server/tests/api/check-params/users.ts

   1 /* eslint-disable @typescript-eslint/no-unused-expressions,@typescript-eslint/require-await */
   2
   3 import 'mocha'
   4 import { omit } from 'lodash'
   5 import { User, UserRole } from '../../../../shared'
   6 import { HttpStatusCode } from '../../../../shared/core-utils/miscs/http-error-codes'
   7 import {
   8   addVideoChannel,
   9   blockUser,
  10   buildAbsoluteFixturePath,
  11   cleanupTests,
  12   createUser,
  13   deleteMe,
  14   flushAndRunServer,
  15   getMyUserInformation,
  16   getMyUserVideoRating,
  17   getUserScopedTokens,
  18   getUsersList,
  19   immutableAssign,
  20   killallServers,
  21   makeGetRequest,
  22   makePostBodyRequest,
  23   makePutBodyRequest,
  24   makeUploadRequest,
  25   registerUser,
  26   removeUser,
  27   renewUserScopedTokens,
  28   reRunServer,
  29   ServerInfo,
  30   setAccessTokensToServers,
  31   unblockUser,
  32   uploadVideo,
  33   userLogin
  34 } from '../../../../shared/extra-utils'
  35 import { MockSmtpServer } from '../../../../shared/extra-utils/miscs/email'
  36 import {
  37   checkBadCountPagination,
  38   checkBadSortPagination,
  39   checkBadStartPagination
  40 } from '../../../../shared/extra-utils/requests/check-api-params'
  41 import { UserAdminFlag } from '../../../../shared/models/users/user-flag.model'
  42
  43 describe('Test users API validators', function () {
  44   const path = '/api/v1/users/'
  45   let userId: number
  46   let rootId: number
  47   let moderatorId: number
  48   let videoId: number
  49   let server: ServerInfo
  50   let serverWithRegistrationDisabled: ServerInfo
  51   let userAccessToken = ''
  52   let moderatorAccessToken = ''
  53   let emailPort: number
  54   let overrideConfig: Object
  55
  56   // ---------------------------------------------------------------
  57
  58   before(async function () {
  59     this.timeout(30000)
  60
  61     const emails: object[] = []
  62     emailPort = await MockSmtpServer.Instance.collectEmails(emails)
  63
  64     overrideConfig = { signup: { limit: 8 } }
  65
  66     {
  67       const res = await Promise.all([
  68         flushAndRunServer(1, overrideConfig),
  69         flushAndRunServer(2)
  70       ])
  71
  72       server = res[0]
  73       serverWithRegistrationDisabled = res[1]
  74
  75       await setAccessTokensToServers([ server ])
  76     }
  77
  78     {
  79       const user = {
  80         username: 'user1',
  81         password: 'my super password'
  82       }
  83
  84       const videoQuota = 42000000
  85       await createUser({
  86         url: server.url,
  87         accessToken: server.accessToken,
  88         username: user.username,
  89         password: user.password,
  90         videoQuota: videoQuota
  91       })
  92       userAccessToken = await userLogin(server, user)
  93     }
  94
  95     {
  96       const moderator = {
  97         username: 'moderator1',
  98         password: 'super password'
  99       }
 100
 101       await createUser({
 102         url: server.url,
 103         accessToken: server.accessToken,
 104         username: moderator.username,
 105         password: moderator.password,
 106         role: UserRole.MODERATOR
 107       })
 108
 109       moderatorAccessToken = await userLogin(server, moderator)
 110     }
 111
 112     {
 113       const moderator = {
 114         username: 'moderator2',
 115         password: 'super password'
 116       }
 117
 118       await createUser({
 119         url: server.url,
 120         accessToken: server.accessToken,
 121         username: moderator.username,
 122         password: moderator.password,
 123         role: UserRole.MODERATOR
 124       })
 125     }
 126
 127     {
 128       const res = await uploadVideo(server.url, server.accessToken, {})
 129       videoId = res.body.video.id
 130     }
 131
 132     {
 133       const res = await getUsersList(server.url, server.accessToken)
 134       const users: User[] = res.body.data
 135
 136       userId = users.find(u => u.username === 'user1').id
 137       rootId = users.find(u => u.username === 'root').id
 138       moderatorId = users.find(u => u.username === 'moderator2').id
 139     }
 140   })
 141
 142   describe('When listing users', function () {
 143     it('Should fail with a bad start pagination', async function () {
 144       await checkBadStartPagination(server.url, path, server.accessToken)
 145     })
 146
 147     it('Should fail with a bad count pagination', async function () {
 148       await checkBadCountPagination(server.url, path, server.accessToken)
 149     })
 150
 151     it('Should fail with an incorrect sort', async function () {
 152       await checkBadSortPagination(server.url, path, server.accessToken)
 153     })
 154
 155     it('Should fail with a non authenticated user', async function () {
 156       await makeGetRequest({
 157         url: server.url,
 158         path,
 159         statusCodeExpected: HttpStatusCode.UNAUTHORIZED_401
 160       })
 161     })
 162
 163     it('Should fail with a non admin user', async function () {
 164       await makeGetRequest({
 165         url: server.url,
 166         path,
 167         token: userAccessToken,
 168         statusCodeExpected: HttpStatusCode.FORBIDDEN_403
 169       })
 170     })
 171   })
 172
 173   describe('When adding a new user', function () {
 174     const baseCorrectParams = {
 175       username: 'user2',
 176       email: 'test@example.com',
 177       password: 'my super password',
 178       videoQuota: -1,
 179       videoQuotaDaily: -1,
 180       role: UserRole.USER,
 181       adminFlags: UserAdminFlag.BYPASS_VIDEO_AUTO_BLACKLIST
 182     }
 183
 184     it('Should fail with a too small username', async function () {
 185       const fields = immutableAssign(baseCorrectParams, { username: '' })
 186
 187       await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
 188     })
 189
 190     it('Should fail with a too long username', async function () {
 191       const fields = immutableAssign(baseCorrectParams, { username: 'super'.repeat(50) })
 192
 193       await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
 194     })
 195
 196     it('Should fail with a not lowercase username', async function () {
 197       const fields = immutableAssign(baseCorrectParams, { username: 'Toto' })
 198
 199       await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
 200     })
 201
 202     it('Should fail with an incorrect username', async function () {
 203       const fields = immutableAssign(baseCorrectParams, { username: 'my username' })
 204
 205       await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
 206     })
 207
 208     it('Should fail with a missing email', async function () {
 209       const fields = omit(baseCorrectParams, 'email')
 210
 211       await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
 212     })
 213
 214     it('Should fail with an invalid email', async function () {
 215       const fields = immutableAssign(baseCorrectParams, { email: 'test_example.com' })
 216
 217       await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
 218     })
 219
 220     it('Should fail with a too small password', async function () {
 221       const fields = immutableAssign(baseCorrectParams, { password: 'bla' })
 222
 223       await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
 224     })
 225
 226     it('Should fail with a too long password', async function () {
 227       const fields = immutableAssign(baseCorrectParams, { password: 'super'.repeat(61) })
 228
 229       await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
 230     })
 231
 232     it('Should fail with empty password and no smtp configured', async function () {
 233       const fields = immutableAssign(baseCorrectParams, { password: '' })
 234
 235       await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
 236     })
 237
 238     it('Should succeed with no password on a server with smtp enabled', async function () {
 239       this.timeout(20000)
 240
 241       killallServers([ server ])
 242
 243       const config = immutableAssign(overrideConfig, {
 244         smtp: {
 245           hostname: 'localhost',
 246           port: emailPort
 247         }
 248       })
 249       await reRunServer(server, config)
 250
 251       const fields = immutableAssign(baseCorrectParams, {
 252         password: '',
 253         username: 'create_password',
 254         email: 'create_password@example.com'
 255       })
 256
 257       await makePostBodyRequest({
 258         url: server.url,
 259         path: path,
 260         token: server.accessToken,
 261         fields,
 262         statusCodeExpected: HttpStatusCode.OK_200
 263       })
 264     })
 265
 266     it('Should fail with invalid admin flags', async function () {
 267       const fields = immutableAssign(baseCorrectParams, { adminFlags: 'toto' })
 268
 269       await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
 270     })
 271
 272     it('Should fail with an non authenticated user', async function () {
 273       await makePostBodyRequest({
 274         url: server.url,
 275         path,
 276         token: 'super token',
 277         fields: baseCorrectParams,
 278         statusCodeExpected: HttpStatusCode.UNAUTHORIZED_401
 279       })
 280     })
 281
 282     it('Should fail if we add a user with the same username', async function () {
 283       const fields = immutableAssign(baseCorrectParams, { username: 'user1' })
 284
 285       await makePostBodyRequest({
 286         url: server.url,
 287         path,
 288         token: server.accessToken,
 289         fields,
 290         statusCodeExpected: HttpStatusCode.CONFLICT_409
 291       })
 292     })
 293
 294     it('Should fail if we add a user with the same email', async function () {
 295       const fields = immutableAssign(baseCorrectParams, { email: 'user1@example.com' })
 296
 297       await makePostBodyRequest({
 298         url: server.url,
 299         path,
 300         token: server.accessToken,
 301         fields,
 302         statusCodeExpected: HttpStatusCode.CONFLICT_409
 303       })
 304     })
 305
 306     it('Should fail without a videoQuota', async function () {
 307       const fields = omit(baseCorrectParams, 'videoQuota')
 308
 309       await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
 310     })
 311
 312     it('Should fail without a videoQuotaDaily', async function () {
 313       const fields = omit(baseCorrectParams, 'videoQuotaDaily')
 314
 315       await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
 316     })
 317
 318     it('Should fail with an invalid videoQuota', async function () {
 319       const fields = immutableAssign(baseCorrectParams, { videoQuota: -5 })
 320
 321       await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
 322     })
 323
 324     it('Should fail with an invalid videoQuotaDaily', async function () {
 325       const fields = immutableAssign(baseCorrectParams, { videoQuotaDaily: -7 })
 326
 327       await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
 328     })
 329
 330     it('Should fail without a user role', async function () {
 331       const fields = omit(baseCorrectParams, 'role')
 332
 333       await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
 334     })
 335
 336     it('Should fail with an invalid user role', async function () {
 337       const fields = immutableAssign(baseCorrectParams, { role: 88989 })
 338
 339       await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
 340     })
 341
 342     it('Should fail with a "peertube" username', async function () {
 343       const fields = immutableAssign(baseCorrectParams, { username: 'peertube' })
 344
 345       await makePostBodyRequest({
 346         url: server.url,
 347         path,
 348         token: server.accessToken,
 349         fields,
 350         statusCodeExpected: HttpStatusCode.CONFLICT_409
 351       })
 352     })
 353
 354     it('Should fail to create a moderator or an admin with a moderator', async function () {
 355       for (const role of [ UserRole.MODERATOR, UserRole.ADMINISTRATOR ]) {
 356         const fields = immutableAssign(baseCorrectParams, { role })
 357
 358         await makePostBodyRequest({
 359           url: server.url,
 360           path,
 361           token: moderatorAccessToken,
 362           fields,
 363           statusCodeExpected: HttpStatusCode.FORBIDDEN_403
 364         })
 365       }
 366     })
 367
 368     it('Should succeed to create a user with a moderator', async function () {
 369       const fields = immutableAssign(baseCorrectParams, { username: 'a4656', email: 'a4656@example.com', role: UserRole.USER })
 370
 371       await makePostBodyRequest({
 372         url: server.url,
 373         path,
 374         token: moderatorAccessToken,
 375         fields,
 376         statusCodeExpected: HttpStatusCode.OK_200
 377       })
 378     })
 379
 380     it('Should succeed with the correct params', async function () {
 381       await makePostBodyRequest({
 382         url: server.url,
 383         path,
 384         token: server.accessToken,
 385         fields: baseCorrectParams,
 386         statusCodeExpected: HttpStatusCode.OK_200
 387       })
 388     })
 389
 390     it('Should fail with a non admin user', async function () {
 391       const user = {
 392         username: 'user1',
 393         password: 'my super password'
 394       }
 395       userAccessToken = await userLogin(server, user)
 396
 397       const fields = {
 398         username: 'user3',
 399         email: 'test@example.com',
 400         password: 'my super password',
 401         videoQuota: 42000000
 402       }
 403       await makePostBodyRequest({ url: server.url, path, token: userAccessToken, fields, statusCodeExpected: HttpStatusCode.FORBIDDEN_403 })
 404     })
 405   })
 406
 407   describe('When updating my account', function () {
 408     it('Should fail with an invalid email attribute', async function () {
 409       const fields = {
 410         email: 'blabla'
 411       }
 412
 413       await makePutBodyRequest({ url: server.url, path: path + 'me', token: server.accessToken, fields })
 414     })
 415
 416     it('Should fail with a too small password', async function () {
 417       const fields = {
 418         currentPassword: 'my super password',
 419         password: 'bla'
 420       }
 421
 422       await makePutBodyRequest({ url: server.url, path: path + 'me', token: userAccessToken, fields })
 423     })
 424
 425     it('Should fail with a too long password', async function () {
 426       const fields = {
 427         currentPassword: 'my super password',
 428         password: 'super'.repeat(61)
 429       }
 430
 431       await makePutBodyRequest({ url: server.url, path: path + 'me', token: userAccessToken, fields })
 432     })
 433
 434     it('Should fail without the current password', async function () {
 435       const fields = {
 436         currentPassword: 'my super password',
 437         password: 'super'.repeat(61)
 438       }
 439
 440       await makePutBodyRequest({ url: server.url, path: path + 'me', token: userAccessToken, fields })
 441     })
 442
 443     it('Should fail with an invalid current password', async function () {
 444       const fields = {
 445         currentPassword: 'my super password fail',
 446         password: 'super'.repeat(61)
 447       }
 448
 449       await makePutBodyRequest({
 450         url: server.url,
 451         path: path + 'me',
 452         token: userAccessToken,
 453         fields,
 454         statusCodeExpected: HttpStatusCode.UNAUTHORIZED_401
 455       })
 456     })
 457
 458     it('Should fail with an invalid NSFW policy attribute', async function () {
 459       const fields = {
 460         nsfwPolicy: 'hello'
 461       }
 462
 463       await makePutBodyRequest({ url: server.url, path: path + 'me', token: userAccessToken, fields })
 464     })
 465
 466     it('Should fail with an invalid autoPlayVideo attribute', async function () {
 467       const fields = {
 468         autoPlayVideo: -1
 469       }
 470
 471       await makePutBodyRequest({ url: server.url, path: path + 'me', token: userAccessToken, fields })
 472     })
 473
 474     it('Should fail with an invalid autoPlayNextVideo attribute', async function () {
 475       const fields = {
 476         autoPlayNextVideo: -1
 477       }
 478
 479       await makePutBodyRequest({ url: server.url, path: path + 'me', token: userAccessToken, fields })
 480     })
 481
 482     it('Should fail with an invalid videosHistoryEnabled attribute', async function () {
 483       const fields = {
 484         videosHistoryEnabled: -1
 485       }
 486
 487       await makePutBodyRequest({ url: server.url, path: path + 'me', token: userAccessToken, fields })
 488     })
 489
 490     it('Should fail with an non authenticated user', async function () {
 491       const fields = {
 492         currentPassword: 'my super password',
 493         password: 'my super password'
 494       }
 495
 496       await makePutBodyRequest({
 497         url: server.url,
 498         path: path + 'me',
 499         token: 'super token',
 500         fields,
 501         statusCodeExpected: HttpStatusCode.UNAUTHORIZED_401
 502       })
 503     })
 504
 505     it('Should fail with a too long description', async function () {
 506       const fields = {
 507         description: 'super'.repeat(201)
 508       }
 509
 510       await makePutBodyRequest({ url: server.url, path: path + 'me', token: userAccessToken, fields })
 511     })
 512
 513     it('Should fail with an invalid videoLanguages attribute', async function () {
 514       {
 515         const fields = {
 516           videoLanguages: 'toto'
 517         }
 518
 519         await makePutBodyRequest({ url: server.url, path: path + 'me', token: userAccessToken, fields })
 520       }
 521
 522       {
 523         const languages = []
 524         for (let i = 0; i < 1000; i++) {
 525           languages.push('fr')
 526         }
 527
 528         const fields = {
 529           videoLanguages: languages
 530         }
 531
 532         await makePutBodyRequest({ url: server.url, path: path + 'me', token: userAccessToken, fields })
 533       }
 534     })
 535
 536     it('Should fail with an invalid theme', async function () {
 537       const fields = { theme: 'invalid' }
 538       await makePutBodyRequest({ url: server.url, path: path + 'me', token: userAccessToken, fields })
 539     })
 540
 541     it('Should fail with an unknown theme', async function () {
 542       const fields = { theme: 'peertube-theme-unknown' }
 543       await makePutBodyRequest({ url: server.url, path: path + 'me', token: userAccessToken, fields })
 544     })
 545
 546     it('Should fail with an invalid noInstanceConfigWarningModal attribute', async function () {
 547       const fields = {
 548         noInstanceConfigWarningModal: -1
 549       }
 550
 551       await makePutBodyRequest({ url: server.url, path: path + 'me', token: userAccessToken, fields })
 552     })
 553
 554     it('Should fail with an invalid noWelcomeModal attribute', async function () {
 555       const fields = {
 556         noWelcomeModal: -1
 557       }
 558
 559       await makePutBodyRequest({ url: server.url, path: path + 'me', token: userAccessToken, fields })
 560     })
 561
 562     it('Should succeed to change password with the correct params', async function () {
 563       const fields = {
 564         currentPassword: 'my super password',
 565         password: 'my super password',
 566         nsfwPolicy: 'blur',
 567         autoPlayVideo: false,
 568         email: 'super_email@example.com',
 569         theme: 'default',
 570         noInstanceConfigWarningModal: true,
 571         noWelcomeModal: true
 572       }
 573
 574       await makePutBodyRequest({
 575         url: server.url,
 576         path: path + 'me',
 577         token: userAccessToken,
 578         fields,
 579         statusCodeExpected: HttpStatusCode.NO_CONTENT_204
 580       })
 581     })
 582
 583     it('Should succeed without password change with the correct params', async function () {
 584       const fields = {
 585         nsfwPolicy: 'blur',
 586         autoPlayVideo: false
 587       }
 588
 589       await makePutBodyRequest({
 590         url: server.url,
 591         path: path + 'me',
 592         token: userAccessToken,
 593         fields,
 594         statusCodeExpected: HttpStatusCode.NO_CONTENT_204
 595       })
 596     })
 597   })
 598
 599   describe('When updating my avatar', function () {
 600     it('Should fail without an incorrect input file', async function () {
 601       const fields = {}
 602       const attaches = {
 603         avatarfile: buildAbsoluteFixturePath('video_short.mp4')
 604       }
 605       await makeUploadRequest({ url: server.url, path: path + '/me/avatar/pick', token: server.accessToken, fields, attaches })
 606     })
 607
 608     it('Should fail with a big file', async function () {
 609       const fields = {}
 610       const attaches = {
 611         avatarfile: buildAbsoluteFixturePath('avatar-big.png')
 612       }
 613       await makeUploadRequest({ url: server.url, path: path + '/me/avatar/pick', token: server.accessToken, fields, attaches })
 614     })
 615
 616     it('Should fail with an unauthenticated user', async function () {
 617       const fields = {}
 618       const attaches = {
 619         avatarfile: buildAbsoluteFixturePath('avatar.png')
 620       }
 621       await makeUploadRequest({
 622         url: server.url,
 623         path: path + '/me/avatar/pick',
 624         fields,
 625         attaches,
 626         statusCodeExpected: HttpStatusCode.UNAUTHORIZED_401
 627       })
 628     })
 629
 630     it('Should succeed with the correct params', async function () {
 631       const fields = {}
 632       const attaches = {
 633         avatarfile: buildAbsoluteFixturePath('avatar.png')
 634       }
 635       await makeUploadRequest({
 636         url: server.url,
 637         path: path + '/me/avatar/pick',
 638         token: server.accessToken,
 639         fields,
 640         attaches,
 641         statusCodeExpected: HttpStatusCode.OK_200
 642       })
 643     })
 644   })
 645
 646   describe('When managing my scoped tokens', function () {
 647
 648     it('Should fail to get my scoped tokens with an non authenticated user', async function () {
 649       await getUserScopedTokens(server.url, null, HttpStatusCode.UNAUTHORIZED_401)
 650     })
 651
 652     it('Should fail to get my scoped tokens with a bad token', async function () {
 653       await getUserScopedTokens(server.url, 'bad', HttpStatusCode.UNAUTHORIZED_401)
 654
 655     })
 656
 657     it('Should succeed to get my scoped tokens', async function () {
 658       await getUserScopedTokens(server.url, server.accessToken)
 659     })
 660
 661     it('Should fail to renew my scoped tokens with an non authenticated user', async function () {
 662       await renewUserScopedTokens(server.url, null, HttpStatusCode.UNAUTHORIZED_401)
 663     })
 664
 665     it('Should fail to renew my scoped tokens with a bad token', async function () {
 666       await renewUserScopedTokens(server.url, 'bad', HttpStatusCode.UNAUTHORIZED_401)
 667     })
 668
 669     it('Should succeed to renew my scoped tokens', async function () {
 670       await renewUserScopedTokens(server.url, server.accessToken)
 671     })
 672   })
 673
 674   describe('When getting a user', function () {
 675
 676     it('Should fail with an non authenticated user', async function () {
 677       await makeGetRequest({
 678         url: server.url,
 679         path: path + userId,
 680         token: 'super token',
 681         statusCodeExpected: HttpStatusCode.UNAUTHORIZED_401
 682       })
 683     })
 684
 685     it('Should fail with a non admin user', async function () {
 686       await makeGetRequest({ url: server.url, path, token: userAccessToken, statusCodeExpected: HttpStatusCode.FORBIDDEN_403 })
 687     })
 688
 689     it('Should succeed with the correct params', async function () {
 690       await makeGetRequest({ url: server.url, path: path + userId, token: server.accessToken, statusCodeExpected: HttpStatusCode.OK_200 })
 691     })
 692   })
 693
 694   describe('When updating a user', function () {
 695
 696     it('Should fail with an invalid email attribute', async function () {
 697       const fields = {
 698         email: 'blabla'
 699       }
 700
 701       await makePutBodyRequest({ url: server.url, path: path + userId, token: server.accessToken, fields })
 702     })
 703
 704     it('Should fail with an invalid emailVerified attribute', async function () {
 705       const fields = {
 706         emailVerified: 'yes'
 707       }
 708
 709       await makePutBodyRequest({ url: server.url, path: path + userId, token: server.accessToken, fields })
 710     })
 711
 712     it('Should fail with an invalid videoQuota attribute', async function () {
 713       const fields = {
 714         videoQuota: -90
 715       }
 716
 717       await makePutBodyRequest({ url: server.url, path: path + userId, token: server.accessToken, fields })
 718     })
 719
 720     it('Should fail with an invalid user role attribute', async function () {
 721       const fields = {
 722         role: 54878
 723       }
 724
 725       await makePutBodyRequest({ url: server.url, path: path + userId, token: server.accessToken, fields })
 726     })
 727
 728     it('Should fail with a too small password', async function () {
 729       const fields = {
 730         currentPassword: 'my super password',
 731         password: 'bla'
 732       }
 733
 734       await makePutBodyRequest({ url: server.url, path: path + userId, token: server.accessToken, fields })
 735     })
 736
 737     it('Should fail with a too long password', async function () {
 738       const fields = {
 739         currentPassword: 'my super password',
 740         password: 'super'.repeat(61)
 741       }
 742
 743       await makePutBodyRequest({ url: server.url, path: path + userId, token: server.accessToken, fields })
 744     })
 745
 746     it('Should fail with an non authenticated user', async function () {
 747       const fields = {
 748         videoQuota: 42
 749       }
 750
 751       await makePutBodyRequest({
 752         url: server.url,
 753         path: path + userId,
 754         token: 'super token',
 755         fields,
 756         statusCodeExpected: HttpStatusCode.UNAUTHORIZED_401
 757       })
 758     })
 759
 760     it('Should fail when updating root role', async function () {
 761       const fields = {
 762         role: UserRole.MODERATOR
 763       }
 764
 765       await makePutBodyRequest({ url: server.url, path: path + rootId, token: server.accessToken, fields })
 766     })
 767
 768     it('Should fail with invalid admin flags', async function () {
 769       const fields = { adminFlags: 'toto' }
 770
 771       await makePutBodyRequest({ url: server.url, path, token: server.accessToken, fields })
 772     })
 773
 774     it('Should fail to update an admin with a moderator', async function () {
 775       const fields = {
 776         videoQuota: 42
 777       }
 778
 779       await makePutBodyRequest({
 780         url: server.url,
 781         path: path + moderatorId,
 782         token: moderatorAccessToken,
 783         fields,
 784         statusCodeExpected: HttpStatusCode.FORBIDDEN_403
 785       })
 786     })
 787
 788     it('Should succeed to update a user with a moderator', async function () {
 789       const fields = {
 790         videoQuota: 42
 791       }
 792
 793       await makePutBodyRequest({
 794         url: server.url,
 795         path: path + userId,
 796         token: moderatorAccessToken,
 797         fields,
 798         statusCodeExpected: HttpStatusCode.NO_CONTENT_204
 799       })
 800     })
 801
 802     it('Should succeed with the correct params', async function () {
 803       const fields = {
 804         email: 'email@example.com',
 805         emailVerified: true,
 806         videoQuota: 42,
 807         role: UserRole.USER
 808       }
 809
 810       await makePutBodyRequest({
 811         url: server.url,
 812         path: path + userId,
 813         token: server.accessToken,
 814         fields,
 815         statusCodeExpected: HttpStatusCode.NO_CONTENT_204
 816       })
 817     })
 818   })
 819
 820   describe('When getting my information', function () {
 821     it('Should fail with a non authenticated user', async function () {
 822       await getMyUserInformation(server.url, 'fake_token', HttpStatusCode.UNAUTHORIZED_401)
 823     })
 824
 825     it('Should success with the correct parameters', async function () {
 826       await getMyUserInformation(server.url, userAccessToken)
 827     })
 828   })
 829
 830   describe('When getting my video rating', function () {
 831     it('Should fail with a non authenticated user', async function () {
 832       await getMyUserVideoRating(server.url, 'fake_token', videoId, HttpStatusCode.UNAUTHORIZED_401)
 833     })
 834
 835     it('Should fail with an incorrect video uuid', async function () {
 836       await getMyUserVideoRating(server.url, server.accessToken, 'blabla', HttpStatusCode.BAD_REQUEST_400)
 837     })
 838
 839     it('Should fail with an unknown video', async function () {
 840       await getMyUserVideoRating(server.url, server.accessToken, '4da6fde3-88f7-4d16-b119-108df5630b06', HttpStatusCode.NOT_FOUND_404)
 841     })
 842
 843     it('Should succeed with the correct parameters', async function () {
 844       await getMyUserVideoRating(server.url, server.accessToken, videoId)
 845     })
 846   })
 847
 848   describe('When retrieving my global ratings', function () {
 849     const path = '/api/v1/accounts/user1/ratings'
 850
 851     it('Should fail with a bad start pagination', async function () {
 852       await checkBadStartPagination(server.url, path, userAccessToken)
 853     })
 854
 855     it('Should fail with a bad count pagination', async function () {
 856       await checkBadCountPagination(server.url, path, userAccessToken)
 857     })
 858
 859     it('Should fail with an incorrect sort', async function () {
 860       await checkBadSortPagination(server.url, path, userAccessToken)
 861     })
 862
 863     it('Should fail with a unauthenticated user', async function () {
 864       await makeGetRequest({ url: server.url, path, statusCodeExpected: HttpStatusCode.UNAUTHORIZED_401 })
 865     })
 866
 867     it('Should fail with a another user', async function () {
 868       await makeGetRequest({ url: server.url, path, token: server.accessToken, statusCodeExpected: HttpStatusCode.FORBIDDEN_403 })
 869     })
 870
 871     it('Should fail with a bad type', async function () {
 872       await makeGetRequest({
 873         url: server.url,
 874         path,
 875         token: userAccessToken,
 876         query: { rating: 'toto ' },
 877         statusCodeExpected: HttpStatusCode.BAD_REQUEST_400
 878       })
 879     })
 880
 881     it('Should succeed with the correct params', async function () {
 882       await makeGetRequest({ url: server.url, path, token: userAccessToken, statusCodeExpected: HttpStatusCode.OK_200 })
 883     })
 884   })
 885
 886   describe('When blocking/unblocking/removing user', function () {
 887     it('Should fail with an incorrect id', async function () {
 888       await removeUser(server.url, 'blabla', server.accessToken, HttpStatusCode.BAD_REQUEST_400)
 889       await blockUser(server.url, 'blabla', server.accessToken, HttpStatusCode.BAD_REQUEST_400)
 890       await unblockUser(server.url, 'blabla', server.accessToken, HttpStatusCode.BAD_REQUEST_400)
 891     })
 892
 893     it('Should fail with the root user', async function () {
 894       await removeUser(server.url, rootId, server.accessToken, HttpStatusCode.BAD_REQUEST_400)
 895       await blockUser(server.url, rootId, server.accessToken, HttpStatusCode.BAD_REQUEST_400)
 896       await unblockUser(server.url, rootId, server.accessToken, HttpStatusCode.BAD_REQUEST_400)
 897     })
 898
 899     it('Should return 404 with a non existing id', async function () {
 900       await removeUser(server.url, 4545454, server.accessToken, HttpStatusCode.NOT_FOUND_404)
 901       await blockUser(server.url, 4545454, server.accessToken, HttpStatusCode.NOT_FOUND_404)
 902       await unblockUser(server.url, 4545454, server.accessToken, HttpStatusCode.NOT_FOUND_404)
 903     })
 904
 905     it('Should fail with a non admin user', async function () {
 906       await removeUser(server.url, userId, userAccessToken, HttpStatusCode.FORBIDDEN_403)
 907       await blockUser(server.url, userId, userAccessToken, HttpStatusCode.FORBIDDEN_403)
 908       await unblockUser(server.url, userId, userAccessToken, HttpStatusCode.FORBIDDEN_403)
 909     })
 910
 911     it('Should fail on a moderator with a moderator', async function () {
 912       await removeUser(server.url, moderatorId, moderatorAccessToken, HttpStatusCode.FORBIDDEN_403)
 913       await blockUser(server.url, moderatorId, moderatorAccessToken, HttpStatusCode.FORBIDDEN_403)
 914       await unblockUser(server.url, moderatorId, moderatorAccessToken, HttpStatusCode.FORBIDDEN_403)
 915     })
 916
 917     it('Should succeed on a user with a moderator', async function () {
 918       await blockUser(server.url, userId, moderatorAccessToken)
 919       await unblockUser(server.url, userId, moderatorAccessToken)
 920     })
 921   })
 922
 923   describe('When deleting our account', function () {
 924     it('Should fail with with the root account', async function () {
 925       await deleteMe(server.url, server.accessToken, HttpStatusCode.BAD_REQUEST_400)
 926     })
 927   })
 928
 929   describe('When registering a new user', function () {
 930     const registrationPath = path + '/register'
 931     const baseCorrectParams = {
 932       username: 'user3',
 933       displayName: 'super user',
 934       email: 'test3@example.com',
 935       password: 'my super password'
 936     }
 937
 938     it('Should fail with a too small username', async function () {
 939       const fields = immutableAssign(baseCorrectParams, { username: '' })
 940
 941       await makePostBodyRequest({ url: server.url, path: registrationPath, token: server.accessToken, fields })
 942     })
 943
 944     it('Should fail with a too long username', async function () {
 945       const fields = immutableAssign(baseCorrectParams, { username: 'super'.repeat(50) })
 946
 947       await makePostBodyRequest({ url: server.url, path: registrationPath, token: server.accessToken, fields })
 948     })
 949
 950     it('Should fail with an incorrect username', async function () {
 951       const fields = immutableAssign(baseCorrectParams, { username: 'my username' })
 952
 953       await makePostBodyRequest({ url: server.url, path: registrationPath, token: server.accessToken, fields })
 954     })
 955
 956     it('Should fail with a missing email', async function () {
 957       const fields = omit(baseCorrectParams, 'email')
 958
 959       await makePostBodyRequest({ url: server.url, path: registrationPath, token: server.accessToken, fields })
 960     })
 961
 962     it('Should fail with an invalid email', async function () {
 963       const fields = immutableAssign(baseCorrectParams, { email: 'test_example.com' })
 964
 965       await makePostBodyRequest({ url: server.url, path: registrationPath, token: server.accessToken, fields })
 966     })
 967
 968     it('Should fail with a too small password', async function () {
 969       const fields = immutableAssign(baseCorrectParams, { password: 'bla' })
 970
 971       await makePostBodyRequest({ url: server.url, path: registrationPath, token: server.accessToken, fields })
 972     })
 973
 974     it('Should fail with a too long password', async function () {
 975       const fields = immutableAssign(baseCorrectParams, { password: 'super'.repeat(61) })
 976
 977       await makePostBodyRequest({ url: server.url, path: registrationPath, token: server.accessToken, fields })
 978     })
 979
 980     it('Should fail if we register a user with the same username', async function () {
 981       const fields = immutableAssign(baseCorrectParams, { username: 'root' })
 982
 983       await makePostBodyRequest({
 984         url: server.url,
 985         path: registrationPath,
 986         token: server.accessToken,
 987         fields,
 988         statusCodeExpected: HttpStatusCode.CONFLICT_409
 989       })
 990     })
 991
 992     it('Should fail with a "peertube" username', async function () {
 993       const fields = immutableAssign(baseCorrectParams, { username: 'peertube' })
 994
 995       await makePostBodyRequest({
 996         url: server.url,
 997         path: registrationPath,
 998         token: server.accessToken,
 999         fields,
1000         statusCodeExpected: HttpStatusCode.CONFLICT_409
1001       })
1002     })
1003
1004     it('Should fail if we register a user with the same email', async function () {
1005       const fields = immutableAssign(baseCorrectParams, { email: 'admin' + server.internalServerNumber + '@example.com' })
1006
1007       await makePostBodyRequest({
1008         url: server.url,
1009         path: registrationPath,
1010         token: server.accessToken,
1011         fields,
1012         statusCodeExpected: HttpStatusCode.CONFLICT_409
1013       })
1014     })
1015
1016     it('Should fail with a bad display name', async function () {
1017       const fields = immutableAssign(baseCorrectParams, { displayName: 'a'.repeat(150) })
1018
1019       await makePostBodyRequest({ url: server.url, path: registrationPath, token: server.accessToken, fields })
1020     })
1021
1022     it('Should fail with a bad channel name', async function () {
1023       const fields = immutableAssign(baseCorrectParams, { channel: { name: '[]azf', displayName: 'toto' } })
1024
1025       await makePostBodyRequest({ url: server.url, path: registrationPath, token: server.accessToken, fields })
1026     })
1027
1028     it('Should fail with a bad channel display name', async function () {
1029       const fields = immutableAssign(baseCorrectParams, { channel: { name: 'toto', displayName: '' } })
1030
1031       await makePostBodyRequest({ url: server.url, path: registrationPath, token: server.accessToken, fields })
1032     })
1033
1034     it('Should fail with a channel name that is the same as username', async function () {
1035       const source = { username: 'super_user', channel: { name: 'super_user', displayName: 'display name' } }
1036       const fields = immutableAssign(baseCorrectParams, source)
1037
1038       await makePostBodyRequest({ url: server.url, path: registrationPath, token: server.accessToken, fields })
1039     })
1040
1041     it('Should fail with an existing channel', async function () {
1042       const videoChannelAttributesArg = { name: 'existing_channel', displayName: 'hello', description: 'super description' }
1043       await addVideoChannel(server.url, server.accessToken, videoChannelAttributesArg)
1044
1045       const fields = immutableAssign(baseCorrectParams, { channel: { name: 'existing_channel', displayName: 'toto' } })
1046
1047       await makePostBodyRequest({
1048         url: server.url,
1049         path: registrationPath,
1050         token: server.accessToken,
1051         fields,
1052         statusCodeExpected: HttpStatusCode.CONFLICT_409
1053       })
1054     })
1055
1056     it('Should succeed with the correct params', async function () {
1057       const fields = immutableAssign(baseCorrectParams, { channel: { name: 'super_channel', displayName: 'toto' } })
1058
1059       await makePostBodyRequest({
1060         url: server.url,
1061         path: registrationPath,
1062         token: server.accessToken,
1063         fields: fields,
1064         statusCodeExpected: HttpStatusCode.NO_CONTENT_204
1065       })
1066     })
1067
1068     it('Should fail on a server with registration disabled', async function () {
1069       const fields = {
1070         username: 'user4',
1071         email: 'test4@example.com',
1072         password: 'my super password 4'
1073       }
1074
1075       await makePostBodyRequest({
1076         url: serverWithRegistrationDisabled.url,
1077         path: registrationPath,
1078         token: serverWithRegistrationDisabled.accessToken,
1079         fields,
1080         statusCodeExpected: HttpStatusCode.FORBIDDEN_403
1081       })
1082     })
1083   })
1084
1085   describe('When registering multiple users on a server with users limit', function () {
1086     it('Should fail when after 3 registrations', async function () {
1087       await registerUser(server.url, 'user42', 'super password', HttpStatusCode.FORBIDDEN_403)
1088     })
1089   })
1090
1091   describe('When asking a password reset', function () {
1092     const path = '/api/v1/users/ask-reset-password'
1093
1094     it('Should fail with a missing email', async function () {
1095       const fields = {}
1096
1097       await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
1098     })
1099
1100     it('Should fail with an invalid email', async function () {
1101       const fields = { email: 'hello' }
1102
1103       await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
1104     })
1105
1106     it('Should success with the correct params', async function () {
1107       const fields = { email: 'admin@example.com' }
1108
1109       await makePostBodyRequest({
1110         url: server.url,
1111         path,
1112         token: server.accessToken,
1113         fields,
1114         statusCodeExpected: HttpStatusCode.NO_CONTENT_204
1115       })
1116     })
1117   })
1118
1119   describe('When asking for an account verification email', function () {
1120     const path = '/api/v1/users/ask-send-verify-email'
1121
1122     it('Should fail with a missing email', async function () {
1123       const fields = {}
1124
1125       await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
1126     })
1127
1128     it('Should fail with an invalid email', async function () {
1129       const fields = { email: 'hello' }
1130
1131       await makePostBodyRequest({ url: server.url, path, token: server.accessToken, fields })
1132     })
1133
1134     it('Should succeed with the correct params', async function () {
1135       const fields = { email: 'admin@example.com' }
1136
1137       await makePostBodyRequest({
1138         url: server.url,
1139         path,
1140         token: server.accessToken,
1141         fields,
1142         statusCodeExpected: HttpStatusCode.NO_CONTENT_204
1143       })
1144     })
1145   })
1146
1147   after(async function () {
1148     MockSmtpServer.Instance.kill()
1149
1150     await cleanupTests([ server, serverWithRegistrationDisabled ])
1151   })
1152 })