mirror of
https://codeberg.org/davrot/forgejo.git
synced 2025-04-25 09:16:06 +02:00

backport #28213 This PR will fix some missed checks for private repositories' data on web routes and API routes. (cherry picked from commit bc3d8bff73a5bd307dc825254b51bfedd722f078)
165 lines
5.5 KiB
Go
165 lines
5.5 KiB
Go
// Copyright 2019 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package integration
|
|
|
|
import (
|
|
"fmt"
|
|
"net/http"
|
|
"testing"
|
|
"time"
|
|
|
|
auth_model "code.gitea.io/gitea/models/auth"
|
|
"code.gitea.io/gitea/models/db"
|
|
issues_model "code.gitea.io/gitea/models/issues"
|
|
repo_model "code.gitea.io/gitea/models/repo"
|
|
"code.gitea.io/gitea/models/unittest"
|
|
user_model "code.gitea.io/gitea/models/user"
|
|
api "code.gitea.io/gitea/modules/structs"
|
|
"code.gitea.io/gitea/services/convert"
|
|
"code.gitea.io/gitea/tests"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
)
|
|
|
|
func TestAPIIssuesReactions(t *testing.T) {
|
|
defer tests.PrepareTestEnv(t)()
|
|
|
|
issue := unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{ID: 1})
|
|
_ = issue.LoadRepo(db.DefaultContext)
|
|
owner := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: issue.Repo.OwnerID})
|
|
|
|
session := loginUser(t, owner.Name)
|
|
token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteIssue)
|
|
|
|
user2 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
|
|
urlStr := fmt.Sprintf("/api/v1/repos/%s/%s/issues/%d/reactions?token=%s",
|
|
owner.Name, issue.Repo.Name, issue.Index, token)
|
|
|
|
// Try to add not allowed reaction
|
|
req := NewRequestWithJSON(t, "POST", urlStr, &api.EditReactionOption{
|
|
Reaction: "wrong",
|
|
})
|
|
MakeRequest(t, req, http.StatusForbidden)
|
|
|
|
// Delete not allowed reaction
|
|
req = NewRequestWithJSON(t, "DELETE", urlStr, &api.EditReactionOption{
|
|
Reaction: "zzz",
|
|
})
|
|
MakeRequest(t, req, http.StatusOK)
|
|
|
|
// Add allowed reaction
|
|
req = NewRequestWithJSON(t, "POST", urlStr, &api.EditReactionOption{
|
|
Reaction: "rocket",
|
|
})
|
|
resp := MakeRequest(t, req, http.StatusCreated)
|
|
var apiNewReaction api.Reaction
|
|
DecodeJSON(t, resp, &apiNewReaction)
|
|
|
|
// Add existing reaction
|
|
MakeRequest(t, req, http.StatusForbidden)
|
|
|
|
// Get end result of reaction list of issue #1
|
|
req = NewRequestf(t, "GET", urlStr)
|
|
resp = MakeRequest(t, req, http.StatusOK)
|
|
var apiReactions []*api.Reaction
|
|
DecodeJSON(t, resp, &apiReactions)
|
|
expectResponse := make(map[int]api.Reaction)
|
|
expectResponse[0] = api.Reaction{
|
|
User: convert.ToUser(db.DefaultContext, user2, user2),
|
|
Reaction: "eyes",
|
|
Created: time.Unix(1573248003, 0),
|
|
}
|
|
expectResponse[1] = apiNewReaction
|
|
assert.Len(t, apiReactions, 2)
|
|
for i, r := range apiReactions {
|
|
assert.Equal(t, expectResponse[i].Reaction, r.Reaction)
|
|
assert.Equal(t, expectResponse[i].Created.Unix(), r.Created.Unix())
|
|
assert.Equal(t, expectResponse[i].User.ID, r.User.ID)
|
|
}
|
|
}
|
|
|
|
func TestAPICommentReactions(t *testing.T) {
|
|
defer tests.PrepareTestEnv(t)()
|
|
|
|
comment := unittest.AssertExistsAndLoadBean(t, &issues_model.Comment{ID: 2})
|
|
_ = comment.LoadIssue(db.DefaultContext)
|
|
issue := comment.Issue
|
|
_ = issue.LoadRepo(db.DefaultContext)
|
|
owner := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: issue.Repo.OwnerID})
|
|
|
|
session := loginUser(t, owner.Name)
|
|
token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteIssue)
|
|
|
|
user1 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 1})
|
|
user2 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
|
|
urlStr := fmt.Sprintf("/api/v1/repos/%s/%s/issues/comments/%d/reactions?token=%s",
|
|
owner.Name, issue.Repo.Name, comment.ID, token)
|
|
|
|
// Try to add not allowed reaction
|
|
req := NewRequestWithJSON(t, "POST", urlStr, &api.EditReactionOption{
|
|
Reaction: "wrong",
|
|
})
|
|
MakeRequest(t, req, http.StatusForbidden)
|
|
|
|
// Delete none existing reaction
|
|
req = NewRequestWithJSON(t, "DELETE", urlStr, &api.EditReactionOption{
|
|
Reaction: "eyes",
|
|
})
|
|
MakeRequest(t, req, http.StatusOK)
|
|
|
|
t.Run("UnrelatedCommentID", func(t *testing.T) {
|
|
// Using the ID of a comment that does not belong to the repository must fail
|
|
repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 4})
|
|
repoOwner := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: repo.OwnerID})
|
|
token := getUserToken(t, repoOwner.Name, auth_model.AccessTokenScopeWriteIssue)
|
|
urlStr := fmt.Sprintf("/api/v1/repos/%s/%s/issues/comments/%d/reactions?token=%s",
|
|
repoOwner.Name, repo.Name, comment.ID, token)
|
|
req = NewRequestWithJSON(t, "POST", urlStr, &api.EditReactionOption{
|
|
Reaction: "+1",
|
|
})
|
|
MakeRequest(t, req, http.StatusNotFound)
|
|
req = NewRequestWithJSON(t, "DELETE", urlStr, &api.EditReactionOption{
|
|
Reaction: "+1",
|
|
})
|
|
MakeRequest(t, req, http.StatusNotFound)
|
|
|
|
req = NewRequestf(t, "GET", urlStr)
|
|
MakeRequest(t, req, http.StatusNotFound)
|
|
})
|
|
|
|
// Add allowed reaction
|
|
req = NewRequestWithJSON(t, "POST", urlStr, &api.EditReactionOption{
|
|
Reaction: "+1",
|
|
})
|
|
resp := MakeRequest(t, req, http.StatusCreated)
|
|
var apiNewReaction api.Reaction
|
|
DecodeJSON(t, resp, &apiNewReaction)
|
|
|
|
// Add existing reaction
|
|
MakeRequest(t, req, http.StatusForbidden)
|
|
|
|
// Get end result of reaction list of issue #1
|
|
req = NewRequestf(t, "GET", urlStr)
|
|
resp = MakeRequest(t, req, http.StatusOK)
|
|
var apiReactions []*api.Reaction
|
|
DecodeJSON(t, resp, &apiReactions)
|
|
expectResponse := make(map[int]api.Reaction)
|
|
expectResponse[0] = api.Reaction{
|
|
User: convert.ToUser(db.DefaultContext, user2, user2),
|
|
Reaction: "laugh",
|
|
Created: time.Unix(1573248004, 0),
|
|
}
|
|
expectResponse[1] = api.Reaction{
|
|
User: convert.ToUser(db.DefaultContext, user1, user1),
|
|
Reaction: "laugh",
|
|
Created: time.Unix(1573248005, 0),
|
|
}
|
|
expectResponse[2] = apiNewReaction
|
|
assert.Len(t, apiReactions, 3)
|
|
for i, r := range apiReactions {
|
|
assert.Equal(t, expectResponse[i].Reaction, r.Reaction)
|
|
assert.Equal(t, expectResponse[i].Created.Unix(), r.Created.Unix())
|
|
assert.Equal(t, expectResponse[i].User.ID, r.User.ID)
|
|
}
|
|
}
|