summaryrefslogtreecommitdiff
path: root/test/web/auth/basic_auth_test.exs
diff options
context:
space:
mode:
authorAlex Gleason <alex@alexgleason.me>2020-10-13 19:22:32 -0500
committerAlex Gleason <alex@alexgleason.me>2020-10-13 19:22:32 -0500
commitb3d6cf90229ff3e9a5bd0028d4a6cbd3b68da9fe (patch)
tree09f6b8bafcfb784c581800887d80a22d0461af0b /test/web/auth/basic_auth_test.exs
parent5c8d2c468c3a14cde029e7aeedd0cdb580cce1df (diff)
parent481906207e6d803e5c4d3e455c7b93119e392177 (diff)
downloadpleroma-b3d6cf90229ff3e9a5bd0028d4a6cbd3b68da9fe.tar.gz
pleroma-b3d6cf90229ff3e9a5bd0028d4a6cbd3b68da9fe.zip
Merge remote-tracking branch 'upstream/develop' into block-behavior
Diffstat (limited to 'test/web/auth/basic_auth_test.exs')
-rw-r--r--test/web/auth/basic_auth_test.exs46
1 files changed, 0 insertions, 46 deletions
diff --git a/test/web/auth/basic_auth_test.exs b/test/web/auth/basic_auth_test.exs
deleted file mode 100644
index bf6e3d2fc..000000000
--- a/test/web/auth/basic_auth_test.exs
+++ /dev/null
@@ -1,46 +0,0 @@
-# Pleroma: A lightweight social networking server
-# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
-# SPDX-License-Identifier: AGPL-3.0-only
-
-defmodule Pleroma.Web.Auth.BasicAuthTest do
- use Pleroma.Web.ConnCase
-
- import Pleroma.Factory
-
- test "with HTTP Basic Auth used, grants access to OAuth scope-restricted endpoints", %{
- conn: conn
- } do
- user = insert(:user)
- assert Pbkdf2.verify_pass("test", user.password_hash)
-
- basic_auth_contents =
- (URI.encode_www_form(user.nickname) <> ":" <> URI.encode_www_form("test"))
- |> Base.encode64()
-
- # Succeeds with HTTP Basic Auth
- response =
- conn
- |> put_req_header("authorization", "Basic " <> basic_auth_contents)
- |> get("/api/v1/accounts/verify_credentials")
- |> json_response(200)
-
- user_nickname = user.nickname
- assert %{"username" => ^user_nickname} = response
-
- # Succeeds with a properly scoped OAuth token
- valid_token = insert(:oauth_token, scopes: ["read:accounts"])
-
- conn
- |> put_req_header("authorization", "Bearer #{valid_token.token}")
- |> get("/api/v1/accounts/verify_credentials")
- |> json_response(200)
-
- # Fails with a wrong-scoped OAuth token (proof of restriction)
- invalid_token = insert(:oauth_token, scopes: ["read:something"])
-
- conn
- |> put_req_header("authorization", "Bearer #{invalid_token.token}")
- |> get("/api/v1/accounts/verify_credentials")
- |> json_response(403)
- end
-end