cst1/openstreetmap-website
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Disable redactions with write_api scope

Browse source 
Requires write_redactions scope to redact. Previously it was possible to redact with either write_redactions or write_api.
This commit is contained in:
Anton Khorev 2024-09-08 12:31:31 +03:00
parent 1fce0c00f1
commit 8b024f48c1
4 changed files with 13 additions and 52 deletions
Download patch file Download diff file Expand all files Collapse all files

21
test/controllers/api/old_nodes_controller_test.rb
View file

@ -238,14 +238,8 @@ module Api
assert_response :bad_request, "shouldn't be OK to redact current version as moderator."
end
def test_redact_node_by_regular_with_read_prefs_scope
auth_header = bearer_authorization_header(create(:user), :scopes => %w[read_prefs])
do_redact_redactable_node(auth_header)
assert_response :forbidden, "should need to be moderator to redact."
end
def test_redact_node_by_regular_with_write_api_scope
auth_header = bearer_authorization_header(create(:user), :scopes => %w[write_api])
def test_redact_node_by_regular_without_write_redactions_scope
auth_header = bearer_authorization_header(create(:user), :scopes => %w[read_prefs write_api])
do_redact_redactable_node(auth_header)
assert_response :forbidden, "should need to be moderator to redact."
end
@ -256,19 +250,12 @@ module Api
assert_response :forbidden, "should need to be moderator to redact."
end
def test_redact_node_by_moderator_with_read_prefs_scope
auth_header = bearer_authorization_header(create(:moderator_user), :scopes => %w[read_prefs])
def test_redact_node_by_moderator_without_write_redactions_scope
auth_header = bearer_authorization_header(create(:moderator_user), :scopes => %w[read_prefs write_api])
do_redact_redactable_node(auth_header)
assert_response :forbidden, "should need to have write_redactions scope to redact."
end
def test_redact_node_by_moderator_with_write_api_scope
auth_header = bearer_authorization_header(create(:moderator_user), :scopes => %w[write_api])
do_redact_redactable_node(auth_header)
assert_response :success, "should be OK to redact old version as moderator with write_api scope."
# assert_response :forbidden, "should need to have write_redactions scope to redact."
end
def test_redact_node_by_moderator_with_write_redactions_scope
auth_header = bearer_authorization_header(create(:moderator_user), :scopes => %w[write_redactions])
do_redact_redactable_node(auth_header)

21
test/controllers/api/old_relations_controller_test.rb
View file

@ -77,14 +77,8 @@ module Api
assert_response :bad_request, "shouldn't be OK to redact current version as moderator."
end
def test_redact_relation_by_regular_with_read_prefs_scope
auth_header = bearer_authorization_header(create(:user), :scopes => %w[read_prefs])
do_redact_redactable_relation(auth_header)
assert_response :forbidden, "should need to be moderator to redact."
end
def test_redact_relation_by_regular_with_write_api_scope
auth_header = bearer_authorization_header(create(:user), :scopes => %w[write_api])
def test_redact_relation_by_regular_without_write_redactions_scope
auth_header = bearer_authorization_header(create(:user), :scopes => %w[read_prefs write_api])
do_redact_redactable_relation(auth_header)
assert_response :forbidden, "should need to be moderator to redact."
end
@ -95,19 +89,12 @@ module Api
assert_response :forbidden, "should need to be moderator to redact."
end
def test_redact_relation_by_moderator_with_read_prefs_scope
auth_header = bearer_authorization_header(create(:moderator_user), :scopes => %w[read_prefs])
def test_redact_relation_by_moderator_without_write_redactions_scope
auth_header = bearer_authorization_header(create(:moderator_user), :scopes => %w[read_prefs write_api])
do_redact_redactable_relation(auth_header)
assert_response :forbidden, "should need to have write_redactions scope to redact."
end
def test_redact_relation_by_moderator_with_write_api_scope
auth_header = bearer_authorization_header(create(:moderator_user), :scopes => %w[write_api])
do_redact_redactable_relation(auth_header)
assert_response :success, "should be OK to redact old version as moderator with write_api scope."
# assert_response :forbidden, "should need to have write_redactions scope to redact."
end
def test_redact_relation_by_moderator_with_write_redactions_scope
auth_header = bearer_authorization_header(create(:moderator_user), :scopes => %w[write_redactions])
do_redact_redactable_relation(auth_header)

21
test/controllers/api/old_ways_controller_test.rb
View file

@ -118,14 +118,8 @@ module Api
assert_response :bad_request, "shouldn't be OK to redact current version as moderator."
end
def test_redact_way_by_regular_with_read_prefs_scope
auth_header = bearer_authorization_header(create(:user), :scopes => %w[read_prefs])
do_redact_redactable_way(auth_header)
assert_response :forbidden, "should need to be moderator to redact."
end
def test_redact_way_by_regular_with_write_api_scope
auth_header = bearer_authorization_header(create(:user), :scopes => %w[write_api])
def test_redact_way_by_regular_without_write_redactions_scope
auth_header = bearer_authorization_header(create(:user), :scopes => %w[read_prefs write_api])
do_redact_redactable_way(auth_header)
assert_response :forbidden, "should need to be moderator to redact."
end
@ -136,19 +130,12 @@ module Api
assert_response :forbidden, "should need to be moderator to redact."
end
def test_redact_way_by_moderator_with_read_prefs_scope
auth_header = bearer_authorization_header(create(:moderator_user), :scopes => %w[read_prefs])
def test_redact_way_by_moderator_without_write_redactions_scope
auth_header = bearer_authorization_header(create(:moderator_user), :scopes => %w[read_prefs write_api])
do_redact_redactable_way(auth_header)
assert_response :forbidden, "should need to have write_redactions scope to redact."
end
def test_redact_way_by_moderator_with_write_api_scope
auth_header = bearer_authorization_header(create(:moderator_user), :scopes => %w[write_api])
do_redact_redactable_way(auth_header)
assert_response :success, "should be OK to redact old version as moderator with write_api scope."
# assert_response :forbidden, "should need to have write_redactions scope to redact."
end
def test_redact_way_by_moderator_with_write_redactions_scope
auth_header = bearer_authorization_header(create(:moderator_user), :scopes => %w[write_redactions])
do_redact_redactable_way(auth_header)