mirror of
https://github.com/go-gitea/gitea.git
synced 2026-08-19 19:18:34 +00:00
bircni
ed4a23e893
Admin and write team authorize now grant that mode on every unit, including units added later, instead of only rows present in `team_unit`. Granular teams keep `authorize=none` and explicit unit rows. Closes the `TEAM-UNIT-PERMISSION` design gap from https://github.com/go-gitea/gitea/pull/34128. Maybe also fix #15962 (actually maybe it had been fixed before, the root cause is out-of-sync "access" table) ## Screenshots only writing selected: <img width="1399" height="1007" alt="image" src="https://github.com/user-attachments/assets/1d1b4c49-a59a-47b6-998f-0464a067395b" /> _Created with the help of AI_ --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
79 lines
2.9 KiB
Go
79 lines
2.9 KiB
Go
// Copyright 2021 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package integration
|
|
|
|
import (
|
|
"fmt"
|
|
"net/http"
|
|
"testing"
|
|
|
|
auth_model "gitea.dev/models/auth"
|
|
repo_model "gitea.dev/models/repo"
|
|
"gitea.dev/models/unittest"
|
|
user_model "gitea.dev/models/user"
|
|
api "gitea.dev/modules/structs"
|
|
"gitea.dev/tests"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
)
|
|
|
|
func TestAPIRepoTeams(t *testing.T) {
|
|
defer tests.PrepareTestEnv(t)()
|
|
|
|
// publicOrgRepo = org3/repo21
|
|
publicOrgRepo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 32})
|
|
// user4
|
|
user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 4})
|
|
session := loginUser(t, user.Name)
|
|
token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteRepository)
|
|
|
|
// ListTeams
|
|
req := NewRequest(t, "GET", fmt.Sprintf("/api/v1/repos/%s/teams", publicOrgRepo.FullName())).
|
|
AddTokenAuth(token)
|
|
res := MakeRequest(t, req, http.StatusOK)
|
|
teams := DecodeJSON(t, res, []*api.Team{})
|
|
if assert.Len(t, teams, 2) {
|
|
assert.Equal(t, "Owners", teams[0].Name)
|
|
assert.True(t, teams[0].CanCreateOrgRepo)
|
|
assert.Equal(t, []string{"repo.issues"}, teams[1].Units) // legacy dirty data, although the team.authorize is "owner", the units are also responded
|
|
assert.Equal(t, api.AccessLevelNameOwner, teams[0].Permission)
|
|
|
|
assert.Equal(t, "test_team", teams[1].Name)
|
|
assert.False(t, teams[1].CanCreateOrgRepo)
|
|
assert.Equal(t, []string{"repo.issues"}, teams[1].Units)
|
|
assert.Equal(t, api.AccessLevelNameWrite, teams[1].Permission) // legacy dirty data, although the team.authorize is "write", the units are also responded
|
|
}
|
|
|
|
// IsTeam
|
|
req = NewRequest(t, "GET", fmt.Sprintf("/api/v1/repos/%s/teams/%s", publicOrgRepo.FullName(), "Test_Team")).
|
|
AddTokenAuth(token)
|
|
res = MakeRequest(t, req, http.StatusOK)
|
|
team := DecodeJSON(t, res, &api.Team{})
|
|
assert.Equal(t, teams[1], team)
|
|
|
|
req = NewRequest(t, "GET", fmt.Sprintf("/api/v1/repos/%s/teams/%s", publicOrgRepo.FullName(), "NonExistingTeam")).
|
|
AddTokenAuth(token)
|
|
MakeRequest(t, req, http.StatusNotFound)
|
|
|
|
// AddTeam with user4
|
|
req = NewRequest(t, "PUT", fmt.Sprintf("/api/v1/repos/%s/teams/%s", publicOrgRepo.FullName(), "team1")).
|
|
AddTokenAuth(token)
|
|
MakeRequest(t, req, http.StatusForbidden)
|
|
|
|
// AddTeam with user2
|
|
user = unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
|
|
session = loginUser(t, user.Name)
|
|
token = getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteRepository)
|
|
req = NewRequest(t, "PUT", fmt.Sprintf("/api/v1/repos/%s/teams/%s", publicOrgRepo.FullName(), "team1")).
|
|
AddTokenAuth(token)
|
|
MakeRequest(t, req, http.StatusNoContent)
|
|
MakeRequest(t, req, http.StatusUnprocessableEntity) // test duplicate request
|
|
|
|
// DeleteTeam
|
|
req = NewRequest(t, "DELETE", fmt.Sprintf("/api/v1/repos/%s/teams/%s", publicOrgRepo.FullName(), "team1")).
|
|
AddTokenAuth(token)
|
|
MakeRequest(t, req, http.StatusNoContent)
|
|
MakeRequest(t, req, http.StatusUnprocessableEntity) // test duplicate request
|
|
}
|