mirror of
https://github.com/hanzoai/forge.git
synced 2026-10-30 15:00:39 +00:00
zeekayandHanzo Dev
9a07b4d089
2978 files. The fork is 2026-07-15 (rebrand: gitea.dev -> github.com/hanzoai/git), so 2026 is the year, and "Copyright 2026 Hanzo AI, Inc." was already the form used by the handful of files that had ours. Shape is now: // Copyright 2026 Hanzo AI, Inc. All rights reserved. // Copyright 2015 The Gogs Authors. All rights reserved. // Copyright 2019 The Gitea Authors. All rights reserved. // SPDX-License-Identifier: MIT Ours on top, theirs retained verbatim. Retained because MIT requires it, and separately because they are true — those authors did write that code. Not renamed to "The Git Authors": Git is a different project under a different license, and putting its name here would attribute this code to people who have nothing to do with it. Adding our line is the fix; overwriting theirs would have been both a licence violation and a false statement. gofmt still reports import-order drift in some of these files. It predates this change (verified against a stash) and is left alone rather than burying a one-line-per-file legal change under 3000 files of unrelated reordering. Build clean. Co-authored-by: Hanzo Dev <[email protected]>
191 lines
6.2 KiB
Go
191 lines
6.2 KiB
Go
// Copyright 2026 Hanzo AI, Inc. All rights reserved.
|
|
// Copyright 2021 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package integration
|
|
|
|
import (
|
|
"fmt"
|
|
"net/http"
|
|
"testing"
|
|
|
|
auth_model "github.com/hanzoai/git/models/auth"
|
|
api "github.com/hanzoai/git/modules/structs"
|
|
"github.com/hanzoai/git/tests"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
)
|
|
|
|
func TestPermissionsAPI(t *testing.T) {
|
|
defer tests.PrepareTestEnv(t)()
|
|
|
|
t.Run("TokenNeeded", testTokenNeeded)
|
|
t.Run("WithOwnerUser", testWithOwnerUser)
|
|
t.Run("CanWriteUser", testCanWriteUser)
|
|
t.Run("AdminUser", testAdminUser)
|
|
t.Run("AdminCanNotCreateRepo", testAdminCanNotCreateRepo)
|
|
t.Run("CanReadUser", testCanReadUser)
|
|
t.Run("UnknownUser", testUnknownUser)
|
|
t.Run("UnknownOrganization", testUnknownOrganization)
|
|
t.Run("HiddenMemberPermissionsForbidden", testHiddenMemberPermissionsForbidden)
|
|
t.Run("PrivateOrgPermissionsNotFound", testPrivateOrgPermissionsNotFound)
|
|
}
|
|
|
|
type apiUserOrgPermTestCase struct {
|
|
LoginUser string
|
|
User string
|
|
Organization string
|
|
ExpectedOrganizationPermissions api.OrganizationPermissions
|
|
}
|
|
|
|
func testTokenNeeded(t *testing.T) {
|
|
req := NewRequest(t, "GET", "/v1/users/user1/orgs/org6/permissions")
|
|
MakeRequest(t, req, http.StatusUnauthorized)
|
|
}
|
|
|
|
func sampleTest(t *testing.T, auoptc apiUserOrgPermTestCase) {
|
|
session := loginUser(t, auoptc.LoginUser)
|
|
token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeReadOrganization, auth_model.AccessTokenScopeReadUser)
|
|
|
|
req := NewRequest(t, "GET", fmt.Sprintf("/v1/users/%s/orgs/%s/permissions", auoptc.User, auoptc.Organization)).
|
|
AddTokenAuth(token)
|
|
resp := MakeRequest(t, req, http.StatusOK)
|
|
|
|
apiOP := DecodeJSON(t, resp, &api.OrganizationPermissions{})
|
|
assert.Equal(t, auoptc.ExpectedOrganizationPermissions.IsOwner, apiOP.IsOwner)
|
|
assert.Equal(t, auoptc.ExpectedOrganizationPermissions.IsAdmin, apiOP.IsAdmin)
|
|
assert.Equal(t, auoptc.ExpectedOrganizationPermissions.CanWrite, apiOP.CanWrite)
|
|
assert.Equal(t, auoptc.ExpectedOrganizationPermissions.CanRead, apiOP.CanRead)
|
|
assert.Equal(t, auoptc.ExpectedOrganizationPermissions.CanCreateRepository, apiOP.CanCreateRepository)
|
|
}
|
|
|
|
func testWithOwnerUser(t *testing.T) {
|
|
sampleTest(t, apiUserOrgPermTestCase{
|
|
LoginUser: "user2",
|
|
User: "user2",
|
|
Organization: "org3",
|
|
ExpectedOrganizationPermissions: api.OrganizationPermissions{
|
|
IsOwner: true,
|
|
IsAdmin: true,
|
|
CanWrite: true,
|
|
CanRead: true,
|
|
CanCreateRepository: true,
|
|
},
|
|
})
|
|
}
|
|
|
|
func testCanWriteUser(t *testing.T) {
|
|
sampleTest(t, apiUserOrgPermTestCase{
|
|
LoginUser: "user4",
|
|
User: "user4",
|
|
Organization: "org3",
|
|
ExpectedOrganizationPermissions: api.OrganizationPermissions{
|
|
IsOwner: false,
|
|
IsAdmin: false,
|
|
CanWrite: true,
|
|
CanRead: true,
|
|
CanCreateRepository: false,
|
|
},
|
|
})
|
|
}
|
|
|
|
func testAdminUser(t *testing.T) {
|
|
sampleTest(t, apiUserOrgPermTestCase{
|
|
LoginUser: "user1",
|
|
User: "user28",
|
|
Organization: "org3",
|
|
ExpectedOrganizationPermissions: api.OrganizationPermissions{
|
|
IsOwner: false,
|
|
IsAdmin: true,
|
|
CanWrite: true,
|
|
CanRead: true,
|
|
CanCreateRepository: true,
|
|
},
|
|
})
|
|
}
|
|
|
|
func testAdminCanNotCreateRepo(t *testing.T) {
|
|
sampleTest(t, apiUserOrgPermTestCase{
|
|
LoginUser: "user1",
|
|
User: "user28",
|
|
Organization: "org6",
|
|
ExpectedOrganizationPermissions: api.OrganizationPermissions{
|
|
IsOwner: false,
|
|
IsAdmin: true,
|
|
CanWrite: true,
|
|
CanRead: true,
|
|
CanCreateRepository: false,
|
|
},
|
|
})
|
|
}
|
|
|
|
func testCanReadUser(t *testing.T) {
|
|
sampleTest(t, apiUserOrgPermTestCase{
|
|
LoginUser: "user1",
|
|
User: "user24",
|
|
Organization: "org25",
|
|
ExpectedOrganizationPermissions: api.OrganizationPermissions{
|
|
IsOwner: false,
|
|
IsAdmin: false,
|
|
CanWrite: false,
|
|
CanRead: true,
|
|
CanCreateRepository: false,
|
|
},
|
|
})
|
|
}
|
|
|
|
func testUnknownUser(t *testing.T) {
|
|
session := loginUser(t, "user1")
|
|
token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeReadUser, auth_model.AccessTokenScopeReadOrganization)
|
|
|
|
req := NewRequest(t, "GET", "/v1/users/unknown/orgs/org25/permissions").
|
|
AddTokenAuth(token)
|
|
resp := MakeRequest(t, req, http.StatusNotFound)
|
|
|
|
apiError := DecodeJSON(t, resp, &api.APIError{})
|
|
assert.Equal(t, "user redirect does not exist [name: unknown]", apiError.Message)
|
|
}
|
|
|
|
func testUnknownOrganization(t *testing.T) {
|
|
session := loginUser(t, "user1")
|
|
token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeReadUser, auth_model.AccessTokenScopeReadOrganization)
|
|
|
|
req := NewRequest(t, "GET", "/v1/users/user1/orgs/unknown/permissions").
|
|
AddTokenAuth(token)
|
|
MakeRequest(t, req, http.StatusNotFound)
|
|
}
|
|
|
|
func testHiddenMemberPermissionsForbidden(t *testing.T) {
|
|
session := loginUser(t, "user8")
|
|
token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeReadUser, auth_model.AccessTokenScopeReadOrganization)
|
|
|
|
req := NewRequest(t, "GET", "/v1/users/user5/orgs/privated_org/permissions").
|
|
AddTokenAuth(token)
|
|
MakeRequest(t, req, http.StatusNotFound)
|
|
|
|
adminSession := loginUser(t, "user1")
|
|
adminToken := getTokenForLoggedInUser(t, adminSession, auth_model.AccessTokenScopeReadUser, auth_model.AccessTokenScopeReadOrganization)
|
|
|
|
adminReq := NewRequest(t, "GET", "/v1/users/user5/orgs/privated_org/permissions").
|
|
AddTokenAuth(adminToken)
|
|
resp := MakeRequest(t, adminReq, http.StatusOK)
|
|
|
|
apiOP := DecodeJSON(t, resp, &api.OrganizationPermissions{})
|
|
assert.Equal(t, &api.OrganizationPermissions{
|
|
IsOwner: false,
|
|
IsAdmin: false,
|
|
CanWrite: true,
|
|
CanRead: true,
|
|
CanCreateRepository: true,
|
|
}, apiOP)
|
|
}
|
|
|
|
func testPrivateOrgPermissionsNotFound(t *testing.T) {
|
|
session := loginUser(t, "user8")
|
|
token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeReadUser, auth_model.AccessTokenScopeReadOrganization)
|
|
|
|
req := NewRequest(t, "GET", "/v1/users/user5/orgs/privated_org/permissions").
|
|
AddTokenAuth(token)
|
|
MakeRequest(t, req, http.StatusNotFound)
|
|
}
|