diff options
Diffstat (limited to 'models/perm/access/access_test.go')
| -rw-r--r-- | models/perm/access/access_test.go | 300 |
1 files changed, 275 insertions, 25 deletions
diff --git a/models/perm/access/access_test.go b/models/perm/access/access_test.go index a9ae9a30f4..a5e0448d3d 100644 --- a/models/perm/access/access_test.go +++ b/models/perm/access/access_test.go @@ -2,14 +2,18 @@ // Use of this source code is governed by a MIT-style // license that can be found in the LICENSE file. -package access +package access_test import ( "testing" + "code.gitea.io/gitea/models" "code.gitea.io/gitea/models/db" - "code.gitea.io/gitea/models/perm" + "code.gitea.io/gitea/models/organization" + perm_model "code.gitea.io/gitea/models/perm" + access_model "code.gitea.io/gitea/models/perm/access" repo_model "code.gitea.io/gitea/models/repo" + "code.gitea.io/gitea/models/unit" "code.gitea.io/gitea/models/unittest" user_model "code.gitea.io/gitea/models/user" @@ -35,36 +39,36 @@ func TestAccessLevel(t *testing.T) { // org. owned private repo repo24 := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 24}).(*repo_model.Repository) - level, err := AccessLevel(user2, repo1) + level, err := access_model.AccessLevel(user2, repo1) assert.NoError(t, err) - assert.Equal(t, perm.AccessModeOwner, level) + assert.Equal(t, perm_model.AccessModeOwner, level) - level, err = AccessLevel(user2, repo3) + level, err = access_model.AccessLevel(user2, repo3) assert.NoError(t, err) - assert.Equal(t, perm.AccessModeOwner, level) + assert.Equal(t, perm_model.AccessModeOwner, level) - level, err = AccessLevel(user5, repo1) + level, err = access_model.AccessLevel(user5, repo1) assert.NoError(t, err) - assert.Equal(t, perm.AccessModeRead, level) + assert.Equal(t, perm_model.AccessModeRead, level) - level, err = AccessLevel(user5, repo3) + level, err = access_model.AccessLevel(user5, repo3) assert.NoError(t, err) - assert.Equal(t, perm.AccessModeNone, level) + assert.Equal(t, perm_model.AccessModeNone, level) // restricted user has no access to a public repo - level, err = AccessLevel(user29, repo1) + level, err = access_model.AccessLevel(user29, repo1) assert.NoError(t, err) - assert.Equal(t, perm.AccessModeNone, level) + assert.Equal(t, perm_model.AccessModeNone, level) // ... unless he's a collaborator - level, err = AccessLevel(user29, repo4) + level, err = access_model.AccessLevel(user29, repo4) assert.NoError(t, err) - assert.Equal(t, perm.AccessModeWrite, level) + assert.Equal(t, perm_model.AccessModeWrite, level) // ... or a team member - level, err = AccessLevel(user29, repo24) + level, err = access_model.AccessLevel(user29, repo24) assert.NoError(t, err) - assert.Equal(t, perm.AccessModeRead, level) + assert.Equal(t, perm_model.AccessModeRead, level) } func TestHasAccess(t *testing.T) { @@ -79,17 +83,17 @@ func TestHasAccess(t *testing.T) { repo2 := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 3}).(*repo_model.Repository) assert.True(t, repo2.IsPrivate) - has, err := HasAccess(db.DefaultContext, user1.ID, repo1) + has, err := access_model.HasAccess(db.DefaultContext, user1.ID, repo1) assert.NoError(t, err) assert.True(t, has) - _, err = HasAccess(db.DefaultContext, user1.ID, repo2) + _, err = access_model.HasAccess(db.DefaultContext, user1.ID, repo2) assert.NoError(t, err) - _, err = HasAccess(db.DefaultContext, user2.ID, repo1) + _, err = access_model.HasAccess(db.DefaultContext, user2.ID, repo1) assert.NoError(t, err) - _, err = HasAccess(db.DefaultContext, user2.ID, repo2) + _, err = access_model.HasAccess(db.DefaultContext, user2.ID, repo2) assert.NoError(t, err) } @@ -101,13 +105,13 @@ func TestRepository_RecalculateAccesses(t *testing.T) { _, err := db.GetEngine(db.DefaultContext).Delete(&repo_model.Collaboration{UserID: 2, RepoID: 3}) assert.NoError(t, err) - assert.NoError(t, RecalculateAccesses(db.DefaultContext, repo1)) + assert.NoError(t, access_model.RecalculateAccesses(db.DefaultContext, repo1)) - access := &Access{UserID: 2, RepoID: 3} + access := &access_model.Access{UserID: 2, RepoID: 3} has, err := db.GetEngine(db.DefaultContext).Get(access) assert.NoError(t, err) assert.True(t, has) - assert.Equal(t, perm.AccessModeOwner, access.Mode) + assert.Equal(t, perm_model.AccessModeOwner, access.Mode) } func TestRepository_RecalculateAccesses2(t *testing.T) { @@ -118,9 +122,255 @@ func TestRepository_RecalculateAccesses2(t *testing.T) { _, err := db.GetEngine(db.DefaultContext).Delete(&repo_model.Collaboration{UserID: 4, RepoID: 4}) assert.NoError(t, err) - assert.NoError(t, RecalculateAccesses(db.DefaultContext, repo1)) + assert.NoError(t, access_model.RecalculateAccesses(db.DefaultContext, repo1)) - has, err := db.GetEngine(db.DefaultContext).Get(&Access{UserID: 4, RepoID: 4}) + has, err := db.GetEngine(db.DefaultContext).Get(&access_model.Access{UserID: 4, RepoID: 4}) assert.NoError(t, err) assert.False(t, has) } + +func TestRepoPermissionPublicNonOrgRepo(t *testing.T) { + assert.NoError(t, unittest.PrepareTestDatabase()) + + // public non-organization repo + repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 4}).(*repo_model.Repository) + assert.NoError(t, repo.LoadUnits(db.DefaultContext)) + + // plain user + user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2}).(*user_model.User) + perm, err := access_model.GetUserRepoPermission(db.DefaultContext, repo, user) + assert.NoError(t, err) + for _, unit := range repo.Units { + assert.True(t, perm.CanRead(unit.Type)) + assert.False(t, perm.CanWrite(unit.Type)) + } + + // change to collaborator + assert.NoError(t, models.AddCollaborator(repo, user)) + perm, err = access_model.GetUserRepoPermission(db.DefaultContext, repo, user) + assert.NoError(t, err) + for _, unit := range repo.Units { + assert.True(t, perm.CanRead(unit.Type)) + assert.True(t, perm.CanWrite(unit.Type)) + } + + // collaborator + collaborator := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 4}).(*user_model.User) + perm, err = access_model.GetUserRepoPermission(db.DefaultContext, repo, collaborator) + assert.NoError(t, err) + for _, unit := range repo.Units { + assert.True(t, perm.CanRead(unit.Type)) + assert.True(t, perm.CanWrite(unit.Type)) + } + + // owner + owner := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 5}).(*user_model.User) + perm, err = access_model.GetUserRepoPermission(db.DefaultContext, repo, owner) + assert.NoError(t, err) + for _, unit := range repo.Units { + assert.True(t, perm.CanRead(unit.Type)) + assert.True(t, perm.CanWrite(unit.Type)) + } + + // admin + admin := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 1}).(*user_model.User) + perm, err = access_model.GetUserRepoPermission(db.DefaultContext, repo, admin) + assert.NoError(t, err) + for _, unit := range repo.Units { + assert.True(t, perm.CanRead(unit.Type)) + assert.True(t, perm.CanWrite(unit.Type)) + } +} + +func TestRepoPermissionPrivateNonOrgRepo(t *testing.T) { + assert.NoError(t, unittest.PrepareTestDatabase()) + + // private non-organization repo + repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 2}).(*repo_model.Repository) + assert.NoError(t, repo.LoadUnits(db.DefaultContext)) + + // plain user + user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 4}).(*user_model.User) + perm, err := access_model.GetUserRepoPermission(db.DefaultContext, repo, user) + assert.NoError(t, err) + for _, unit := range repo.Units { + assert.False(t, perm.CanRead(unit.Type)) + assert.False(t, perm.CanWrite(unit.Type)) + } + + // change to collaborator to default write access + assert.NoError(t, models.AddCollaborator(repo, user)) + perm, err = access_model.GetUserRepoPermission(db.DefaultContext, repo, user) + assert.NoError(t, err) + for _, unit := range repo.Units { + assert.True(t, perm.CanRead(unit.Type)) + assert.True(t, perm.CanWrite(unit.Type)) + } + + assert.NoError(t, repo_model.ChangeCollaborationAccessMode(repo, user.ID, perm_model.AccessModeRead)) + perm, err = access_model.GetUserRepoPermission(db.DefaultContext, repo, user) + assert.NoError(t, err) + for _, unit := range repo.Units { + assert.True(t, perm.CanRead(unit.Type)) + assert.False(t, perm.CanWrite(unit.Type)) + } + + // owner + owner := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2}).(*user_model.User) + perm, err = access_model.GetUserRepoPermission(db.DefaultContext, repo, owner) + assert.NoError(t, err) + for _, unit := range repo.Units { + assert.True(t, perm.CanRead(unit.Type)) + assert.True(t, perm.CanWrite(unit.Type)) + } + + // admin + admin := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 1}).(*user_model.User) + perm, err = access_model.GetUserRepoPermission(db.DefaultContext, repo, admin) + assert.NoError(t, err) + for _, unit := range repo.Units { + assert.True(t, perm.CanRead(unit.Type)) + assert.True(t, perm.CanWrite(unit.Type)) + } +} + +func TestRepoPermissionPublicOrgRepo(t *testing.T) { + assert.NoError(t, unittest.PrepareTestDatabase()) + + // public organization repo + repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 32}).(*repo_model.Repository) + assert.NoError(t, repo.LoadUnits(db.DefaultContext)) + + // plain user + user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 5}).(*user_model.User) + perm, err := access_model.GetUserRepoPermission(db.DefaultContext, repo, user) + assert.NoError(t, err) + for _, unit := range repo.Units { + assert.True(t, perm.CanRead(unit.Type)) + assert.False(t, perm.CanWrite(unit.Type)) + } + + // change to collaborator to default write access + assert.NoError(t, models.AddCollaborator(repo, user)) + perm, err = access_model.GetUserRepoPermission(db.DefaultContext, repo, user) + assert.NoError(t, err) + for _, unit := range repo.Units { + assert.True(t, perm.CanRead(unit.Type)) + assert.True(t, perm.CanWrite(unit.Type)) + } + + assert.NoError(t, repo_model.ChangeCollaborationAccessMode(repo, user.ID, perm_model.AccessModeRead)) + perm, err = access_model.GetUserRepoPermission(db.DefaultContext, repo, user) + assert.NoError(t, err) + for _, unit := range repo.Units { + assert.True(t, perm.CanRead(unit.Type)) + assert.False(t, perm.CanWrite(unit.Type)) + } + + // org member team owner + owner := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2}).(*user_model.User) + perm, err = access_model.GetUserRepoPermission(db.DefaultContext, repo, owner) + assert.NoError(t, err) + for _, unit := range repo.Units { + assert.True(t, perm.CanRead(unit.Type)) + assert.True(t, perm.CanWrite(unit.Type)) + } + + // org member team tester + member := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 15}).(*user_model.User) + perm, err = access_model.GetUserRepoPermission(db.DefaultContext, repo, member) + assert.NoError(t, err) + for _, unit := range repo.Units { + assert.True(t, perm.CanRead(unit.Type)) + } + assert.True(t, perm.CanWrite(unit.TypeIssues)) + assert.False(t, perm.CanWrite(unit.TypeCode)) + + // admin + admin := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 1}).(*user_model.User) + perm, err = access_model.GetUserRepoPermission(db.DefaultContext, repo, admin) + assert.NoError(t, err) + for _, unit := range repo.Units { + assert.True(t, perm.CanRead(unit.Type)) + assert.True(t, perm.CanWrite(unit.Type)) + } +} + +func TestRepoPermissionPrivateOrgRepo(t *testing.T) { + assert.NoError(t, unittest.PrepareTestDatabase()) + + // private organization repo + repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 24}).(*repo_model.Repository) + assert.NoError(t, repo.LoadUnits(db.DefaultContext)) + + // plain user + user := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 5}).(*user_model.User) + perm, err := access_model.GetUserRepoPermission(db.DefaultContext, repo, user) + assert.NoError(t, err) + for _, unit := range repo.Units { + assert.False(t, perm.CanRead(unit.Type)) + assert.False(t, perm.CanWrite(unit.Type)) + } + + // change to collaborator to default write access + assert.NoError(t, models.AddCollaborator(repo, user)) + perm, err = access_model.GetUserRepoPermission(db.DefaultContext, repo, user) + assert.NoError(t, err) + for _, unit := range repo.Units { + assert.True(t, perm.CanRead(unit.Type)) + assert.True(t, perm.CanWrite(unit.Type)) + } + + assert.NoError(t, repo_model.ChangeCollaborationAccessMode(repo, user.ID, perm_model.AccessModeRead)) + perm, err = access_model.GetUserRepoPermission(db.DefaultContext, repo, user) + assert.NoError(t, err) + for _, unit := range repo.Units { + assert.True(t, perm.CanRead(unit.Type)) + assert.False(t, perm.CanWrite(unit.Type)) + } + + // org member team owner + owner := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 15}).(*user_model.User) + perm, err = access_model.GetUserRepoPermission(db.DefaultContext, repo, owner) + assert.NoError(t, err) + for _, unit := range repo.Units { + assert.True(t, perm.CanRead(unit.Type)) + assert.True(t, perm.CanWrite(unit.Type)) + } + + // update team information and then check permission + team := unittest.AssertExistsAndLoadBean(t, &organization.Team{ID: 5}).(*organization.Team) + err = organization.UpdateTeamUnits(team, nil) + assert.NoError(t, err) + perm, err = access_model.GetUserRepoPermission(db.DefaultContext, repo, owner) + assert.NoError(t, err) + for _, unit := range repo.Units { + assert.True(t, perm.CanRead(unit.Type)) + assert.True(t, perm.CanWrite(unit.Type)) + } + + // org member team tester + tester := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2}).(*user_model.User) + perm, err = access_model.GetUserRepoPermission(db.DefaultContext, repo, tester) + assert.NoError(t, err) + assert.True(t, perm.CanWrite(unit.TypeIssues)) + assert.False(t, perm.CanWrite(unit.TypeCode)) + assert.False(t, perm.CanRead(unit.TypeCode)) + + // org member team reviewer + reviewer := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 20}).(*user_model.User) + perm, err = access_model.GetUserRepoPermission(db.DefaultContext, repo, reviewer) + assert.NoError(t, err) + assert.False(t, perm.CanRead(unit.TypeIssues)) + assert.False(t, perm.CanWrite(unit.TypeCode)) + assert.True(t, perm.CanRead(unit.TypeCode)) + + // admin + admin := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 1}).(*user_model.User) + perm, err = access_model.GetUserRepoPermission(db.DefaultContext, repo, admin) + assert.NoError(t, err) + for _, unit := range repo.Units { + assert.True(t, perm.CanRead(unit.Type)) + assert.True(t, perm.CanWrite(unit.Type)) + } +} |