From 04ee877a20a849db53a307a1736e635229129b7a Mon Sep 17 00:00:00 2001 From: Ivan Tashkinov Date: Tue, 19 Feb 2019 22:28:21 +0300 Subject: [#468] Added OAuth scopes-specific tests. --- test/web/mastodon_api/mastodon_api_controller_test.exs | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) (limited to 'test/web/mastodon_api/mastodon_api_controller_test.exs') diff --git a/test/web/mastodon_api/mastodon_api_controller_test.exs b/test/web/mastodon_api/mastodon_api_controller_test.exs index e43bc4508..8dcbde48b 100644 --- a/test/web/mastodon_api/mastodon_api_controller_test.exs +++ b/test/web/mastodon_api/mastodon_api_controller_test.exs @@ -1536,6 +1536,24 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIControllerTest do assert user_response = json_response(conn, 200) assert user_response["header"] != User.banner_url(user) end + + test "requires 'write' permission", %{conn: conn} do + token1 = insert(:oauth_token, scopes: ["read"]) + token2 = insert(:oauth_token, scopes: ["write", "follow"]) + + for token <- [token1, token2] do + conn = + conn + |> put_req_header("authorization", "Bearer #{token.token}") + |> patch("/api/v1/accounts/update_credentials", %{}) + + if token == token1 do + assert %{"error" => "Insufficient permissions: write."} == json_response(conn, 403) + else + assert json_response(conn, 200) + end + end + end end test "get instance information", %{conn: conn} do -- cgit v1.2.3