web interface for table_definition improved

web/src/lib.rs

@@ -8,6 +8,7 @@ use axum::{
 };
 
 mod pages;
+mod schema;
 mod services;
 mod ui;
 mod analytics {
@@ -136,6 +137,7 @@ fn router(state: AppState) -> Router {
         .merge(pages::analytics::router())
         .merge(pages::login::router())
         .merge(pages::admin::admin::router())
+        .merge(pages::admin::table_definition::router())
         .merge(pages::add_table::router())
         .merge(pages::add_logic::router())
         .merge(pages::add_validation::router())
@@ -231,6 +233,48 @@ mod tests {
         assert!(!body.contains("hx-post=\"/logout\""));
     }
 
+    /// Every table-definition endpoint is mounted, and every one of them is
+    /// behind a session: without a cookie there is no request to sign, so each
+    /// answers with the redirect to the login page rather than a 404 or a call
+    /// to the backend.
+    #[tokio::test]
+    async fn the_table_definition_workspace_is_mounted_and_needs_a_session() {
+        for path in ["/admin/table-definition", "/admin/table-definition/workspace"] {
+            let (status, _) = get(path).await;
+            assert_eq!(
+                status,
+                axum::http::StatusCode::SEE_OTHER,
+                "{path} did not send an anonymous visitor to the login page"
+            );
+        }
+
+        for path in [
+            "/admin/table-definition/columns",
+            "/admin/table-definition/columns/builder",
+            "/admin/table-definition/rename",
+            "/admin/table-definition/delete",
+            "/admin/table-definition/copy",
+            "/admin/table-definition/invoice-template",
+        ] {
+            let response = test_router()
+                .oneshot(
+                    Request::builder()
+                        .method("POST")
+                        .uri(path)
+                        .header("content-type", "application/x-www-form-urlencoded")
+                        .body(Body::from("profile=billing&table=invoice"))
+                        .unwrap(),
+                )
+                .await
+                .unwrap();
+            assert_eq!(
+                response.status(),
+                axum::http::StatusCode::SEE_OTHER,
+                "{path} did not send an anonymous visitor to the login page"
+            );
+        }
+    }
+
     #[tokio::test]
     async fn stylesheet_is_served_once_for_every_page() {
         let (status, body) = get("/static/app.css").await;