mirror of
https://github.com/go-gitea/gitea.git
synced 2026-10-19 17:43:58 +09:00
829b49c1ae
Backport https://github.com/go-gitea/gitea/pull/39839 by @silverwind Several handlers and model helpers skipped checks that their siblings already perform. - Only match principal keys when looking up SSH certificate principals - Return no attachments for an unsaved issue instead of every issue-less one - Reject issue and comment attachments when adding release attachments - Share one permission check for editing, deleting and reacting to issue content and for comment attachments between the web UI and the API, refusing them on locked issues for users who can't write - Reject issue edits, deletion and label changes in archived repositories via the API - Apply cross-origin protection to the repository topics endpoint - Return 404 for the repositories tab of individual users and respect profile visibility for the heatmap * Fixes: https://github.com/go-gitea/gitea/issues/39226 Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: bircni <bircni@icloud.com>
651 lines
26 KiB
Go
651 lines
26 KiB
Go
// Copyright 2017 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package integration
|
|
|
|
import (
|
|
"fmt"
|
|
"net/http"
|
|
"net/url"
|
|
"strconv"
|
|
"sync"
|
|
"testing"
|
|
"time"
|
|
|
|
auth_model "gitea.dev/models/auth"
|
|
"gitea.dev/models/db"
|
|
issues_model "gitea.dev/models/issues"
|
|
repo_model "gitea.dev/models/repo"
|
|
"gitea.dev/models/unittest"
|
|
user_model "gitea.dev/models/user"
|
|
"gitea.dev/modules/setting"
|
|
api "gitea.dev/modules/structs"
|
|
"gitea.dev/modules/test"
|
|
"gitea.dev/tests"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
)
|
|
|
|
func TestAPIIssue(t *testing.T) {
|
|
defer tests.PrepareTestEnv(t)()
|
|
t.Run("ListIssues", testAPIListIssues)
|
|
t.Run("ListIssuesPublicOnly", testAPIListIssuesPublicOnly)
|
|
t.Run("SearchIssues", testAPISearchIssues)
|
|
t.Run("SearchIssuesWithLabels", testAPISearchIssuesWithLabels)
|
|
t.Run("EditIssue", testAPIEditIssue)
|
|
t.Run("IssueContentVersion", testAPIIssueContentVersion)
|
|
t.Run("CreateIssue", testAPICreateIssue)
|
|
t.Run("CreateIssueParallel", testAPICreateIssueParallel)
|
|
t.Run("IssueAssignees", testAPIIssueAssignees)
|
|
t.Run("IssueProjects", testAPIIssueProjects)
|
|
}
|
|
|
|
func testAPIListIssues(t *testing.T) {
|
|
repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
|
|
owner := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: repo.OwnerID})
|
|
|
|
session := loginUser(t, owner.Name)
|
|
token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeReadIssue)
|
|
link, _ := url.Parse(fmt.Sprintf("/api/v1/repos/%s/%s/issues", owner.Name, repo.Name))
|
|
|
|
link.RawQuery = url.Values{"token": {token}, "state": {"all"}}.Encode()
|
|
resp := MakeRequest(t, NewRequest(t, "GET", link.String()), http.StatusOK)
|
|
apiIssues := DecodeJSON(t, resp, []*api.Issue{})
|
|
assert.Len(t, apiIssues, unittest.GetCount(t, &issues_model.Issue{RepoID: repo.ID}))
|
|
for _, apiIssue := range apiIssues {
|
|
unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{ID: apiIssue.ID, RepoID: repo.ID})
|
|
}
|
|
|
|
// test milestone filter
|
|
link.RawQuery = url.Values{"token": {token}, "state": {"all"}, "type": {"all"}, "milestones": {"ignore,milestone1,3,4"}}.Encode()
|
|
resp = MakeRequest(t, NewRequest(t, "GET", link.String()), http.StatusOK)
|
|
apiIssues = DecodeJSON(t, resp, []*api.Issue{})
|
|
if assert.Len(t, apiIssues, 2) {
|
|
assert.EqualValues(t, 3, apiIssues[0].Milestone.ID)
|
|
assert.EqualValues(t, 1, apiIssues[1].Milestone.ID)
|
|
}
|
|
|
|
link.RawQuery = url.Values{"token": {token}, "state": {"all"}, "created_by": {"user2"}}.Encode()
|
|
resp = MakeRequest(t, NewRequest(t, "GET", link.String()), http.StatusOK)
|
|
apiIssues = DecodeJSON(t, resp, []*api.Issue{})
|
|
if assert.Len(t, apiIssues, 1) {
|
|
assert.EqualValues(t, 5, apiIssues[0].ID)
|
|
}
|
|
|
|
link.RawQuery = url.Values{"token": {token}, "state": {"all"}, "assigned_by": {"user1"}}.Encode()
|
|
resp = MakeRequest(t, NewRequest(t, "GET", link.String()), http.StatusOK)
|
|
apiIssues = DecodeJSON(t, resp, []*api.Issue{})
|
|
if assert.Len(t, apiIssues, 1) {
|
|
assert.EqualValues(t, 1, apiIssues[0].ID)
|
|
}
|
|
|
|
link.RawQuery = url.Values{"token": {token}, "state": {"all"}, "mentioned_by": {"user4"}}.Encode()
|
|
resp = MakeRequest(t, NewRequest(t, "GET", link.String()), http.StatusOK)
|
|
apiIssues = DecodeJSON(t, resp, []*api.Issue{})
|
|
if assert.Len(t, apiIssues, 1) {
|
|
assert.EqualValues(t, 1, apiIssues[0].ID)
|
|
}
|
|
}
|
|
|
|
func testAPIListIssuesPublicOnly(t *testing.T) {
|
|
repo1 := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
|
|
owner1 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: repo1.OwnerID})
|
|
|
|
session := loginUser(t, owner1.Name)
|
|
token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeReadIssue)
|
|
link, _ := url.Parse(fmt.Sprintf("/api/v1/repos/%s/%s/issues", owner1.Name, repo1.Name))
|
|
link.RawQuery = url.Values{"state": {"all"}}.Encode()
|
|
req := NewRequest(t, "GET", link.String()).AddTokenAuth(token)
|
|
MakeRequest(t, req, http.StatusOK)
|
|
|
|
repo2 := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 2})
|
|
owner2 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: repo2.OwnerID})
|
|
|
|
session = loginUser(t, owner2.Name)
|
|
token = getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeReadIssue)
|
|
link, _ = url.Parse(fmt.Sprintf("/api/v1/repos/%s/%s/issues", owner2.Name, repo2.Name))
|
|
link.RawQuery = url.Values{"state": {"all"}}.Encode()
|
|
req = NewRequest(t, "GET", link.String()).AddTokenAuth(token)
|
|
MakeRequest(t, req, http.StatusOK)
|
|
|
|
publicOnlyToken := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeReadIssue, auth_model.AccessTokenScopePublicOnly)
|
|
req = NewRequest(t, "GET", link.String()).AddTokenAuth(publicOnlyToken)
|
|
MakeRequest(t, req, http.StatusNotFound)
|
|
}
|
|
|
|
func testAPICreateIssue(t *testing.T) {
|
|
const body, title = "apiTestBody", "apiTestTitle"
|
|
|
|
repoBefore := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
|
|
owner := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: repoBefore.OwnerID})
|
|
|
|
session := loginUser(t, owner.Name)
|
|
token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteIssue)
|
|
urlStr := fmt.Sprintf("/api/v1/repos/%s/%s/issues", owner.Name, repoBefore.Name)
|
|
req := NewRequestWithJSON(t, "POST", urlStr, &api.CreateIssueOption{
|
|
Body: body,
|
|
Title: title,
|
|
Assignee: owner.Name,
|
|
}).AddTokenAuth(token)
|
|
resp := MakeRequest(t, req, http.StatusCreated)
|
|
apiIssue := DecodeJSON(t, resp, &api.Issue{})
|
|
assert.Equal(t, body, apiIssue.Body)
|
|
assert.Equal(t, title, apiIssue.Title)
|
|
|
|
unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{
|
|
RepoID: repoBefore.ID,
|
|
AssigneeID: owner.ID,
|
|
Content: body,
|
|
Title: title,
|
|
})
|
|
|
|
repoAfter := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
|
|
assert.Equal(t, repoBefore.NumIssues+1, repoAfter.NumIssues)
|
|
assert.Equal(t, repoBefore.NumClosedIssues, repoAfter.NumClosedIssues)
|
|
|
|
user34 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 34})
|
|
req = NewRequestWithJSON(t, "POST", urlStr, &api.CreateIssueOption{
|
|
Title: title,
|
|
}).AddTokenAuth(getUserToken(t, user34.Name, auth_model.AccessTokenScopeWriteIssue))
|
|
MakeRequest(t, req, http.StatusForbidden)
|
|
}
|
|
|
|
func testAPICreateIssueParallel(t *testing.T) {
|
|
// HINT: There seems to be a bug in github.com/mattn/go-sqlite3 with sqlite_unlock_notify, when doing concurrent writes to the same database,
|
|
// some requests may get stuck in "go-sqlite3.(*SQLiteRows).Next", "go-sqlite3.(*SQLiteStmt).exec" and "go-sqlite3.unlock_notify_wait",
|
|
// because the "unlock_notify_wait" never returns and the internal lock never gets released.
|
|
//
|
|
// The trigger is: a previous test created issues and made the real issue indexer queue start processing, then this test does concurrent writing.
|
|
// Adding this "Sleep" makes go-sqlite3 "finish" some internal operations before concurrent writes and then won't get stuck.
|
|
// To reproduce: make a new test run these 2 tests enough times:
|
|
// > func testBug() { for i := 0; i < 100; i++ { testAPICreateIssue(t); testAPICreateIssueParallel(t) } }
|
|
// Usually the test gets stuck in fewer than 10 iterations without this "sleep".
|
|
time.Sleep(100 * time.Millisecond)
|
|
|
|
const body, title = "apiTestBody", "apiTestTitle"
|
|
|
|
repoBefore := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
|
|
owner := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: repoBefore.OwnerID})
|
|
|
|
session := loginUser(t, owner.Name)
|
|
token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteIssue)
|
|
urlStr := fmt.Sprintf("/api/v1/repos/%s/%s/issues", owner.Name, repoBefore.Name)
|
|
|
|
var wg sync.WaitGroup
|
|
for i := range 10 {
|
|
wg.Go(func() {
|
|
t.Run(fmt.Sprintf("ParallelCreateIssue_%d", i), func(t *testing.T) {
|
|
newTitle := title + strconv.Itoa(i)
|
|
newBody := body + strconv.Itoa(i)
|
|
req := NewRequestWithJSON(t, "POST", urlStr, &api.CreateIssueOption{
|
|
Body: newBody,
|
|
Title: newTitle,
|
|
Assignee: owner.Name,
|
|
}).AddTokenAuth(token)
|
|
resp := MakeRequest(t, req, http.StatusCreated)
|
|
apiIssue := DecodeJSON(t, resp, &api.Issue{})
|
|
assert.Equal(t, newBody, apiIssue.Body)
|
|
assert.Equal(t, newTitle, apiIssue.Title)
|
|
|
|
unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{
|
|
RepoID: repoBefore.ID,
|
|
AssigneeID: owner.ID,
|
|
Content: newBody,
|
|
Title: newTitle,
|
|
})
|
|
})
|
|
})
|
|
}
|
|
wg.Wait()
|
|
}
|
|
|
|
func testAPIEditIssue(t *testing.T) {
|
|
issueBefore := unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{ID: 10})
|
|
repoBefore := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: issueBefore.RepoID})
|
|
owner := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: repoBefore.OwnerID})
|
|
assert.NoError(t, issueBefore.LoadAttributes(t.Context()))
|
|
assert.Equal(t, int64(1019307200), int64(issueBefore.DeadlineUnix))
|
|
assert.Equal(t, api.StateOpen, issueBefore.State())
|
|
|
|
session := loginUser(t, owner.Name)
|
|
token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteIssue)
|
|
|
|
// update values of issue
|
|
issueState := "closed"
|
|
removeDeadline := true
|
|
milestone := int64(4)
|
|
body := "new content!"
|
|
title := "new title from api set"
|
|
|
|
urlStr := fmt.Sprintf("/api/v1/repos/%s/%s/issues/%d", owner.Name, repoBefore.Name, issueBefore.Index)
|
|
req := NewRequestWithJSON(t, "PATCH", urlStr, api.EditIssueOption{
|
|
State: &issueState,
|
|
RemoveDeadline: &removeDeadline,
|
|
Milestone: &milestone,
|
|
Body: &body,
|
|
Title: title,
|
|
|
|
// ToDo change more
|
|
}).AddTokenAuth(token)
|
|
resp := MakeRequest(t, req, http.StatusCreated)
|
|
apiIssue := DecodeJSON(t, resp, &api.Issue{})
|
|
|
|
issueAfter := unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{ID: 10})
|
|
repoAfter := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: issueBefore.RepoID})
|
|
|
|
// check comment history
|
|
unittest.AssertExistsAndLoadBean(t, &issues_model.Comment{IssueID: issueAfter.ID, OldTitle: issueBefore.Title, NewTitle: title})
|
|
unittest.AssertExistsAndLoadBean(t, &issues_model.ContentHistory{IssueID: issueAfter.ID, ContentText: body, IsFirstCreated: false})
|
|
|
|
// check deleted user
|
|
assert.Equal(t, int64(500), issueAfter.PosterID)
|
|
assert.NoError(t, issueAfter.LoadAttributes(t.Context()))
|
|
assert.Equal(t, int64(-1), issueAfter.PosterID)
|
|
assert.Equal(t, int64(-1), issueBefore.PosterID)
|
|
assert.Equal(t, int64(-1), apiIssue.Poster.ID)
|
|
|
|
// check repo change
|
|
assert.Equal(t, repoBefore.NumClosedIssues+1, repoAfter.NumClosedIssues)
|
|
|
|
// API response
|
|
assert.Equal(t, api.StateClosed, apiIssue.State)
|
|
assert.Equal(t, milestone, apiIssue.Milestone.ID)
|
|
assert.Equal(t, body, apiIssue.Body)
|
|
assert.Nil(t, apiIssue.Deadline)
|
|
assert.Equal(t, title, apiIssue.Title)
|
|
|
|
// in database
|
|
assert.Equal(t, api.StateClosed, issueAfter.State())
|
|
assert.Equal(t, milestone, issueAfter.MilestoneID)
|
|
assert.Equal(t, int64(0), int64(issueAfter.DeadlineUnix))
|
|
assert.Equal(t, body, issueAfter.Content)
|
|
assert.Equal(t, title, issueAfter.Title)
|
|
|
|
token = getUserToken(t, "user30", auth_model.AccessTokenScopeWriteIssue)
|
|
req = NewRequestWithJSON(t, "PATCH", "/api/v1/repos/user30/repo51/issues/1", api.EditIssueOption{Title: title}).AddTokenAuth(token)
|
|
MakeRequest(t, req, http.StatusLocked)
|
|
unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{ID: 14, Title: "issue in archived repo"})
|
|
}
|
|
|
|
func testAPISearchIssues(t *testing.T) {
|
|
defer test.MockVariableValue(&setting.API.DefaultPagingNum, 20)()
|
|
expectedIssueCount := 20 // 20 is from the fixtures
|
|
|
|
link, _ := url.Parse("/api/v1/repos/issues/search")
|
|
token := getUserToken(t, "user1", auth_model.AccessTokenScopeReadIssue)
|
|
query := url.Values{}
|
|
var apiIssues []*api.Issue
|
|
|
|
link.RawQuery = query.Encode()
|
|
req := NewRequest(t, "GET", link.String()).AddTokenAuth(token)
|
|
resp := MakeRequest(t, req, http.StatusOK)
|
|
apiIssues = DecodeJSON(t, resp, []*api.Issue{})
|
|
assert.Len(t, apiIssues, expectedIssueCount)
|
|
|
|
publicOnlyToken := getUserToken(t, "user1", auth_model.AccessTokenScopeReadIssue, auth_model.AccessTokenScopePublicOnly)
|
|
req = NewRequest(t, "GET", link.String()).AddTokenAuth(publicOnlyToken)
|
|
resp = MakeRequest(t, req, http.StatusOK)
|
|
apiIssues = DecodeJSON(t, resp, []*api.Issue{})
|
|
assert.Len(t, apiIssues, 15) // 15 public issues
|
|
|
|
since := "2000-01-01T00:50:01+00:00" // 946687801
|
|
before := time.Unix(999307200, 0).Format(time.RFC3339)
|
|
query.Add("since", since)
|
|
query.Add("before", before)
|
|
link.RawQuery = query.Encode()
|
|
req = NewRequest(t, "GET", link.String()).AddTokenAuth(token)
|
|
resp = MakeRequest(t, req, http.StatusOK)
|
|
apiIssues = DecodeJSON(t, resp, []*api.Issue{})
|
|
assert.Len(t, apiIssues, 11)
|
|
query.Del("since")
|
|
query.Del("before")
|
|
|
|
query.Add("state", "closed")
|
|
link.RawQuery = query.Encode()
|
|
req = NewRequest(t, "GET", link.String()).AddTokenAuth(token)
|
|
resp = MakeRequest(t, req, http.StatusOK)
|
|
apiIssues = DecodeJSON(t, resp, []*api.Issue{})
|
|
assert.Len(t, apiIssues, 2)
|
|
|
|
query.Set("state", "all")
|
|
link.RawQuery = query.Encode()
|
|
req = NewRequest(t, "GET", link.String()).AddTokenAuth(token)
|
|
resp = MakeRequest(t, req, http.StatusOK)
|
|
apiIssues = DecodeJSON(t, resp, []*api.Issue{})
|
|
assert.Equal(t, "22", resp.Header().Get("X-Total-Count"))
|
|
assert.Len(t, apiIssues, 20)
|
|
|
|
query.Add("limit", "10")
|
|
link.RawQuery = query.Encode()
|
|
req = NewRequest(t, "GET", link.String()).AddTokenAuth(token)
|
|
resp = MakeRequest(t, req, http.StatusOK)
|
|
apiIssues = DecodeJSON(t, resp, []*api.Issue{})
|
|
assert.Equal(t, "22", resp.Header().Get("X-Total-Count"))
|
|
assert.Len(t, apiIssues, 10)
|
|
|
|
query = url.Values{"assigned": {"true"}, "state": {"all"}}
|
|
link.RawQuery = query.Encode()
|
|
req = NewRequest(t, "GET", link.String()).AddTokenAuth(token)
|
|
resp = MakeRequest(t, req, http.StatusOK)
|
|
apiIssues = DecodeJSON(t, resp, []*api.Issue{})
|
|
assert.Len(t, apiIssues, 2)
|
|
|
|
query = url.Values{"milestones": {"milestone1"}, "state": {"all"}}
|
|
link.RawQuery = query.Encode()
|
|
req = NewRequest(t, "GET", link.String()).AddTokenAuth(token)
|
|
resp = MakeRequest(t, req, http.StatusOK)
|
|
apiIssues = DecodeJSON(t, resp, []*api.Issue{})
|
|
assert.Len(t, apiIssues, 1)
|
|
|
|
query = url.Values{"milestones": {"milestone1,milestone3"}, "state": {"all"}}
|
|
link.RawQuery = query.Encode()
|
|
req = NewRequest(t, "GET", link.String()).AddTokenAuth(token)
|
|
resp = MakeRequest(t, req, http.StatusOK)
|
|
apiIssues = DecodeJSON(t, resp, []*api.Issue{})
|
|
assert.Len(t, apiIssues, 2)
|
|
|
|
query = url.Values{"owner": {"user2"}} // user
|
|
link.RawQuery = query.Encode()
|
|
req = NewRequest(t, "GET", link.String()).AddTokenAuth(token)
|
|
resp = MakeRequest(t, req, http.StatusOK)
|
|
apiIssues = DecodeJSON(t, resp, []*api.Issue{})
|
|
assert.Len(t, apiIssues, 8)
|
|
|
|
query = url.Values{"owner": {"org3"}} // organization
|
|
link.RawQuery = query.Encode()
|
|
req = NewRequest(t, "GET", link.String()).AddTokenAuth(token)
|
|
resp = MakeRequest(t, req, http.StatusOK)
|
|
apiIssues = DecodeJSON(t, resp, []*api.Issue{})
|
|
assert.Len(t, apiIssues, 5)
|
|
|
|
query = url.Values{"owner": {"org3"}, "team": {"team1"}} // organization + team
|
|
link.RawQuery = query.Encode()
|
|
req = NewRequest(t, "GET", link.String()).AddTokenAuth(token)
|
|
resp = MakeRequest(t, req, http.StatusOK)
|
|
apiIssues = DecodeJSON(t, resp, []*api.Issue{})
|
|
assert.Len(t, apiIssues, 2)
|
|
|
|
query = url.Values{"created": {"1"}} // issues created by the auth user
|
|
link.RawQuery = query.Encode()
|
|
req = NewRequest(t, "GET", link.String()).AddTokenAuth(token)
|
|
resp = MakeRequest(t, req, http.StatusOK)
|
|
apiIssues = DecodeJSON(t, resp, []*api.Issue{})
|
|
assert.Len(t, apiIssues, 5)
|
|
|
|
query = url.Values{"created": {"1"}, "type": {"pulls"}} // prs created by the auth user
|
|
link.RawQuery = query.Encode()
|
|
req = NewRequest(t, "GET", link.String()).AddTokenAuth(token)
|
|
resp = MakeRequest(t, req, http.StatusOK)
|
|
apiIssues = DecodeJSON(t, resp, []*api.Issue{})
|
|
assert.Len(t, apiIssues, 3)
|
|
|
|
query = url.Values{"created_by": {"user2"}} // issues created by the user2
|
|
link.RawQuery = query.Encode()
|
|
req = NewRequest(t, "GET", link.String()).AddTokenAuth(token)
|
|
resp = MakeRequest(t, req, http.StatusOK)
|
|
apiIssues = DecodeJSON(t, resp, []*api.Issue{})
|
|
assert.Len(t, apiIssues, 9)
|
|
|
|
query = url.Values{"created_by": {"user2"}, "type": {"pulls"}} // prs created by user2
|
|
link.RawQuery = query.Encode()
|
|
req = NewRequest(t, "GET", link.String()).AddTokenAuth(token)
|
|
resp = MakeRequest(t, req, http.StatusOK)
|
|
apiIssues = DecodeJSON(t, resp, []*api.Issue{})
|
|
assert.Len(t, apiIssues, 3)
|
|
}
|
|
|
|
func testAPISearchIssuesWithLabels(t *testing.T) {
|
|
// as this API was used in the frontend, it uses UI page size
|
|
expectedIssueCount := min(20, setting.UI.IssuePagingNum) // 20 is from the fixtures
|
|
|
|
link, _ := url.Parse("/api/v1/repos/issues/search")
|
|
token := getUserToken(t, "user1", auth_model.AccessTokenScopeReadIssue)
|
|
query := url.Values{}
|
|
var apiIssues []*api.Issue
|
|
|
|
link.RawQuery = query.Encode()
|
|
req := NewRequest(t, "GET", link.String()).AddTokenAuth(token)
|
|
resp := MakeRequest(t, req, http.StatusOK)
|
|
apiIssues = DecodeJSON(t, resp, []*api.Issue{})
|
|
assert.Len(t, apiIssues, expectedIssueCount)
|
|
|
|
query.Add("labels", "label1")
|
|
link.RawQuery = query.Encode()
|
|
req = NewRequest(t, "GET", link.String()).AddTokenAuth(token)
|
|
resp = MakeRequest(t, req, http.StatusOK)
|
|
apiIssues = DecodeJSON(t, resp, []*api.Issue{})
|
|
assert.Len(t, apiIssues, 2)
|
|
|
|
// multiple labels
|
|
query.Set("labels", "label1,label2")
|
|
link.RawQuery = query.Encode()
|
|
req = NewRequest(t, "GET", link.String()).AddTokenAuth(token)
|
|
resp = MakeRequest(t, req, http.StatusOK)
|
|
apiIssues = DecodeJSON(t, resp, []*api.Issue{})
|
|
assert.Len(t, apiIssues, 2)
|
|
|
|
// an org label
|
|
query.Set("labels", "orglabel4")
|
|
link.RawQuery = query.Encode()
|
|
req = NewRequest(t, "GET", link.String()).AddTokenAuth(token)
|
|
resp = MakeRequest(t, req, http.StatusOK)
|
|
apiIssues = DecodeJSON(t, resp, []*api.Issue{})
|
|
assert.Len(t, apiIssues, 1)
|
|
|
|
// org and repo label
|
|
query.Set("labels", "label2,orglabel4")
|
|
query.Add("state", "all")
|
|
link.RawQuery = query.Encode()
|
|
req = NewRequest(t, "GET", link.String()).AddTokenAuth(token)
|
|
resp = MakeRequest(t, req, http.StatusOK)
|
|
apiIssues = DecodeJSON(t, resp, []*api.Issue{})
|
|
assert.Len(t, apiIssues, 2)
|
|
|
|
// org and repo label which share the same issue
|
|
query.Set("labels", "label1,orglabel4")
|
|
link.RawQuery = query.Encode()
|
|
req = NewRequest(t, "GET", link.String()).AddTokenAuth(token)
|
|
resp = MakeRequest(t, req, http.StatusOK)
|
|
apiIssues = DecodeJSON(t, resp, []*api.Issue{})
|
|
assert.Len(t, apiIssues, 2)
|
|
}
|
|
|
|
func testAPIIssueContentVersion(t *testing.T) {
|
|
issue := unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{ID: 10})
|
|
repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: issue.RepoID})
|
|
owner := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: repo.OwnerID})
|
|
|
|
session := loginUser(t, owner.Name)
|
|
token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteIssue)
|
|
urlStr := fmt.Sprintf("/api/v1/repos/%s/%s/issues/%d", owner.Name, repo.Name, issue.Index)
|
|
|
|
t.Run("ResponseIncludesContentVersion", func(t *testing.T) {
|
|
defer tests.PrintCurrentTest(t)()
|
|
|
|
req := NewRequest(t, "GET", urlStr).AddTokenAuth(token)
|
|
resp := MakeRequest(t, req, http.StatusOK)
|
|
apiIssue := DecodeJSON(t, resp, &api.Issue{})
|
|
assert.GreaterOrEqual(t, apiIssue.ContentVersion, 0)
|
|
})
|
|
|
|
t.Run("EditWithCorrectVersion", func(t *testing.T) {
|
|
defer tests.PrintCurrentTest(t)()
|
|
|
|
req := NewRequest(t, "GET", urlStr).AddTokenAuth(token)
|
|
resp := MakeRequest(t, req, http.StatusOK)
|
|
before := DecodeJSON(t, resp, &api.Issue{})
|
|
req = NewRequestWithJSON(t, "PATCH", urlStr, api.EditIssueOption{
|
|
Body: new("updated body with correct version"),
|
|
ContentVersion: new(before.ContentVersion),
|
|
}).AddTokenAuth(token)
|
|
resp = MakeRequest(t, req, http.StatusCreated)
|
|
after := DecodeJSON(t, resp, &api.Issue{})
|
|
assert.Equal(t, "updated body with correct version", after.Body)
|
|
assert.Greater(t, after.ContentVersion, before.ContentVersion)
|
|
})
|
|
|
|
t.Run("EditWithWrongVersion", func(t *testing.T) {
|
|
defer tests.PrintCurrentTest(t)()
|
|
req := NewRequestWithJSON(t, "PATCH", urlStr, api.EditIssueOption{
|
|
Body: new("should fail"),
|
|
ContentVersion: new(99999),
|
|
}).AddTokenAuth(token)
|
|
MakeRequest(t, req, http.StatusConflict)
|
|
})
|
|
|
|
t.Run("EditWithoutVersion", func(t *testing.T) {
|
|
defer tests.PrintCurrentTest(t)()
|
|
req := NewRequestWithJSON(t, "PATCH", urlStr, api.EditIssueOption{
|
|
Body: new("edit without version succeeds"),
|
|
}).AddTokenAuth(token)
|
|
MakeRequest(t, req, http.StatusCreated)
|
|
})
|
|
}
|
|
|
|
func testAPIIssueAssignees(t *testing.T) {
|
|
issue := unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{ID: 1})
|
|
repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: issue.RepoID})
|
|
owner := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: repo.OwnerID})
|
|
|
|
session := loginUser(t, owner.Name)
|
|
token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteIssue)
|
|
|
|
urlStr := fmt.Sprintf("/api/v1/repos/%s/%s/issues/%d/assignees", owner.Name, repo.Name, issue.Index)
|
|
getAssigneeIDs := func(issueID int64) []int64 {
|
|
assigneeIDs, err := issues_model.GetAssigneeIDsByIssue(t.Context(), issueID)
|
|
assert.NoError(t, err)
|
|
return assigneeIDs
|
|
}
|
|
|
|
t.Run("NonWriter", func(t *testing.T) {
|
|
req := NewRequestWithJSON(t, "POST", urlStr, &api.IssueAssigneesOption{Assignees: []string{"user40"}}).
|
|
AddTokenAuth(getUserToken(t, "user5", auth_model.AccessTokenScopeWriteIssue))
|
|
MakeRequest(t, req, http.StatusForbidden)
|
|
})
|
|
|
|
t.Run("MissingIssue", func(t *testing.T) {
|
|
req := NewRequestWithJSON(t, "POST", fmt.Sprintf("/api/v1/repos/%s/%s/issues/99999/assignees", owner.Name, repo.Name), &api.IssueAssigneesOption{Assignees: []string{"user40"}}).
|
|
AddTokenAuth(token)
|
|
MakeRequest(t, req, http.StatusNotFound)
|
|
})
|
|
|
|
t.Run("UnknownAssignee", func(t *testing.T) {
|
|
req := NewRequestWithJSON(t, "POST", urlStr, &api.IssueAssigneesOption{Assignees: []string{"does-not-exist"}}).
|
|
AddTokenAuth(token)
|
|
resp := MakeRequest(t, req, http.StatusUnprocessableEntity)
|
|
apiErr := DecodeJSON(t, resp, &api.APIError{})
|
|
assert.Equal(t, "user does not exist [uid: 0, name: does-not-exist]", apiErr.Message)
|
|
})
|
|
|
|
t.Run("OrganizationAssignee", func(t *testing.T) {
|
|
req := NewRequestWithJSON(t, "POST", urlStr, &api.IssueAssigneesOption{Assignees: []string{"org3"}}).
|
|
AddTokenAuth(token)
|
|
MakeRequest(t, req, http.StatusBadRequest)
|
|
|
|
checkReq := NewRequest(t, "GET", fmt.Sprintf("%s/%s", urlStr, "org3")).AddTokenAuth(token)
|
|
MakeRequest(t, checkReq, http.StatusBadRequest)
|
|
})
|
|
|
|
t.Run("BlockedAssigneeIsAtomic", func(t *testing.T) {
|
|
blockedIssue := unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{ID: 5})
|
|
blockedURL := fmt.Sprintf("/api/v1/repos/%s/%s/issues/%d/assignees", owner.Name, repo.Name, blockedIssue.Index)
|
|
blockedToken := getUserToken(t, "user40", auth_model.AccessTokenScopeWriteIssue)
|
|
|
|
assert.Empty(t, getAssigneeIDs(blockedIssue.ID))
|
|
assert.NoError(t, db.Insert(t.Context(), &user_model.Blocking{
|
|
BlockerID: owner.ID,
|
|
BlockeeID: 40,
|
|
}))
|
|
|
|
req := NewRequestWithJSON(t, "POST", blockedURL, &api.IssueAssigneesOption{Assignees: []string{"user1", "user2"}}).
|
|
AddTokenAuth(blockedToken)
|
|
MakeRequest(t, req, http.StatusForbidden)
|
|
assert.Empty(t, getAssigneeIDs(blockedIssue.ID))
|
|
})
|
|
|
|
t.Run("HappyPath", func(t *testing.T) {
|
|
req := NewRequestWithJSON(t, "POST", urlStr, &api.IssueAssigneesOption{Assignees: []string{"user40"}}).
|
|
AddTokenAuth(token)
|
|
resp := MakeRequest(t, req, http.StatusCreated)
|
|
apiIssue := DecodeJSON(t, resp, &api.Issue{})
|
|
assert.Len(t, apiIssue.Assignees, 2)
|
|
assert.ElementsMatch(t, []int64{1, 40}, []int64{apiIssue.Assignees[0].ID, apiIssue.Assignees[1].ID})
|
|
|
|
checkReq := NewRequest(t, "GET", fmt.Sprintf("%s/%s", urlStr, "user40")).AddTokenAuth(token)
|
|
MakeRequest(t, checkReq, http.StatusNoContent)
|
|
|
|
// This endpoint checks assignability, not current assignment membership.
|
|
checkReq = NewRequest(t, "GET", fmt.Sprintf("%s/%s", urlStr, "user5")).AddTokenAuth(token)
|
|
MakeRequest(t, checkReq, http.StatusNoContent)
|
|
|
|
req = NewRequestWithJSON(t, "DELETE", urlStr, &api.IssueAssigneesOption{Assignees: []string{"user1"}}).
|
|
AddTokenAuth(token)
|
|
resp = MakeRequest(t, req, http.StatusOK)
|
|
apiIssue = DecodeJSON(t, resp, &api.Issue{})
|
|
assert.Len(t, apiIssue.Assignees, 1)
|
|
assert.Equal(t, int64(40), apiIssue.Assignees[0].ID)
|
|
})
|
|
}
|
|
|
|
func testAPIIssueProjects(t *testing.T) {
|
|
repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
|
|
owner := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: repo.OwnerID})
|
|
|
|
session := loginUser(t, owner.Name)
|
|
token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteIssue)
|
|
urlStr := fmt.Sprintf("/api/v1/repos/%s/%s/issues", owner.Name, repo.Name)
|
|
|
|
// Create issue with a project
|
|
req := NewRequestWithJSON(t, "POST", urlStr, &api.CreateIssueOption{
|
|
Title: "issue with project",
|
|
Body: "test body",
|
|
Projects: []int64{1},
|
|
}).AddTokenAuth(token)
|
|
resp := MakeRequest(t, req, http.StatusCreated)
|
|
apiIssue := DecodeJSON(t, resp, &api.Issue{})
|
|
assert.Len(t, apiIssue.Projects, 1)
|
|
assert.EqualValues(t, 1, apiIssue.Projects[0].ID)
|
|
|
|
// Get issue should include projects
|
|
req = NewRequest(t, "GET", fmt.Sprintf("%s/%d", urlStr, apiIssue.Index)).AddTokenAuth(token)
|
|
resp = MakeRequest(t, req, http.StatusOK)
|
|
apiIssue = DecodeJSON(t, resp, &api.Issue{})
|
|
assert.Len(t, apiIssue.Projects, 1)
|
|
assert.EqualValues(t, 1, apiIssue.Projects[0].ID)
|
|
|
|
// Edit issue to remove projects
|
|
emptyProjects := []int64{}
|
|
req = NewRequestWithJSON(t, "PATCH", fmt.Sprintf("%s/%d", urlStr, apiIssue.Index), &api.EditIssueOption{
|
|
Projects: &emptyProjects,
|
|
}).AddTokenAuth(token)
|
|
resp = MakeRequest(t, req, http.StatusCreated)
|
|
apiIssue = DecodeJSON(t, resp, &api.Issue{})
|
|
assert.Empty(t, apiIssue.Projects)
|
|
|
|
// Edit issue to add project back
|
|
projects := []int64{1}
|
|
req = NewRequestWithJSON(t, "PATCH", fmt.Sprintf("%s/%d", urlStr, apiIssue.Index), &api.EditIssueOption{
|
|
Projects: &projects,
|
|
}).AddTokenAuth(token)
|
|
resp = MakeRequest(t, req, http.StatusCreated)
|
|
apiIssue = DecodeJSON(t, resp, &api.Issue{})
|
|
assert.Len(t, apiIssue.Projects, 1)
|
|
assert.EqualValues(t, 1, apiIssue.Projects[0].ID)
|
|
|
|
// Test invalid project ID
|
|
req = NewRequestWithJSON(t, "POST", urlStr, &api.CreateIssueOption{
|
|
Title: "issue with invalid project",
|
|
Body: "test body",
|
|
Projects: []int64{99999},
|
|
}).AddTokenAuth(token)
|
|
MakeRequest(t, req, http.StatusBadRequest)
|
|
|
|
// Test project from different repo (project 2 is for repo 3)
|
|
req = NewRequestWithJSON(t, "POST", urlStr, &api.CreateIssueOption{
|
|
Title: "issue with inaccessible project",
|
|
Body: "test body",
|
|
Projects: []int64{2},
|
|
}).AddTokenAuth(token)
|
|
MakeRequest(t, req, http.StatusBadRequest)
|
|
}
|