1 /* eslint-disable @typescript-eslint/no-unused-expressions,@typescript-eslint/require-await */
3 import { checkBadCountPagination, checkBadSortPagination, checkBadStartPagination, MockSmtpServer } from '@server/tests/shared'
4 import { omit } from '@shared/core-utils'
5 import { HttpStatusCode, UserAdminFlag, UserRole } from '@shared/models'
15 setAccessTokensToServers
16 } from '@shared/server-commands'
18 describe('Test users admin API validators', function () {
19 const path = '/api/v1/users/'
22 let moderatorId: number
23 let server: PeerTubeServer
25 let moderatorToken = ''
28 // ---------------------------------------------------------------
30 before(async function () {
33 const emails: object[] = []
34 emailPort = await MockSmtpServer.Instance.collectEmails(emails)
37 server = await createSingleServer(1)
39 await setAccessTokensToServers([ server ])
43 const result = await server.users.generate('user1')
44 userToken = result.token
45 userId = result.userId
49 const result = await server.users.generate('moderator1', UserRole.MODERATOR)
50 moderatorToken = result.token
54 const result = await server.users.generate('moderator2', UserRole.MODERATOR)
55 moderatorId = result.userId
59 describe('When listing users', function () {
60 it('Should fail with a bad start pagination', async function () {
61 await checkBadStartPagination(server.url, path, server.accessToken)
64 it('Should fail with a bad count pagination', async function () {
65 await checkBadCountPagination(server.url, path, server.accessToken)
68 it('Should fail with an incorrect sort', async function () {
69 await checkBadSortPagination(server.url, path, server.accessToken)
72 it('Should fail with a non authenticated user', async function () {
73 await makeGetRequest({
76 expectedStatus: HttpStatusCode.UNAUTHORIZED_401
80 it('Should fail with a non admin user', async function () {
81 await makeGetRequest({
85 expectedStatus: HttpStatusCode.FORBIDDEN_403
90 describe('When adding a new user', function () {
91 const baseCorrectParams = {
93 email: 'test@example.com',
94 password: 'my super password',
98 adminFlags: UserAdminFlag.BYPASS_VIDEO_AUTO_BLACKLIST
101 it('Should fail with a too small username', async function () {
102 const fields = { ...baseCorrectParams, username: '' }
104 await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
107 it('Should fail with a too long username', async function () {
108 const fields = { ...baseCorrectParams, username: 'super'.repeat(50) }
110 await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
113 it('Should fail with a not lowercase username', async function () {
114 const fields = { ...baseCorrectParams, username: 'Toto' }
116 await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
119 it('Should fail with an incorrect username', async function () {
120 const fields = { ...baseCorrectParams, username: 'my username' }
122 await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
125 it('Should fail with a missing email', async function () {
126 const fields = omit(baseCorrectParams, [ 'email' ])
128 await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
131 it('Should fail with an invalid email', async function () {
132 const fields = { ...baseCorrectParams, email: 'test_example.com' }
134 await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
137 it('Should fail with a too small password', async function () {
138 const fields = { ...baseCorrectParams, password: 'bla' }
140 await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
143 it('Should fail with a too long password', async function () {
144 const fields = { ...baseCorrectParams, password: 'super'.repeat(61) }
146 await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
149 it('Should fail with empty password and no smtp configured', async function () {
150 const fields = { ...baseCorrectParams, password: '' }
152 await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
155 it('Should succeed with no password on a server with smtp enabled', async function () {
158 await killallServers([ server ])
160 await server.run(ConfigCommand.getEmailOverrideConfig(emailPort))
163 ...baseCorrectParams,
166 username: 'create_password',
167 email: 'create_password@example.com'
170 await makePostBodyRequest({
173 token: server.accessToken,
175 expectedStatus: HttpStatusCode.OK_200
179 it('Should fail with invalid admin flags', async function () {
180 const fields = { ...baseCorrectParams, adminFlags: 'toto' }
182 await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
185 it('Should fail with an non authenticated user', async function () {
186 await makePostBodyRequest({
189 token: 'super token',
190 fields: baseCorrectParams,
191 expectedStatus: HttpStatusCode.UNAUTHORIZED_401
195 it('Should fail if we add a user with the same username', async function () {
196 const fields = { ...baseCorrectParams, username: 'user1' }
198 await makePostBodyRequest({
201 token: server.accessToken,
203 expectedStatus: HttpStatusCode.CONFLICT_409
207 it('Should fail if we add a user with the same email', async function () {
208 const fields = { ...baseCorrectParams, email: 'user1@example.com' }
210 await makePostBodyRequest({
213 token: server.accessToken,
215 expectedStatus: HttpStatusCode.CONFLICT_409
219 it('Should fail without a videoQuota', async function () {
220 const fields = omit(baseCorrectParams, [ 'videoQuota' ])
222 await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
225 it('Should fail without a videoQuotaDaily', async function () {
226 const fields = omit(baseCorrectParams, [ 'videoQuotaDaily' ])
228 await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
231 it('Should fail with an invalid videoQuota', async function () {
232 const fields = { ...baseCorrectParams, videoQuota: -5 }
234 await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
237 it('Should fail with an invalid videoQuotaDaily', async function () {
238 const fields = { ...baseCorrectParams, videoQuotaDaily: -7 }
240 await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
243 it('Should fail without a user role', async function () {
244 const fields = omit(baseCorrectParams, [ 'role' ])
246 await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
249 it('Should fail with an invalid user role', async function () {
250 const fields = { ...baseCorrectParams, role: 88989 }
252 await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
255 it('Should fail with a "peertube" username', async function () {
256 const fields = { ...baseCorrectParams, username: 'peertube' }
258 await makePostBodyRequest({
261 token: server.accessToken,
263 expectedStatus: HttpStatusCode.CONFLICT_409
267 it('Should fail to create a moderator or an admin with a moderator', async function () {
268 for (const role of [ UserRole.MODERATOR, UserRole.ADMINISTRATOR ]) {
269 const fields = { ...baseCorrectParams, role }
271 await makePostBodyRequest({
274 token: moderatorToken,
276 expectedStatus: HttpStatusCode.FORBIDDEN_403
281 it('Should succeed to create a user with a moderator', async function () {
282 const fields = { ...baseCorrectParams, username: 'a4656', email: 'a4656@example.com', role: UserRole.USER }
284 await makePostBodyRequest({
287 token: moderatorToken,
289 expectedStatus: HttpStatusCode.OK_200
293 it('Should succeed with the correct params', async function () {
294 await makePostBodyRequest({
297 token: server.accessToken,
298 fields: baseCorrectParams,
299 expectedStatus: HttpStatusCode.OK_200
303 it('Should fail with a non admin user', async function () {
304 const user = { username: 'user1' }
305 userToken = await server.login.getAccessToken(user)
309 email: 'test@example.com',
310 password: 'my super password',
313 await makePostBodyRequest({ url: server.url, path, token: userToken, fields, expectedStatus: HttpStatusCode.FORBIDDEN_403 })
317 describe('When getting a user', function () {
319 it('Should fail with an non authenticated user', async function () {
320 await makeGetRequest({
323 token: 'super token',
324 expectedStatus: HttpStatusCode.UNAUTHORIZED_401
328 it('Should fail with a non admin user', async function () {
329 await makeGetRequest({ url: server.url, path, token: userToken, expectedStatus: HttpStatusCode.FORBIDDEN_403 })
332 it('Should succeed with the correct params', async function () {
333 await makeGetRequest({ url: server.url, path: path + userId, token: server.accessToken, expectedStatus: HttpStatusCode.OK_200 })
337 describe('When updating a user', function () {
339 it('Should fail with an invalid email attribute', async function () {
344 await makePutBodyRequest({ url: server.url, path: path + userId, token: server.accessToken, fields })
347 it('Should fail with an invalid emailVerified attribute', async function () {
352 await makePutBodyRequest({ url: server.url, path: path + userId, token: server.accessToken, fields })
355 it('Should fail with an invalid videoQuota attribute', async function () {
360 await makePutBodyRequest({ url: server.url, path: path + userId, token: server.accessToken, fields })
363 it('Should fail with an invalid user role attribute', async function () {
368 await makePutBodyRequest({ url: server.url, path: path + userId, token: server.accessToken, fields })
371 it('Should fail with a too small password', async function () {
373 currentPassword: 'password',
377 await makePutBodyRequest({ url: server.url, path: path + userId, token: server.accessToken, fields })
380 it('Should fail with a too long password', async function () {
382 currentPassword: 'password',
383 password: 'super'.repeat(61)
386 await makePutBodyRequest({ url: server.url, path: path + userId, token: server.accessToken, fields })
389 it('Should fail with an non authenticated user', async function () {
394 await makePutBodyRequest({
397 token: 'super token',
399 expectedStatus: HttpStatusCode.UNAUTHORIZED_401
403 it('Should fail when updating root role', async function () {
405 role: UserRole.MODERATOR
408 await makePutBodyRequest({ url: server.url, path: path + rootId, token: server.accessToken, fields })
411 it('Should fail with invalid admin flags', async function () {
412 const fields = { adminFlags: 'toto' }
414 await makePutBodyRequest({ url: server.url, path, token: server.accessToken, fields })
417 it('Should fail to update an admin with a moderator', async function () {
422 await makePutBodyRequest({
424 path: path + moderatorId,
425 token: moderatorToken,
427 expectedStatus: HttpStatusCode.FORBIDDEN_403
431 it('Should succeed to update a user with a moderator', async function () {
436 await makePutBodyRequest({
439 token: moderatorToken,
441 expectedStatus: HttpStatusCode.NO_CONTENT_204
445 it('Should succeed with the correct params', async function () {
447 email: 'email@example.com',
453 await makePutBodyRequest({
456 token: server.accessToken,
458 expectedStatus: HttpStatusCode.NO_CONTENT_204
463 after(async function () {
464 MockSmtpServer.Instance.kill()
466 await cleanupTests([ server ])