# Pleroma: A lightweight social networking server
-# Copyright © 2017-2018 Pleroma Authors <https://pleroma.social/>
+# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
# SPDX-License-Identifier: AGPL-3.0-only
defmodule Pleroma.Plugs.UserIsAdminPlugTest do
import Pleroma.Factory
describe "unless [:auth, :enforce_oauth_admin_scope_usage]," do
- clear_config([:auth, :enforce_oauth_admin_scope_usage]) do
- Pleroma.Config.put([:auth, :enforce_oauth_admin_scope_usage], false)
- end
+ setup do: clear_config([:auth, :enforce_oauth_admin_scope_usage], false)
- test "accepts a user that is admin" do
+ test "accepts a user that is an admin" do
user = insert(:user, is_admin: true)
conn = assign(build_conn(), :user, user)
assert conn == ret_conn
end
- test "denies a user that isn't admin" do
+ test "denies a user that isn't an admin" do
user = insert(:user)
conn =
end
describe "with [:auth, :enforce_oauth_admin_scope_usage]," do
- clear_config([:auth, :enforce_oauth_admin_scope_usage]) do
- Pleroma.Config.put([:auth, :enforce_oauth_admin_scope_usage], true)
- end
+ setup do: clear_config([:auth, :enforce_oauth_admin_scope_usage], true)
setup do
admin_user = insert(:user, is_admin: true)
{:ok, %{users: [admin_user, non_admin_user, blank_user]}}
end
- # Note: in real-life scenarios only users with is_admin flag can possess admin-scoped tokens;
- # however, the following test stresses out that is_admin flag is not checked if we got token
- test "if token has any of admin scopes, accepts users regardless of is_admin flag",
- %{users: users} do
- for user <- users do
- token = insert(:oauth_token, user: user, scopes: ["admin:something"])
+ test "if token has any of admin scopes, accepts a user that is an admin", %{conn: conn} do
+ user = insert(:user, is_admin: true)
+ token = insert(:oauth_token, user: user, scopes: ["admin:something"])
- conn =
- build_conn()
- |> assign(:user, user)
- |> assign(:token, token)
- |> UserIsAdminPlug.call(%{})
+ conn =
+ conn
+ |> assign(:user, user)
+ |> assign(:token, token)
- ret_conn = UserIsAdminPlug.call(conn, %{})
+ ret_conn = UserIsAdminPlug.call(conn, %{})
- assert conn == ret_conn
- end
+ assert conn == ret_conn
+ end
+
+ test "if token has any of admin scopes, denies a user that isn't an admin", %{conn: conn} do
+ user = insert(:user, is_admin: false)
+ token = insert(:oauth_token, user: user, scopes: ["admin:something"])
+
+ conn =
+ conn
+ |> assign(:user, user)
+ |> assign(:token, token)
+ |> UserIsAdminPlug.call(%{})
+
+ assert conn.status == 403
+ end
+
+ test "if token has any of admin scopes, denies when a user isn't set", %{conn: conn} do
+ token = insert(:oauth_token, scopes: ["admin:something"])
+
+ conn =
+ conn
+ |> assign(:user, nil)
+ |> assign(:token, token)
+ |> UserIsAdminPlug.call(%{})
+
+ assert conn.status == 403
end
test "if token lacks admin scopes, denies users regardless of is_admin flag",