1 /* eslint-disable @typescript-eslint/no-unused-expressions,@typescript-eslint/require-await */
3 import { checkBadCountPagination, checkBadSortPagination, checkBadStartPagination, MockSmtpServer } from '@server/tests/shared'
4 import { omit } from '@shared/core-utils'
5 import { HttpStatusCode, UserAdminFlag, UserRole } from '@shared/models'
14 setAccessTokensToServers
15 } from '@shared/server-commands'
17 describe('Test users admin API validators', function () {
18 const path = '/api/v1/users/'
21 let moderatorId: number
22 let server: PeerTubeServer
24 let moderatorToken = ''
27 // ---------------------------------------------------------------
29 before(async function () {
32 const emails: object[] = []
33 emailPort = await MockSmtpServer.Instance.collectEmails(emails)
36 server = await createSingleServer(1)
38 await setAccessTokensToServers([ server ])
42 const result = await server.users.generate('user1')
43 userToken = result.token
44 userId = result.userId
48 const result = await server.users.generate('moderator1', UserRole.MODERATOR)
49 moderatorToken = result.token
53 const result = await server.users.generate('moderator2', UserRole.MODERATOR)
54 moderatorId = result.userId
58 describe('When listing users', function () {
59 it('Should fail with a bad start pagination', async function () {
60 await checkBadStartPagination(server.url, path, server.accessToken)
63 it('Should fail with a bad count pagination', async function () {
64 await checkBadCountPagination(server.url, path, server.accessToken)
67 it('Should fail with an incorrect sort', async function () {
68 await checkBadSortPagination(server.url, path, server.accessToken)
71 it('Should fail with a non authenticated user', async function () {
72 await makeGetRequest({
75 expectedStatus: HttpStatusCode.UNAUTHORIZED_401
79 it('Should fail with a non admin user', async function () {
80 await makeGetRequest({
84 expectedStatus: HttpStatusCode.FORBIDDEN_403
89 describe('When adding a new user', function () {
90 const baseCorrectParams = {
92 email: 'test@example.com',
93 password: 'my super password',
97 adminFlags: UserAdminFlag.BYPASS_VIDEO_AUTO_BLACKLIST
100 it('Should fail with a too small username', async function () {
101 const fields = { ...baseCorrectParams, username: '' }
103 await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
106 it('Should fail with a too long username', async function () {
107 const fields = { ...baseCorrectParams, username: 'super'.repeat(50) }
109 await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
112 it('Should fail with a not lowercase username', async function () {
113 const fields = { ...baseCorrectParams, username: 'Toto' }
115 await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
118 it('Should fail with an incorrect username', async function () {
119 const fields = { ...baseCorrectParams, username: 'my username' }
121 await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
124 it('Should fail with a missing email', async function () {
125 const fields = omit(baseCorrectParams, [ 'email' ])
127 await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
130 it('Should fail with an invalid email', async function () {
131 const fields = { ...baseCorrectParams, email: 'test_example.com' }
133 await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
136 it('Should fail with a too small password', async function () {
137 const fields = { ...baseCorrectParams, password: 'bla' }
139 await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
142 it('Should fail with a too long password', async function () {
143 const fields = { ...baseCorrectParams, password: 'super'.repeat(61) }
145 await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
148 it('Should fail with empty password and no smtp configured', async function () {
149 const fields = { ...baseCorrectParams, password: '' }
151 await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
154 it('Should succeed with no password on a server with smtp enabled', async function () {
157 await killallServers([ server ])
161 hostname: 'localhost',
165 await server.run(config)
168 ...baseCorrectParams,
171 username: 'create_password',
172 email: 'create_password@example.com'
175 await makePostBodyRequest({
178 token: server.accessToken,
180 expectedStatus: HttpStatusCode.OK_200
184 it('Should fail with invalid admin flags', async function () {
185 const fields = { ...baseCorrectParams, adminFlags: 'toto' }
187 await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
190 it('Should fail with an non authenticated user', async function () {
191 await makePostBodyRequest({
194 token: 'super token',
195 fields: baseCorrectParams,
196 expectedStatus: HttpStatusCode.UNAUTHORIZED_401
200 it('Should fail if we add a user with the same username', async function () {
201 const fields = { ...baseCorrectParams, username: 'user1' }
203 await makePostBodyRequest({
206 token: server.accessToken,
208 expectedStatus: HttpStatusCode.CONFLICT_409
212 it('Should fail if we add a user with the same email', async function () {
213 const fields = { ...baseCorrectParams, email: 'user1@example.com' }
215 await makePostBodyRequest({
218 token: server.accessToken,
220 expectedStatus: HttpStatusCode.CONFLICT_409
224 it('Should fail without a videoQuota', async function () {
225 const fields = omit(baseCorrectParams, [ 'videoQuota' ])
227 await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
230 it('Should fail without a videoQuotaDaily', async function () {
231 const fields = omit(baseCorrectParams, [ 'videoQuotaDaily' ])
233 await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
236 it('Should fail with an invalid videoQuota', async function () {
237 const fields = { ...baseCorrectParams, videoQuota: -5 }
239 await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
242 it('Should fail with an invalid videoQuotaDaily', async function () {
243 const fields = { ...baseCorrectParams, videoQuotaDaily: -7 }
245 await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
248 it('Should fail without a user role', async function () {
249 const fields = omit(baseCorrectParams, [ 'role' ])
251 await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
254 it('Should fail with an invalid user role', async function () {
255 const fields = { ...baseCorrectParams, role: 88989 }
257 await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
260 it('Should fail with a "peertube" username', async function () {
261 const fields = { ...baseCorrectParams, username: 'peertube' }
263 await makePostBodyRequest({
266 token: server.accessToken,
268 expectedStatus: HttpStatusCode.CONFLICT_409
272 it('Should fail to create a moderator or an admin with a moderator', async function () {
273 for (const role of [ UserRole.MODERATOR, UserRole.ADMINISTRATOR ]) {
274 const fields = { ...baseCorrectParams, role }
276 await makePostBodyRequest({
279 token: moderatorToken,
281 expectedStatus: HttpStatusCode.FORBIDDEN_403
286 it('Should succeed to create a user with a moderator', async function () {
287 const fields = { ...baseCorrectParams, username: 'a4656', email: 'a4656@example.com', role: UserRole.USER }
289 await makePostBodyRequest({
292 token: moderatorToken,
294 expectedStatus: HttpStatusCode.OK_200
298 it('Should succeed with the correct params', async function () {
299 await makePostBodyRequest({
302 token: server.accessToken,
303 fields: baseCorrectParams,
304 expectedStatus: HttpStatusCode.OK_200
308 it('Should fail with a non admin user', async function () {
309 const user = { username: 'user1' }
310 userToken = await server.login.getAccessToken(user)
314 email: 'test@example.com',
315 password: 'my super password',
318 await makePostBodyRequest({ url: server.url, path, token: userToken, fields, expectedStatus: HttpStatusCode.FORBIDDEN_403 })
322 describe('When getting a user', function () {
324 it('Should fail with an non authenticated user', async function () {
325 await makeGetRequest({
328 token: 'super token',
329 expectedStatus: HttpStatusCode.UNAUTHORIZED_401
333 it('Should fail with a non admin user', async function () {
334 await makeGetRequest({ url: server.url, path, token: userToken, expectedStatus: HttpStatusCode.FORBIDDEN_403 })
337 it('Should succeed with the correct params', async function () {
338 await makeGetRequest({ url: server.url, path: path + userId, token: server.accessToken, expectedStatus: HttpStatusCode.OK_200 })
342 describe('When updating a user', function () {
344 it('Should fail with an invalid email attribute', async function () {
349 await makePutBodyRequest({ url: server.url, path: path + userId, token: server.accessToken, fields })
352 it('Should fail with an invalid emailVerified attribute', async function () {
357 await makePutBodyRequest({ url: server.url, path: path + userId, token: server.accessToken, fields })
360 it('Should fail with an invalid videoQuota attribute', async function () {
365 await makePutBodyRequest({ url: server.url, path: path + userId, token: server.accessToken, fields })
368 it('Should fail with an invalid user role attribute', async function () {
373 await makePutBodyRequest({ url: server.url, path: path + userId, token: server.accessToken, fields })
376 it('Should fail with a too small password', async function () {
378 currentPassword: 'password',
382 await makePutBodyRequest({ url: server.url, path: path + userId, token: server.accessToken, fields })
385 it('Should fail with a too long password', async function () {
387 currentPassword: 'password',
388 password: 'super'.repeat(61)
391 await makePutBodyRequest({ url: server.url, path: path + userId, token: server.accessToken, fields })
394 it('Should fail with an non authenticated user', async function () {
399 await makePutBodyRequest({
402 token: 'super token',
404 expectedStatus: HttpStatusCode.UNAUTHORIZED_401
408 it('Should fail when updating root role', async function () {
410 role: UserRole.MODERATOR
413 await makePutBodyRequest({ url: server.url, path: path + rootId, token: server.accessToken, fields })
416 it('Should fail with invalid admin flags', async function () {
417 const fields = { adminFlags: 'toto' }
419 await makePutBodyRequest({ url: server.url, path, token: server.accessToken, fields })
422 it('Should fail to update an admin with a moderator', async function () {
427 await makePutBodyRequest({
429 path: path + moderatorId,
430 token: moderatorToken,
432 expectedStatus: HttpStatusCode.FORBIDDEN_403
436 it('Should succeed to update a user with a moderator', async function () {
441 await makePutBodyRequest({
444 token: moderatorToken,
446 expectedStatus: HttpStatusCode.NO_CONTENT_204
450 it('Should succeed with the correct params', async function () {
452 email: 'email@example.com',
458 await makePutBodyRequest({
461 token: server.accessToken,
463 expectedStatus: HttpStatusCode.NO_CONTENT_204
468 after(async function () {
469 MockSmtpServer.Instance.kill()
471 await cleanupTests([ server ])