\": \"client1\", \"secret\": \"wrongsecret\", \"event\": \"begin_backup\"}",
+			.size = strlen("{\"client\": \"client1\", \"secret\": \"wrongsecret\", \"event\": \"begin_backup\"}"),
+		};
+		curlRes = curl_easy_setopt(curl, CURLOPT_READDATA, &req_body);
+		assert(curlRes == CURLE_OK);
+
+		curlRes = curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_to_memory);
+		assert(curlRes == CURLE_OK);
+
+		struct memory body = {0};
+		curlRes = curl_easy_setopt(curl, CURLOPT_WRITEDATA, &body);
+		assert(curlRes == CURLE_OK);
+
+		curlRes = curl_easy_perform(curl);
+		assert(curlRes == CURLE_OK);
+
+		long code;
+		curlRes = curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &code);
+		assert(code == 401);  // Unauthorized
+	}
+
 	web_join(&server);
 }
-- 
cgit v1.2.3