Properly initiate UIA sessions in TestRegistration

Signed-off-by: timedout <git@nexy7574.co.uk>

Author: timedoutuk

tests/csapi/apidoc_register_test.go

@@ -6,7 +6,9 @@ import (
 	"encoding/hex"
 	"encoding/json"
 	"fmt"
+	"io"
 	"io/ioutil"
+	"maps"
 	"net/http"
 	"net/url"
 	"testing"
@@ -63,14 +65,10 @@ func TestRegistration(t *testing.T) {
 		// sytest: POST /register can create a user
 		t.Run("POST /register can create a user", func(t *testing.T) {
 			t.Parallel()
-			res := unauthedClient.Do(t, "POST", []string{"_matrix", "client", "v3", "register"}, client.WithRawBody(json.RawMessage(`{
-				"auth": {
-					"type": "m.login.dummy"
-				},
-				"username": "post-can-create-a-user",
-				"password": "sUp3rs3kr1t"
-			}`)))
+			reqBody, _ := startUIASession(t, unauthedClient, "post-can-create-a-user", "sUp3rs3kr1t", nil)
+			res := unauthedClient.Do(t, "POST", []string{"_matrix", "client", "v3", "register"}, client.WithJSONBody(t, reqBody))
 			must.MatchResponse(t, res, match.HTTPResponse{
+				StatusCode: 200,
 				JSON: []match.JSON{
 					match.JSONKeyTypeEqual("access_token", gjson.String),
 					match.JSONKeyTypeEqual("user_id", gjson.String),
@@ -80,14 +78,10 @@ func TestRegistration(t *testing.T) {
 		// sytest: POST /register downcases capitals in usernames
 		t.Run("POST /register downcases capitals in usernames", func(t *testing.T) {
 			t.Parallel()
-			res := unauthedClient.Do(t, "POST", []string{"_matrix", "client", "v3", "register"}, client.WithRawBody(json.RawMessage(`{
-				"auth": {
-					"type": "m.login.dummy"
-				},
-				"username": "user-UPPER",
-				"password": "sUp3rs3kr1t"
-			}`)))
+			reqBody, _ := startUIASession(t, unauthedClient, "user-UPPER", "sUp3rs3kr1t", nil)
+			res := unauthedClient.Do(t, "POST", []string{"_matrix", "client", "v3", "register"}, client.WithJSONBody(t, reqBody))
 			must.MatchResponse(t, res, match.HTTPResponse{
+				StatusCode: 200,
 				JSON: []match.JSON{
 					match.JSONKeyTypeEqual("access_token", gjson.String),
 					match.JSONKeyEqual("user_id", "@user-upper:hs1"),
@@ -98,15 +92,10 @@ func TestRegistration(t *testing.T) {
 		t.Run("POST /register returns the same device_id as that in the request", func(t *testing.T) {
 			t.Parallel()
 			deviceID := "my_device_id"
-			res := unauthedClient.Do(t, "POST", []string{"_matrix", "client", "v3", "register"}, client.WithRawBody(json.RawMessage(`{
-				"auth": {
-					"type": "m.login.dummy"
-				},
-				"username": "user-device",
-				"password": "sUp3rs3kr1t",
-				"device_id": "`+deviceID+`"
-			}`)))
+			reqBody, _ := startUIASession(t, unauthedClient, "user-device", deviceID, map[string]any{"device_id": deviceID})
+			res := unauthedClient.Do(t, "POST", []string{"_matrix", "client", "v3", "register"}, client.WithJSONBody(t, reqBody))
 			must.MatchResponse(t, res, match.HTTPResponse{
+				StatusCode: 200,
 				JSON: []match.JSON{
 					match.JSONKeyTypeEqual("access_token", gjson.String),
 					match.JSONKeyEqual("device_id", deviceID),
@@ -134,14 +123,10 @@ func TestRegistration(t *testing.T) {
 				`'`,
 			}
 			for _, ch := range specialChars {
-				res := unauthedClient.Do(t, "POST", []string{"_matrix", "client", "v3", "register"},
-					client.WithJSONBody(t, map[string]interface{}{
-						"auth": map[string]string{
-							"type": "m.login.dummy",
-						},
-						"username": "user-" + ch + "-reject-please",
-						"password": "sUp3rs3kr1t",
-					}))
+				// CONCERN: Should servers be expected to validate parameters before starting a UIA session?
+				// This test will flake if they do so, since 401 will be returned instead of 400.
+				reqBody, _ := startUIASession(t, unauthedClient, "user-"+ch+"-reject-please", "sUp3rs3kr1t", nil)
+				res := unauthedClient.Do(t, "POST", []string{"_matrix", "client", "v3", "register"}, client.WithJSONBody(t, reqBody))
 				must.MatchResponse(t, res, match.HTTPResponse{
 					StatusCode: 400,
 					JSON: []match.JSON{
@@ -152,28 +137,21 @@ func TestRegistration(t *testing.T) {
 		})
 		t.Run("POST /register rejects if user already exists", func(t *testing.T) {
 			t.Parallel()
-			res := unauthedClient.Do(t, "POST", []string{"_matrix", "client", "v3", "register"}, client.WithRawBody(json.RawMessage(`{
-				"auth": {
-					"type": "m.login.dummy"
-				},
-				"username": "post-can-create-a-user-once",
-				"password": "sUp3rs3kr1t"
-			}`)))
+			reqBody, _ := startUIASession(t, unauthedClient, "post-can-create-a-user-once", "sUp3rs3kr1t", nil)
+			res := unauthedClient.Do(t, "POST", []string{"_matrix", "client", "v3", "register"}, client.WithJSONBody(t, reqBody))
 			must.MatchResponse(t, res, match.HTTPResponse{
 				JSON: []match.JSON{
 					match.JSONKeyTypeEqual("access_token", gjson.String),
 					match.JSONKeyTypeEqual("user_id", gjson.String),
 				},
 			})
-			res = unauthedClient.Do(t, "POST", []string{"_matrix", "client", "v3", "register"}, client.WithRawBody(json.RawMessage(`{
-				"auth": {
-					"type": "m.login.dummy"
-				},
-				"username": "post-can-create-a-user-once",
-				"password": "anotherSuperSecret"
-			}`)))
+			reqBody, _ = startUIASession(t, unauthedClient, "post-can-create-a-user-once", "sUp3rs3kr1t", nil)
+			res = unauthedClient.Do(t, "POST", []string{"_matrix", "client", "v3", "register"}, client.WithJSONBody(t, reqBody))
 			must.MatchResponse(t, res, match.HTTPResponse{
 				StatusCode: 400,
+				JSON: []match.JSON{
+					match.JSONKeyEqual("errcode", "M_USER_IN_USE"),
+				},
 			})
 		})
 		// sytest: POST /register allows registration of usernames with '$chr'
@@ -346,3 +324,29 @@ func registerSharedSecret(t *testing.T, c *client.CSAPI, user, pass string, isAd
 	resp = c.Do(t, "POST", []string{"_synapse", "admin", "v1", "register"}, client.WithJSONBody(t, reqBody))
 	return resp
 }
+
+// startUIASession starts a UIA session and returns the updated request body,
+// and associated session token, failing the test if the response is not a UIA challenge.
+func startUIASession(t *testing.T, c *client.CSAPI, user, pass string, extra map[string]any) (map[string]any, string) {
+	reqBody := map[string]any{
+		"username": user,
+		"password": pass,
+	}
+	if extra != nil {
+		maps.Copy(extra, reqBody)
+	}
+	res := c.Do(t, "POST", []string{"_matrix", "client", "v3", "register"}, client.WithJSONBody(t, reqBody))
+	if res.StatusCode != 401 {
+		t.Fatalf("expected status code 401 (UIA challenge), got %d", res.StatusCode)
+	}
+	body, err := io.ReadAll(res.Body)
+	if err != nil {
+		t.Fatal(err)
+	}
+	session := client.GetJSONFieldStr(t, body, "session")
+	if session == "" {
+		t.Fatal("expected non-empty `session` in uia challenge")
+	}
+	reqBody["auth"] = map[string]string{"session": session, "type": "m.login.dummy"}
+	return reqBody, session
+}