258 lines
11 KiB
Go
258 lines
11 KiB
Go
// Vikunja is a to-do list application to facilitate your life.
|
|
// Copyright 2018-present Vikunja and contributors. All rights reserved.
|
|
//
|
|
// This program is free software: you can redistribute it and/or modify
|
|
// it under the terms of the GNU Affero General Public License as published by
|
|
// the Free Software Foundation, either version 3 of the License, or
|
|
// (at your option) any later version.
|
|
//
|
|
// This program is distributed in the hope that it will be useful,
|
|
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
// GNU Affero General Public License for more details.
|
|
//
|
|
// You should have received a copy of the GNU Affero General Public License
|
|
// along with this program. If not, see <https://www.gnu.org/licenses/>.
|
|
|
|
package webtests
|
|
|
|
import (
|
|
"net/http"
|
|
"testing"
|
|
|
|
"code.vikunja.io/api/pkg/db"
|
|
"code.vikunja.io/api/pkg/user"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
// TestHumaTeamMember ports the v1 model coverage (pkg/models/team_members_test.go:
|
|
// TestTeamMember_Create / _Delete / _Update) plus the permission matrix from
|
|
// CanCreate/CanDelete/CanUpdate to /api/v2. It drives the Echo+Huma stack
|
|
// directly (humaRequest/humaTokenFor) because these are action sub-paths under a
|
|
// team that webHandlerTestV2's buildURL does not model.
|
|
//
|
|
// Fixture facts (team_members.yml, teams.yml): user1 is an ADMIN of team 1 and a
|
|
// non-admin member of teams 2-8. user2 is a non-admin member of team 1. Team 9
|
|
// lists only user2. Teams 2/3/4 each list only user1 (non-admin). Teams 14/15
|
|
// are external (external_id set) — team 14 lists user10 and user11.
|
|
func TestHumaTeamMember(t *testing.T) {
|
|
// user11 is a member of external team 14; not pre-defined in integrations.go.
|
|
testuser11 := user.User{
|
|
ID: 11,
|
|
Username: "user11",
|
|
Email: "user11@example.com",
|
|
Issuer: "local",
|
|
}
|
|
|
|
t.Run("Add", func(t *testing.T) {
|
|
// v1's TestTeamMember_Create/normal: team admin adds a user by username.
|
|
t.Run("Normal", func(t *testing.T) {
|
|
e, err := setupTestEnv()
|
|
require.NoError(t, err)
|
|
token := humaTokenFor(t, &testuser1) // admin of team 1
|
|
|
|
rec := humaRequest(t, e, http.MethodPost, "/api/v2/teams/1/members", `{"username":"user3"}`, token, "")
|
|
require.Equal(t, http.StatusCreated, rec.Code, "body: %s", rec.Body.String())
|
|
assert.Contains(t, rec.Body.String(), `"username":"user3"`)
|
|
// user3 has id 3.
|
|
db.AssertExists(t, "team_members", map[string]interface{}{
|
|
"team_id": 1,
|
|
"user_id": 3,
|
|
}, false)
|
|
})
|
|
// v1's TestTeamMember_Create/normal also allows seeding an admin member.
|
|
t.Run("As admin", func(t *testing.T) {
|
|
e, err := setupTestEnv()
|
|
require.NoError(t, err)
|
|
token := humaTokenFor(t, &testuser1)
|
|
|
|
rec := humaRequest(t, e, http.MethodPost, "/api/v2/teams/1/members", `{"username":"user3","admin":true}`, token, "")
|
|
require.Equal(t, http.StatusCreated, rec.Code, "body: %s", rec.Body.String())
|
|
assert.Contains(t, rec.Body.String(), `"admin":true`)
|
|
db.AssertExists(t, "team_members", map[string]interface{}{
|
|
"team_id": 1,
|
|
"user_id": 3,
|
|
"admin": true,
|
|
}, false)
|
|
})
|
|
// v1's TestTeamMember_Create/"already existing" -> ErrUserIsMemberOfTeam (409).
|
|
t.Run("Already a member", func(t *testing.T) {
|
|
e, err := setupTestEnv()
|
|
require.NoError(t, err)
|
|
token := humaTokenFor(t, &testuser1)
|
|
|
|
rec := humaRequest(t, e, http.MethodPost, "/api/v2/teams/1/members", `{"username":"user1"}`, token, "")
|
|
require.Equal(t, http.StatusConflict, rec.Code, "body: %s", rec.Body.String())
|
|
})
|
|
// v1's TestTeamMember_Create/"nonexisting user" -> ErrUserDoesNotExist (404).
|
|
t.Run("Nonexisting user", func(t *testing.T) {
|
|
e, err := setupTestEnv()
|
|
require.NoError(t, err)
|
|
token := humaTokenFor(t, &testuser1)
|
|
|
|
rec := humaRequest(t, e, http.MethodPost, "/api/v2/teams/1/members", `{"username":"nonexistinguser"}`, token, "")
|
|
require.Equal(t, http.StatusNotFound, rec.Code, "body: %s", rec.Body.String())
|
|
})
|
|
// v1's TestTeamMember_Create/"empty username": required by valid: tag -> 422.
|
|
t.Run("Empty username", func(t *testing.T) {
|
|
e, err := setupTestEnv()
|
|
require.NoError(t, err)
|
|
token := humaTokenFor(t, &testuser1)
|
|
|
|
rec := humaRequest(t, e, http.MethodPost, "/api/v2/teams/1/members", `{"username":""}`, token, "")
|
|
require.Equal(t, http.StatusUnprocessableEntity, rec.Code, "body: %s", rec.Body.String())
|
|
})
|
|
t.Run("Permissions check", func(t *testing.T) {
|
|
// CanCreate -> IsAdmin: a non-admin member cannot add members.
|
|
t.Run("Forbidden non-admin member", func(t *testing.T) {
|
|
e, err := setupTestEnv()
|
|
require.NoError(t, err)
|
|
token := humaTokenFor(t, &testuser2) // member of team 1, not admin
|
|
|
|
rec := humaRequest(t, e, http.MethodPost, "/api/v2/teams/1/members", `{"username":"user3"}`, token, "")
|
|
require.Equal(t, http.StatusForbidden, rec.Code, "body: %s", rec.Body.String())
|
|
})
|
|
// A non-member is likewise forbidden (team 9, user1 not a member).
|
|
t.Run("Forbidden non-member", func(t *testing.T) {
|
|
e, err := setupTestEnv()
|
|
require.NoError(t, err)
|
|
token := humaTokenFor(t, &testuser1)
|
|
|
|
rec := humaRequest(t, e, http.MethodPost, "/api/v2/teams/9/members", `{"username":"user3"}`, token, "")
|
|
require.Equal(t, http.StatusForbidden, rec.Code, "body: %s", rec.Body.String())
|
|
})
|
|
})
|
|
})
|
|
|
|
t.Run("Remove", func(t *testing.T) {
|
|
// v1's TestTeamMember_Delete/normal: team admin removes a member.
|
|
t.Run("Normal", func(t *testing.T) {
|
|
e, err := setupTestEnv()
|
|
require.NoError(t, err)
|
|
token := humaTokenFor(t, &testuser1) // admin of team 1
|
|
|
|
rec := humaRequest(t, e, http.MethodDelete, "/api/v2/teams/1/members/user2", "", token, "")
|
|
require.Equal(t, http.StatusNoContent, rec.Code, "body: %s", rec.Body.String())
|
|
assert.Empty(t, rec.Body.String())
|
|
db.AssertMissing(t, "team_members", map[string]interface{}{
|
|
"team_id": 1,
|
|
"user_id": 2,
|
|
})
|
|
})
|
|
// CanDelete grants self-removal even to a non-admin: user2 removes itself
|
|
// from team 1 (which still has user1 afterwards, so not the last member).
|
|
t.Run("Member can remove themselves", func(t *testing.T) {
|
|
e, err := setupTestEnv()
|
|
require.NoError(t, err)
|
|
token := humaTokenFor(t, &testuser2) // non-admin member of team 1
|
|
|
|
rec := humaRequest(t, e, http.MethodDelete, "/api/v2/teams/1/members/user2", "", token, "")
|
|
require.Equal(t, http.StatusNoContent, rec.Code, "body: %s", rec.Body.String())
|
|
db.AssertMissing(t, "team_members", map[string]interface{}{
|
|
"team_id": 1,
|
|
"user_id": 2,
|
|
})
|
|
})
|
|
// Delete guard: removing the only member is refused. Team 2 lists just
|
|
// user1; CanDelete passes (self), then the last-member guard rejects it.
|
|
t.Run("Cannot remove last member", func(t *testing.T) {
|
|
e, err := setupTestEnv()
|
|
require.NoError(t, err)
|
|
token := humaTokenFor(t, &testuser1)
|
|
|
|
rec := humaRequest(t, e, http.MethodDelete, "/api/v2/teams/2/members/user1", "", token, "")
|
|
require.Equal(t, http.StatusBadRequest, rec.Code, "body: %s", rec.Body.String())
|
|
})
|
|
// Delete guard: members of an external (oidc/ldap) team cannot be removed.
|
|
// Team 14 has external_id set; user11 removing itself hits that guard.
|
|
t.Run("Cannot remove from external team", func(t *testing.T) {
|
|
e, err := setupTestEnv()
|
|
require.NoError(t, err)
|
|
token := humaTokenFor(t, &testuser11)
|
|
|
|
rec := humaRequest(t, e, http.MethodDelete, "/api/v2/teams/14/members/user11", "", token, "")
|
|
require.Equal(t, http.StatusPreconditionFailed, rec.Code, "body: %s", rec.Body.String())
|
|
})
|
|
t.Run("Permissions check", func(t *testing.T) {
|
|
// CanDelete -> IsAdmin (when not self): a non-admin member cannot remove
|
|
// someone else. user2 (non-admin) tries to remove user1 from team 1.
|
|
t.Run("Forbidden non-admin removing another", func(t *testing.T) {
|
|
e, err := setupTestEnv()
|
|
require.NoError(t, err)
|
|
token := humaTokenFor(t, &testuser2)
|
|
|
|
rec := humaRequest(t, e, http.MethodDelete, "/api/v2/teams/1/members/user1", "", token, "")
|
|
require.Equal(t, http.StatusForbidden, rec.Code, "body: %s", rec.Body.String())
|
|
})
|
|
// A non-member is forbidden (team 9, user1 not a member).
|
|
t.Run("Forbidden non-member", func(t *testing.T) {
|
|
e, err := setupTestEnv()
|
|
require.NoError(t, err)
|
|
token := humaTokenFor(t, &testuser1)
|
|
|
|
rec := humaRequest(t, e, http.MethodDelete, "/api/v2/teams/9/members/user2", "", token, "")
|
|
require.Equal(t, http.StatusForbidden, rec.Code, "body: %s", rec.Body.String())
|
|
})
|
|
})
|
|
})
|
|
|
|
t.Run("ToggleAdmin", func(t *testing.T) {
|
|
// v1's TestTeamMember_Update/normal: the toggle flips the flag. user2 is a
|
|
// non-admin member of team 1, so toggling makes them an admin.
|
|
t.Run("Normal", func(t *testing.T) {
|
|
e, err := setupTestEnv()
|
|
require.NoError(t, err)
|
|
token := humaTokenFor(t, &testuser1) // admin of team 1
|
|
|
|
rec := humaRequest(t, e, http.MethodPost, "/api/v2/teams/1/members/user2/admin", "", token, "")
|
|
require.Equal(t, http.StatusOK, rec.Code, "body: %s", rec.Body.String())
|
|
assert.Contains(t, rec.Body.String(), `"admin":true`)
|
|
db.AssertExists(t, "team_members", map[string]interface{}{
|
|
"team_id": 1,
|
|
"user_id": 2,
|
|
"admin": true,
|
|
}, false)
|
|
})
|
|
// v1's TestTeamMember_Update/"explicitly false in payload": the body is
|
|
// ignored and the flag toggled regardless — user1 (admin of team 1) becomes
|
|
// a non-admin despite admin:false in the payload.
|
|
t.Run("Body is ignored", func(t *testing.T) {
|
|
e, err := setupTestEnv()
|
|
require.NoError(t, err)
|
|
token := humaTokenFor(t, &testuser1)
|
|
|
|
rec := humaRequest(t, e, http.MethodPost, "/api/v2/teams/1/members/user1/admin", `{"admin":false}`, token, "")
|
|
require.Equal(t, http.StatusOK, rec.Code, "body: %s", rec.Body.String())
|
|
assert.Contains(t, rec.Body.String(), `"admin":false`)
|
|
db.AssertExists(t, "team_members", map[string]interface{}{
|
|
"team_id": 1,
|
|
"user_id": 1,
|
|
"admin": false,
|
|
}, false)
|
|
})
|
|
t.Run("Permissions check", func(t *testing.T) {
|
|
// CanUpdate -> IsAdmin: a non-admin member cannot toggle admin status,
|
|
// not even their own. The handler checks this explicitly (non-CRUD action).
|
|
t.Run("Forbidden non-admin member", func(t *testing.T) {
|
|
e, err := setupTestEnv()
|
|
require.NoError(t, err)
|
|
token := humaTokenFor(t, &testuser2) // non-admin member of team 1
|
|
|
|
rec := humaRequest(t, e, http.MethodPost, "/api/v2/teams/1/members/user2/admin", "", token, "")
|
|
require.Equal(t, http.StatusForbidden, rec.Code, "body: %s", rec.Body.String())
|
|
})
|
|
// A non-member is forbidden (team 9, user1 not a member).
|
|
t.Run("Forbidden non-member", func(t *testing.T) {
|
|
e, err := setupTestEnv()
|
|
require.NoError(t, err)
|
|
token := humaTokenFor(t, &testuser1)
|
|
|
|
rec := humaRequest(t, e, http.MethodPost, "/api/v2/teams/9/members/user2/admin", "", token, "")
|
|
require.Equal(t, http.StatusForbidden, rec.Code, "body: %s", rec.Body.String())
|
|
})
|
|
})
|
|
})
|
|
}
|