52ae0c5802
Some checks failed
cache-seeder / prune (push) Has been skipped
cache-seeder / frontend (push) Failing after 3s
cache-seeder / python (push) Failing after 3s
cache-seeder / gobuild (push) Failing after 4s
cache-seeder / lint (bindata, lint-backend) (push) Failing after 3s
giteabot backport / giteabot (push) Has been skipped
giteabot / giteabot (push) Has been skipped
cache-prune / prune (push) Has been skipped
release-nightly-snapcraft / build-and-publish (ubuntu-24.04) (push) Has been cancelled
release-nightly-snapcraft / build-and-publish (ubuntu-24.04-arm) (push) Has been cancelled
release-nightly / nightly-binary (push) Has been cancelled
release-nightly / nightly-container (push) Has been cancelled
cron-renovate / cron-renovate (push) Has been skipped
77 lines
2.7 KiB
Go
77 lines
2.7 KiB
Go
// Copyright 2026 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package integration
|
|
|
|
import (
|
|
"net/http"
|
|
"net/url"
|
|
"testing"
|
|
|
|
auth_model "gitea.dev/models/auth"
|
|
"gitea.dev/models/unittest"
|
|
user_model "gitea.dev/models/user"
|
|
api "gitea.dev/modules/structs"
|
|
"gitea.dev/tests"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestAPIRestrictedUserLimitedOwner(t *testing.T) {
|
|
defer tests.PrepareTestEnv(t)()
|
|
|
|
owner := unittest.AssertExistsAndLoadBean(t, &user_model.User{Name: "user2"})
|
|
owner.Visibility = api.VisibleTypeLimited
|
|
require.NoError(t, user_model.UpdateUserCols(t.Context(), owner, "visibility"))
|
|
|
|
restrictedToken := getUserToken(t, "user29", auth_model.AccessTokenScopeReadUser, auth_model.AccessTokenScopeReadIssue, auth_model.AccessTokenScopeReadOrganization)
|
|
for _, path := range []string{
|
|
"/api/v1/users/user2/activities/feeds",
|
|
"/api/v1/users/user2/heatmap",
|
|
"/api/v1/users/user2/keys",
|
|
"/api/v1/users/user2/gpg_keys",
|
|
"/api/v1/users/user2/orgs",
|
|
} {
|
|
req := NewRequest(t, "GET", path).AddTokenAuth(restrictedToken)
|
|
MakeRequest(t, req, http.StatusNotFound)
|
|
}
|
|
|
|
issueSearch := url.URL{Path: "/api/v1/repos/issues/search"}
|
|
issueSearch.RawQuery = url.Values{"owner": {"user2"}}.Encode()
|
|
req := NewRequest(t, "GET", issueSearch.String()).AddTokenAuth(restrictedToken)
|
|
resp := MakeRequest(t, req, http.StatusOK)
|
|
assert.Empty(t, DecodeJSON(t, resp, []*api.Issue{}))
|
|
|
|
issueSearch.RawQuery = url.Values{"limit": {"100"}, "type": {"issues"}}.Encode()
|
|
req = NewRequest(t, "GET", issueSearch.String()).AddTokenAuth(restrictedToken)
|
|
resp = MakeRequest(t, req, http.StatusOK)
|
|
issues := DecodeJSON(t, resp, []*api.Issue{})
|
|
require.NotEmpty(t, issues)
|
|
for _, issue := range issues {
|
|
assert.NotEqual(t, owner.Name, issue.Repo.Owner)
|
|
}
|
|
|
|
restrictedSession := loginUser(t, "user29")
|
|
req = NewRequest(t, "GET", "/issues/search?owner=user2")
|
|
resp = restrictedSession.MakeRequest(t, req, http.StatusOK)
|
|
assert.Empty(t, DecodeJSON(t, resp, []*api.Issue{}))
|
|
|
|
viewerToken := getUserToken(t, "user4", auth_model.AccessTokenScopeReadUser, auth_model.AccessTokenScopeReadIssue, auth_model.AccessTokenScopeReadOrganization)
|
|
for _, path := range []string{
|
|
"/api/v1/users/user2/activities/feeds",
|
|
"/api/v1/users/user2/heatmap",
|
|
"/api/v1/users/user2/keys",
|
|
"/api/v1/users/user2/gpg_keys",
|
|
"/api/v1/users/user2/orgs",
|
|
} {
|
|
req := NewRequest(t, "GET", path).AddTokenAuth(viewerToken)
|
|
MakeRequest(t, req, http.StatusOK)
|
|
}
|
|
|
|
issueSearch.RawQuery = url.Values{"owner": {"user2"}}.Encode()
|
|
req = NewRequest(t, "GET", issueSearch.String()).AddTokenAuth(viewerToken)
|
|
resp = MakeRequest(t, req, http.StatusOK)
|
|
assert.NotEmpty(t, DecodeJSON(t, resp, []*api.Issue{}))
|
|
}
|