code.gitea.io/gitea@v1.21.7/tests/integration/api_repo_collaborator_test.go (about)

     1  // Copyright 2022 The Gitea Authors. All rights reserved.
     2  // SPDX-License-Identifier: MIT
     3  
     4  package integration
     5  
     6  import (
     7  	"net/http"
     8  	"net/url"
     9  	"testing"
    10  
    11  	auth_model "code.gitea.io/gitea/models/auth"
    12  	"code.gitea.io/gitea/models/perm"
    13  	repo_model "code.gitea.io/gitea/models/repo"
    14  	"code.gitea.io/gitea/models/unittest"
    15  	user_model "code.gitea.io/gitea/models/user"
    16  	api "code.gitea.io/gitea/modules/structs"
    17  
    18  	"github.com/stretchr/testify/assert"
    19  )
    20  
    21  func TestAPIRepoCollaboratorPermission(t *testing.T) {
    22  	onGiteaRun(t, func(t *testing.T, u *url.URL) {
    23  		repo2 := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 2})
    24  		repo2Owner := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: repo2.OwnerID})
    25  
    26  		user4 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 4})
    27  		user5 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 5})
    28  		user10 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 10})
    29  		user11 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 11})
    30  
    31  		testCtx := NewAPITestContext(t, repo2Owner.Name, repo2.Name, auth_model.AccessTokenScopeWriteRepository)
    32  
    33  		t.Run("RepoOwnerShouldBeOwner", func(t *testing.T) {
    34  			req := NewRequestf(t, "GET", "/api/v1/repos/%s/%s/collaborators/%s/permission?token=%s", repo2Owner.Name, repo2.Name, repo2Owner.Name, testCtx.Token)
    35  			resp := MakeRequest(t, req, http.StatusOK)
    36  
    37  			var repoPermission api.RepoCollaboratorPermission
    38  			DecodeJSON(t, resp, &repoPermission)
    39  
    40  			assert.Equal(t, "owner", repoPermission.Permission)
    41  		})
    42  
    43  		t.Run("CollaboratorWithReadAccess", func(t *testing.T) {
    44  			t.Run("AddUserAsCollaboratorWithReadAccess", doAPIAddCollaborator(testCtx, user4.Name, perm.AccessModeRead))
    45  
    46  			req := NewRequestf(t, "GET", "/api/v1/repos/%s/%s/collaborators/%s/permission?token=%s", repo2Owner.Name, repo2.Name, user4.Name, testCtx.Token)
    47  			resp := MakeRequest(t, req, http.StatusOK)
    48  
    49  			var repoPermission api.RepoCollaboratorPermission
    50  			DecodeJSON(t, resp, &repoPermission)
    51  
    52  			assert.Equal(t, "read", repoPermission.Permission)
    53  		})
    54  
    55  		t.Run("CollaboratorWithWriteAccess", func(t *testing.T) {
    56  			t.Run("AddUserAsCollaboratorWithWriteAccess", doAPIAddCollaborator(testCtx, user4.Name, perm.AccessModeWrite))
    57  
    58  			req := NewRequestf(t, "GET", "/api/v1/repos/%s/%s/collaborators/%s/permission?token=%s", repo2Owner.Name, repo2.Name, user4.Name, testCtx.Token)
    59  			resp := MakeRequest(t, req, http.StatusOK)
    60  
    61  			var repoPermission api.RepoCollaboratorPermission
    62  			DecodeJSON(t, resp, &repoPermission)
    63  
    64  			assert.Equal(t, "write", repoPermission.Permission)
    65  		})
    66  
    67  		t.Run("CollaboratorWithAdminAccess", func(t *testing.T) {
    68  			t.Run("AddUserAsCollaboratorWithAdminAccess", doAPIAddCollaborator(testCtx, user4.Name, perm.AccessModeAdmin))
    69  
    70  			req := NewRequestf(t, "GET", "/api/v1/repos/%s/%s/collaborators/%s/permission?token=%s", repo2Owner.Name, repo2.Name, user4.Name, testCtx.Token)
    71  			resp := MakeRequest(t, req, http.StatusOK)
    72  
    73  			var repoPermission api.RepoCollaboratorPermission
    74  			DecodeJSON(t, resp, &repoPermission)
    75  
    76  			assert.Equal(t, "admin", repoPermission.Permission)
    77  		})
    78  
    79  		t.Run("CollaboratorNotFound", func(t *testing.T) {
    80  			req := NewRequestf(t, "GET", "/api/v1/repos/%s/%s/collaborators/%s/permission?token=%s", repo2Owner.Name, repo2.Name, "non-existent-user", testCtx.Token)
    81  			MakeRequest(t, req, http.StatusNotFound)
    82  		})
    83  
    84  		t.Run("CollaboratorCanQueryItsPermissions", func(t *testing.T) {
    85  			t.Run("AddUserAsCollaboratorWithReadAccess", doAPIAddCollaborator(testCtx, user5.Name, perm.AccessModeRead))
    86  
    87  			_session := loginUser(t, user5.Name)
    88  			_testCtx := NewAPITestContext(t, user5.Name, repo2.Name, auth_model.AccessTokenScopeReadRepository)
    89  
    90  			req := NewRequestf(t, "GET", "/api/v1/repos/%s/%s/collaborators/%s/permission?token=%s", repo2Owner.Name, repo2.Name, user5.Name, _testCtx.Token)
    91  			resp := _session.MakeRequest(t, req, http.StatusOK)
    92  
    93  			var repoPermission api.RepoCollaboratorPermission
    94  			DecodeJSON(t, resp, &repoPermission)
    95  
    96  			assert.Equal(t, "read", repoPermission.Permission)
    97  		})
    98  
    99  		t.Run("CollaboratorCanQueryItsPermissions", func(t *testing.T) {
   100  			t.Run("AddUserAsCollaboratorWithReadAccess", doAPIAddCollaborator(testCtx, user5.Name, perm.AccessModeRead))
   101  
   102  			_session := loginUser(t, user5.Name)
   103  			_testCtx := NewAPITestContext(t, user5.Name, repo2.Name, auth_model.AccessTokenScopeReadRepository)
   104  
   105  			req := NewRequestf(t, "GET", "/api/v1/repos/%s/%s/collaborators/%s/permission?token=%s", repo2Owner.Name, repo2.Name, user5.Name, _testCtx.Token)
   106  			resp := _session.MakeRequest(t, req, http.StatusOK)
   107  
   108  			var repoPermission api.RepoCollaboratorPermission
   109  			DecodeJSON(t, resp, &repoPermission)
   110  
   111  			assert.Equal(t, "read", repoPermission.Permission)
   112  		})
   113  
   114  		t.Run("RepoAdminCanQueryACollaboratorsPermissions", func(t *testing.T) {
   115  			t.Run("AddUserAsCollaboratorWithAdminAccess", doAPIAddCollaborator(testCtx, user10.Name, perm.AccessModeAdmin))
   116  			t.Run("AddUserAsCollaboratorWithReadAccess", doAPIAddCollaborator(testCtx, user11.Name, perm.AccessModeRead))
   117  
   118  			_session := loginUser(t, user10.Name)
   119  			_testCtx := NewAPITestContext(t, user10.Name, repo2.Name, auth_model.AccessTokenScopeReadRepository)
   120  
   121  			req := NewRequestf(t, "GET", "/api/v1/repos/%s/%s/collaborators/%s/permission?token=%s", repo2Owner.Name, repo2.Name, user11.Name, _testCtx.Token)
   122  			resp := _session.MakeRequest(t, req, http.StatusOK)
   123  
   124  			var repoPermission api.RepoCollaboratorPermission
   125  			DecodeJSON(t, resp, &repoPermission)
   126  
   127  			assert.Equal(t, "read", repoPermission.Permission)
   128  		})
   129  	})
   130  }