X-Git-Url: http://git.squeep.com/?a=blobdiff_plain;f=test%2Fplugs%2Fuser_is_admin_plug_test.exs;h=015d51018c35bd1ef24aef733b34ad9891f0520a;hb=193d67cde590efd9a75ac11da76657151f58afdd;hp=154c9b195ed1798fe057c59633d737d61353bc3d;hpb=40e1817f707c3c2ef253009c7363cd81b11322a6;p=akkoma
diff --git a/test/plugs/user_is_admin_plug_test.exs b/test/plugs/user_is_admin_plug_test.exs
index 154c9b195..015d51018 100644
--- a/test/plugs/user_is_admin_plug_test.exs
+++ b/test/plugs/user_is_admin_plug_test.exs
@@ -1,5 +1,5 @@
# Pleroma: A lightweight social networking server
-# Copyright © 2017-2018 Pleroma Authors
+# Copyright © 2017-2020 Pleroma Authors
# SPDX-License-Identifier: AGPL-3.0-only
defmodule Pleroma.Plugs.UserIsAdminPlugTest do
@@ -13,7 +13,7 @@ defmodule Pleroma.Plugs.UserIsAdminPlugTest do
Pleroma.Config.put([:auth, :enforce_oauth_admin_scope_usage], false)
end
- test "accepts a user that is admin" do
+ test "accepts a user that is an admin" do
user = insert(:user, is_admin: true)
conn = assign(build_conn(), :user, user)
@@ -23,7 +23,7 @@ defmodule Pleroma.Plugs.UserIsAdminPlugTest do
assert conn == ret_conn
end
- test "denies a user that isn't admin" do
+ test "denies a user that isn't an admin" do
user = insert(:user)
conn =
@@ -54,23 +54,43 @@ defmodule Pleroma.Plugs.UserIsAdminPlugTest do
{:ok, %{users: [admin_user, non_admin_user, blank_user]}}
end
- # Note: in real-life scenarios only users with is_admin flag can possess admin-scoped tokens;
- # however, the following test stresses out that is_admin flag is not checked if we got token
- test "if token has any of admin scopes, accepts users regardless of is_admin flag",
- %{users: users} do
- for user <- users do
- token = insert(:oauth_token, user: user, scopes: ["admin:something"])
+ test "if token has any of admin scopes, accepts a user that is an admin", %{conn: conn} do
+ user = insert(:user, is_admin: true)
+ token = insert(:oauth_token, user: user, scopes: ["admin:something"])
- conn =
- build_conn()
- |> assign(:user, user)
- |> assign(:token, token)
- |> UserIsAdminPlug.call(%{})
+ conn =
+ conn
+ |> assign(:user, user)
+ |> assign(:token, token)
- ret_conn = UserIsAdminPlug.call(conn, %{})
+ ret_conn = UserIsAdminPlug.call(conn, %{})
- assert conn == ret_conn
- end
+ assert conn == ret_conn
+ end
+
+ test "if token has any of admin scopes, denies a user that isn't an admin", %{conn: conn} do
+ user = insert(:user, is_admin: false)
+ token = insert(:oauth_token, user: user, scopes: ["admin:something"])
+
+ conn =
+ conn
+ |> assign(:user, user)
+ |> assign(:token, token)
+ |> UserIsAdminPlug.call(%{})
+
+ assert conn.status == 403
+ end
+
+ test "if token has any of admin scopes, denies when a user isn't set", %{conn: conn} do
+ token = insert(:oauth_token, scopes: ["admin:something"])
+
+ conn =
+ conn
+ |> assign(:user, nil)
+ |> assign(:token, token)
+ |> UserIsAdminPlug.call(%{})
+
+ assert conn.status == 403
end
test "if token lacks admin scopes, denies users regardless of is_admin flag",