This instance will be upgraded to Heptapod 0.31.0 on 2022-05-19 at 11:00 UTC+2 (a few minutes of down time)

Commit 5224b37e authored by Georges Racinet's avatar Georges Racinet 🦑
Browse files

Testing Group custom attributes API permissions

The official documentation states that access is only
possible to instance administrators, which we can confirm.

This test will warn us if that were to change.

--HG--
branch : stable
parent b5db0768dab8
Pipeline #26467 passed with stage
in 21 minutes and 53 seconds
......@@ -3,8 +3,10 @@ from .utils import (
needs,
unique_name,
)
from .utils.access import GroupAccess
from .utils.group import Group
from .utils.project import Project
from .utils.user import User
from .test_push import prepare_simple_repo
......@@ -80,6 +82,32 @@ def test_group_project_push(heptapod, tmpdir):
}
def test_custom_attributes_perms(heptapod):
"""Ensuring that these are as private as we think they are."""
owner = heptapod.get_user('test_basic')
admin = heptapod.get_user('root')
with Group.api_create(heptapod, unique_name('test_group'),
user_name=owner.name) as group:
# first check that custom attributes do work
group.api_set_custom_attribute('location', 'secret lair',
user=admin)
assert group.api_get_custom_attribute('location',
user=admin) == 'secret lair'
def assert_forbidden(user):
resp = group.api_get_custom_attribute('location', user=user,
check=False)
assert resp.status_code == 403
with User.create(heptapod,
unique_name('user_custom_attr')) as user:
for level in GroupAccess:
group.grant_member_access(user, level)
# Even OWNER is forbidden. If that were to
# change it probably wouldn't be really shocking.
assert_forbidden(owner)
@needs.services
@parametrize('hashed_storage', [True, False])
def test_subgroups(heptapod, hashed_storage):
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment