git.squeep.com Git - akkoma/blob - test/plugs/user_is_admin_plug_test.exs

   1 # Pleroma: A lightweight social networking server
   2 # Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
   3 # SPDX-License-Identifier: AGPL-3.0-only
   4
   5 defmodule Pleroma.Plugs.UserIsAdminPlugTest do
   6   use Pleroma.Web.ConnCase, async: true
   7
   8   alias Pleroma.Plugs.UserIsAdminPlug
   9   import Pleroma.Factory
  10
  11   describe "unless [:auth, :enforce_oauth_admin_scope_usage]," do
  12     clear_config([:auth, :enforce_oauth_admin_scope_usage]) do
  13       Pleroma.Config.put([:auth, :enforce_oauth_admin_scope_usage], false)
  14     end
  15
  16     test "accepts a user that is an admin" do
  17       user = insert(:user, is_admin: true)
  18
  19       conn = assign(build_conn(), :user, user)
  20
  21       ret_conn = UserIsAdminPlug.call(conn, %{})
  22
  23       assert conn == ret_conn
  24     end
  25
  26     test "denies a user that isn't an admin" do
  27       user = insert(:user)
  28
  29       conn =
  30         build_conn()
  31         |> assign(:user, user)
  32         |> UserIsAdminPlug.call(%{})
  33
  34       assert conn.status == 403
  35     end
  36
  37     test "denies when a user isn't set" do
  38       conn = UserIsAdminPlug.call(build_conn(), %{})
  39
  40       assert conn.status == 403
  41     end
  42   end
  43
  44   describe "with [:auth, :enforce_oauth_admin_scope_usage]," do
  45     clear_config([:auth, :enforce_oauth_admin_scope_usage]) do
  46       Pleroma.Config.put([:auth, :enforce_oauth_admin_scope_usage], true)
  47     end
  48
  49     setup do
  50       admin_user = insert(:user, is_admin: true)
  51       non_admin_user = insert(:user, is_admin: false)
  52       blank_user = nil
  53
  54       {:ok, %{users: [admin_user, non_admin_user, blank_user]}}
  55     end
  56
  57     test "if token has any of admin scopes, accepts a user that is an admin", %{conn: conn} do
  58       user = insert(:user, is_admin: true)
  59       token = insert(:oauth_token, user: user, scopes: ["admin:something"])
  60
  61       conn =
  62         conn
  63         |> assign(:user, user)
  64         |> assign(:token, token)
  65
  66       ret_conn = UserIsAdminPlug.call(conn, %{})
  67
  68       assert conn == ret_conn
  69     end
  70
  71     test "if token has any of admin scopes, denies a user that isn't an admin", %{conn: conn} do
  72       user = insert(:user, is_admin: false)
  73       token = insert(:oauth_token, user: user, scopes: ["admin:something"])
  74
  75       conn =
  76         conn
  77         |> assign(:user, user)
  78         |> assign(:token, token)
  79         |> UserIsAdminPlug.call(%{})
  80
  81       assert conn.status == 403
  82     end
  83
  84     test "if token has any of admin scopes, denies when a user isn't set", %{conn: conn} do
  85       token = insert(:oauth_token, scopes: ["admin:something"])
  86
  87       conn =
  88         conn
  89         |> assign(:user, nil)
  90         |> assign(:token, token)
  91         |> UserIsAdminPlug.call(%{})
  92
  93       assert conn.status == 403
  94     end
  95
  96     test "if token lacks admin scopes, denies users regardless of is_admin flag",
  97          %{users: users} do
  98       for user <- users do
  99         token = insert(:oauth_token, user: user)
 100
 101         conn =
 102           build_conn()
 103           |> assign(:user, user)
 104           |> assign(:token, token)
 105           |> UserIsAdminPlug.call(%{})
 106
 107         assert conn.status == 403
 108       end
 109     end
 110
 111     test "if token is missing, denies users regardless of is_admin flag", %{users: users} do
 112       for user <- users do
 113         conn =
 114           build_conn()
 115           |> assign(:user, user)
 116           |> assign(:token, nil)
 117           |> UserIsAdminPlug.call(%{})
 118
 119         assert conn.status == 403
 120       end
 121     end
 122   end
 123 end