From 91504656a2153cefef5759aa693a2723d95e301a Mon Sep 17 00:00:00 2001
From: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Date: Thu, 21 Sep 2023 16:49:22 +0200
Subject: [PATCH] Bug 34478: [DO NOT PUSH] Cypress tests

This should not be pushed, we are not ready on jenkins.
---
 cypress.config.ts                  |   3 +
 t/cypress/integration/Auth/csrf.ts | 153 +++++++++++++++++++++++++++++
 2 files changed, 156 insertions(+)
 create mode 100644 t/cypress/integration/Auth/csrf.ts

diff --git a/cypress.config.ts b/cypress.config.ts
index 95d03d37e87..c2d49b4579b 100644
--- a/cypress.config.ts
+++ b/cypress.config.ts
@@ -7,6 +7,9 @@ export default defineConfig({
     defaultCommandTimeout: 10000,
 
     e2e: {
+        setupNodeEvents(on, config) {
+            return require("./t/cypress/plugins/index.js")(on, config);
+        },
         experimentalStudio: true,
         baseUrl: "http://kohadev-intra.mydnsname.org:8081",
         specPattern: "t/cypress/integration/**/*.*",
diff --git a/t/cypress/integration/Auth/csrf.ts b/t/cypress/integration/Auth/csrf.ts
new file mode 100644
index 00000000000..1db1c65018c
--- /dev/null
+++ b/t/cypress/integration/Auth/csrf.ts
@@ -0,0 +1,153 @@
+import { mount } from "@cypress/vue";
+
+const branchcode = "TEST_LIB";
+const branchname = "test_branchname";
+
+function cleanup() {
+    const sql = "DELETE FROM branches WHERE branchcode=?";
+    cy.query(sql, branchcode);
+}
+
+describe("CSRF", () => {
+    beforeEach(() => {
+        cy.login();
+        cy.title().should("eq", "Koha staff interface");
+    });
+
+    before(function () {
+        cleanup();
+    });
+    after(function () {
+        cleanup();
+    });
+
+    it("Add using POST without csrf", () => {
+        cy.visit("/cgi-bin/koha/admin/branches.pl");
+
+        cy.get("#newbranch").click();
+        cy.get("#Aform").find("input[name='csrf_token']").invoke("remove");
+        cy.get("#branchcode").type(branchcode);
+        cy.get("#branchname").type(branchname);
+        cy.get("#Aform").contains("Submit").click();
+
+        cy.get("main")
+            .find(".message")
+            .contains(/Wrong CSRF token/);
+
+        cy.query(
+            "SELECT COUNT(*) as count FROM branches WHERE branchcode=?",
+            branchcode
+        ).then(result => {
+            expect(result[0].count).to.equal(0);
+        });
+    });
+
+    it("Add using GET", () => {
+        // Trying correct op=cud-add_validate
+        cy.visit(
+            "/cgi-bin/koha/admin/branches.pl?op=cud-add_validate&branchcode=" +
+                branchcode +
+                "&branchname=" +
+                branchname
+        );
+
+        // We do not display a message
+        // We do not want Wrong CSRF token here
+        cy.get(".message").should("not.exist");
+
+        // Trying incorrect op=add_validate
+        cy.visit(
+            "/cgi-bin/koha/admin/branches.pl?op=add_validate&branchcode=" +
+                branchcode +
+                "&branchname=" +
+                branchname
+        );
+
+        // We do not display a message
+        // We do not want Wrong CSRF token here
+        cy.get(".message").should("not.exist");
+
+        cy.query(
+            "SELECT COUNT(*) as count FROM branches WHERE branchcode=?",
+            branchcode
+        ).then(result => {
+            expect(result[0].count).to.equal(0);
+        });
+    });
+
+    it("Add", () => {
+        cy.visit("/cgi-bin/koha/admin/branches.pl");
+
+        cy.get("#newbranch").click();
+        cy.get("#branchcode").type(branchcode);
+        cy.get("#branchname").type(branchname);
+        cy.get("#Aform").contains("Submit").click();
+
+        cy.get("main")
+            .find(".message")
+            .contains(/Library added successfully/);
+
+        cy.get("select[name='libraries_length']").select("-1");
+        cy.get("td").contains(branchcode);
+
+        cy.query(
+            "SELECT COUNT(*) as count FROM branches WHERE branchcode=?",
+            branchcode
+        ).then(result => {
+            expect(result[0].count).to.equal(1);
+        });
+    });
+
+    it("Delete without CSRF", () => {
+        cy.query("INSERT INTO branches(branchcode, branchname) VALUES (?, ?)", [
+            branchcode,
+            branchname,
+        ]);
+
+        cy.visit("/cgi-bin/koha/admin/branches.pl");
+        cy.get("select[name='libraries_length']").select("-1");
+        cy.get("#delete_library_" + branchcode).click();
+
+        // Remove CSRF Token
+        cy.get("form[method='post']")
+            .find("input[name='csrf_token']")
+            .invoke("remove");
+
+        cy.contains("Yes, delete").click();
+
+        cy.get("main")
+            .find(".message")
+            .contains(/Wrong CSRF token/);
+
+        cy.query(
+            "SELECT COUNT(*) as count FROM branches WHERE branchcode=?",
+            branchcode
+        ).then(result => {
+            expect(result[0].count).to.equal(1);
+        });
+    });
+
+    it("Delete", () => {
+        cy.query("INSERT INTO branches(branchcode, branchname) VALUES (?, ?)", [
+            branchcode,
+            branchname,
+        ]);
+
+        cy.visit("/cgi-bin/koha/admin/branches.pl");
+        cy.get("select[name='libraries_length']").select("-1");
+        cy.get("#delete_library_" + branchcode).click();
+
+        cy.contains("Yes, delete").click();
+
+        cy.get("main")
+            .find(".message")
+            .contains(/Library deleted successfully/);
+
+        cy.query(
+            "SELECT COUNT(*) as count FROM branches WHERE branchcode=?",
+            branchcode
+        ).then(result => {
+            expect(result[0].count).to.equal(0);
+        });
+    });
+});
-- 
2.25.1