2 files changed, 66 insertions, 19 deletions

diff --git a/server/tests/api/check-params/users.ts b/server/tests/api/check-params/users.ts
index 2a220be83..da7dc9704 100644
--- a/server/tests/api/check-params/users.ts
+++ b/server/tests/api/check-params/users.ts
@@ -14,6 +14,7 @@ import {
   flushAndRunServer,
   getMyUserInformation,
   getMyUserVideoRating,
+  getUserScopedTokens,
   getUsersList,
   immutableAssign,
   killallServers,
@@ -23,6 +24,7 @@ import {
   makeUploadRequest,
   registerUser,
   removeUser,
+  renewUserScopedTokens,
   reRunServer,
   ServerInfo,
   setAccessTokensToServers,
@@ -38,7 +40,7 @@ import {
   checkBadStartPagination
 } from '../../../../shared/extra-utils/requests/check-api-params'
 import { waitJobs } from '../../../../shared/extra-utils/server/jobs'
-import { getMagnetURI, getMyVideoImports, getGoodVideoUrl, importVideo } from '../../../../shared/extra-utils/videos/video-imports'
+import { getGoodVideoUrl, getMagnetURI, getMyVideoImports, importVideo } from '../../../../shared/extra-utils/videos/video-imports'
 import { UserAdminFlag } from '../../../../shared/models/users/user-flag.model'
 import { VideoPrivacy } from '../../../../shared/models/videos'
 
@@ -609,6 +611,34 @@ describe('Test users API validators', function () {
     })
   })
 
+  describe('When managing my scoped tokens', function () {
+
+    it('Should fail to get my scoped tokens with an non authenticated user', async function () {
+      await getUserScopedTokens(server.url, null, 401)
+    })
+
+    it('Should fail to get my scoped tokens with a bad token', async function () {
+      await getUserScopedTokens(server.url, 'bad', 401)
+
+    })
+
+    it('Should succeed to get my scoped tokens', async function () {
+      await getUserScopedTokens(server.url, server.accessToken)
+    })
+
+    it('Should fail to renew my scoped tokens with an non authenticated user', async function () {
+      await renewUserScopedTokens(server.url, null, 401)
+    })
+
+    it('Should fail to renew my scoped tokens with a bad token', async function () {
+      await renewUserScopedTokens(server.url, 'bad', 401)
+    })
+
+    it('Should succeed to renew my scoped tokens', async function () {
+      await renewUserScopedTokens(server.url, server.accessToken)
+    })
+  })
+
   describe('When getting a user', function () {
 
     it('Should fail with an non authenticated user', async function () {
diff --git a/server/tests/feeds/feeds.ts b/server/tests/feeds/feeds.ts
index 175ea9102..92a468192 100644
--- a/server/tests/feeds/feeds.ts
+++ b/server/tests/feeds/feeds.ts
@@ -8,28 +8,29 @@ import {
   addAccountToServerBlocklist,
   removeAccountFromServerBlocklist
 } from '@shared/extra-utils/users/blocklist'
+import { addUserSubscription, listUserSubscriptionVideos } from '@shared/extra-utils/users/user-subscriptions'
 import { VideoPrivacy } from '@shared/models'
+import { ScopedToken } from '@shared/models/users/user-scoped-token'
 import {
   cleanupTests,
   createUser,
   doubleFollow,
   flushAndRunMultipleServers,
+  flushAndRunServer,
   getJSONfeed,
   getMyUserInformation,
+  getUserScopedTokens,
   getXMLfeed,
+  renewUserScopedTokens,
   ServerInfo,
   setAccessTokensToServers,
   uploadVideo,
   uploadVideoAndGetId,
-  userLogin,
-  flushAndRunServer,
-  getUserScopedTokens
+  userLogin
 } from '../../../shared/extra-utils'
 import { waitJobs } from '../../../shared/extra-utils/server/jobs'
 import { addVideoCommentThread } from '../../../shared/extra-utils/videos/video-comments'
 import { User } from '../../../shared/models/users'
-import { ScopedToken } from '@shared/models/users/user-scoped-token'
-import { listUserSubscriptionVideos, addUserSubscription } from '@shared/extra-utils/users/user-subscriptions'
 
 chai.use(require('chai-xml'))
 chai.use(require('chai-json-schema'))
@@ -298,14 +299,10 @@ describe('Test syndication feeds', () => {
   })
 
   describe('Video feed from my subscriptions', function () {
-    /**
-     * use the 'version' query parameter to bust cache between tests
-     */
+    let feeduserAccountId: number
+    let feeduserFeedToken: string
 
     it('Should list no videos for a user with no videos and no subscriptions', async function () {
-      let feeduserAccountId: number
-      let feeduserFeedToken: string
-
       const attr = { username: 'feeduser', password: 'password' }
       await createUser({ url: servers[0].url, accessToken: servers[0].accessToken, username: attr.username, password: attr.password })
       const feeduserAccessToken = await userLogin(servers[0], attr)
@@ -332,15 +329,21 @@ describe('Test syndication feeds', () => {
       }
     })
 
+    it('Should fail with an invalid token', async function () {
+      await getJSONfeed(servers[0].url, 'subscriptions', { accountId: feeduserAccountId, token: 'toto' }, 403)
+    })
+
+    it('Should fail with a token of another user', async function () {
+      await getJSONfeed(servers[0].url, 'subscriptions', { accountId: feeduserAccountId, token: userFeedToken }, 403)
+    })
+
     it('Should list no videos for a user with videos but no subscriptions', async function () {
-      {
-        const res = await listUserSubscriptionVideos(servers[0].url, userAccessToken)
-        expect(res.body.total).to.equal(0)
+      const res = await listUserSubscriptionVideos(servers[0].url, userAccessToken)
+      expect(res.body.total).to.equal(0)
 
-        const json = await getJSONfeed(servers[0].url, 'subscriptions', { accountId: userAccountId, token: userFeedToken })
-        const jsonObj = JSON.parse(json.text)
-        expect(jsonObj.items.length).to.be.equal(0) // no subscription, it should not list the instance's videos but list 0 videos
-      }
+      const json = await getJSONfeed(servers[0].url, 'subscriptions', { accountId: userAccountId, token: userFeedToken })
+      const jsonObj = JSON.parse(json.text)
+      expect(jsonObj.items.length).to.be.equal(0) // no subscription, it should not list the instance's videos but list 0 videos
     })
 
     it('Should list self videos for a user with a subscription to themselves', async function () {
@@ -376,6 +379,20 @@ describe('Test syndication feeds', () => {
       }
     })
 
+    it('Should renew the token, and so have an invalid old token', async function () {
+      await renewUserScopedTokens(servers[0].url, userAccessToken)
+
+      await getJSONfeed(servers[0].url, 'subscriptions', { accountId: userAccountId, token: userFeedToken, version: 3 }, 403)
+    })
+
+    it('Should succeed with the new token', async function () {
+      const res2 = await getUserScopedTokens(servers[0].url, userAccessToken)
+      const token: ScopedToken = res2.body
+      userFeedToken = token.feedToken
+
+      await getJSONfeed(servers[0].url, 'subscriptions', { accountId: userAccountId, token: userFeedToken, version: 4 })
+    })
+
   })
 
   after(async function () {