110 lines
3.0 KiB
Python
110 lines
3.0 KiB
Python
|
# retoor <retoor@molodetz.nl>
|
||
|
|
|
||
|
|
import time
|
||
|
|
import pytest
|
||
|
|
import requests
|
||
|
|
from tests.conftest import BASE_URL
|
||
|
|
from devplacepy.database import get_table, refresh_snapshot, set_setting
|
||
|
|
|
||
|
|
JSON = {"Accept": "application/json"}
|
||
|
|
_counter = [0]
|
||
|
|
|
||
|
|
|
||
|
|
@pytest.fixture(scope="module", autouse=True)
|
||
|
|
def _settings(app_server):
|
||
|
|
set_setting("rate_limit_per_minute", "1000000")
|
||
|
|
set_setting("registration_open", "1")
|
||
|
|
set_setting("devii_interactions_default", "1")
|
||
|
|
yield
|
||
|
|
|
||
|
|
|
||
|
|
def _member():
|
||
|
|
_counter[0] += 1
|
||
|
|
name = f"ixp{int(time.time() * 1000)}{_counter[0]}"
|
||
|
|
requests.post(
|
||
|
|
f"{BASE_URL}/auth/signup",
|
||
|
|
data={
|
||
|
|
"username": name,
|
||
|
|
"email": f"{name}@t.dev",
|
||
|
|
"password": "secret123",
|
||
|
|
"confirm_password": "secret123",
|
||
|
|
},
|
||
|
|
allow_redirects=True,
|
||
|
|
)
|
||
|
|
refresh_snapshot()
|
||
|
|
user = get_table("users").find_one(username=name)
|
||
|
|
return name, user["uid"], user["api_key"]
|
||
|
|
|
||
|
|
|
||
|
|
def _admin_key(seeded_db):
|
||
|
|
refresh_snapshot()
|
||
|
|
return get_table("users").find_one(username="alice_test")["api_key"]
|
||
|
|
|
||
|
|
|
||
|
|
def test_owner_disables_interactions(app_server):
|
||
|
|
name, uid, key = _member()
|
||
|
|
r = requests.post(
|
||
|
|
f"{BASE_URL}/profile/{name}/interactions",
|
||
|
|
headers={"X-API-KEY": key, **JSON},
|
||
|
|
data={"enabled": "false"},
|
||
|
|
)
|
||
|
|
assert r.status_code == 200, r.text[:200]
|
||
|
|
body = r.json()["data"]
|
||
|
|
assert body["enabled"] is False
|
||
|
|
assert body["source"] == "user"
|
||
|
|
refresh_snapshot()
|
||
|
|
assert get_table("users").find_one(uid=uid)["interactions_enabled"] == 0
|
||
|
|
|
||
|
|
|
||
|
|
def test_owner_resets_to_default(app_server):
|
||
|
|
name, uid, key = _member()
|
||
|
|
requests.post(
|
||
|
|
f"{BASE_URL}/profile/{name}/interactions",
|
||
|
|
headers={"X-API-KEY": key, **JSON},
|
||
|
|
data={"enabled": "false"},
|
||
|
|
)
|
||
|
|
r = requests.post(
|
||
|
|
f"{BASE_URL}/profile/{name}/interactions",
|
||
|
|
headers={"X-API-KEY": key, **JSON},
|
||
|
|
data={"reset": "true"},
|
||
|
|
)
|
||
|
|
assert r.status_code == 200
|
||
|
|
body = r.json()["data"]
|
||
|
|
assert body["source"] == "default"
|
||
|
|
refresh_snapshot()
|
||
|
|
assert get_table("users").find_one(uid=uid)["interactions_enabled"] == -1
|
||
|
|
|
||
|
|
|
||
|
|
def test_admin_sets_for_other_user(seeded_db):
|
||
|
|
name, uid, key = _member()
|
||
|
|
r = requests.post(
|
||
|
|
f"{BASE_URL}/profile/{name}/interactions",
|
||
|
|
headers={"X-API-KEY": _admin_key(seeded_db), **JSON},
|
||
|
|
data={"enabled": "false"},
|
||
|
|
)
|
||
|
|
assert r.status_code == 200
|
||
|
|
refresh_snapshot()
|
||
|
|
assert get_table("users").find_one(uid=uid)["interactions_enabled"] == 0
|
||
|
|
|
||
|
|
|
||
|
|
def test_non_owner_forbidden(app_server):
|
||
|
|
name, uid, key = _member()
|
||
|
|
_, _, other_key = _member()
|
||
|
|
r = requests.post(
|
||
|
|
f"{BASE_URL}/profile/{name}/interactions",
|
||
|
|
headers={"X-API-KEY": other_key, **JSON},
|
||
|
|
data={"enabled": "false"},
|
||
|
|
)
|
||
|
|
assert r.status_code == 403
|
||
|
|
|
||
|
|
|
||
|
|
def test_guest_rejected(app_server):
|
||
|
|
name, uid, key = _member()
|
||
|
|
r = requests.post(
|
||
|
|
f"{BASE_URL}/profile/{name}/interactions",
|
||
|
|
headers=JSON,
|
||
|
|
data={"enabled": "false"},
|
||
|
|
allow_redirects=False,
|
||
|
|
)
|
||
|
|
assert r.status_code in (401, 303)
|