126 lines
3.2 KiB
TypeScript
126 lines
3.2 KiB
TypeScript
import * as asserts from '@std/assert';
|
|
import { delete_user, EPHEMERAL_SERVER, get_ephemeral_listen_server, get_new_user, set_user_permissions } from './helpers.ts';
|
|
import { api, API_CLIENT } from '../utils/api.ts';
|
|
import { generateTotp } from '../utils/totp.ts';
|
|
import { clear_topic_events_cache } from '../models/event.ts';
|
|
|
|
Deno.test({
|
|
name: 'API - TOPICS - EVENTS - Create',
|
|
permissions: {
|
|
env: true,
|
|
read: true,
|
|
write: true,
|
|
net: true
|
|
},
|
|
fn: async () => {
|
|
let test_server_info: EPHEMERAL_SERVER | null = null;
|
|
try {
|
|
test_server_info = await get_ephemeral_listen_server();
|
|
const client: API_CLIENT = api({
|
|
prefix: '/api',
|
|
hostname: test_server_info.hostname,
|
|
port: test_server_info.port
|
|
});
|
|
|
|
const owner_info = await get_new_user(client);
|
|
|
|
await set_user_permissions(client, owner_info.user, owner_info.session, [...owner_info.user.permissions, 'topics.create']);
|
|
|
|
const topic = await client.fetch('/topics', {
|
|
method: 'POST',
|
|
headers: {
|
|
'x-session_id': owner_info.session.id,
|
|
'x-totp': await generateTotp(owner_info.session.secret)
|
|
},
|
|
json: {
|
|
name: 'test events topic',
|
|
permissions: {
|
|
write_events: [owner_info.user.id]
|
|
}
|
|
}
|
|
});
|
|
|
|
asserts.assert(topic);
|
|
|
|
const event_from_owner = await client.fetch(`/topics/${topic.id}/events`, {
|
|
method: 'POST',
|
|
headers: {
|
|
'x-session_id': owner_info.session.id,
|
|
'x-totp': await generateTotp(owner_info.session.secret)
|
|
},
|
|
json: {
|
|
type: 'test',
|
|
data: {
|
|
foo: 'bar'
|
|
}
|
|
}
|
|
});
|
|
|
|
asserts.assert(event_from_owner);
|
|
|
|
const other_user_info = await get_new_user(client, {}, owner_info);
|
|
|
|
try {
|
|
const _permission_denied_topic = await client.fetch(`/topics/${topic.id}/events`, {
|
|
method: 'POST',
|
|
headers: {
|
|
'x-session_id': other_user_info.session.id,
|
|
'x-totp': await generateTotp(other_user_info.session.secret)
|
|
},
|
|
json: {
|
|
type: 'test',
|
|
data: {
|
|
other_user: true
|
|
}
|
|
}
|
|
});
|
|
|
|
asserts.fail('allowed adding an event to a topic without permission');
|
|
} catch (error) {
|
|
asserts.assertEquals((error as Error).cause, 'permission_denied');
|
|
}
|
|
|
|
// make the topic public write
|
|
const updated_by_owner_topic = await client.fetch(`/topics/${topic.id}`, {
|
|
method: 'PUT',
|
|
headers: {
|
|
'x-session_id': owner_info.session.id,
|
|
'x-totp': await generateTotp(owner_info.session.secret)
|
|
},
|
|
json: {
|
|
permissions: {
|
|
...topic.permissions,
|
|
write_events: []
|
|
}
|
|
}
|
|
});
|
|
|
|
asserts.assert(updated_by_owner_topic);
|
|
asserts.assertEquals(updated_by_owner_topic.permissions.write_events, []);
|
|
|
|
const event_from_other_user = await client.fetch(`/topics/${topic.id}/events`, {
|
|
method: 'POST',
|
|
headers: {
|
|
'x-session_id': other_user_info.session.id,
|
|
'x-totp': await generateTotp(other_user_info.session.secret)
|
|
},
|
|
json: {
|
|
type: 'test',
|
|
data: {
|
|
other_user: true
|
|
}
|
|
}
|
|
});
|
|
|
|
asserts.assert(event_from_other_user);
|
|
|
|
await delete_user(client, other_user_info);
|
|
await delete_user(client, owner_info);
|
|
} finally {
|
|
clear_topic_events_cache();
|
|
if (test_server_info) {
|
|
await test_server_info?.server?.stop();
|
|
}
|
|
}
|
|
}
|
|
});
|