X-Git-Url: https://git.immae.eu/?a=blobdiff_plain;f=server%2Ftests%2Fapi%2Fcheck-params%2Fvideo-comments.ts;h=55019884487824479dfccc4327131e1a0ae7fbc9;hb=8a6828b1664ce3fc535d23c54ed22bab35588d06;hp=05cf61cba2e80d277b5d14872f1dbeb7a24be497;hpb=bf54587a3e2ad9c2c186828f2a5682b91ee2cc00;p=github%2FChocobozzz%2FPeerTube.git

diff --git a/server/tests/api/check-params/video-comments.ts b/server/tests/api/check-params/video-comments.ts
index 05cf61cba..550198844 100644
--- a/server/tests/api/check-params/video-comments.ts
+++ b/server/tests/api/check-params/video-comments.ts
@@ -1,11 +1,9 @@
 /* eslint-disable @typescript-eslint/no-unused-expressions,@typescript-eslint/require-await */
 
-import 'mocha'
-import * as chai from 'chai'
+import { expect } from 'chai'
+import { checkBadCountPagination, checkBadSortPagination, checkBadStartPagination } from '@server/tests/shared'
+import { HttpStatusCode, VideoCreateResult, VideoPrivacy } from '@shared/models'
 import {
-  checkBadCountPagination,
-  checkBadSortPagination,
-  checkBadStartPagination,
   cleanupTests,
   createSingleServer,
   makeDeleteRequest,
@@ -14,18 +12,21 @@ import {
   PeerTubeServer,
   setAccessTokensToServers
 } from '@shared/server-commands'
-import { HttpStatusCode, VideoCreateResult } from '@shared/models'
-
-const expect = chai.expect
 
 describe('Test video comments API validator', function () {
   let pathThread: string
   let pathComment: string
+
   let server: PeerTubeServer
+
   let video: VideoCreateResult
+
   let userAccessToken: string
   let userAccessToken2: string
+
   let commentId: number
+  let privateCommentId: number
+  let privateVideo: VideoCreateResult
 
   // ---------------------------------------------------------------
 
@@ -41,12 +42,21 @@ describe('Test video comments API validator', function () {
       pathThread = '/api/v1/videos/' + video.uuid + '/comment-threads'
     }
 
+    {
+      privateVideo = await server.videos.upload({ attributes: { privacy: VideoPrivacy.PRIVATE } })
+    }
+
     {
       const created = await server.comments.createThread({ videoId: video.uuid, text: 'coucou' })
       commentId = created.id
       pathComment = '/api/v1/videos/' + video.uuid + '/comments/' + commentId
     }
 
+    {
+      const created = await server.comments.createThread({ videoId: privateVideo.uuid, text: 'coucou' })
+      privateCommentId = created.id
+    }
+
     {
       const user = { username: 'user1', password: 'my super password' }
       await server.users.create({ username: user.username, password: user.password })
@@ -80,6 +90,32 @@ describe('Test video comments API validator', function () {
         expectedStatus: HttpStatusCode.NOT_FOUND_404
       })
     })
+
+    it('Should fail with a private video without token', async function () {
+      await makeGetRequest({
+        url: server.url,
+        path: '/api/v1/videos/' + privateVideo.shortUUID + '/comment-threads',
+        expectedStatus: HttpStatusCode.UNAUTHORIZED_401
+      })
+    })
+
+    it('Should fail with another user token', async function () {
+      await makeGetRequest({
+        url: server.url,
+        token: userAccessToken,
+        path: '/api/v1/videos/' + privateVideo.shortUUID + '/comment-threads',
+        expectedStatus: HttpStatusCode.FORBIDDEN_403
+      })
+    })
+
+    it('Should succeed with the correct params', async function () {
+      await makeGetRequest({
+        url: server.url,
+        token: server.accessToken,
+        path: '/api/v1/videos/' + privateVideo.shortUUID + '/comment-threads',
+        expectedStatus: HttpStatusCode.OK_200
+      })
+    })
   })
 
   describe('When listing comments of a thread', function () {
@@ -99,7 +135,31 @@ describe('Test video comments API validator', function () {
       })
     })
 
+    it('Should fail with a private video without token', async function () {
+      await makeGetRequest({
+        url: server.url,
+        path: '/api/v1/videos/' + privateVideo.shortUUID + '/comment-threads/' + privateCommentId,
+        expectedStatus: HttpStatusCode.UNAUTHORIZED_401
+      })
+    })
+
+    it('Should fail with another user token', async function () {
+      await makeGetRequest({
+        url: server.url,
+        token: userAccessToken,
+        path: '/api/v1/videos/' + privateVideo.shortUUID + '/comment-threads/' + privateCommentId,
+        expectedStatus: HttpStatusCode.FORBIDDEN_403
+      })
+    })
+
     it('Should success with the correct params', async function () {
+      await makeGetRequest({
+        url: server.url,
+        token: server.accessToken,
+        path: '/api/v1/videos/' + privateVideo.shortUUID + '/comment-threads/' + privateCommentId,
+        expectedStatus: HttpStatusCode.OK_200
+      })
+
       await makeGetRequest({
         url: server.url,
         path: '/api/v1/videos/' + video.shortUUID + '/comment-threads/' + commentId,
@@ -144,9 +204,8 @@ describe('Test video comments API validator', function () {
 
     it('Should fail with an incorrect video', async function () {
       const path = '/api/v1/videos/ba708d62-e3d7-45d9-9d73-41b9097cc02d/comment-threads'
-      const fields = {
-        text: 'super comment'
-      }
+      const fields = { text: 'super comment' }
+
       await makePostBodyRequest({
         url: server.url,
         path,
@@ -156,10 +215,21 @@ describe('Test video comments API validator', function () {
       })
     })
 
+    it('Should fail with a private video of another user', async function () {
+      const fields = { text: 'super comment' }
+
+      await makePostBodyRequest({
+        url: server.url,
+        path: '/api/v1/videos/' + privateVideo.shortUUID + '/comment-threads',
+        token: userAccessToken,
+        fields,
+        expectedStatus: HttpStatusCode.FORBIDDEN_403
+      })
+    })
+
     it('Should succeed with the correct parameters', async function () {
-      const fields = {
-        text: 'super comment'
-      }
+      const fields = { text: 'super comment' }
+
       await makePostBodyRequest({
         url: server.url,
         path: pathThread,
@@ -171,6 +241,7 @@ describe('Test video comments API validator', function () {
   })
 
   describe('When adding a comment to a thread', function () {
+
     it('Should fail with a non authenticated user', async function () {
       const fields = {
         text: 'text'
@@ -217,6 +288,18 @@ describe('Test video comments API validator', function () {
       })
     })
 
+    it('Should fail with a private video of another user', async function () {
+      const fields = { text: 'super comment' }
+
+      await makePostBodyRequest({
+        url: server.url,
+        path: '/api/v1/videos/' + privateVideo.uuid + '/comments/' + privateCommentId,
+        token: userAccessToken,
+        fields,
+        expectedStatus: HttpStatusCode.FORBIDDEN_403
+      })
+    })
+
     it('Should fail with an incorrect comment', async function () {
       const path = '/api/v1/videos/' + video.uuid + '/comments/124'
       const fields = {