Skip to content

Commit c31a259

Browse files
susnuxChartman123
susnux
authored and
Chartman123
committed
test: Add test cases for admin settings possibly influencing the API
Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>
1 parent b1565a3 commit c31a259

File tree

3 files changed

+421
-3
lines changed

3 files changed

+421
-3
lines changed

‎tests/Integration/Api/RespectAdminSettingsTest.php‎

Lines changed: 323 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,323 @@
1+
<?php
2+
3+
declare(strict_types=1);
4+
/**
5+
* SPDX-FileCopyrightText: 2025 Nextcloud GmbH and Nextcloud contributors
6+
* SPDX-License-Identifier: AGPL-3.0-or-later
7+
*/
8+
namespace OCA\Forms\Tests\Integration\Api;
9+
10+
use GuzzleHttp\Client;
11+
use OCA\Forms\AppInfo\Application;
12+
use OCA\Forms\Constants;
13+
use OCA\Forms\Tests\Integration\IntegrationBase;
14+
use OCP\IConfig;
15+
16+
/**
17+
* This tests that the API respects all admin settings
18+
* @group DB
19+
*/
20+
class RespectAdminSettingsTest extends IntegrationBase {
21+
/** @var GuzzleHttp\Client */
22+
private $http;
23+
24+
protected array $users = [
25+
'test' => 'Test user',
26+
];
27+
28+
/**
29+
* Store Test Forms Array.
30+
* Necessary as function due to object type-casting.
31+
*/
32+
private function setTestForms() {
33+
$this->testForms = [
34+
[
35+
'hash' => 'abcdefghij123456',
36+
'title' => 'Title of owned Form',
37+
'description' => '',
38+
'owner_id' => 'test',
39+
'access_enum' => 0,
40+
'created' => 12345,
41+
'expires' => 0,
42+
'state' => 0,
43+
'is_anonymous' => false,
44+
'submit_multiple' => false,
45+
'show_expiration' => false,
46+
'last_updated' => 123456789,
47+
'submission_message' => '',
48+
'file_id' => null,
49+
'file_format' => null,
50+
'questions' => [],
51+
'shares' => [],
52+
'submissions' => [],
53+
],
54+
[
55+
'hash' => '1234567890abcdef',
56+
'title' => 'Title of a globally shared Form',
57+
'description' => '',
58+
'owner_id' => 'test1',
59+
'access_enum' => 2,
60+
'created' => 12345,
61+
'expires' => 0,
62+
'state' => 0,
63+
'is_anonymous' => false,
64+
'submit_multiple' => false,
65+
'show_expiration' => false,
66+
'last_updated' => 123456789,
67+
'submission_message' => '',
68+
'file_id' => null,
69+
'file_format' => null,
70+
'questions' => [],
71+
'shares' => [],
72+
'submissions' => [],
73+
],
74+
[
75+
'hash' => 'bcdf011899881',
76+
'title' => 'Title of a directly shared Form',
77+
'description' => '',
78+
'owner_id' => 'test1',
79+
'access_enum' => 0,
80+
'created' => 12345,
81+
'expires' => 0,
82+
'state' => 0,
83+
'is_anonymous' => false,
84+
'submit_multiple' => false,
85+
'show_expiration' => false,
86+
'last_updated' => 123456789,
87+
'submission_message' => '',
88+
'file_id' => null,
89+
'file_format' => null,
90+
'questions' => [],
91+
'shares' => [
92+
[
93+
'shareType' => 0,
94+
'shareWith' => 'test',
95+
'permissions' => ['submit'],
96+
],
97+
],
98+
'submissions' => [],
99+
],
100+
];
101+
}
102+
103+
private static function sharedTestForms(): array {
104+
return [
105+
[
106+
'hash' => 'abcdefghij123456',
107+
'title' => 'Title of owned Form',
108+
'description' => '',
109+
'created' => 12345,
110+
'expires' => 0,
111+
'state' => 0,
112+
'questions' => [],
113+
'shares' => [],
114+
'ownerId' => 'test',
115+
'fileId' => null,
116+
'fileFormat' => null,
117+
'access' => [
118+
'permitAllUsers' => false,
119+
'showToAllUsers' => false,
120+
],
121+
'isAnonymous' => false,
122+
'submitMultiple' => false,
123+
'showExpiration' => false,
124+
'submissionMessage' => '',
125+
'permissions' => [
126+
'edit',
127+
'results',
128+
'results_delete',
129+
'submit',
130+
'embed',
131+
],
132+
'canSubmit' => true,
133+
'submissionCount' => 0,
134+
],
135+
];
136+
}
137+
138+
/**
139+
* Set up test environment.
140+
* Writing testforms into db, preparing http request
141+
*/
142+
public function setUp(): void {
143+
$this->setTestForms();
144+
$this->users = [
145+
'test' => 'Test Displayname',
146+
'user1' => 'User No. 1',
147+
];
148+
149+
parent::setUp();
150+
151+
// Set up http Client
152+
$this->http = new Client([
153+
'base_uri' => 'http://localhost:8080/ocs/v2.php/apps/forms/',
154+
'auth' => ['test', 'test'],
155+
'headers' => [
156+
'OCS-ApiRequest' => 'true',
157+
'Accept' => 'application/json'
158+
],
159+
]);
160+
}
161+
162+
public function tearDown(): void {
163+
parent::tearDown();
164+
}
165+
166+
// Small Wrapper for OCS-Response
167+
private function OcsResponse2Data($resp) {
168+
$arr = json_decode($resp->getBody()->getContents(), true);
169+
return $arr['ocs']['data'];
170+
}
171+
172+
/**
173+
* Allow to update form if there are no admin settings
174+
*/
175+
public function testAllowUpdate(): void {
176+
$resp = $this->http->request(
177+
'PATCH',
178+
"api/v3/forms/{$this->testForms[0]['id']}",
179+
[
180+
'json' => [
181+
'keyValuePairs' => ['access' => ['permitAllUsers' => true, 'showToAllUsers' => true]],
182+
],
183+
],
184+
);
185+
$this->assertEquals(200, $resp->getStatusCode());
186+
187+
$resp = $this->http->request(
188+
'GET',
189+
"api/v3/forms/{$this->testForms[0]['id']}",
190+
);
191+
$data = $this->OcsResponse2Data($resp);
192+
// we do not know the ID and the update time is flaky
193+
unset($data['id']);
194+
unset($data['lastUpdated']);
195+
196+
$expected = self::sharedTestForms()[0];
197+
$expected['access'] = ['permitAllUsers' => true, 'showToAllUsers' => true];
198+
199+
$this->assertEquals(200, $resp->getStatusCode());
200+
$this->assertEquals($expected, $data);
201+
}
202+
203+
/**
204+
* Forbid to update form if there are admin settings
205+
* @dataProvider forbidUpdateAdminSettingsData
206+
*/
207+
public function testForbidUpdate(array $accessValue, array $adminConfigKeys): void {
208+
$config = \OCP\Server::get(IConfig::class);
209+
foreach ($adminConfigKeys as $key => $value) {
210+
$config->setAppValue(Application::APP_ID, $key, $value);
211+
}
212+
213+
$resp = $this->http->request(
214+
'PATCH',
215+
"api/v3/forms/{$this->testForms[0]['id']}",
216+
[
217+
'json' => [
218+
'keyValuePairs' => ['access' => $accessValue],
219+
],
220+
// do not throw on 403
221+
'http_errors' => false,
222+
],
223+
);
224+
$this->assertEquals(403, $resp->getStatusCode());
225+
226+
$resp = $this->http->request(
227+
'GET',
228+
"api/v3/forms/{$this->testForms[0]['id']}",
229+
);
230+
$data = $this->OcsResponse2Data($resp);
231+
// we do not know the ID or the update
232+
unset($data['id']);
233+
unset($data['lastUpdated']);
234+
235+
$this->assertEquals(200, $resp->getStatusCode());
236+
$this->assertEquals(self::sharedTestForms()[0], $data);
237+
}
238+
239+
public static function forbidUpdateAdminSettingsData(): array {
240+
return [
241+
'set both without show-to-all permission' => [
242+
[
243+
'permitAllUsers' => true,
244+
'showToAllUsers' => true,
245+
],
246+
[
247+
Constants::CONFIG_KEY_ALLOWSHOWTOALL => 'false',
248+
Constants::CONFIG_KEY_ALLOWPERMITALL => 'true',
249+
],
250+
],
251+
'set both without permit-all permission' => [
252+
[
253+
'permitAllUsers' => true,
254+
'showToAllUsers' => true,
255+
],
256+
[
257+
Constants::CONFIG_KEY_ALLOWSHOWTOALL => 'true',
258+
Constants::CONFIG_KEY_ALLOWPERMITALL => 'false',
259+
],
260+
],
261+
'set show-to-all without permission' => [
262+
[
263+
'showToAllUsers' => true,
264+
],
265+
[
266+
Constants::CONFIG_KEY_ALLOWSHOWTOALL => 'false',
267+
Constants::CONFIG_KEY_ALLOWPERMITALL => 'true',
268+
],
269+
],
270+
'set permit-all without permission' => [
271+
[
272+
'permitAllUsers' => true,
273+
],
274+
[
275+
Constants::CONFIG_KEY_ALLOWSHOWTOALL => 'true',
276+
Constants::CONFIG_KEY_ALLOWPERMITALL => 'false',
277+
],
278+
],
279+
];
280+
}
281+
282+
/**
283+
* Test that forms with public access are listed
284+
*/
285+
public function testListFormsAllowed(): void {
286+
$resp = $this->http->request(
287+
'GET',
288+
'api/v3/forms?type=shared',
289+
);
290+
$this->assertEquals(200, $resp->getStatusCode());
291+
292+
$data = $this->OcsResponse2Data($resp);
293+
$this->assertEqualsCanonicalizing(
294+
[
295+
'Title of a globally shared Form',
296+
'Title of a directly shared Form',
297+
],
298+
array_map(fn ($form) => $form['title'], $data),
299+
);
300+
}
301+
302+
/**
303+
* Test that only forms directly shared are listed if the admin setting forbid access to the form.
304+
* Equivalent to creating form with "show to all" permission, but then the admin deactivates the "show all" globally.
305+
*/
306+
public function testListFormsNoAdminPermission(): void {
307+
// Disable global access
308+
\OCP\Server::get(IConfig::class)->setAppValue(Application::APP_ID, Constants::CONFIG_KEY_ALLOWPERMITALL, 'false');
309+
310+
$resp = $this->http->request(
311+
'GET',
312+
'api/v3/forms?type=shared',
313+
);
314+
$this->assertEquals(200, $resp->getStatusCode());
315+
316+
$data = $this->OcsResponse2Data($resp);
317+
$this->assertEqualsCanonicalizing(
318+
['Title of a directly shared Form'],
319+
array_map(fn ($form) => $form['title'], $data),
320+
);
321+
}
322+
323+
};

0 commit comments

Comments
 (0)