Merge branch 'fix-admin-api-scope' into 'develop'

fix oauth scopes for AdminApi#reports_update

See merge request pleroma/pleroma!2087
This commit is contained in:
lain 2020-01-20 12:07:12 +00:00
commit c814f22030
2 changed files with 25 additions and 1 deletions

View File

@ -75,7 +75,7 @@ defmodule Pleroma.Web.AdminAPI.AdminAPIController do
plug(
OAuthScopesPlug,
%{scopes: ["write:reports"], admin: true}
when action in [:report_update_state, :report_respond]
when action in [:reports_update]
)
plug(

View File

@ -1363,6 +1363,30 @@ test "returns 404 when report id is invalid", %{conn: conn} do
}
end
test "requires write:reports scope", %{conn: conn, id: id, admin: admin} do
read_token = insert(:oauth_token, user: admin, scopes: ["read"])
write_token = insert(:oauth_token, user: admin, scopes: ["write:reports"])
response =
conn
|> assign(:token, read_token)
|> patch("/api/pleroma/admin/reports", %{
"reports" => [%{"state" => "resolved", "id" => id}]
})
|> json_response(403)
assert response == %{
"error" => "Insufficient permissions: admin:write:reports | write:reports."
}
conn
|> assign(:token, write_token)
|> patch("/api/pleroma/admin/reports", %{
"reports" => [%{"state" => "resolved", "id" => id}]
})
|> json_response(:no_content)
end
test "mark report as resolved", %{conn: conn, id: id, admin: admin} do
conn
|> patch("/api/pleroma/admin/reports", %{