implement API for username changes

Author: avirshup

src/controllers/user/update.rs

@@ -1,14 +1,18 @@
 use crate::app::AppState;
 use crate::auth::AuthCheck;
-use crate::controllers::helpers::OkResponse;
+use crate::controllers::helpers::{OkResponse, USERNAME_COOLDOWN, check_username};
 use crate::email::EmailMessage;
 use crate::models::NewEmail;
-use crate::schema::users;
+use crate::schema::{abandoned_usernames, users};
 use crate::util::errors::{AppResult, bad_request, server_error};
+
+use crates_io_database::models::NewAbandonedUsername;
+
 use axum::Json;
 use axum::extract::Path;
+use chrono::Utc;
 use diesel::prelude::*;
-use diesel_async::RunQueryDsl;
+use diesel_async::{AsyncConnection, RunQueryDsl};
 use http::request::Parts;
 use lettre::Address;
 use minijinja::context;
@@ -24,6 +28,7 @@ pub struct UserUpdate {
 
 #[derive(Deserialize, utoipa::ToSchema)]
 pub struct User {
+    username: Option<String>,
     email: Option<String>,
     publish_notifications: Option<bool>,
 }
@@ -101,6 +106,33 @@ pub async fn update_user(
         }
     }
 
+    if let Some(newname) = &user_update.user.username
+        && newname != &user.username
+    {
+        conn.transaction(async |conn| -> AppResult<()> {
+            // ensure this username can be adopted
+            check_username(newname, conn).await?;
+
+            let now = Utc::now();
+            diesel::insert_into(abandoned_usernames::table)
+                .values(NewAbandonedUsername {
+                    username: &user.username,
+                    previous_user_id: Some(user.id),
+                    abandoned_at: &now,
+                    available_at: &(now + USERNAME_COOLDOWN),
+                })
+                .execute(conn)
+                .await?;
+            diesel::update(user)
+                .set(users::username.eq(newname))
+                .execute(conn)
+                .await?;
+
+            Ok(())
+        })
+        .await?;
+    }
+
     if let Some(user_email) = &user_update.user.email {
         let user_email = user_email.trim();
 

src/tests/routes/users/update.rs

@@ -1,4 +1,11 @@
 use crate::util::{RequestHelper, Response, TestApp};
+use chrono::{DateTime, TimeDelta, Utc};
+use claims::{assert_ge, assert_le, assert_ok};
+use crates_io_database::models::{AbandonedUsername, NewAbandonedUsername, User};
+use crates_io_database::schema::{abandoned_usernames, reserved_usernames};
+use diesel::HasQuery;
+use diesel::prelude::*;
+use diesel_async::RunQueryDsl;
 use http::StatusCode;
 use insta::assert_snapshot;
 use serde_json::json;
@@ -26,6 +33,13 @@ impl crate::util::MockCookieUser {
         assert_eq!(response.status(), StatusCode::OK);
         assert_eq!(response.json(), json!({ "ok": true }));
     }
+
+    async fn request_username_update(&self, new_username: &str) -> Response<()> {
+        let model = self.as_model();
+        let body = json!({"user": { "username": new_username }});
+        let url = format!("/api/v1/users/{}", model.id);
+        self.put(&url, body.to_string()).await
+    }
 }
 
 /// Given a crates.io user, check to make sure that the user
@@ -111,6 +125,118 @@ async fn test_invalid_email_address() {
     assert_snapshot!(response.text(), @r#"{"errors":[{"detail":"invalid email address"}]}"#);
 }
 
+/// Runs what should be a successful rename and ensures that the
+/// expected DB tables have been updated appropriately
+#[tokio::test(flavor = "multi_thread")]
+async fn test_change_username_happy_path() {
+    let (app, _, user) = TestApp::init().with_user().await;
+    let model = user.as_model();
+    let mut conn = app.db_conn().await;
+
+    let old_username = &model.username;
+    let new_username = "new-foo_username1";
+
+    // actuallly do the request
+    let put_request_start = Utc::now(); // for checking the timestamps later
+    let response: Response<()> = user.request_username_update(new_username).await;
+    let put_request_end = Utc::now();
+
+    assert_snapshot!(response.status(), @"200 OK");
+    assert_snapshot!(response.json(), @r#"{"ok":true}"#);
+
+    // ───── Postconditions ─────
+    // 1. check that new abandoned username record was created
+    let records: Vec<AbandonedUsername> = assert_ok!(
+        AbandonedUsername::query()
+            .filter(abandoned_usernames::username.eq(old_username))
+            .load(&mut conn)
+            .await
+    );
+    assert_eq!(records.len(), 1);
+    let record = records.into_iter().next().unwrap();
+    assert_eq!(record.previous_user_id, Some(model.id));
+    assert_eq!(record.username, *old_username);
+    assert_eq!(
+        record.available_at,
+        record.abandoned_at + TimeDelta::days(30)
+    );
+
+    assert_ge!(record.abandoned_at, put_request_start);
+    assert_le!(record.abandoned_at, put_request_end);
+
+    // 2. user record should have been updated
+    let updated_user: User = assert_ok!(User::find(&conn, model.id).await);
+    assert_eq!(updated_user.username, new_username);
+}
+
+/// Check that invalid usernames are rejected
+#[tokio::test(flavor = "multi_thread")]
+async fn test_reject_prohibited_username_changes() {
+    let (app, _, user) = TestApp::init().with_user().await;
+    let mut conn = app.db_conn().await;
+    let initial_model = User::find(&conn, user.as_model().id)
+        .await
+        .expect("initial user lookup");
+
+    // populate various tables with values to test against
+    let _squatter = app.db_new_user("desirable-username").await;
+    diesel::insert_into(reserved_usernames::table)
+        .values(reserved_usernames::username.eq("superadminuser"))
+        .execute(&mut conn)
+        .await
+        .expect("db setup");
+    diesel::insert_into(abandoned_usernames::table)
+        .values(NewAbandonedUsername {
+            username: "on-cooldown",
+            previous_user_id: None,
+            abandoned_at: &DateTime::parse_from_rfc3339("2000-01-01T12:00:00Z")
+                .unwrap()
+                .to_utc(),
+            available_at: &DateTime::parse_from_rfc3339("3000-01-01T12:00:00Z")
+                .unwrap()
+                .to_utc(),
+        })
+        .execute(&mut conn)
+        .await
+        .expect("db setup");
+
+    // ───── tests ─────
+    // reject empty string "": it fails string validation
+    let response = user.request_username_update("").await;
+    assert_snapshot!(response.status(), @"400 Bad Request");
+    assert_snapshot!(
+        response.json(),
+        @r#"{"errors":[{"detail":"username cannot be empty"}]}"#);
+
+    // reject "desirable-username": another user is using it
+    let response = user.request_username_update("DeSiRaBlE_uSeRnAmE").await;
+    assert_snapshot!(response.status(), @"400 Bad Request");
+    assert_snapshot!(
+        response.json(),
+        @r#"{"errors":[{"detail":"the username `DeSiRaBlE_uSeRnAmE` is not available"}]}"#
+    );
+
+    // reject "superadminuser": it is reserved
+    let response = user.request_username_update("SuPeRaDmInUsEr").await;
+    assert_snapshot!(response.status(), @"400 Bad Request");
+    assert_snapshot!(
+        response.json(),
+        @r#"{"errors":[{"detail":"the username `SuPeRaDmInUsEr` is reserved"}]}"#);
+
+    // reject "on-cooldown": it is unavailable until the year 3000
+    let response = user.request_username_update("On-CoOlDoWn").await;
+    assert_snapshot!(response.status(), @"400 Bad Request");
+    assert_snapshot!(
+        response.text(),
+        @r#"{"errors":[{"detail":"The username `On-CoOlDoWn` was recently in use. This username will be available after 3000-01-01T12:00:00Z."}]}"#
+    );
+
+    // ───── Post-conditions ─────
+    // user record should not have changed at all
+    let final_model = assert_ok!(User::find(&conn, user.as_model().id).await);
+    assert_eq!(initial_model.username, final_model.username);
+}
+
 #[tokio::test(flavor = "multi_thread")]
 async fn test_invalid_json() {
     let (_app, _anon, user) = TestApp::init().with_user().await;

src/tests/snapshots/integration__openapi__openapi_internal_snapshot-2.snap

@@ -6667,6 +6667,12 @@ expression: response.json()
                           "boolean",
                           "null"
                         ]
+                      },
+                      "username": {
+                        "type": [
+                          "string",
+                          "null"
+                        ]
                       }
                     },
                     "type": "object"

src/tests/snapshots/integration__openapi__openapi_snapshot-2.snap

@@ -5737,6 +5737,12 @@ expression: response.json()
                           "boolean",
                           "null"
                         ]
+                      },
+                      "username": {
+                        "type": [
+                          "string",
+                          "null"
+                        ]
                       }
                     },
                     "type": "object"