Merge branch 'develop' of https://git.pleroma.social/pleroma/pleroma into develop

[akkoma] / test / plugs / user_is_admin_plug_test.exs

diff --git a/test/plugs/user_is_admin_plug_test.exs b/test/plugs/user_is_admin_plug_test.exs
index 154c9b195ed1798fe057c59633d737d61353bc3d..fd6a50e534e62079d33993470f000322fac93792 100644 (file)
--- a/test/plugs/user_is_admin_plug_test.exs
+++ b/test/plugs/user_is_admin_plug_test.exs
@@ -1,5 +1,5 @@
 # Pleroma: A lightweight social networking server
-# Copyright © 2017-2018 Pleroma Authors <https://pleroma.social/>
+# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
 # SPDX-License-Identifier: AGPL-3.0-only
 
 defmodule Pleroma.Plugs.UserIsAdminPlugTest do
@@ -9,11 +9,9 @@ defmodule Pleroma.Plugs.UserIsAdminPlugTest do
   import Pleroma.Factory
 
   describe "unless [:auth, :enforce_oauth_admin_scope_usage]," do
-    clear_config([:auth, :enforce_oauth_admin_scope_usage]) do
-      Pleroma.Config.put([:auth, :enforce_oauth_admin_scope_usage], false)
-    end
+    setup do: clear_config([:auth, :enforce_oauth_admin_scope_usage], false)
 
-    test "accepts a user that is admin" do
+    test "accepts a user that is an admin" do
       user = insert(:user, is_admin: true)
 
       conn = assign(build_conn(), :user, user)
@@ -23,7 +21,7 @@ defmodule Pleroma.Plugs.UserIsAdminPlugTest do
       assert conn == ret_conn
     end
 
-    test "denies a user that isn't admin" do
+    test "denies a user that isn't an admin" do
       user = insert(:user)
 
       conn =
@@ -42,9 +40,7 @@ defmodule Pleroma.Plugs.UserIsAdminPlugTest do
   end
 
   describe "with [:auth, :enforce_oauth_admin_scope_usage]," do
-    clear_config([:auth, :enforce_oauth_admin_scope_usage]) do
-      Pleroma.Config.put([:auth, :enforce_oauth_admin_scope_usage], true)
-    end
+    setup do: clear_config([:auth, :enforce_oauth_admin_scope_usage], true)
 
     setup do
       admin_user = insert(:user, is_admin: true)
@@ -54,23 +50,43 @@ defmodule Pleroma.Plugs.UserIsAdminPlugTest do
       {:ok, %{users: [admin_user, non_admin_user, blank_user]}}
     end
 
-    # Note: in real-life scenarios only users with is_admin flag can possess admin-scoped tokens;
-    #   however, the following test stresses out that is_admin flag is not checked if we got token
-    test "if token has any of admin scopes, accepts users regardless of is_admin flag",
-         %{users: users} do
-      for user <- users do
-        token = insert(:oauth_token, user: user, scopes: ["admin:something"])
+    test "if token has any of admin scopes, accepts a user that is an admin", %{conn: conn} do
+      user = insert(:user, is_admin: true)
+      token = insert(:oauth_token, user: user, scopes: ["admin:something"])
 
-        conn =
-          build_conn()
-          |> assign(:user, user)
-          |> assign(:token, token)
-          |> UserIsAdminPlug.call(%{})
+      conn =
+        conn
+        |> assign(:user, user)
+        |> assign(:token, token)
 
-        ret_conn = UserIsAdminPlug.call(conn, %{})
+      ret_conn = UserIsAdminPlug.call(conn, %{})
 
-        assert conn == ret_conn
-      end
+      assert conn == ret_conn
+    end
+
+    test "if token has any of admin scopes, denies a user that isn't an admin", %{conn: conn} do
+      user = insert(:user, is_admin: false)
+      token = insert(:oauth_token, user: user, scopes: ["admin:something"])
+
+      conn =
+        conn
+        |> assign(:user, user)
+        |> assign(:token, token)
+        |> UserIsAdminPlug.call(%{})
+
+      assert conn.status == 403
+    end
+
+    test "if token has any of admin scopes, denies when a user isn't set", %{conn: conn} do
+      token = insert(:oauth_token, scopes: ["admin:something"])
+
+      conn =
+        conn
+        |> assign(:user, nil)
+        |> assign(:token, token)
+        |> UserIsAdminPlug.call(%{})
+
+      assert conn.status == 403
     end
 
     test "if token lacks admin scopes, denies users regardless of is_admin flag",