97000dcd1e
Serve /api/v1/bm (seed, quiz import, materials, courses, me) behind user.api_token, user.scope and user.permission. jz.bm now requires golem15.quizzes for the quiz import.
66 lines
2.1 KiB
Go
66 lines
2.1 KiB
Go
package bm_test
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
|
|
userclasses "git.golem15.com/golem15/sm-user-plugin/classes"
|
|
"git.golem15.com/golem15/summercms/modules/surf"
|
|
)
|
|
|
|
func TestManagementAPIUsesSharedTokenAndCurrentUserPermissions(t *testing.T) {
|
|
app, plugins, db := migrated(t)
|
|
|
|
var userID uint
|
|
if err := db.Raw(`
|
|
INSERT INTO users (email, password, must_change_password)
|
|
VALUES ('bm-shared-token@example.test', '', false)
|
|
RETURNING id`).Scan(&userID).Error; err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
var groupID uint
|
|
if err := db.Raw(`
|
|
INSERT INTO user_groups (name, code, permissions, created_at, updated_at)
|
|
VALUES ('BM API', 'bm-api', '{"jz.bm.access_courses":1}', NOW(), NOW())
|
|
RETURNING id`).Scan(&groupID).Error; err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := db.Exec(`INSERT INTO users_groups (user_id, user_group_id) VALUES (?, ?)`, userID, groupID).Error; err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
secret, token, err := userclasses.MintAPIToken("usr_", userID, "BM integration", []string{"read"}, nil, nil)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := db.Create(token).Error; err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
handler, err := surf.Assemble(app, plugins)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
request := func(path string) *httptest.ResponseRecorder {
|
|
req := httptest.NewRequest(http.MethodGet, path, nil)
|
|
req.Header.Set("Authorization", "Bearer "+secret)
|
|
rec := httptest.NewRecorder()
|
|
handler.ServeHTTP(rec, req)
|
|
return rec
|
|
}
|
|
|
|
if rec := request("/api/v1/bm/courses"); rec.Code != http.StatusOK {
|
|
t.Fatalf("permitted courses request = %d %s", rec.Code, rec.Body.String())
|
|
}
|
|
if rec := request("/api/v1/bm/materials"); rec.Code != http.StatusForbidden {
|
|
t.Fatalf("ungranted materials request = %d %s", rec.Code, rec.Body.String())
|
|
}
|
|
if err := db.Model(&struct{}{}).Table("user_groups").Where("id = ?", groupID).Update("permissions", `{}`).Error; err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if rec := request("/api/v1/bm/courses"); rec.Code != http.StatusForbidden || !strings.Contains(rec.Body.String(), "Forbidden") {
|
|
t.Fatalf("request after permission revocation = %d %s", rec.Code, rec.Body.String())
|
|
}
|
|
}
|