2 files changed, 51 insertions, 1 deletions
diff --git a/tests/playwright/conftest.py b/tests/playwright/conftest.py
index efa82c6..21edca8 100644
--- a/tests/playwright/conftest.py
+++ b/tests/playwright/conftest.py
@@ -8,7 +8,7 @@ from pyramid.authentication import AuthTktCookieHelper
 from pyramid.testing import DummyRequest
 
 from testutils import load_gpx_asset
-from fietsboek import models
+from fietsboek import models, util
 from fietsboek.models.track import Visibility, TrackType
 from fietsboek.config import Config
 
@@ -119,6 +119,7 @@ class Helper:
                 visibility=Visibility.PRIVATE,
                 description="Another description",
                 type=TrackType.ORGANIC,
+                link_secret=util.random_link_secret(),
             )
             track.date = datetime.datetime(2022, 12, 21, 17, 5, tzinfo=datetime.timezone.utc)
             user.tracks.append(track)
diff --git a/tests/playwright/test_share.py b/tests/playwright/test_share.py
new file mode 100644
index 0000000..de288a0
--- /dev/null
+++ b/tests/playwright/test_share.py
@@ -0,0 +1,49 @@
+from playwright.sync_api import Page, expect
+from sqlalchemy import select
+
+from fietsboek import models
+
+
+def test_view_link(page: Page, playwright_helper, dbaccess):
+    playwright_helper.login()
+    track = playwright_helper.add_track()
+
+    page.goto(f"/track/{track.id}")
+
+    page.locator(".btn", has_text="Share").click()
+
+    expect(page.locator("a", has_text=track.link_secret)).to_be_visible()
+
+
+def test_view_with_link(page: Page, playwright_helper, dbaccess):
+    track = playwright_helper.add_track()
+
+    page.goto(f"/track/{track.id}?secret={track.link_secret}")
+
+    expect(page.locator("h1")).to_have_text("Another awesome track")
+
+
+def test_view_wrong_link(page: Page, playwright_helper, dbaccess):
+    track = playwright_helper.add_track()
+
+    with page.expect_response(lambda resp: resp.status == 403):
+        page.goto(f"/track/{track.id}?secret=foobar")
+
+    assert "Forbidden" in page.content()
+
+
+def test_change_link(page: Page, playwright_helper, dbaccess):
+    playwright_helper.login()
+    track = playwright_helper.add_track()
+    old_secret = track.link_secret
+
+    page.goto(f"/track/{track.id}")
+
+    page.locator(".btn", has_text="Share").click()
+    page.get_by_role("button", name="Invalidate link").click()
+    page.wait_for_load_state()
+
+    query = select(models.Track).filter_by(id=track.id)
+    new_track = dbaccess.execute(query).scalar_one()
+
+    assert old_secret != new_track.link_secret