2021-10-19 08:02:43 -05:00
|
|
|
/* eslint-disable @typescript-eslint/no-unused-expressions,@typescript-eslint/require-await */
|
|
|
|
|
2021-12-17 04:58:15 -06:00
|
|
|
import { checkBadCountPagination, checkBadSortPagination, checkBadStartPagination, MockSmtpServer } from '@server/tests/shared'
|
2022-08-17 08:25:58 -05:00
|
|
|
import { omit } from '@shared/core-utils'
|
2021-12-17 04:58:15 -06:00
|
|
|
import { HttpStatusCode, UserAdminFlag, UserRole } from '@shared/models'
|
2021-10-19 08:02:43 -05:00
|
|
|
import {
|
|
|
|
cleanupTests,
|
2023-01-19 02:28:29 -06:00
|
|
|
ConfigCommand,
|
2021-10-19 08:02:43 -05:00
|
|
|
createSingleServer,
|
|
|
|
killallServers,
|
|
|
|
makeGetRequest,
|
|
|
|
makePostBodyRequest,
|
|
|
|
makePutBodyRequest,
|
|
|
|
PeerTubeServer,
|
|
|
|
setAccessTokensToServers
|
2021-12-17 02:29:23 -06:00
|
|
|
} from '@shared/server-commands'
|
2021-10-19 08:02:43 -05:00
|
|
|
|
|
|
|
describe('Test users admin API validators', function () {
|
|
|
|
const path = '/api/v1/users/'
|
|
|
|
let userId: number
|
|
|
|
let rootId: number
|
|
|
|
let moderatorId: number
|
|
|
|
let server: PeerTubeServer
|
|
|
|
let userToken = ''
|
|
|
|
let moderatorToken = ''
|
|
|
|
let emailPort: number
|
|
|
|
|
|
|
|
// ---------------------------------------------------------------
|
|
|
|
|
|
|
|
before(async function () {
|
|
|
|
this.timeout(30000)
|
|
|
|
|
|
|
|
const emails: object[] = []
|
|
|
|
emailPort = await MockSmtpServer.Instance.collectEmails(emails)
|
|
|
|
|
|
|
|
{
|
|
|
|
server = await createSingleServer(1)
|
|
|
|
|
|
|
|
await setAccessTokensToServers([ server ])
|
|
|
|
}
|
|
|
|
|
|
|
|
{
|
|
|
|
const result = await server.users.generate('user1')
|
|
|
|
userToken = result.token
|
|
|
|
userId = result.userId
|
|
|
|
}
|
|
|
|
|
|
|
|
{
|
|
|
|
const result = await server.users.generate('moderator1', UserRole.MODERATOR)
|
|
|
|
moderatorToken = result.token
|
|
|
|
}
|
|
|
|
|
|
|
|
{
|
|
|
|
const result = await server.users.generate('moderator2', UserRole.MODERATOR)
|
|
|
|
moderatorId = result.userId
|
|
|
|
}
|
|
|
|
})
|
|
|
|
|
|
|
|
describe('When listing users', function () {
|
|
|
|
it('Should fail with a bad start pagination', async function () {
|
|
|
|
await checkBadStartPagination(server.url, path, server.accessToken)
|
|
|
|
})
|
|
|
|
|
|
|
|
it('Should fail with a bad count pagination', async function () {
|
|
|
|
await checkBadCountPagination(server.url, path, server.accessToken)
|
|
|
|
})
|
|
|
|
|
|
|
|
it('Should fail with an incorrect sort', async function () {
|
|
|
|
await checkBadSortPagination(server.url, path, server.accessToken)
|
|
|
|
})
|
|
|
|
|
|
|
|
it('Should fail with a non authenticated user', async function () {
|
|
|
|
await makeGetRequest({
|
|
|
|
url: server.url,
|
|
|
|
path,
|
|
|
|
expectedStatus: HttpStatusCode.UNAUTHORIZED_401
|
|
|
|
})
|
|
|
|
})
|
|
|
|
|
|
|
|
it('Should fail with a non admin user', async function () {
|
|
|
|
await makeGetRequest({
|
|
|
|
url: server.url,
|
|
|
|
path,
|
|
|
|
token: userToken,
|
|
|
|
expectedStatus: HttpStatusCode.FORBIDDEN_403
|
|
|
|
})
|
|
|
|
})
|
|
|
|
})
|
|
|
|
|
|
|
|
describe('When adding a new user', function () {
|
|
|
|
const baseCorrectParams = {
|
|
|
|
username: 'user2',
|
|
|
|
email: 'test@example.com',
|
|
|
|
password: 'my super password',
|
|
|
|
videoQuota: -1,
|
|
|
|
videoQuotaDaily: -1,
|
|
|
|
role: UserRole.USER,
|
|
|
|
adminFlags: UserAdminFlag.BYPASS_VIDEO_AUTO_BLACKLIST
|
|
|
|
}
|
|
|
|
|
|
|
|
it('Should fail with a too small username', async function () {
|
|
|
|
const fields = { ...baseCorrectParams, username: '' }
|
|
|
|
|
|
|
|
await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
|
|
|
|
})
|
|
|
|
|
|
|
|
it('Should fail with a too long username', async function () {
|
|
|
|
const fields = { ...baseCorrectParams, username: 'super'.repeat(50) }
|
|
|
|
|
|
|
|
await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
|
|
|
|
})
|
|
|
|
|
|
|
|
it('Should fail with a not lowercase username', async function () {
|
|
|
|
const fields = { ...baseCorrectParams, username: 'Toto' }
|
|
|
|
|
|
|
|
await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
|
|
|
|
})
|
|
|
|
|
|
|
|
it('Should fail with an incorrect username', async function () {
|
|
|
|
const fields = { ...baseCorrectParams, username: 'my username' }
|
|
|
|
|
|
|
|
await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
|
|
|
|
})
|
|
|
|
|
|
|
|
it('Should fail with a missing email', async function () {
|
2022-08-17 08:25:58 -05:00
|
|
|
const fields = omit(baseCorrectParams, [ 'email' ])
|
2021-10-19 08:02:43 -05:00
|
|
|
|
|
|
|
await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
|
|
|
|
})
|
|
|
|
|
|
|
|
it('Should fail with an invalid email', async function () {
|
|
|
|
const fields = { ...baseCorrectParams, email: 'test_example.com' }
|
|
|
|
|
|
|
|
await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
|
|
|
|
})
|
|
|
|
|
|
|
|
it('Should fail with a too small password', async function () {
|
|
|
|
const fields = { ...baseCorrectParams, password: 'bla' }
|
|
|
|
|
|
|
|
await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
|
|
|
|
})
|
|
|
|
|
|
|
|
it('Should fail with a too long password', async function () {
|
|
|
|
const fields = { ...baseCorrectParams, password: 'super'.repeat(61) }
|
|
|
|
|
|
|
|
await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
|
|
|
|
})
|
|
|
|
|
|
|
|
it('Should fail with empty password and no smtp configured', async function () {
|
|
|
|
const fields = { ...baseCorrectParams, password: '' }
|
|
|
|
|
|
|
|
await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
|
|
|
|
})
|
|
|
|
|
|
|
|
it('Should succeed with no password on a server with smtp enabled', async function () {
|
|
|
|
this.timeout(20000)
|
|
|
|
|
|
|
|
await killallServers([ server ])
|
|
|
|
|
2023-01-19 02:28:29 -06:00
|
|
|
await server.run(ConfigCommand.getEmailOverrideConfig(emailPort))
|
2021-10-19 08:02:43 -05:00
|
|
|
|
|
|
|
const fields = {
|
|
|
|
...baseCorrectParams,
|
|
|
|
|
|
|
|
password: '',
|
|
|
|
username: 'create_password',
|
|
|
|
email: 'create_password@example.com'
|
|
|
|
}
|
|
|
|
|
|
|
|
await makePostBodyRequest({
|
|
|
|
url: server.url,
|
2022-07-13 04:58:01 -05:00
|
|
|
path,
|
2021-10-19 08:02:43 -05:00
|
|
|
token: server.accessToken,
|
|
|
|
fields,
|
|
|
|
expectedStatus: HttpStatusCode.OK_200
|
|
|
|
})
|
|
|
|
})
|
|
|
|
|
|
|
|
it('Should fail with invalid admin flags', async function () {
|
|
|
|
const fields = { ...baseCorrectParams, adminFlags: 'toto' }
|
|
|
|
|
|
|
|
await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
|
|
|
|
})
|
|
|
|
|
|
|
|
it('Should fail with an non authenticated user', async function () {
|
|
|
|
await makePostBodyRequest({
|
|
|
|
url: server.url,
|
|
|
|
path,
|
|
|
|
token: 'super token',
|
|
|
|
fields: baseCorrectParams,
|
|
|
|
expectedStatus: HttpStatusCode.UNAUTHORIZED_401
|
|
|
|
})
|
|
|
|
})
|
|
|
|
|
|
|
|
it('Should fail if we add a user with the same username', async function () {
|
|
|
|
const fields = { ...baseCorrectParams, username: 'user1' }
|
|
|
|
|
|
|
|
await makePostBodyRequest({
|
|
|
|
url: server.url,
|
|
|
|
path,
|
|
|
|
token: server.accessToken,
|
|
|
|
fields,
|
|
|
|
expectedStatus: HttpStatusCode.CONFLICT_409
|
|
|
|
})
|
|
|
|
})
|
|
|
|
|
|
|
|
it('Should fail if we add a user with the same email', async function () {
|
|
|
|
const fields = { ...baseCorrectParams, email: 'user1@example.com' }
|
|
|
|
|
|
|
|
await makePostBodyRequest({
|
|
|
|
url: server.url,
|
|
|
|
path,
|
|
|
|
token: server.accessToken,
|
|
|
|
fields,
|
|
|
|
expectedStatus: HttpStatusCode.CONFLICT_409
|
|
|
|
})
|
|
|
|
})
|
|
|
|
|
|
|
|
it('Should fail without a videoQuota', async function () {
|
2022-08-17 08:25:58 -05:00
|
|
|
const fields = omit(baseCorrectParams, [ 'videoQuota' ])
|
2021-10-19 08:02:43 -05:00
|
|
|
|
|
|
|
await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
|
|
|
|
})
|
|
|
|
|
|
|
|
it('Should fail without a videoQuotaDaily', async function () {
|
2022-08-17 08:25:58 -05:00
|
|
|
const fields = omit(baseCorrectParams, [ 'videoQuotaDaily' ])
|
2021-10-19 08:02:43 -05:00
|
|
|
|
|
|
|
await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
|
|
|
|
})
|
|
|
|
|
|
|
|
it('Should fail with an invalid videoQuota', async function () {
|
|
|
|
const fields = { ...baseCorrectParams, videoQuota: -5 }
|
|
|
|
|
|
|
|
await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
|
|
|
|
})
|
|
|
|
|
|
|
|
it('Should fail with an invalid videoQuotaDaily', async function () {
|
|
|
|
const fields = { ...baseCorrectParams, videoQuotaDaily: -7 }
|
|
|
|
|
|
|
|
await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
|
|
|
|
})
|
|
|
|
|
|
|
|
it('Should fail without a user role', async function () {
|
2022-08-17 08:25:58 -05:00
|
|
|
const fields = omit(baseCorrectParams, [ 'role' ])
|
2021-10-19 08:02:43 -05:00
|
|
|
|
|
|
|
await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
|
|
|
|
})
|
|
|
|
|
|
|
|
it('Should fail with an invalid user role', async function () {
|
|
|
|
const fields = { ...baseCorrectParams, role: 88989 }
|
|
|
|
|
|
|
|
await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
|
|
|
|
})
|
|
|
|
|
|
|
|
it('Should fail with a "peertube" username', async function () {
|
|
|
|
const fields = { ...baseCorrectParams, username: 'peertube' }
|
|
|
|
|
|
|
|
await makePostBodyRequest({
|
|
|
|
url: server.url,
|
|
|
|
path,
|
|
|
|
token: server.accessToken,
|
|
|
|
fields,
|
|
|
|
expectedStatus: HttpStatusCode.CONFLICT_409
|
|
|
|
})
|
|
|
|
})
|
|
|
|
|
|
|
|
it('Should fail to create a moderator or an admin with a moderator', async function () {
|
|
|
|
for (const role of [ UserRole.MODERATOR, UserRole.ADMINISTRATOR ]) {
|
|
|
|
const fields = { ...baseCorrectParams, role }
|
|
|
|
|
|
|
|
await makePostBodyRequest({
|
|
|
|
url: server.url,
|
|
|
|
path,
|
|
|
|
token: moderatorToken,
|
|
|
|
fields,
|
|
|
|
expectedStatus: HttpStatusCode.FORBIDDEN_403
|
|
|
|
})
|
|
|
|
}
|
|
|
|
})
|
|
|
|
|
|
|
|
it('Should succeed to create a user with a moderator', async function () {
|
|
|
|
const fields = { ...baseCorrectParams, username: 'a4656', email: 'a4656@example.com', role: UserRole.USER }
|
|
|
|
|
|
|
|
await makePostBodyRequest({
|
|
|
|
url: server.url,
|
|
|
|
path,
|
|
|
|
token: moderatorToken,
|
|
|
|
fields,
|
|
|
|
expectedStatus: HttpStatusCode.OK_200
|
|
|
|
})
|
|
|
|
})
|
|
|
|
|
|
|
|
it('Should succeed with the correct params', async function () {
|
|
|
|
await makePostBodyRequest({
|
|
|
|
url: server.url,
|
|
|
|
path,
|
|
|
|
token: server.accessToken,
|
|
|
|
fields: baseCorrectParams,
|
|
|
|
expectedStatus: HttpStatusCode.OK_200
|
|
|
|
})
|
|
|
|
})
|
|
|
|
|
|
|
|
it('Should fail with a non admin user', async function () {
|
|
|
|
const user = { username: 'user1' }
|
|
|
|
userToken = await server.login.getAccessToken(user)
|
|
|
|
|
|
|
|
const fields = {
|
|
|
|
username: 'user3',
|
|
|
|
email: 'test@example.com',
|
|
|
|
password: 'my super password',
|
|
|
|
videoQuota: 42000000
|
|
|
|
}
|
|
|
|
await makePostBodyRequest({ url: server.url, path, token: userToken, fields, expectedStatus: HttpStatusCode.FORBIDDEN_403 })
|
|
|
|
})
|
|
|
|
})
|
|
|
|
|
|
|
|
describe('When getting a user', function () {
|
|
|
|
|
|
|
|
it('Should fail with an non authenticated user', async function () {
|
|
|
|
await makeGetRequest({
|
|
|
|
url: server.url,
|
|
|
|
path: path + userId,
|
|
|
|
token: 'super token',
|
|
|
|
expectedStatus: HttpStatusCode.UNAUTHORIZED_401
|
|
|
|
})
|
|
|
|
})
|
|
|
|
|
|
|
|
it('Should fail with a non admin user', async function () {
|
|
|
|
await makeGetRequest({ url: server.url, path, token: userToken, expectedStatus: HttpStatusCode.FORBIDDEN_403 })
|
|
|
|
})
|
|
|
|
|
|
|
|
it('Should succeed with the correct params', async function () {
|
|
|
|
await makeGetRequest({ url: server.url, path: path + userId, token: server.accessToken, expectedStatus: HttpStatusCode.OK_200 })
|
|
|
|
})
|
|
|
|
})
|
|
|
|
|
|
|
|
describe('When updating a user', function () {
|
|
|
|
|
|
|
|
it('Should fail with an invalid email attribute', async function () {
|
|
|
|
const fields = {
|
|
|
|
email: 'blabla'
|
|
|
|
}
|
|
|
|
|
|
|
|
await makePutBodyRequest({ url: server.url, path: path + userId, token: server.accessToken, fields })
|
|
|
|
})
|
|
|
|
|
|
|
|
it('Should fail with an invalid emailVerified attribute', async function () {
|
|
|
|
const fields = {
|
|
|
|
emailVerified: 'yes'
|
|
|
|
}
|
|
|
|
|
|
|
|
await makePutBodyRequest({ url: server.url, path: path + userId, token: server.accessToken, fields })
|
|
|
|
})
|
|
|
|
|
|
|
|
it('Should fail with an invalid videoQuota attribute', async function () {
|
|
|
|
const fields = {
|
|
|
|
videoQuota: -90
|
|
|
|
}
|
|
|
|
|
|
|
|
await makePutBodyRequest({ url: server.url, path: path + userId, token: server.accessToken, fields })
|
|
|
|
})
|
|
|
|
|
|
|
|
it('Should fail with an invalid user role attribute', async function () {
|
|
|
|
const fields = {
|
|
|
|
role: 54878
|
|
|
|
}
|
|
|
|
|
|
|
|
await makePutBodyRequest({ url: server.url, path: path + userId, token: server.accessToken, fields })
|
|
|
|
})
|
|
|
|
|
|
|
|
it('Should fail with a too small password', async function () {
|
|
|
|
const fields = {
|
|
|
|
currentPassword: 'password',
|
|
|
|
password: 'bla'
|
|
|
|
}
|
|
|
|
|
|
|
|
await makePutBodyRequest({ url: server.url, path: path + userId, token: server.accessToken, fields })
|
|
|
|
})
|
|
|
|
|
|
|
|
it('Should fail with a too long password', async function () {
|
|
|
|
const fields = {
|
|
|
|
currentPassword: 'password',
|
|
|
|
password: 'super'.repeat(61)
|
|
|
|
}
|
|
|
|
|
|
|
|
await makePutBodyRequest({ url: server.url, path: path + userId, token: server.accessToken, fields })
|
|
|
|
})
|
|
|
|
|
|
|
|
it('Should fail with an non authenticated user', async function () {
|
|
|
|
const fields = {
|
|
|
|
videoQuota: 42
|
|
|
|
}
|
|
|
|
|
|
|
|
await makePutBodyRequest({
|
|
|
|
url: server.url,
|
|
|
|
path: path + userId,
|
|
|
|
token: 'super token',
|
|
|
|
fields,
|
|
|
|
expectedStatus: HttpStatusCode.UNAUTHORIZED_401
|
|
|
|
})
|
|
|
|
})
|
|
|
|
|
|
|
|
it('Should fail when updating root role', async function () {
|
|
|
|
const fields = {
|
|
|
|
role: UserRole.MODERATOR
|
|
|
|
}
|
|
|
|
|
|
|
|
await makePutBodyRequest({ url: server.url, path: path + rootId, token: server.accessToken, fields })
|
|
|
|
})
|
|
|
|
|
|
|
|
it('Should fail with invalid admin flags', async function () {
|
|
|
|
const fields = { adminFlags: 'toto' }
|
|
|
|
|
|
|
|
await makePutBodyRequest({ url: server.url, path, token: server.accessToken, fields })
|
|
|
|
})
|
|
|
|
|
|
|
|
it('Should fail to update an admin with a moderator', async function () {
|
|
|
|
const fields = {
|
|
|
|
videoQuota: 42
|
|
|
|
}
|
|
|
|
|
|
|
|
await makePutBodyRequest({
|
|
|
|
url: server.url,
|
|
|
|
path: path + moderatorId,
|
|
|
|
token: moderatorToken,
|
|
|
|
fields,
|
|
|
|
expectedStatus: HttpStatusCode.FORBIDDEN_403
|
|
|
|
})
|
|
|
|
})
|
|
|
|
|
|
|
|
it('Should succeed to update a user with a moderator', async function () {
|
|
|
|
const fields = {
|
|
|
|
videoQuota: 42
|
|
|
|
}
|
|
|
|
|
|
|
|
await makePutBodyRequest({
|
|
|
|
url: server.url,
|
|
|
|
path: path + userId,
|
|
|
|
token: moderatorToken,
|
|
|
|
fields,
|
|
|
|
expectedStatus: HttpStatusCode.NO_CONTENT_204
|
|
|
|
})
|
|
|
|
})
|
|
|
|
|
|
|
|
it('Should succeed with the correct params', async function () {
|
|
|
|
const fields = {
|
|
|
|
email: 'email@example.com',
|
|
|
|
emailVerified: true,
|
|
|
|
videoQuota: 42,
|
|
|
|
role: UserRole.USER
|
|
|
|
}
|
|
|
|
|
|
|
|
await makePutBodyRequest({
|
|
|
|
url: server.url,
|
|
|
|
path: path + userId,
|
|
|
|
token: server.accessToken,
|
|
|
|
fields,
|
|
|
|
expectedStatus: HttpStatusCode.NO_CONTENT_204
|
|
|
|
})
|
|
|
|
})
|
|
|
|
})
|
|
|
|
|
|
|
|
after(async function () {
|
|
|
|
MockSmtpServer.Instance.kill()
|
|
|
|
|
|
|
|
await cleanupTests([ server ])
|
|
|
|
})
|
|
|
|
})
|