From f6bfde3675163d4981a5fbd5ccc9eef0f35047ce Mon Sep 17 00:00:00 2001 From: slhx agent Date: Mon, 25 May 2026 22:45:37 +0200 Subject: [PATCH] test(axum): preserve csrf fields Cover the integration boundary for CSRF-style hidden fields: InteractionForm keeps arbitrary form fields available to app/auth extractors instead of dropping them during dispatch parsing. req: auth/004 --- slhx-axum/tests/response.rs | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/slhx-axum/tests/response.rs b/slhx-axum/tests/response.rs index f2af15d..afd8717 100644 --- a/slhx-axum/tests/response.rs +++ b/slhx-axum/tests/response.rs @@ -72,6 +72,17 @@ fn interaction_form_requires_numeric_handle() { ); } +#[test] +fn interaction_form_preserves_hidden_csrf_fields_for_extractors() { + // req: auth/004 + let form = InteractionForm::parse_urlencoded(b"__h=42&csrf_token=abc123&title=Hello") + .unwrap(); + + assert_eq!(form.handle_id, 42); + assert_eq!(form.value("csrf_token"), Some("abc123")); + assert!(form.fields().iter().any(|(name, _)| name == "csrf_token")); +} + #[test] fn handler_registry_dispatches_by_numeric_handle_id() { let title = Slot::::new(7);