| 1 | package sheets |
| 2 | |
| 3 | import ( |
| 4 | "context" |
| 5 | "encoding/json" |
| 6 | "net/http" |
| 7 | "strconv" |
| 8 | "testing" |
| 9 | ) |
| 10 | |
| 11 | func TestNativeRolesAndJobOwnership(t *testing.T) { |
| 12 | a, cookies := signIn(t) |
| 13 | own, _ := newSheet(t, a, cookies, "Private native history") |
| 14 | shared, _ := newSheet(t, a, cookies, "Shared native sheet") |
| 15 | guestOn(t, a, shared.ID, "native-guest@example.com", SheetViewer) |
| 16 | guestCookies := signInAs(t, a, "native-guest@example.com") |
| 17 | privatePath := "/sheets/" + strconv.FormatUint(own.ID, 10) |
| 18 | sharedPath := "/sheets/" + strconv.FormatUint(shared.ID, 10) |
| 19 | for _, suffix := range []string{"", "/history", "/comments", "/share", "/table"} { |
| 20 | rec := do(t, a, as(nativeGet(privatePath+suffix), guestCookies)) |
| 21 | if rec.Code != 404 { |
| 22 | t.Fatalf("guest private %s=%d", suffix, rec.Code) |
| 23 | } |
| 24 | } |
| 25 | for _, suffix := range []string{"/rename", "/undo", "/restore", "/comments", "/view", "/share"} { |
| 26 | req := postForm(sharedPath+suffix, map[string][]string{"title": {"forbidden"}, "r": {"0"}, "c": {"0"}, "body": {"forbidden"}}) |
| 27 | req.Header.Set("Accept", "application/json") |
| 28 | rec := do(t, a, as(req, guestCookies)) |
| 29 | if rec.Code != 404 { |
| 30 | t.Fatalf("viewer mutation %s=%d", suffix, rec.Code) |
| 31 | } |
| 32 | } |
| 33 | rec := do(t, a, as(nativeGet(sharedPath), guestCookies)) |
| 34 | var page sheetPageView |
| 35 | if err := json.Unmarshal(rec.Body.Bytes(), &page); err != nil { |
| 36 | t.Fatal(err) |
| 37 | } |
| 38 | if page.MayWrite || page.MayComment || page.MayShare { |
| 39 | t.Fatal("viewer offered editing permissions") |
| 40 | } |
| 41 | job, err := a.jobs.Start(signedInMember(t, a).Address, "Native test", "/sheets/1", func(context.Context, func(string)) error { return nil }) |
| 42 | if err != nil { |
| 43 | t.Fatal(err) |
| 44 | } |
| 45 | rec = do(t, a, as(nativeGet("/api/native/jobs/"+job.ID), guestCookies)) |
| 46 | if rec.Code != http.StatusNotFound { |
| 47 | t.Fatal("another subject read native import job") |
| 48 | } |
| 49 | rec = do(t, a, as(nativeGet("/api/native/jobs/"+job.ID), cookies)) |
| 50 | if rec.Code != 200 || !json.Valid(rec.Body.Bytes()) { |
| 51 | t.Fatalf("owner job response = %d", rec.Code) |
| 52 | } |
| 53 | } |
| 54 | |
amadan