2017-12-06 13:27:10 +03:00
// Copyright 2017 The Gitea Authors. All rights reserved.
2022-11-27 21:20:29 +03:00
// SPDX-License-Identifier: MIT
2017-12-06 13:27:10 +03:00
2022-09-02 22:18:23 +03:00
package integration
2017-12-06 13:27:10 +03:00
import (
"fmt"
"net/http"
"testing"
2021-12-10 11:14:24 +03:00
asymkey_model "code.gitea.io/gitea/models/asymkey"
2023-01-18 00:46:03 +03:00
auth_model "code.gitea.io/gitea/models/auth"
2021-11-16 11:53:21 +03:00
"code.gitea.io/gitea/models/unittest"
2021-11-24 12:49:20 +03:00
user_model "code.gitea.io/gitea/models/user"
2021-07-24 19:03:58 +03:00
"code.gitea.io/gitea/modules/json"
2019-05-11 13:21:34 +03:00
api "code.gitea.io/gitea/modules/structs"
2022-09-02 22:18:23 +03:00
"code.gitea.io/gitea/tests"
2018-09-13 05:33:48 +03:00
"github.com/stretchr/testify/assert"
2017-12-06 13:27:10 +03:00
)
func TestAPIAdminCreateAndDeleteSSHKey ( t * testing . T ) {
2022-09-02 22:18:23 +03:00
defer tests . PrepareTestEnv ( t ) ( )
2017-12-06 13:27:10 +03:00
// user1 is an admin user
session := loginUser ( t , "user1" )
2022-08-16 05:22:25 +03:00
keyOwner := unittest . AssertExistsAndLoadBean ( t , & user_model . User { Name : "user2" } )
2017-12-06 13:27:10 +03:00
2023-01-18 00:46:03 +03:00
token := getTokenForLoggedInUser ( t , session , auth_model . AccessTokenScopeSudo )
2018-09-10 19:15:52 +03:00
urlStr := fmt . Sprintf ( "/api/v1/admin/users/%s/keys?token=%s" , keyOwner . Name , token )
2017-12-06 13:27:10 +03:00
req := NewRequestWithValues ( t , "POST" , urlStr , map [ string ] string {
2020-10-09 09:52:57 +03:00
"key" : "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC4cn+iXnA4KvcQYSV88vGn0Yi91vG47t1P7okprVmhNTkipNRIHWr6WdCO4VDr/cvsRkuVJAsLO2enwjGWWueOO6BodiBgyAOZ/5t5nJNMCNuLGT5UIo/RI1b0WRQwxEZTRjt6mFNw6lH14wRd8ulsr9toSWBPMOGWoYs1PDeDL0JuTjL+tr1SZi/EyxCngpYszKdXllJEHyI79KQgeD0Vt3pTrkbNVTOEcCNqZePSVmUH8X8Vhugz3bnE0/iE9Pb5fkWO9c4AnM1FgI/8Bvp27Fw2ShryIXuR6kKvUqhVMTuOSDHwu6A8jLE5Owt3GAYugDpDYuwTVNGrHLXKpPzrGGPE/jPmaLCMZcsdkec95dYeU3zKODEm8UQZFhmJmDeWVJ36nGrGZHL4J5aTTaeFUJmmXDaJYiJ+K2/ioKgXqnXvltu0A9R8/LGy4nrTJRr4JMLuJFoUXvGm1gXQ70w2LSpk6yl71RNC0hCtsBe8BP8IhYCM0EP5jh7eCMQZNvM= nocomment\n" ,
2017-12-06 13:27:10 +03:00
"title" : "test-key" ,
} )
2022-12-02 06:39:42 +03:00
resp := MakeRequest ( t , req , http . StatusCreated )
2017-12-06 13:27:10 +03:00
var newPublicKey api . PublicKey
DecodeJSON ( t , resp , & newPublicKey )
2021-12-10 11:14:24 +03:00
unittest . AssertExistsAndLoadBean ( t , & asymkey_model . PublicKey {
2017-12-06 13:27:10 +03:00
ID : newPublicKey . ID ,
Name : newPublicKey . Title ,
Fingerprint : newPublicKey . Fingerprint ,
OwnerID : keyOwner . ID ,
} )
2018-11-04 04:15:55 +03:00
req = NewRequestf ( t , "DELETE" , "/api/v1/admin/users/%s/keys/%d?token=%s" ,
keyOwner . Name , newPublicKey . ID , token )
2022-12-02 06:39:42 +03:00
MakeRequest ( t , req , http . StatusNoContent )
2021-12-10 11:14:24 +03:00
unittest . AssertNotExistsBean ( t , & asymkey_model . PublicKey { ID : newPublicKey . ID } )
2017-12-06 13:27:10 +03:00
}
func TestAPIAdminDeleteMissingSSHKey ( t * testing . T ) {
2022-09-02 22:18:23 +03:00
defer tests . PrepareTestEnv ( t ) ( )
2017-12-06 13:27:10 +03:00
2022-12-02 06:39:42 +03:00
// user1 is an admin user
2023-01-18 00:46:03 +03:00
token := getUserToken ( t , "user1" , auth_model . AccessTokenScopeSudo )
2021-11-16 11:53:21 +03:00
req := NewRequestf ( t , "DELETE" , "/api/v1/admin/users/user1/keys/%d?token=%s" , unittest . NonexistentID , token )
2022-12-02 06:39:42 +03:00
MakeRequest ( t , req , http . StatusNotFound )
2017-12-06 13:27:10 +03:00
}
func TestAPIAdminDeleteUnauthorizedKey ( t * testing . T ) {
2022-09-02 22:18:23 +03:00
defer tests . PrepareTestEnv ( t ) ( )
2017-12-06 13:27:10 +03:00
adminUsername := "user1"
normalUsername := "user2"
2023-01-18 00:46:03 +03:00
token := getUserToken ( t , adminUsername , auth_model . AccessTokenScopeSudo )
2017-12-06 13:27:10 +03:00
2018-09-10 19:15:52 +03:00
urlStr := fmt . Sprintf ( "/api/v1/admin/users/%s/keys?token=%s" , adminUsername , token )
2017-12-06 13:27:10 +03:00
req := NewRequestWithValues ( t , "POST" , urlStr , map [ string ] string {
2020-10-09 09:52:57 +03:00
"key" : "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC4cn+iXnA4KvcQYSV88vGn0Yi91vG47t1P7okprVmhNTkipNRIHWr6WdCO4VDr/cvsRkuVJAsLO2enwjGWWueOO6BodiBgyAOZ/5t5nJNMCNuLGT5UIo/RI1b0WRQwxEZTRjt6mFNw6lH14wRd8ulsr9toSWBPMOGWoYs1PDeDL0JuTjL+tr1SZi/EyxCngpYszKdXllJEHyI79KQgeD0Vt3pTrkbNVTOEcCNqZePSVmUH8X8Vhugz3bnE0/iE9Pb5fkWO9c4AnM1FgI/8Bvp27Fw2ShryIXuR6kKvUqhVMTuOSDHwu6A8jLE5Owt3GAYugDpDYuwTVNGrHLXKpPzrGGPE/jPmaLCMZcsdkec95dYeU3zKODEm8UQZFhmJmDeWVJ36nGrGZHL4J5aTTaeFUJmmXDaJYiJ+K2/ioKgXqnXvltu0A9R8/LGy4nrTJRr4JMLuJFoUXvGm1gXQ70w2LSpk6yl71RNC0hCtsBe8BP8IhYCM0EP5jh7eCMQZNvM= nocomment\n" ,
2017-12-06 13:27:10 +03:00
"title" : "test-key" ,
} )
2022-12-02 06:39:42 +03:00
resp := MakeRequest ( t , req , http . StatusCreated )
2017-12-06 13:27:10 +03:00
var newPublicKey api . PublicKey
DecodeJSON ( t , resp , & newPublicKey )
2022-12-02 06:39:42 +03:00
token = getUserToken ( t , normalUsername )
2018-11-04 04:15:55 +03:00
req = NewRequestf ( t , "DELETE" , "/api/v1/admin/users/%s/keys/%d?token=%s" ,
adminUsername , newPublicKey . ID , token )
2022-12-02 06:39:42 +03:00
MakeRequest ( t , req , http . StatusForbidden )
2017-12-06 13:27:10 +03:00
}
2018-09-07 06:31:29 +03:00
func TestAPISudoUser ( t * testing . T ) {
2022-09-02 22:18:23 +03:00
defer tests . PrepareTestEnv ( t ) ( )
2018-09-07 06:31:29 +03:00
adminUsername := "user1"
normalUsername := "user2"
2023-01-18 00:46:03 +03:00
token := getUserToken ( t , adminUsername , auth_model . AccessTokenScopeSudo )
2018-09-07 06:31:29 +03:00
2018-09-10 19:15:52 +03:00
urlStr := fmt . Sprintf ( "/api/v1/user?sudo=%s&token=%s" , normalUsername , token )
2018-09-07 06:31:29 +03:00
req := NewRequest ( t , "GET" , urlStr )
2022-12-02 06:39:42 +03:00
resp := MakeRequest ( t , req , http . StatusOK )
2018-09-07 06:31:29 +03:00
var user api . User
DecodeJSON ( t , resp , & user )
assert . Equal ( t , normalUsername , user . UserName )
}
func TestAPISudoUserForbidden ( t * testing . T ) {
2022-09-02 22:18:23 +03:00
defer tests . PrepareTestEnv ( t ) ( )
2018-09-07 06:31:29 +03:00
adminUsername := "user1"
normalUsername := "user2"
2023-01-18 00:46:03 +03:00
token := getUserToken ( t , normalUsername , auth_model . AccessTokenScopeSudo )
2018-09-10 19:15:52 +03:00
urlStr := fmt . Sprintf ( "/api/v1/user?sudo=%s&token=%s" , adminUsername , token )
2018-09-07 06:31:29 +03:00
req := NewRequest ( t , "GET" , urlStr )
2022-12-02 06:39:42 +03:00
MakeRequest ( t , req , http . StatusForbidden )
2018-09-07 06:31:29 +03:00
}
2019-04-15 19:36:59 +03:00
func TestAPIListUsers ( t * testing . T ) {
2022-09-02 22:18:23 +03:00
defer tests . PrepareTestEnv ( t ) ( )
2019-04-15 19:36:59 +03:00
adminUsername := "user1"
2023-01-18 00:46:03 +03:00
token := getUserToken ( t , adminUsername , auth_model . AccessTokenScopeSudo )
2019-04-15 19:36:59 +03:00
urlStr := fmt . Sprintf ( "/api/v1/admin/users?token=%s" , token )
req := NewRequest ( t , "GET" , urlStr )
2022-12-02 06:39:42 +03:00
resp := MakeRequest ( t , req , http . StatusOK )
2019-04-15 19:36:59 +03:00
var users [ ] api . User
DecodeJSON ( t , resp , & users )
found := false
for _ , user := range users {
if user . UserName == adminUsername {
found = true
}
}
assert . True ( t , found )
2021-11-24 12:49:20 +03:00
numberOfUsers := unittest . GetCount ( t , & user_model . User { } , "type = 0" )
2023-04-23 00:56:27 +03:00
assert . Len ( t , users , numberOfUsers )
2019-04-15 19:36:59 +03:00
}
2019-05-08 22:17:32 +03:00
func TestAPIListUsersNotLoggedIn ( t * testing . T ) {
2022-09-02 22:18:23 +03:00
defer tests . PrepareTestEnv ( t ) ( )
2019-05-08 22:17:32 +03:00
req := NewRequest ( t , "GET" , "/api/v1/admin/users" )
MakeRequest ( t , req , http . StatusUnauthorized )
}
func TestAPIListUsersNonAdmin ( t * testing . T ) {
2022-09-02 22:18:23 +03:00
defer tests . PrepareTestEnv ( t ) ( )
2019-05-08 22:17:32 +03:00
nonAdminUsername := "user2"
2022-12-02 06:39:42 +03:00
token := getUserToken ( t , nonAdminUsername )
2019-05-08 22:17:32 +03:00
req := NewRequestf ( t , "GET" , "/api/v1/admin/users?token=%s" , token )
2022-12-02 06:39:42 +03:00
MakeRequest ( t , req , http . StatusForbidden )
2019-05-08 22:17:32 +03:00
}
2020-11-14 19:53:43 +03:00
func TestAPICreateUserInvalidEmail ( t * testing . T ) {
2022-09-02 22:18:23 +03:00
defer tests . PrepareTestEnv ( t ) ( )
2020-11-14 19:53:43 +03:00
adminUsername := "user1"
2023-01-18 00:46:03 +03:00
token := getUserToken ( t , adminUsername , auth_model . AccessTokenScopeSudo )
2020-11-14 19:53:43 +03:00
urlStr := fmt . Sprintf ( "/api/v1/admin/users?token=%s" , token )
req := NewRequestWithValues ( t , "POST" , urlStr , map [ string ] string {
"email" : "invalid_email@domain.com\r\n" ,
"full_name" : "invalid user" ,
"login_name" : "invalidUser" ,
"must_change_password" : "true" ,
"password" : "password" ,
"send_notify" : "true" ,
"source_id" : "0" ,
"username" : "invalidUser" ,
} )
2022-12-02 06:39:42 +03:00
MakeRequest ( t , req , http . StatusUnprocessableEntity )
2020-11-14 19:53:43 +03:00
}
2020-11-20 04:56:42 +03:00
2022-10-17 19:23:27 +03:00
func TestAPICreateAndDeleteUser ( t * testing . T ) {
defer tests . PrepareTestEnv ( t ) ( )
adminUsername := "user1"
2023-01-18 00:46:03 +03:00
token := getUserToken ( t , adminUsername , auth_model . AccessTokenScopeSudo )
2022-10-17 19:23:27 +03:00
req := NewRequestWithValues (
t ,
"POST" ,
fmt . Sprintf ( "/api/v1/admin/users?token=%s" , token ) ,
map [ string ] string {
"email" : "deleteme@domain.com" ,
"full_name" : "delete me" ,
"login_name" : "deleteme" ,
"must_change_password" : "true" ,
"password" : "password" ,
"send_notify" : "true" ,
"source_id" : "0" ,
"username" : "deleteme" ,
} ,
)
MakeRequest ( t , req , http . StatusCreated )
req = NewRequest ( t , "DELETE" , fmt . Sprintf ( "/api/v1/admin/users/deleteme?token=%s" , token ) )
MakeRequest ( t , req , http . StatusNoContent )
}
2020-11-20 04:56:42 +03:00
func TestAPIEditUser ( t * testing . T ) {
2022-09-02 22:18:23 +03:00
defer tests . PrepareTestEnv ( t ) ( )
2020-11-20 04:56:42 +03:00
adminUsername := "user1"
2023-01-18 00:46:03 +03:00
token := getUserToken ( t , adminUsername , auth_model . AccessTokenScopeSudo )
2020-11-20 04:56:42 +03:00
urlStr := fmt . Sprintf ( "/api/v1/admin/users/%s?token=%s" , "user2" , token )
req := NewRequestWithValues ( t , "PATCH" , urlStr , map [ string ] string {
// required
"login_name" : "user2" ,
"source_id" : "0" ,
// to change
"full_name" : "Full Name User 2" ,
} )
2022-12-02 06:39:42 +03:00
MakeRequest ( t , req , http . StatusOK )
2020-11-20 04:56:42 +03:00
empty := ""
req = NewRequestWithJSON ( t , "PATCH" , urlStr , api . EditUserOption {
LoginName : "user2" ,
SourceID : 0 ,
Email : & empty ,
} )
2022-12-02 06:39:42 +03:00
resp := MakeRequest ( t , req , http . StatusUnprocessableEntity )
2020-11-20 04:56:42 +03:00
errMap := make ( map [ string ] interface { } )
json . Unmarshal ( resp . Body . Bytes ( ) , & errMap )
assert . EqualValues ( t , "email is not allowed to be empty string" , errMap [ "message" ] . ( string ) )
2021-02-18 11:25:35 +03:00
2022-08-16 05:22:25 +03:00
user2 := unittest . AssertExistsAndLoadBean ( t , & user_model . User { LoginName : "user2" } )
2021-06-07 08:27:09 +03:00
assert . False ( t , user2 . IsRestricted )
2021-02-18 11:25:35 +03:00
bTrue := true
req = NewRequestWithJSON ( t , "PATCH" , urlStr , api . EditUserOption {
// required
LoginName : "user2" ,
SourceID : 0 ,
// to change
Restricted : & bTrue ,
} )
2022-12-02 06:39:42 +03:00
MakeRequest ( t , req , http . StatusOK )
2022-08-16 05:22:25 +03:00
user2 = unittest . AssertExistsAndLoadBean ( t , & user_model . User { LoginName : "user2" } )
2021-06-07 08:27:09 +03:00
assert . True ( t , user2 . IsRestricted )
2020-11-20 04:56:42 +03:00
}
2022-10-17 19:23:27 +03:00
func TestAPICreateRepoForUser ( t * testing . T ) {
defer tests . PrepareTestEnv ( t ) ( )
adminUsername := "user1"
2023-01-18 00:46:03 +03:00
token := getUserToken ( t , adminUsername , auth_model . AccessTokenScopeSudo )
2022-10-17 19:23:27 +03:00
req := NewRequestWithJSON (
t ,
"POST" ,
fmt . Sprintf ( "/api/v1/admin/users/%s/repos?token=%s" , adminUsername , token ) ,
& api . CreateRepoOption {
Name : "admincreatedrepo" ,
} ,
)
MakeRequest ( t , req , http . StatusCreated )
}