gitea/nas
1
0
Fork 2
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

Merge remote-tracking branch 'parent/main' into upstream-20241009

Browse source
This commit is contained in:
KMY 2024-10-09 12:32:11 +09:00
commit d021659cb7
130 changed files with 1120 additions and 917 deletions
Download patch file Download diff file Expand all files Collapse all files

20
spec/requests/api/v1/accounts_spec.rb
View file

@ -200,6 +200,26 @@ RSpec.describe '/api/v1/accounts' do
end
end
context 'when user tries to follow their own account' do
subject do
post "/api/v1/accounts/#{other_account.id}/follow", headers: headers
end
let(:locked) { false }
let(:other_account) { user.account }
it 'returns http forbidden and error message' do
subject
error_msg = I18n.t('accounts.self_follow_error')
expect(response).to have_http_status(403)
expect(response.parsed_body[:error]).to eq(error_msg)
end
it_behaves_like 'forbidden for wrong scope', 'read:accounts'
end
context 'when modifying follow options' do
let(:locked) { false }

96
spec/system/oauth_spec.rb
View file

@ -24,28 +24,28 @@ RSpec.describe 'Using OAuth from an external app' do
subject
# It presents the user with an authorization page
expect(page).to have_content(I18n.t('doorkeeper.authorizations.buttons.authorize'))
# Upon authorizing, it redirects to the apps' callback URL
click_on I18n.t('doorkeeper.authorizations.buttons.authorize')
expect(page).to have_current_path(/\A#{client_app.redirect_uri}/, url: true)
expect(page).to have_content(oauth_authorize_text)
# It grants the app access to the account
expect(Doorkeeper::AccessGrant.exists?(application: client_app, resource_owner_id: user.id)).to be true
expect { click_on oauth_authorize_text }
.to change { user_has_grant_with_client_app? }.to(true)
# Upon authorizing, it redirects to the apps' callback URL
expect(page).to redirect_to_callback_url
end
it 'when rejecting the authorization request' do
subject
# It presents the user with an authorization page
expect(page).to have_content(I18n.t('doorkeeper.authorizations.buttons.deny'))
# Upon denying, it redirects to the apps' callback URL
click_on I18n.t('doorkeeper.authorizations.buttons.deny')
expect(page).to have_current_path(/\A#{client_app.redirect_uri}/, url: true)
expect(page).to have_content(oauth_deny_text)
# It does not grant the app access to the account
expect(Doorkeeper::AccessGrant.exists?(application: client_app, resource_owner_id: user.id)).to be false
expect { click_on oauth_deny_text }
.to_not change { user_has_grant_with_client_app? }.from(false)
# Upon denying, it redirects to the apps' callback URL
expect(page).to redirect_to_callback_url
end
# The tests in this context ensures that requests without PKCE parameters
@ -133,7 +133,6 @@ RSpec.describe 'Using OAuth from an external app' do
end
it 'when accepting the authorization request' do
params = { client_id: client_app.uid, response_type: 'code', redirect_uri: client_app.redirect_uri, scope: 'read' }
visit "/oauth/authorize?#{params.to_query}"
# It presents the user with a log-in page
@ -145,18 +144,17 @@ RSpec.describe 'Using OAuth from an external app' do
# Logging in redirects to an authorization page
fill_in_auth_details(email, password)
expect(page).to have_content(I18n.t('doorkeeper.authorizations.buttons.authorize'))
# Upon authorizing, it redirects to the apps' callback URL
click_on I18n.t('doorkeeper.authorizations.buttons.authorize')
expect(page).to have_current_path(/\A#{client_app.redirect_uri}/, url: true)
expect(page).to have_content(oauth_authorize_text)
# It grants the app access to the account
expect(Doorkeeper::AccessGrant.exists?(application: client_app, resource_owner_id: user.id)).to be true
expect { click_on oauth_authorize_text }
.to change { user_has_grant_with_client_app? }.to(true)
# Upon authorizing, it redirects to the apps' callback URL
expect(page).to redirect_to_callback_url
end
it 'when rejecting the authorization request' do
params = { client_id: client_app.uid, response_type: 'code', redirect_uri: client_app.redirect_uri, scope: 'read' }
visit "/oauth/authorize?#{params.to_query}"
# It presents the user with a log-in page
@ -168,21 +166,20 @@ RSpec.describe 'Using OAuth from an external app' do
# Logging in redirects to an authorization page
fill_in_auth_details(email, password)
expect(page).to have_content(I18n.t('doorkeeper.authorizations.buttons.authorize'))
# Upon denying, it redirects to the apps' callback URL
click_on I18n.t('doorkeeper.authorizations.buttons.deny')
expect(page).to have_current_path(/\A#{client_app.redirect_uri}/, url: true)
expect(page).to have_content(oauth_authorize_text)
# It does not grant the app access to the account
expect(Doorkeeper::AccessGrant.exists?(application: client_app, resource_owner_id: user.id)).to be false
expect { click_on oauth_deny_text }
.to_not change { user_has_grant_with_client_app? }.from(false)
# Upon denying, it redirects to the apps' callback URL
expect(page).to redirect_to_callback_url
end
context 'when the user has set up TOTP' do
let(:user) { Fabricate(:user, email: email, password: password, otp_required_for_login: true, otp_secret: User.generate_otp_secret) }
it 'when accepting the authorization request' do
params = { client_id: client_app.uid, response_type: 'code', redirect_uri: client_app.redirect_uri, scope: 'read' }
visit "/oauth/authorize?#{params.to_query}"
# It presents the user with a log-in page
@ -202,18 +199,17 @@ RSpec.describe 'Using OAuth from an external app' do
# Filling in the correct TOTP code redirects to an app authorization page
fill_in_otp_details(user.current_otp)
expect(page).to have_content(I18n.t('doorkeeper.authorizations.buttons.authorize'))
# Upon authorizing, it redirects to the apps' callback URL
click_on I18n.t('doorkeeper.authorizations.buttons.authorize')
expect(page).to have_current_path(/\A#{client_app.redirect_uri}/, url: true)
expect(page).to have_content(oauth_authorize_text)
# It grants the app access to the account
expect(Doorkeeper::AccessGrant.exists?(application: client_app, resource_owner_id: user.id)).to be true
expect { click_on oauth_authorize_text }
.to change { user_has_grant_with_client_app? }.to(true)
# Upon authorizing, it redirects to the apps' callback URL
expect(page).to redirect_to_callback_url
end
it 'when rejecting the authorization request' do
params = { client_id: client_app.uid, response_type: 'code', redirect_uri: client_app.redirect_uri, scope: 'read' }
visit "/oauth/authorize?#{params.to_query}"
# It presents the user with a log-in page
@ -233,14 +229,14 @@ RSpec.describe 'Using OAuth from an external app' do
# Filling in the correct TOTP code redirects to an app authorization page
fill_in_otp_details(user.current_otp)
expect(page).to have_content(I18n.t('doorkeeper.authorizations.buttons.authorize'))
# Upon denying, it redirects to the apps' callback URL
click_on I18n.t('doorkeeper.authorizations.buttons.deny')
expect(page).to have_current_path(/\A#{client_app.redirect_uri}/, url: true)
expect(page).to have_content(oauth_authorize_text)
# It does not grant the app access to the account
expect(Doorkeeper::AccessGrant.exists?(application: client_app, resource_owner_id: user.id)).to be false
expect { click_on oauth_deny_text }
.to_not change { user_has_grant_with_client_app? }.from(false)
# Upon denying, it redirects to the apps' callback URL
expect(page).to redirect_to_callback_url
end
end
# TODO: external auth
@ -252,4 +248,24 @@ RSpec.describe 'Using OAuth from an external app' do
fill_in 'user_otp_attempt', with: value
click_on I18n.t('auth.login')
end
def oauth_authorize_text
I18n.t('doorkeeper.authorizations.buttons.authorize')
end
def oauth_deny_text
I18n.t('doorkeeper.authorizations.buttons.deny')
end
def redirect_to_callback_url
have_current_path(/\A#{client_app.redirect_uri}/, url: true)
end
def user_has_grant_with_client_app?
Doorkeeper::AccessGrant
.exists?(
application: client_app,
resource_owner_id: user.id
)
end
end