mirror of
https://github.com/go-gitea/gitea.git
synced 2026-08-25 04:54:35 +00:00
bircni
204c0bafd3
Require organization ownership before changing repository team associations when team access is restricted. --------- Co-authored-by: silverwind <me@silverwind.io>
94 lines
4.0 KiB
Go
94 lines
4.0 KiB
Go
// Copyright 2021 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package integration
|
|
|
|
import (
|
|
"fmt"
|
|
"net/http"
|
|
"testing"
|
|
|
|
auth_model "gitea.dev/models/auth"
|
|
"gitea.dev/models/organization"
|
|
repo_model "gitea.dev/models/repo"
|
|
"gitea.dev/models/unittest"
|
|
user_model "gitea.dev/models/user"
|
|
api "gitea.dev/modules/structs"
|
|
repo_service "gitea.dev/services/repository"
|
|
"gitea.dev/tests"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
)
|
|
|
|
func TestAPIRepoTeams(t *testing.T) {
|
|
defer tests.PrepareTestEnv(t)()
|
|
|
|
// publicOrgRepo = org3/repo21
|
|
publicOrgRepo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 32})
|
|
// user4
|
|
user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 4})
|
|
session := loginUser(t, user.Name)
|
|
token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteRepository)
|
|
|
|
// ListTeams
|
|
req := NewRequest(t, "GET", fmt.Sprintf("/api/v1/repos/%s/teams", publicOrgRepo.FullName())).
|
|
AddTokenAuth(token)
|
|
res := MakeRequest(t, req, http.StatusOK)
|
|
teams := DecodeJSON(t, res, []*api.Team{})
|
|
if assert.Len(t, teams, 2) {
|
|
assert.Equal(t, "Owners", teams[0].Name)
|
|
assert.True(t, teams[0].CanCreateOrgRepo)
|
|
assert.Equal(t, []string{"repo.issues"}, teams[1].Units) // legacy dirty data, although the team.authorize is "owner", the units are also responded
|
|
assert.Equal(t, api.AccessLevelNameOwner, teams[0].Permission)
|
|
|
|
assert.Equal(t, "test_team", teams[1].Name)
|
|
assert.False(t, teams[1].CanCreateOrgRepo)
|
|
assert.Equal(t, []string{"repo.issues"}, teams[1].Units)
|
|
assert.Equal(t, api.AccessLevelNameWrite, teams[1].Permission) // legacy dirty data, although the team.authorize is "write", the units are also responded
|
|
}
|
|
|
|
// IsTeam
|
|
req = NewRequest(t, "GET", fmt.Sprintf("/api/v1/repos/%s/teams/%s", publicOrgRepo.FullName(), "Test_Team")).
|
|
AddTokenAuth(token)
|
|
res = MakeRequest(t, req, http.StatusOK)
|
|
team := DecodeJSON(t, res, &api.Team{})
|
|
assert.Equal(t, teams[1], team)
|
|
|
|
req = NewRequest(t, "GET", fmt.Sprintf("/api/v1/repos/%s/teams/%s", publicOrgRepo.FullName(), "NonExistingTeam")).
|
|
AddTokenAuth(token)
|
|
MakeRequest(t, req, http.StatusNotFound)
|
|
|
|
// AddTeam with user4
|
|
req = NewRequest(t, "PUT", fmt.Sprintf("/api/v1/repos/%s/teams/%s", publicOrgRepo.FullName(), "team1")).
|
|
AddTokenAuth(token)
|
|
MakeRequest(t, req, http.StatusForbidden)
|
|
|
|
adminTeam := unittest.AssertExistsAndLoadBean(t, &organization.Team{ID: 12})
|
|
targetTeam := unittest.AssertExistsAndLoadBean(t, &organization.Team{ID: 2})
|
|
existingTeam := unittest.AssertExistsAndLoadBean(t, &organization.Team{ID: 7})
|
|
assert.NoError(t, repo_service.TeamAddRepository(t.Context(), adminTeam, publicOrgRepo))
|
|
user = unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 28})
|
|
token = getUserToken(t, user.Name, auth_model.AccessTokenScopeWriteRepository)
|
|
req = NewRequest(t, "PUT", fmt.Sprintf("/api/v1/repos/%s/teams/%s", publicOrgRepo.FullName(), targetTeam.Name)).AddTokenAuth(token)
|
|
MakeRequest(t, req, http.StatusForbidden)
|
|
assert.False(t, repo_service.HasRepository(t.Context(), targetTeam, publicOrgRepo.ID))
|
|
req = NewRequest(t, "DELETE", fmt.Sprintf("/api/v1/repos/%s/teams/%s", publicOrgRepo.FullName(), existingTeam.Name)).AddTokenAuth(token)
|
|
MakeRequest(t, req, http.StatusForbidden)
|
|
assert.True(t, repo_service.HasRepository(t.Context(), existingTeam, publicOrgRepo.ID))
|
|
|
|
// AddTeam with user2
|
|
user = unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
|
|
session = loginUser(t, user.Name)
|
|
token = getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteRepository)
|
|
req = NewRequest(t, "PUT", fmt.Sprintf("/api/v1/repos/%s/teams/%s", publicOrgRepo.FullName(), "team1")).
|
|
AddTokenAuth(token)
|
|
MakeRequest(t, req, http.StatusNoContent)
|
|
MakeRequest(t, req, http.StatusUnprocessableEntity) // test duplicate request
|
|
|
|
// DeleteTeam
|
|
req = NewRequest(t, "DELETE", fmt.Sprintf("/api/v1/repos/%s/teams/%s", publicOrgRepo.FullName(), "team1")).
|
|
AddTokenAuth(token)
|
|
MakeRequest(t, req, http.StatusNoContent)
|
|
MakeRequest(t, req, http.StatusUnprocessableEntity) // test duplicate request
|
|
}
|