1 files changed, 114 insertions, 0 deletions
diff --git a/packages/meshbay-hub/tests/test_group_membership.py b/packages/meshbay-hub/tests/test_group_membership.py
new file mode 100644
index 0000000..7eeaa2f
--- /dev/null
+++ b/packages/meshbay-hub/tests/test_group_membership.py
@@ -0,0 +1,114 @@
+"""
+Removing someone from a group.
+
+The distinction these pin is the one that matters: removing a member from a
+group is not deleting their account. It takes away one membership row, and
+leaves the person, their other groups and everything they have uploaded exactly
+where they were.
+"""
+
+import base64
+import hashlib
+
+import pytest
+from sqlalchemy import select
+
+from meshbay_hub.db.models import Group, GroupMember, User
+
+
+def _auth_key(password: str, username: str) -> str:
+    salt = hashlib.sha256(f"meshbay:auth:v1:{username}".encode()).digest()
+    return base64.b64encode(
+        hashlib.pbkdf2_hmac("sha512", password.encode(), salt, 600_000, 32)).decode()
+
+
+async def _user(client, username, password="a-long-enough-passphrase"):
+    await client.post("/v1/users/register", json={
+        "username": username, "email": f"{username}@example.com",
+        "auth_key": _auth_key(password, username)})
+    r = await client.post("/v1/users/login", json={
+        "username": username, "auth_key": _auth_key(password, username)})
+    return {"Authorization": f"Bearer {r.json()['access_token']}"}
+
+
+async def _group_with_member(client, owner, member_name, name="crew"):
+    g = await client.post("/v1/groups", json={"name": name}, headers=owner)
+    gid = g.json()["group_id"]
+    await client.post(f"/v1/groups/{gid}/members/{member_name}", json={},
+                      headers=owner)
+    return gid
+
+
+@pytest.mark.asyncio
+async def test_the_owner_removes_a_member(client, db_session):
+    owner = await _user(client, "chief")
+    await _user(client, "hanger_on")
+    gid = await _group_with_member(client, owner, "hanger_on")
+
+    r = await client.delete(f"/v1/groups/{gid}/members/hanger_on", headers=owner)
+    assert r.status_code == 200, r.text
+
+    rows = (await db_session.execute(
+        select(GroupMember).where(GroupMember.group_id == gid))).scalars().all()
+    assert [m.user_id for m in rows] != [], "the owner lost their own membership"
+    names = {(await db_session.get(User, m.user_id)).username for m in rows}
+    assert names == {"chief"}
+
+
+@pytest.mark.asyncio
+async def test_removing_a_member_is_not_deleting_an_account(client, db_session):
+    """
+    The account survives untouched, with its other groups. Anything else would
+    make one group's owner able to erase someone from the whole hub.
+    """
+    owner = await _user(client, "boss")
+    member = await _user(client, "member_x")
+    elsewhere = await _user(client, "other_owner")
+
+    gid = await _group_with_member(client, owner, "member_x")
+    other = await _group_with_member(client, elsewhere, "member_x", name="elsewhere")
+
+    await client.delete(f"/v1/groups/{gid}/members/member_x", headers=owner)
+
+    user = (await db_session.execute(
+        select(User).where(User.username == "member_x"))).scalar_one()
+    assert user.status == "active", "the account was touched"
+
+    me = await client.get("/v1/users/me", headers=member)
+    assert me.status_code == 200, "they can no longer sign in"
+
+    still = await db_session.get(GroupMember, (other, user.id))
+    assert still is not None, "removing them from one group emptied another"
+
+
+@pytest.mark.asyncio
+async def test_a_member_cannot_remove_anyone(client):
+    owner = await _user(client, "owner_y")
+    member = await _user(client, "member_y")
+    await _user(client, "victim_y")
+    gid = await _group_with_member(client, owner, "member_y")
+    await client.post(f"/v1/groups/{gid}/members/victim_y", json={}, headers=owner)
+
+    r = await client.delete(f"/v1/groups/{gid}/members/victim_y", headers=member)
+    assert r.status_code == 403
+
+
+@pytest.mark.asyncio
+async def test_the_owner_cannot_be_removed_from_their_own_group(client):
+    """Otherwise the group is left with nobody who can invite or remove."""
+    owner = await _user(client, "owner_z")
+    gid = await _group_with_member(client, owner, "owner_z")
+
+    r = await client.delete(f"/v1/groups/{gid}/members/owner_z", headers=owner)
+    assert r.status_code == 409
+
+
+@pytest.mark.asyncio
+async def test_removing_someone_who_is_not_a_member_says_so(client):
+    owner = await _user(client, "owner_w")
+    await _user(client, "stranger")
+    g = await client.post("/v1/groups", json={"name": "closed"}, headers=owner)
+    gid = g.json()["group_id"]
+
+    r = await client.delete(f"/v1/groups/{gid}/members/stranger", headers=owner)
+    assert r.status_code == 404