BTHLABS-50: Safari Web extension

Co-authored-by: Tomek Wójcik <labs@tomekwojcik.pl>
Co-committed-by: Tomek Wójcik <labs@tomekwojcik.pl>

services/backend/tests/ui/views/accounts/apps/test_browse.py

@@ -0,0 +1,154 @@
+# -*- coding: utf-8 -*-
+# type: ignore
+from __future__ import annotations
+
+import http
+
+from django.test import Client
+from django.urls import reverse
+import pytest
+from pytest_django import asserts
+
+
+def assert_default_mode_response_context(response, access_tokens):
+    expected_access_token_ids = list(sorted(
+        [obj.pk for obj in access_tokens],
+        reverse=True,
+    ))
+
+    assert len(response.context['access_tokens']) == 2
+    assert response.context['access_tokens'][0].pk == expected_access_token_ids[0]
+    assert response.context['access_tokens'][1].pk == expected_access_token_ids[1]
+    assert response.context['before'] is None
+    assert response.context['next_url'] is None
+
+
+@pytest.mark.django_db
+def test_ok(browsable_access_token_outs,
+            authenticated_client: Client,
+            ):
+    # When
+    result = authenticated_client.get(
+        reverse('ui.accounts.apps.browse'),
+    )
+
+    # Then
+    assert result.status_code == http.HTTPStatus.OK
+
+    asserts.assertTemplateUsed(result, 'ui/accounts/apps/browse.html')
+
+    assert_default_mode_response_context(result, browsable_access_token_outs)
+
+
+@pytest.mark.django_db
+def test_ok_htmx(browsable_access_token_outs,
+                 authenticated_client: Client,
+                 ):
+    # When
+    result = authenticated_client.get(
+        reverse('ui.accounts.apps.browse'),
+        headers={
+            'HX-Request': 'true',
+        },
+    )
+
+    # Then
+    assert result.status_code == http.HTTPStatus.OK
+
+    asserts.assertTemplateNotUsed(result, 'ui/accounts/apps/browse.html')
+    asserts.assertTemplateUsed(result, 'ui/accounts/partials/apps/apps.html')
+
+    assert_default_mode_response_context(result, browsable_access_token_outs)
+
+
+@pytest.mark.parametrize(
+    'query_before_index,expected_before_index,expected_length,first_index,last_index',
+    [
+        (None, 9, 10, 0, 9),
+        (9, None, 2, 10, 11),
+    ],
+)
+@pytest.mark.django_db
+def test_pagination(query_before_index,
+                    expected_before_index,
+                    expected_length,
+                    first_index,
+                    last_index,
+                    paginatable_access_token_outs,
+                    authenticated_client: Client,
+                    ):
+    # Given
+    request_data = {}
+
+    if query_before_index is not None:
+        request_data['before'] = str(
+            paginatable_access_token_outs[query_before_index].pk,
+        )
+
+    # When
+    result = authenticated_client.get(
+        reverse('ui.accounts.apps.browse'),
+        data=request_data,
+    )
+
+    # Then
+    assert result.status_code == http.HTTPStatus.OK
+
+    expected_before = None
+    expected_next_url = None
+
+    if expected_before_index:
+        expected_before = paginatable_access_token_outs[expected_before_index].pk
+        expected_next_url = reverse(
+            'ui.accounts.apps.browse',
+            query=[
+                ('before', expected_before),
+                ('limit', 10),
+            ],
+        )
+
+    assert len(result.context['access_tokens']) == expected_length
+    assert result.context['access_tokens'][0].pk == paginatable_access_token_outs[first_index].pk
+    assert result.context['access_tokens'][-1].pk == paginatable_access_token_outs[last_index].pk
+    assert result.context['before'] == expected_before
+    assert result.context['next_url'] == expected_next_url
+
+
+@pytest.mark.django_db
+def test_inactive_account(inactive_account_client: Client):
+    # When
+    result = inactive_account_client.get(
+        reverse('ui.accounts.apps.browse'),
+    )
+
+    # Then
+    asserts.assertRedirects(
+        result,
+        reverse(
+            'ui.accounts.login',
+            query=[
+                ('next', reverse('ui.accounts.apps.browse')),
+            ],
+        ),
+        fetch_redirect_response=False,
+    )
+
+
+@pytest.mark.django_db
+def test_anonymous(client: Client):
+    # When
+    result = client.get(
+        reverse('ui.accounts.apps.browse'),
+    )
+
+    # Then
+    asserts.assertRedirects(
+        result,
+        reverse(
+            'ui.accounts.login',
+            query=[
+                ('next', reverse('ui.accounts.apps.browse')),
+            ],
+        ),
+        fetch_redirect_response=False,
+    )

services/backend/tests/ui/views/accounts/apps/test_delete.py

@@ -0,0 +1,172 @@
+# -*- coding: utf-8 -*-
+# type: ignore
+from __future__ import annotations
+
+import http
+
+from django.test import Client
+from django.urls import reverse
+import pytest
+from pytest_django import asserts
+
+from hotpocket_backend_testing.services.accounts import (
+    AccessTokensTestingService,
+)
+
+
+@pytest.mark.django_db
+def test_ok(authenticated_client: Client,
+            access_token_out,
+            ):
+    # When
+    result = authenticated_client.post(
+        reverse('ui.accounts.apps.delete', args=(access_token_out.pk,)),
+        data={
+            'canhazconfirm': 'hai',
+        },
+    )
+
+    # Then
+    asserts.assertRedirects(
+        result,
+        reverse('ui.accounts.apps.browse'),
+        fetch_redirect_response=False,
+    )
+
+    AccessTokensTestingService().assert_deleted(
+        pk=access_token_out.pk, reference=access_token_out,
+    )
+
+
+@pytest.mark.django_db
+def test_ok_htmx(authenticated_client: Client,
+                 access_token_out,
+                 ):
+    # When
+    result = authenticated_client.post(
+        reverse('ui.accounts.apps.delete', args=(access_token_out.pk,)),
+        headers={
+            'HX-Request': 'true',
+        },
+        data={
+            'canhazconfirm': 'hai',
+        },
+    )
+
+    # Then
+    assert result.status_code == http.HTTPStatus.OK
+
+    expected_payload = {
+        'status': 'ok',
+        'result': True,
+    }
+    assert result.json() == expected_payload
+
+
+@pytest.mark.django_db
+def test_invalid_all_missing(authenticated_client: Client,
+                             access_token_out,
+                             ):
+    # When
+    result = authenticated_client.post(
+        reverse('ui.accounts.apps.delete', args=(access_token_out.pk,)),
+        data={
+        },
+    )
+
+    # Then
+    assert result.status_code == http.HTTPStatus.OK
+
+    AccessTokensTestingService().assert_not_deleted(
+        pk=access_token_out.pk, reference=access_token_out,
+    )
+
+    assert 'canhazconfirm' in result.context['form'].errors
+
+
+@pytest.mark.django_db
+def test_invalid_all_empty(authenticated_client: Client,
+                           access_token_out,
+                           ):
+    # When
+    result = authenticated_client.post(
+        reverse('ui.accounts.apps.delete', args=(access_token_out.pk,)),
+        data={
+            'canhazconfirm': '',
+        },
+    )
+
+    # Then
+    assert result.status_code == http.HTTPStatus.OK
+
+    AccessTokensTestingService().assert_not_deleted(
+        pk=access_token_out.pk, reference=access_token_out,
+    )
+
+    assert 'canhazconfirm' in result.context['form'].errors
+
+
+@pytest.mark.django_db
+def test_other_account_access_token(authenticated_client: Client,
+                                    other_account_access_token_out,
+                                    ):
+    # When
+    result = authenticated_client.post(
+        reverse('ui.accounts.apps.delete', args=(other_account_access_token_out.pk,)),
+        data={
+            'canhazconfirm': 'hai',
+        },
+    )
+
+    # Then
+    assert result.status_code == http.HTTPStatus.FORBIDDEN
+
+
+@pytest.mark.django_db
+def test_inactive_account(inactive_account_client: Client,
+                          access_token_out,
+                          ):
+    # When
+    result = inactive_account_client.post(
+        reverse('ui.accounts.apps.delete', args=(access_token_out.pk,)),
+        data={
+            'canhazconfirm': 'hai',
+        },
+    )
+
+    # Then
+    asserts.assertRedirects(
+        result,
+        reverse(
+            'ui.accounts.login',
+            query=[
+                ('next', reverse('ui.accounts.apps.delete', args=(access_token_out.pk,))),
+            ],
+        ),
+        fetch_redirect_response=False,
+    )
+
+
+@pytest.mark.django_db
+def test_anonymous(client: Client,
+                   access_token_out,
+                   ):
+    # When
+    result = client.post(
+        reverse('ui.accounts.apps.delete', args=(access_token_out.pk,)),
+        data={
+            'canhazconfirm': 'hai',
+        },
+    )
+
+    # Then
+    asserts.assertRedirects(
+        result,
+        reverse(
+            'ui.accounts.login',
+            query=[
+                ('next', reverse('ui.accounts.apps.delete', args=(access_token_out.pk,))),
+            ],
+        ),
+        fetch_redirect_response=False,
+    )

services/backend/tests/ui/views/accounts/apps/test_index.py

@@ -0,0 +1,60 @@
+# -*- coding: utf-8 -*-
+# type: ignore
+from __future__ import annotations
+
+from django.test import Client
+from django.urls import reverse
+import pytest
+from pytest_django import asserts
+
+
+@pytest.mark.django_db
+def test_ok(authenticated_client: Client):
+    # When
+    result = authenticated_client.get(
+        reverse('ui.accounts.apps.index'),
+        follow=False,
+    )
+
+    # Then
+    asserts.assertRedirects(
+        result,
+        reverse('ui.accounts.apps.browse'),
+        fetch_redirect_response=False,
+    )
+
+
+@pytest.mark.django_db
+def test_inactive_account(inactive_account_client: Client):
+    # When
+    result = inactive_account_client.get(
+        reverse('ui.accounts.apps.index'),
+    )
+
+    # Then
+    asserts.assertRedirects(
+        result,
+        reverse(
+            'ui.accounts.login',
+            query=[('next', reverse('ui.accounts.apps.index'))],
+        ),
+        fetch_redirect_response=False,
+    )
+
+
+@pytest.mark.django_db
+def test_anonymous(client: Client):
+    # When
+    result = client.get(
+        reverse('ui.accounts.apps.index'),
+    )
+
+    # Then
+    asserts.assertRedirects(
+        result,
+        reverse(
+            'ui.accounts.login',
+            query=[('next', reverse('ui.accounts.apps.index'))],
+        ),
+        fetch_redirect_response=False,
+    )

services/backend/tests/ui/views/integrations/extension/test_authenticate.py

@@ -0,0 +1,68 @@
+# -*- coding: utf-8 -*-
+# type: ignore
+from __future__ import annotations
+
+import http
+
+from django.test import Client
+from django.urls import reverse
+import pytest
+from pytest_django import asserts
+
+from hotpocket_common.url import URL
+
+
+@pytest.mark.django_db
+def test_ok(authenticated_client: Client):
+    # When
+    result = authenticated_client.get(
+        reverse('ui.integrations.extension.authenticate'),
+        follow=False,
+    )
+
+    # Then
+    assert result.status_code == http.HTTPStatus.FOUND
+    assert 'Location' in result.headers
+
+    redirect_url = URL(result.headers['Location'])
+    assert redirect_url.raw_path == reverse('ui.integrations.extension.post_authenticate')
+    assert 'auth_key' in redirect_url.query
+
+    assert 'extension_auth_key' in authenticated_client.session
+    assert authenticated_client.session['extension_auth_key'] == redirect_url.query['auth_key'][0]
+
+
+@pytest.mark.django_db
+def test_inactive_account(inactive_account_client: Client):
+    # When
+    result = inactive_account_client.get(
+        reverse('ui.integrations.extension.authenticate'),
+    )
+
+    # Then
+    asserts.assertRedirects(
+        result,
+        reverse(
+            'ui.accounts.login',
+            query=[('next', reverse('ui.integrations.extension.authenticate'))],
+        ),
+        fetch_redirect_response=False,
+    )
+
+
+@pytest.mark.django_db
+def test_anonymous(client: Client):
+    # When
+    result = client.get(
+        reverse('ui.integrations.extension.authenticate'),
+    )
+
+    # Then
+    asserts.assertRedirects(
+        result,
+        reverse(
+            'ui.accounts.login',
+            query=[('next', reverse('ui.integrations.extension.authenticate'))],
+        ),
+        fetch_redirect_response=False,
+    )

services/backend/tests/ui/views/integrations/extension/test_post_authenticate.py

@@ -0,0 +1,112 @@
+# -*- coding: utf-8 -*-
+# type: ignore
+from __future__ import annotations
+
+import http
+import uuid
+
+from django.test import Client
+from django.urls import reverse
+import pytest
+from pytest_django import asserts
+
+
+@pytest.fixture
+def auth_key():
+    return str(uuid.uuid4())
+
+
+@pytest.mark.django_db
+def test_ok(authenticated_client: Client, auth_key):
+    # Given
+    session = authenticated_client.session
+    session['extension_auth_key'] = auth_key
+    session.save()
+
+    # When
+    result = authenticated_client.get(
+        reverse('ui.integrations.extension.post_authenticate'),
+        data={
+            'auth_key': auth_key,
+        },
+    )
+
+    # Then
+    assert result.status_code == http.HTTPStatus.OK
+
+    asserts.assertTemplateUsed(
+        result, 'ui/integrations/extension/post_authenticate.html',
+    )
+
+
+@pytest.mark.django_db
+def test_auth_key_not_in_session(authenticated_client: Client, auth_key):
+    # When
+    result = authenticated_client.get(
+        reverse('ui.integrations.extension.post_authenticate'),
+        data={
+            'auth_key': auth_key,
+        },
+    )
+
+    # Then
+    assert result.status_code == http.HTTPStatus.FORBIDDEN
+
+
+@pytest.mark.django_db
+def test_auth_key_not_request(authenticated_client: Client, auth_key):
+    # Given
+    session = authenticated_client.session
+    session['extension_auth_key'] = auth_key
+    session.save()
+
+    # When
+    result = authenticated_client.get(
+        reverse('ui.integrations.extension.post_authenticate'),
+        data={
+        },
+    )
+
+    # Then
+    assert result.status_code == http.HTTPStatus.FORBIDDEN
+
+
+@pytest.mark.django_db
+def test_auth_key_mismatch(authenticated_client: Client, auth_key):
+    # Given
+    session = authenticated_client.session
+    session['extension_auth_key'] = auth_key
+    session.save()
+
+    # When
+    result = authenticated_client.get(
+        reverse('ui.integrations.extension.post_authenticate'),
+        data={
+            'auth_key': 'thisisntright',
+        },
+    )
+
+    # Then
+    assert result.status_code == http.HTTPStatus.FORBIDDEN
+
+
+@pytest.mark.django_db
+def test_inactive_account(inactive_account_client: Client):
+    # When
+    result = inactive_account_client.get(
+        reverse('ui.integrations.extension.post_authenticate'),
+    )
+
+    # Then
+    assert result.status_code == http.HTTPStatus.FORBIDDEN
+
+
+@pytest.mark.django_db
+def test_anonymous(client: Client):
+    # When
+    result = client.get(
+        reverse('ui.integrations.extension.post_authenticate'),
+    )
+
+    # Then
+    assert result.status_code == http.HTTPStatus.FORBIDDEN

services/backend/tests/ui/views/rpc/accounts/access_tokens/test_create.py

@@ -0,0 +1,154 @@
+# -*- coding: utf-8 -*-
+# type: ignore
+from __future__ import annotations
+
+import http
+import uuid
+
+from django.test import Client
+from django.urls import reverse
+import pytest
+
+from hotpocket_backend_testing.services.accounts import (
+    AccessTokensTestingService,
+)
+
+
+@pytest.fixture
+def origin():
+    return f'safari-web-extension://{uuid.uuid4()}'
+
+
+@pytest.fixture
+def auth_key():
+    return str(uuid.uuid4())
+
+
+@pytest.fixture
+def meta():
+    return {
+        'platform': 'MacIntel',
+        'version': '1987.10.03',
+    }
+
+
+@pytest.fixture
+def call(rpc_call_factory, auth_key, meta):
+    return rpc_call_factory(
+        'accounts.access_tokens.create',
+        [auth_key, meta],
+    )
+
+
+@pytest.mark.django_db
+def test_ok(authenticated_client: Client,
+            auth_key,
+            call,
+            origin,
+            account,
+            meta,
+            ):
+    # Given
+    session = authenticated_client.session
+    session['extension_auth_key'] = auth_key
+    session.save()
+
+    # When
+    result = authenticated_client.post(
+        reverse('ui.rpc'),
+        data=call,
+        content_type='application/json',
+        headers={
+            'Origin': origin,
+        },
+    )
+
+    # Then
+    assert result.status_code == http.HTTPStatus.OK
+
+    call_result = result.json()
+    assert 'error' not in call_result
+
+    AccessTokensTestingService().assert_created(
+        key=call_result['result'],
+        account_uuid=account.pk,
+        origin=origin,
+        meta=meta,
+    )
+
+    assert 'extension_auth_key' not in authenticated_client.session
+
+
+@pytest.mark.django_db
+def test_auth_key_missing(authenticated_client: Client,
+                          call,
+                          origin,
+                          ):
+    # When
+    result = authenticated_client.post(
+        reverse('ui.rpc'),
+        data=call,
+        content_type='application/json',
+        headers={
+            'Origin': origin,
+        },
+    )
+
+    # Then
+    assert result.status_code == http.HTTPStatus.OK
+
+    call_result = result.json()
+    assert 'error' in call_result
+    assert call_result['error']['data'] == 'Auth key missing'
+
+
+@pytest.mark.django_db
+def test_auth_key_mismatch(authenticated_client: Client,
+                           call,
+                           origin,
+                           ):
+    # Given
+    session = authenticated_client.session
+    session['extension_auth_key'] = 'thisisntright'
+    session.save()
+
+    # When
+    result = authenticated_client.post(
+        reverse('ui.rpc'),
+        data=call,
+        content_type='application/json',
+        headers={
+            'Origin': origin,
+        },
+    )
+
+    # Then
+    assert result.status_code == http.HTTPStatus.OK
+
+    call_result = result.json()
+    assert 'error' in call_result
+    assert call_result['error']['data'] == 'Auth key mismatch'
+
+
+@pytest.mark.django_db
+def test_inactive_account(inactive_account_client: Client, call):
+    # When
+    result = inactive_account_client.post(
+        reverse('ui.rpc'),
+        data=call,
+    )
+
+    # Then
+    assert result.status_code == http.HTTPStatus.FORBIDDEN
+
+
+@pytest.mark.django_db
+def test_anonymous(client: Client, call):
+    # When
+    result = client.post(
+        reverse('ui.rpc'),
+        data=call,
+    )
+
+    # Then
+    assert result.status_code == http.HTTPStatus.FORBIDDEN

services/backend/tests/ui/views/rpc/accounts/auth/test_check.py

@@ -0,0 +1,157 @@
+# -*- coding: utf-8 -*-
+# type: ignore
+from __future__ import annotations
+
+import http
+
+from django.test import Client
+from django.urls import reverse
+import pytest
+
+
+@pytest.fixture
+def call(rpc_call_factory):
+    return rpc_call_factory(
+        'accounts.auth.check',
+        [],
+    )
+
+
+@pytest.mark.django_db
+def test_ok_session_auth(authenticated_client: Client,
+                         call,
+                         ):
+    # When
+    result = authenticated_client.post(
+        reverse('ui.rpc'),
+        data=call,
+        content_type='application/json',
+    )
+
+    # Then
+    assert result.status_code == http.HTTPStatus.OK
+
+    call_result = result.json()
+    assert 'error' not in call_result
+    assert call_result['result'] is True
+
+
+@pytest.mark.django_db
+def test_session_auth_inactive_account(inactive_account_client: Client,
+                                       call,
+                                       ):
+    # When
+    result = inactive_account_client.post(
+        reverse('ui.rpc'),
+        data=call,
+    )
+
+    # Then
+    assert result.status_code == http.HTTPStatus.FORBIDDEN
+
+
+@pytest.mark.django_db
+def test_ok_access_token_auth(client: Client,
+                              call,
+                              access_token_out,
+                              ):
+    # When
+    result = client.post(
+        reverse('ui.rpc'),
+        data=call,
+        content_type='application/json',
+        headers={
+            'Authorization': f'Bearer {access_token_out.key}',
+        },
+    )
+
+    # Then
+    assert result.status_code == http.HTTPStatus.OK
+
+    call_result = result.json()
+    assert 'error' not in call_result
+    assert call_result['result'] is True
+
+
+@pytest.mark.django_db
+def test_access_token_auth_not_bearer(client: Client,
+                                      call,
+                                      access_token_out,
+                                      ):
+    # When
+    result = client.post(
+        reverse('ui.rpc'),
+        data=call,
+        headers={
+            'Authorization': f'thisisntright {access_token_out.key}',
+        },
+    )
+
+    # Then
+    assert result.status_code == http.HTTPStatus.FORBIDDEN
+
+
+@pytest.mark.django_db
+def test_access_token_auth_invalid_access_token(client: Client,
+                                                call,
+                                                null_uuid,
+                                                ):
+    # When
+    result = client.post(
+        reverse('ui.rpc'),
+        data=call,
+        headers={
+            'Authorization': f'Bearer {null_uuid}',
+        },
+    )
+
+    # Then
+    assert result.status_code == http.HTTPStatus.FORBIDDEN
+
+
+@pytest.mark.django_db
+def test_access_token_auth_deleted_access_token(client: Client,
+                                                call,
+                                                deleted_access_token,
+                                                ):
+    # When
+    result = client.post(
+        reverse('ui.rpc'),
+        data=call,
+        headers={
+            'Authorization': f'Bearer {deleted_access_token.key}',
+        },
+    )
+
+    # Then
+    assert result.status_code == http.HTTPStatus.FORBIDDEN
+
+
+@pytest.mark.django_db
+def test_access_token_auth_inactive_account(client: Client,
+                                            call,
+                                            inactive_account_access_token,
+                                            ):
+    # When
+    result = client.post(
+        reverse('ui.rpc'),
+        data=call,
+        headers={
+            'Authorization': f'Bearer {inactive_account_access_token.key}',
+        },
+    )
+
+    # Then
+    assert result.status_code == http.HTTPStatus.FORBIDDEN
+
+
+@pytest.mark.django_db
+def test_anonymous(client: Client, call):
+    # When
+    result = client.post(
+        reverse('ui.rpc'),
+        data=call,
+    )
+
+    # Then
+    assert result.status_code == http.HTTPStatus.FORBIDDEN

services/backend/tests/ui/views/rpc/saves/test_create.py

@@ -0,0 +1,287 @@
+# -*- coding: utf-8 -*-
+# type: ignore
+from __future__ import annotations
+
+import http
+from unittest import mock
+import uuid
+
+from django.test import Client
+from django.urls import reverse
+import pytest
+import pytest_mock
+
+from hotpocket_backend_testing.services.saves import (
+    AssociationsTestingService,
+    SaveProcessorTestingService,
+    SavesTestingService,
+)
+
+
+@pytest.fixture
+def mock_saves_process_save_task_apply_async(mocker: pytest_mock.MockerFixture,
+                                             async_result,
+                                             ) -> mock.Mock:
+    return SaveProcessorTestingService().mock_process_save_task_apply_async(
+        mocker=mocker, async_result=async_result,
+    )
+
+
+@pytest.fixture
+def call(rpc_call_factory):
+    return rpc_call_factory(
+        'saves.create',
+        ['https://www.ziomek.dog/'],
+    )
+
+
+@pytest.mark.django_db
+def test_ok(authenticated_client: Client,
+            call,
+            account,
+            mock_saves_process_save_task_apply_async: mock.Mock,
+            ):
+    # When
+    result = authenticated_client.post(
+        reverse('ui.rpc'),
+        data=call,
+        content_type='application/json',
+    )
+
+    # Then
+    assert result.status_code == http.HTTPStatus.OK
+
+    call_result = result.json()
+    assert 'error' not in call_result
+
+    save_pk = uuid.UUID(call_result['result']['target_uuid'])
+    association_pk = uuid.UUID(call_result['result']['id'])
+
+    AssociationsTestingService().assert_created(
+        pk=association_pk,
+        account_uuid=account.pk,
+        target_uuid=save_pk,
+    )
+
+    SavesTestingService().assert_created(
+        pk=save_pk,
+        account_uuid=account.pk,
+        url=call['params'][0],
+        is_netloc_banned=False,
+    )
+
+    mock_saves_process_save_task_apply_async.assert_called_once_with(
+        kwargs={
+            'pk': save_pk,
+        },
+    )
+
+
+@pytest.mark.django_db
+def test_ok_netloc_banned(authenticated_client: Client,
+                          call,
+                          account,
+                          mock_saves_process_save_task_apply_async: mock.Mock,
+                          ):
+    # Given
+    call['params'][0] = 'https://youtube.com/'
+
+    # When
+    result = authenticated_client.post(
+        reverse('ui.rpc'),
+        data=call,
+        content_type='application/json',
+    )
+
+    # Then
+    assert result.status_code == http.HTTPStatus.OK
+
+    call_result = result.json()
+    assert 'error' not in call_result
+
+    save_pk = uuid.UUID(call_result['result']['target_uuid'])
+
+    SavesTestingService().assert_created(
+        pk=save_pk,
+        account_uuid=account.pk,
+        url=call['params'][0],
+        is_netloc_banned=True,
+    )
+
+
+@pytest.mark.django_db
+def test_ok_resuse_save(save_out,
+                        authenticated_client: Client,
+                        call,
+                        account,
+                        mock_saves_process_save_task_apply_async: mock.Mock,
+                        ):
+    # Given
+    call['params'][0] = save_out.url
+
+    # When
+    result = authenticated_client.post(
+        reverse('ui.rpc'),
+        data=call,
+        content_type='application/json',
+    )
+
+    # Then
+    assert result.status_code == http.HTTPStatus.OK
+
+    call_result = result.json()
+    assert 'error' not in call_result
+
+    save_pk = uuid.UUID(call_result['result']['target_uuid'])
+    association_pk = uuid.UUID(call_result['result']['id'])
+
+    AssociationsTestingService().assert_created(
+        pk=association_pk,
+        account_uuid=account.pk,
+        target_uuid=save_pk,
+    )
+
+    SavesTestingService().assert_reused(
+        pk=save_pk,
+        reference=save_out,
+    )
+
+
+@pytest.mark.django_db
+def test_ok_resuse_association(association_out,
+                               save_out,
+                               authenticated_client: Client,
+                               call,
+                               account,
+                               mock_saves_process_save_task_apply_async: mock.Mock,
+                               ):
+    # Given
+    call['params'][0] = save_out.url
+
+    # When
+    result = authenticated_client.post(
+        reverse('ui.rpc'),
+        data=call,
+        content_type='application/json',
+    )
+
+    # Then
+    assert result.status_code == http.HTTPStatus.OK
+
+    call_result = result.json()
+    assert 'error' not in call_result
+
+    association_pk = uuid.UUID(call_result['result']['id'])
+
+    AssociationsTestingService().assert_reused(
+        pk=association_pk,
+        reference=association_out,
+    )
+
+
+@pytest.mark.django_db
+def test_ok_reuse_other_account_save(other_account_save_out,
+                                     authenticated_client: Client,
+                                     call,
+                                     account,
+                                     mock_saves_process_save_task_apply_async: mock.Mock,
+                                     ):
+    # Given
+    call['params'][0] = other_account_save_out.url
+
+    # When
+    result = authenticated_client.post(
+        reverse('ui.rpc'),
+        data=call,
+        content_type='application/json',
+    )
+
+    # Then
+    assert result.status_code == http.HTTPStatus.OK
+
+    call_result = result.json()
+    assert 'error' not in call_result
+
+    save_pk = uuid.UUID(call_result['result']['target_uuid'])
+    association_pk = uuid.UUID(call_result['result']['id'])
+
+    AssociationsTestingService().assert_created(
+        pk=association_pk,
+        account_uuid=account.pk,
+        target_uuid=save_pk,
+    )
+
+    SavesTestingService().assert_reused(
+        pk=save_pk,
+        reference=other_account_save_out,
+    )
+
+
+@pytest.mark.django_db
+def test_ok_dont_process_reused_processed_save(processed_save_out,
+                                               authenticated_client: Client,
+                                               call,
+                                               account,
+                                               mock_saves_process_save_task_apply_async: mock.Mock,
+                                               ):
+    # Given
+    call['params'][0] = processed_save_out.url
+
+    # When
+    _ = authenticated_client.post(
+        reverse('ui.rpc'),
+        data=call,
+        content_type='application/json',
+    )
+
+    # Then
+    mock_saves_process_save_task_apply_async.assert_not_called()
+
+
+@pytest.mark.django_db
+def test_empty_url(authenticated_client: Client,
+                   call,
+                   account,
+                   mock_saves_process_save_task_apply_async: mock.Mock,
+                   ):
+    # Given
+    call['params'][0] = ''
+
+    # When
+    result = authenticated_client.post(
+        reverse('ui.rpc'),
+        data=call,
+        content_type='application/json',
+    )
+
+    # Then
+    assert result.status_code == http.HTTPStatus.OK
+
+    call_result = result.json()
+    assert 'error' in call_result
+
+    assert call_result['error']['data']['url'] == ['blank']
+
+
+@pytest.mark.django_db
+def test_inactive_account(inactive_account_client: Client, call):
+    # When
+    result = inactive_account_client.post(
+        reverse('ui.rpc'),
+        data=call,
+    )
+
+    # Then
+    assert result.status_code == http.HTTPStatus.FORBIDDEN
+
+
+@pytest.mark.django_db
+def test_anonymous(client: Client, call):
+    # When
+    result = client.post(
+        reverse('ui.rpc'),
+        data=call,
+    )
+
+    # Then
+    assert result.status_code == http.HTTPStatus.FORBIDDEN