summaryrefslogtreecommitdiff
path: root/test
diff options
context:
space:
mode:
Diffstat (limited to 'test')
-rw-r--r--test/plugs/user_is_admin_plug_test.exs124
-rw-r--r--test/web/admin_api/admin_api_controller_test.exs61
-rw-r--r--test/web/mastodon_api/views/account_view_test.exs9
3 files changed, 167 insertions, 27 deletions
diff --git a/test/plugs/user_is_admin_plug_test.exs b/test/plugs/user_is_admin_plug_test.exs
index 136dcc54e..bc6fcd73c 100644
--- a/test/plugs/user_is_admin_plug_test.exs
+++ b/test/plugs/user_is_admin_plug_test.exs
@@ -8,36 +8,116 @@ defmodule Pleroma.Plugs.UserIsAdminPlugTest do
alias Pleroma.Plugs.UserIsAdminPlug
import Pleroma.Factory
- test "accepts a user that is admin" do
- user = insert(:user, is_admin: true)
+ describe "unless [:auth, :enforce_oauth_admin_scope_usage]," do
+ clear_config([:auth, :enforce_oauth_admin_scope_usage]) do
+ Pleroma.Config.put([:auth, :enforce_oauth_admin_scope_usage], false)
+ end
- conn =
- build_conn()
- |> assign(:user, user)
+ test "accepts a user that is an admin" do
+ user = insert(:user, is_admin: true)
- ret_conn =
- conn
- |> UserIsAdminPlug.call(%{})
+ conn = assign(build_conn(), :user, user)
- assert conn == ret_conn
- end
+ ret_conn = UserIsAdminPlug.call(conn, %{})
+
+ assert conn == ret_conn
+ end
+
+ test "denies a user that isn't an admin" do
+ user = insert(:user)
- test "denies a user that isn't admin" do
- user = insert(:user)
+ conn =
+ build_conn()
+ |> assign(:user, user)
+ |> UserIsAdminPlug.call(%{})
- conn =
- build_conn()
- |> assign(:user, user)
- |> UserIsAdminPlug.call(%{})
+ assert conn.status == 403
+ end
- assert conn.status == 403
+ test "denies when a user isn't set" do
+ conn = UserIsAdminPlug.call(build_conn(), %{})
+
+ assert conn.status == 403
+ end
end
- test "denies when a user isn't set" do
- conn =
- build_conn()
- |> UserIsAdminPlug.call(%{})
+ describe "with [:auth, :enforce_oauth_admin_scope_usage]," do
+ clear_config([:auth, :enforce_oauth_admin_scope_usage]) do
+ Pleroma.Config.put([:auth, :enforce_oauth_admin_scope_usage], true)
+ end
+
+ setup do
+ admin_user = insert(:user, is_admin: true)
+ non_admin_user = insert(:user, is_admin: false)
+ blank_user = nil
+
+ {:ok, %{users: [admin_user, non_admin_user, blank_user]}}
+ end
+
+ test "if token has any of admin scopes, accepts a user that is an admin", %{conn: conn} do
+ user = insert(:user, is_admin: true)
+ token = insert(:oauth_token, user: user, scopes: ["admin:something"])
+
+ conn =
+ conn
+ |> assign(:user, user)
+ |> assign(:token, token)
+
+ ret_conn = UserIsAdminPlug.call(conn, %{})
+
+ assert conn == ret_conn
+ end
+
+ test "if token has any of admin scopes, denies a user that isn't an admin", %{conn: conn} do
+ user = insert(:user, is_admin: false)
+ token = insert(:oauth_token, user: user, scopes: ["admin:something"])
+
+ conn =
+ conn
+ |> assign(:user, user)
+ |> assign(:token, token)
+ |> UserIsAdminPlug.call(%{})
+
+ assert conn.status == 403
+ end
+
+ test "if token has any of admin scopes, denies when a user isn't set", %{conn: conn} do
+ token = insert(:oauth_token, scopes: ["admin:something"])
+
+ conn =
+ conn
+ |> assign(:user, nil)
+ |> assign(:token, token)
+ |> UserIsAdminPlug.call(%{})
+
+ assert conn.status == 403
+ end
+
+ test "if token lacks admin scopes, denies users regardless of is_admin flag",
+ %{users: users} do
+ for user <- users do
+ token = insert(:oauth_token, user: user)
+
+ conn =
+ build_conn()
+ |> assign(:user, user)
+ |> assign(:token, token)
+ |> UserIsAdminPlug.call(%{})
+
+ assert conn.status == 403
+ end
+ end
+
+ test "if token is missing, denies users regardless of is_admin flag", %{users: users} do
+ for user <- users do
+ conn =
+ build_conn()
+ |> assign(:user, user)
+ |> assign(:token, nil)
+ |> UserIsAdminPlug.call(%{})
- assert conn.status == 403
+ assert conn.status == 403
+ end
+ end
end
end
diff --git a/test/web/admin_api/admin_api_controller_test.exs b/test/web/admin_api/admin_api_controller_test.exs
index 4148f04bc..23ca7f110 100644
--- a/test/web/admin_api/admin_api_controller_test.exs
+++ b/test/web/admin_api/admin_api_controller_test.exs
@@ -25,6 +25,60 @@ defmodule Pleroma.Web.AdminAPI.AdminAPIControllerTest do
:ok
end
+ clear_config([:auth, :enforce_oauth_admin_scope_usage]) do
+ Pleroma.Config.put([:auth, :enforce_oauth_admin_scope_usage], false)
+ end
+
+ describe "with [:auth, :enforce_oauth_admin_scope_usage]," do
+ clear_config([:auth, :enforce_oauth_admin_scope_usage]) do
+ Pleroma.Config.put([:auth, :enforce_oauth_admin_scope_usage], true)
+ end
+
+ test "GET /api/pleroma/admin/users/:nickname requires admin:read:accounts or broader scope" do
+ user = insert(:user)
+ admin = insert(:user, is_admin: true)
+ url = "/api/pleroma/admin/users/#{user.nickname}"
+
+ good_token1 = insert(:oauth_token, user: admin, scopes: ["admin"])
+ good_token2 = insert(:oauth_token, user: admin, scopes: ["admin:read"])
+ good_token3 = insert(:oauth_token, user: admin, scopes: ["admin:read:accounts"])
+
+ bad_token1 = insert(:oauth_token, user: admin, scopes: ["read:accounts"])
+ bad_token2 = insert(:oauth_token, user: admin, scopes: ["admin:read:accounts:partial"])
+ bad_token3 = nil
+
+ for good_token <- [good_token1, good_token2, good_token3] do
+ conn =
+ build_conn()
+ |> assign(:user, admin)
+ |> assign(:token, good_token)
+ |> get(url)
+
+ assert json_response(conn, 200)
+ end
+
+ for good_token <- [good_token1, good_token2, good_token3] do
+ conn =
+ build_conn()
+ |> assign(:user, nil)
+ |> assign(:token, good_token)
+ |> get(url)
+
+ assert json_response(conn, :forbidden)
+ end
+
+ for bad_token <- [bad_token1, bad_token2, bad_token3] do
+ conn =
+ build_conn()
+ |> assign(:user, admin)
+ |> assign(:token, bad_token)
+ |> get(url)
+
+ assert json_response(conn, :forbidden)
+ end
+ end
+ end
+
describe "DELETE /api/pleroma/admin/users" do
test "single user" do
admin = insert(:user, is_admin: true)
@@ -98,7 +152,7 @@ defmodule Pleroma.Web.AdminAPI.AdminAPIControllerTest do
assert ["lain", "lain2"] -- Enum.map(log_entry.data["subjects"], & &1["nickname"]) == []
end
- test "Cannot create user with exisiting email" do
+ test "Cannot create user with existing email" do
admin = insert(:user, is_admin: true)
user = insert(:user)
@@ -129,7 +183,7 @@ defmodule Pleroma.Web.AdminAPI.AdminAPIControllerTest do
]
end
- test "Cannot create user with exisiting nickname" do
+ test "Cannot create user with existing nickname" do
admin = insert(:user, is_admin: true)
user = insert(:user)
@@ -1560,7 +1614,8 @@ defmodule Pleroma.Web.AdminAPI.AdminAPIControllerTest do
|> assign(:user, user)
|> get("/api/pleroma/admin/reports")
- assert json_response(conn, :forbidden) == %{"error" => "User is not admin."}
+ assert json_response(conn, :forbidden) ==
+ %{"error" => "User is not an admin or OAuth admin scope is not granted."}
end
test "returns 403 when requested by anonymous" do
diff --git a/test/web/mastodon_api/views/account_view_test.exs b/test/web/mastodon_api/views/account_view_test.exs
index 5e297d129..2107bb85c 100644
--- a/test/web/mastodon_api/views/account_view_test.exs
+++ b/test/web/mastodon_api/views/account_view_test.exs
@@ -66,6 +66,7 @@ defmodule Pleroma.Web.MastodonAPI.AccountViewTest do
note: "valid html",
sensitive: false,
pleroma: %{
+ actor_type: "Person",
discoverable: false
},
fields: []
@@ -106,7 +107,8 @@ defmodule Pleroma.Web.MastodonAPI.AccountViewTest do
insert(:user, %{
follower_count: 3,
note_count: 5,
- source_data: %{"type" => "Service"},
+ source_data: %{},
+ actor_type: "Service",
nickname: "shp@shitposter.club",
inserted_at: ~N[2017-08-15 15:47:06.597036]
})
@@ -134,6 +136,7 @@ defmodule Pleroma.Web.MastodonAPI.AccountViewTest do
note: user.bio,
sensitive: false,
pleroma: %{
+ actor_type: "Service",
discoverable: false
},
fields: []
@@ -278,7 +281,8 @@ defmodule Pleroma.Web.MastodonAPI.AccountViewTest do
insert(:user, %{
follower_count: 0,
note_count: 5,
- source_data: %{"type" => "Service"},
+ source_data: %{},
+ actor_type: "Service",
nickname: "shp@shitposter.club",
inserted_at: ~N[2017-08-15 15:47:06.597036]
})
@@ -311,6 +315,7 @@ defmodule Pleroma.Web.MastodonAPI.AccountViewTest do
note: user.bio,
sensitive: false,
pleroma: %{
+ actor_type: "Service",
discoverable: false
},
fields: []
generated by cgit v1.2.3 (git 2.25.1) at 2025-04-29 04:52:23 +0000