code.gitea.io/gitea@v1.22.3/tests/integration/org_project_test.go (about)

     1  // Copyright 2023 The Gitea Authors. All rights reserved.
     2  // SPDX-License-Identifier: MIT
     3  
     4  package integration
     5  
     6  import (
     7  	"net/http"
     8  	"slices"
     9  	"testing"
    10  
    11  	unit_model "code.gitea.io/gitea/models/unit"
    12  	"code.gitea.io/gitea/tests"
    13  )
    14  
    15  func TestOrgProjectAccess(t *testing.T) {
    16  	defer tests.PrepareTestEnv(t)()
    17  
    18  	disabledRepoUnits := unit_model.DisabledRepoUnitsGet()
    19  	unit_model.DisabledRepoUnitsSet(append(slices.Clone(disabledRepoUnits), unit_model.TypeProjects))
    20  	defer unit_model.DisabledRepoUnitsSet(disabledRepoUnits)
    21  
    22  	// repo project, 404
    23  	req := NewRequest(t, "GET", "/user2/repo1/projects")
    24  	MakeRequest(t, req, http.StatusNotFound)
    25  
    26  	// user project, 200
    27  	req = NewRequest(t, "GET", "/user2/-/projects")
    28  	MakeRequest(t, req, http.StatusOK)
    29  
    30  	// org project, 200
    31  	req = NewRequest(t, "GET", "/org3/-/projects")
    32  	MakeRequest(t, req, http.StatusOK)
    33  
    34  	// change the org's visibility to private
    35  	session := loginUser(t, "user2")
    36  	req = NewRequestWithValues(t, "POST", "/org/org3/settings", map[string]string{
    37  		"_csrf":      GetCSRF(t, session, "/org3/-/projects"),
    38  		"name":       "org3",
    39  		"visibility": "2",
    40  	})
    41  	session.MakeRequest(t, req, http.StatusSeeOther)
    42  
    43  	// user4 can still access the org's project because its team(team1) has the permission
    44  	session = loginUser(t, "user4")
    45  	req = NewRequest(t, "GET", "/org3/-/projects")
    46  	session.MakeRequest(t, req, http.StatusOK)
    47  
    48  	// disable team1's project unit
    49  	session = loginUser(t, "user2")
    50  	req = NewRequestWithValues(t, "POST", "/org/org3/teams/team1/edit", map[string]string{
    51  		"_csrf":       GetCSRF(t, session, "/org3/-/projects"),
    52  		"team_name":   "team1",
    53  		"repo_access": "specific",
    54  		"permission":  "read",
    55  		"unit_8":      "0",
    56  	})
    57  	session.MakeRequest(t, req, http.StatusSeeOther)
    58  
    59  	// user4 can no longer access the org's project
    60  	session = loginUser(t, "user4")
    61  	req = NewRequest(t, "GET", "/org3/-/projects")
    62  	session.MakeRequest(t, req, http.StatusNotFound)
    63  }