Don't leak unlisted videos in comments feed

[github/Chocobozzz/PeerTube.git] / server / tests / feeds / feeds.ts

diff --git a/server/tests/feeds/feeds.ts b/server/tests/feeds/feeds.ts
index 0dcdf09cf1bdedcd986b711871fd3545389b0920..d978123cfc827449b0a22e28ae4da90f74146862 100644 (file)
--- a/server/tests/feeds/feeds.ts
+++ b/server/tests/feeds/feeds.ts
@@ -1,4 +1,4 @@
-/* tslint:disable:no-unused-expression */
+/* eslint-disable @typescript-eslint/no-unused-expressions,@typescript-eslint/require-await */
 
 import * as chai from 'chai'
 import 'mocha'
@@ -7,18 +7,19 @@ import {
   createUser,
   doubleFollow,
   flushAndRunMultipleServers,
-  flushTests,
-  getJSONfeed, getMyUserInformation,
+  getJSONfeed,
+  getMyUserInformation,
   getXMLfeed,
-  killallServers,
   ServerInfo,
   setAccessTokensToServers,
-  uploadVideo, userLogin
+  uploadVideo,
+  userLogin
 } from '../../../shared/extra-utils'
 import * as libxmljs from 'libxmljs'
 import { addVideoCommentThread } from '../../../shared/extra-utils/videos/video-comments'
 import { waitJobs } from '../../../shared/extra-utils/server/jobs'
 import { User } from '../../../shared/models/users'
+import { VideoPrivacy } from '@shared/models'
 
 chai.use(require('chai-xml'))
 chai.use(require('chai-json-schema'))
@@ -28,10 +29,10 @@ const expect = chai.expect
 describe('Test syndication feeds', () => {
   let servers: ServerInfo[] = []
   let userAccessToken: string
-  let rootAccountUUID: string
-  let rootChannelUUID: string
-  let userAccountUUID: string
-  let userChannelUUID: string
+  let rootAccountId: number
+  let rootChannelId: number
+  let userAccountId: number
+  let userChannelId: number
 
   before(async function () {
     this.timeout(120000)
@@ -45,23 +46,23 @@ describe('Test syndication feeds', () => {
     {
       const res = await getMyUserInformation(servers[0].url, servers[0].accessToken)
       const user: User = res.body
-      rootAccountUUID = user.account.uuid
-      rootChannelUUID = user.videoChannels[0].uuid
+      rootAccountId = user.account.id
+      rootChannelId = user.videoChannels[0].id
     }
 
     {
       const attr = { username: 'john', password: 'password' }
-      await createUser({ url: servers[ 0 ].url, accessToken: servers[ 0 ].accessToken, username: attr.username, password: attr.password })
+      await createUser({ url: servers[0].url, accessToken: servers[0].accessToken, username: attr.username, password: attr.password })
       userAccessToken = await userLogin(servers[0], attr)
 
       const res = await getMyUserInformation(servers[0].url, userAccessToken)
       const user: User = res.body
-      userAccountUUID = user.account.uuid
-      userChannelUUID = user.videoChannels[0].uuid
+      userAccountId = user.account.id
+      userChannelId = user.videoChannels[0].id
     }
 
     {
-      await uploadVideo(servers[ 0 ].url, userAccessToken, { name: 'user video' })
+      await uploadVideo(servers[0].url, userAccessToken, { name: 'user video' })
     }
 
     {
@@ -70,11 +71,19 @@ describe('Test syndication feeds', () => {
         description: 'my super description for server 1',
         fixture: 'video_short.webm'
       }
-      const res = await uploadVideo(servers[ 0 ].url, servers[ 0 ].accessToken, videoAttributes)
+      const res = await uploadVideo(servers[0].url, servers[0].accessToken, videoAttributes)
       const videoId = res.body.video.id
 
-      await addVideoCommentThread(servers[ 0 ].url, servers[ 0 ].accessToken, videoId, 'super comment 1')
-      await addVideoCommentThread(servers[ 0 ].url, servers[ 0 ].accessToken, videoId, 'super comment 2')
+      await addVideoCommentThread(servers[0].url, servers[0].accessToken, videoId, 'super comment 1')
+      await addVideoCommentThread(servers[0].url, servers[0].accessToken, videoId, 'super comment 2')
+    }
+
+    {
+      const videoAttributes = { name: 'unlisted video', privacy: VideoPrivacy.UNLISTED }
+      const res = await uploadVideo(servers[0].url, servers[0].accessToken, videoAttributes)
+      const videoId = res.body.video.id
+
+      await addVideoCommentThread(servers[0].url, servers[0].accessToken, videoId, 'comment on unlisted video')
     }
 
     await waitJobs(servers)
@@ -84,18 +93,18 @@ describe('Test syndication feeds', () => {
 
     it('Should be well formed XML (covers RSS 2.0 and ATOM 1.0 endpoints)', async function () {
       for (const feed of [ 'video-comments' as 'video-comments', 'videos' as 'videos' ]) {
-        const rss = await getXMLfeed(servers[ 0 ].url, feed)
+        const rss = await getXMLfeed(servers[0].url, feed)
         expect(rss.text).xml.to.be.valid()
 
-        const atom = await getXMLfeed(servers[ 0 ].url, feed, 'atom')
+        const atom = await getXMLfeed(servers[0].url, feed, 'atom')
         expect(atom.text).xml.to.be.valid()
       }
     })
 
     it('Should be well formed JSON (covers JSON feed 1.0 endpoint)', async function () {
       for (const feed of [ 'video-comments' as 'video-comments', 'videos' as 'videos' ]) {
-        const json = await getJSONfeed(servers[ 0 ].url, feed)
-        expect(JSON.parse(json.text)).to.be.jsonSchema({ 'type': 'object' })
+        const json = await getJSONfeed(servers[0].url, feed)
+        expect(JSON.parse(json.text)).to.be.jsonSchema({ type: 'object' })
       }
     })
   })
@@ -118,92 +127,93 @@ describe('Test syndication feeds', () => {
         const json = await getJSONfeed(server.url, 'videos')
         const jsonObj = JSON.parse(json.text)
         expect(jsonObj.items.length).to.be.equal(2)
-        expect(jsonObj.items[ 0 ].attachments).to.exist
-        expect(jsonObj.items[ 0 ].attachments.length).to.be.eq(1)
-        expect(jsonObj.items[ 0 ].attachments[ 0 ].mime_type).to.be.eq('application/x-bittorrent')
-        expect(jsonObj.items[ 0 ].attachments[ 0 ].size_in_bytes).to.be.eq(218910)
-        expect(jsonObj.items[ 0 ].attachments[ 0 ].url).to.contain('720.torrent')
+        expect(jsonObj.items[0].attachments).to.exist
+        expect(jsonObj.items[0].attachments.length).to.be.eq(1)
+        expect(jsonObj.items[0].attachments[0].mime_type).to.be.eq('application/x-bittorrent')
+        expect(jsonObj.items[0].attachments[0].size_in_bytes).to.be.eq(218910)
+        expect(jsonObj.items[0].attachments[0].url).to.contain('720.torrent')
       }
     })
 
     it('Should filter by account', async function () {
+      {
+        const json = await getJSONfeed(servers[0].url, 'videos', { accountId: rootAccountId })
+        const jsonObj = JSON.parse(json.text)
+        expect(jsonObj.items.length).to.be.equal(1)
+        expect(jsonObj.items[0].title).to.equal('my super name for server 1')
+        expect(jsonObj.items[0].author.name).to.equal('root')
+      }
+
+      {
+        const json = await getJSONfeed(servers[0].url, 'videos', { accountId: userAccountId })
+        const jsonObj = JSON.parse(json.text)
+        expect(jsonObj.items.length).to.be.equal(1)
+        expect(jsonObj.items[0].title).to.equal('user video')
+        expect(jsonObj.items[0].author.name).to.equal('john')
+      }
+
       for (const server of servers) {
         {
-          const json = await getJSONfeed(server.url, 'videos', { accountId: rootAccountUUID })
+          const json = await getJSONfeed(server.url, 'videos', { accountName: 'root@localhost:' + servers[0].port })
           const jsonObj = JSON.parse(json.text)
           expect(jsonObj.items.length).to.be.equal(1)
-          expect(jsonObj.items[ 0 ].title).to.equal('my super name for server 1')
-          expect(jsonObj.items[ 0 ].author.name).to.equal('root')
+          expect(jsonObj.items[0].title).to.equal('my super name for server 1')
         }
 
         {
-          const json = await getJSONfeed(server.url, 'videos', { accountId: userAccountUUID })
+          const json = await getJSONfeed(server.url, 'videos', { accountName: 'john@localhost:' + servers[0].port })
           const jsonObj = JSON.parse(json.text)
           expect(jsonObj.items.length).to.be.equal(1)
-          expect(jsonObj.items[ 0 ].title).to.equal('user video')
-          expect(jsonObj.items[ 0 ].author.name).to.equal('john')
+          expect(jsonObj.items[0].title).to.equal('user video')
         }
       }
+    })
 
+    it('Should filter by video channel', async function () {
       {
-        const json = await getJSONfeed(servers[0].url, 'videos', { accountName: 'root' })
+        const json = await getJSONfeed(servers[0].url, 'videos', { videoChannelId: rootChannelId })
         const jsonObj = JSON.parse(json.text)
         expect(jsonObj.items.length).to.be.equal(1)
-        expect(jsonObj.items[ 0 ].title).to.equal('my super name for server 1')
+        expect(jsonObj.items[0].title).to.equal('my super name for server 1')
+        expect(jsonObj.items[0].author.name).to.equal('root')
       }
 
       {
-        const json = await getJSONfeed(servers[0].url, 'videos', { accountName: 'john' })
+        const json = await getJSONfeed(servers[0].url, 'videos', { videoChannelId: userChannelId })
         const jsonObj = JSON.parse(json.text)
         expect(jsonObj.items.length).to.be.equal(1)
-        expect(jsonObj.items[ 0 ].title).to.equal('user video')
+        expect(jsonObj.items[0].title).to.equal('user video')
+        expect(jsonObj.items[0].author.name).to.equal('john')
       }
-    })
 
-    it('Should filter by video channel', async function () {
       for (const server of servers) {
         {
-          const json = await getJSONfeed(server.url, 'videos', { videoChannelId: rootChannelUUID })
+          const json = await getJSONfeed(server.url, 'videos', { videoChannelName: 'root_channel@localhost:' + servers[0].port })
           const jsonObj = JSON.parse(json.text)
           expect(jsonObj.items.length).to.be.equal(1)
-          expect(jsonObj.items[ 0 ].title).to.equal('my super name for server 1')
-          expect(jsonObj.items[ 0 ].author.name).to.equal('root')
+          expect(jsonObj.items[0].title).to.equal('my super name for server 1')
         }
 
         {
-          const json = await getJSONfeed(server.url, 'videos', { videoChannelId: userChannelUUID })
+          const json = await getJSONfeed(server.url, 'videos', { videoChannelName: 'john_channel@localhost:' + servers[0].port })
           const jsonObj = JSON.parse(json.text)
           expect(jsonObj.items.length).to.be.equal(1)
-          expect(jsonObj.items[ 0 ].title).to.equal('user video')
-          expect(jsonObj.items[ 0 ].author.name).to.equal('john')
+          expect(jsonObj.items[0].title).to.equal('user video')
         }
       }
-
-      {
-        const json = await getJSONfeed(servers[0].url, 'videos', { videoChannelName: 'root_channel' })
-        const jsonObj = JSON.parse(json.text)
-        expect(jsonObj.items.length).to.be.equal(1)
-        expect(jsonObj.items[ 0 ].title).to.equal('my super name for server 1')
-      }
-
-      {
-        const json = await getJSONfeed(servers[0].url, 'videos', { videoChannelName: 'john_channel' })
-        const jsonObj = JSON.parse(json.text)
-        expect(jsonObj.items.length).to.be.equal(1)
-        expect(jsonObj.items[ 0 ].title).to.equal('user video')
-      }
     })
   })
 
   describe('Video comments feed', function () {
-    it('Should contain valid comments (covers JSON feed 1.0 endpoint)', async function () {
+
+    it('Should contain valid comments (covers JSON feed 1.0 endpoint) and not from unlisted videos', async function () {
       for (const server of servers) {
         const json = await getJSONfeed(server.url, 'video-comments')
 
         const jsonObj = JSON.parse(json.text)
         expect(jsonObj.items.length).to.be.equal(2)
-        expect(jsonObj.items[ 0 ].html_content).to.equal('super comment 2')
-        expect(jsonObj.items[ 1 ].html_content).to.equal('super comment 1')
+        expect(jsonObj.items[0].html_content).to.equal('super comment 2')
+        expect(jsonObj.items[1].html_content).to.equal('super comment 1')
       }
     })
   })