mirror of
https://github.com/discourse/discourse.git
synced 2025-02-06 03:18:23 +00:00
eb5a3cfded
Discourse has the Discourse Connect Provider protocol that makes it possible to use a Discourse instance as an identity provider for external sites. As a natural extension to this protocol, this PR adds a new feature that makes it possible to use Discourse as a 2FA provider as well as an identity provider. The rationale for this change is that it's very difficult to implement 2FA support in a website and if you have multiple websites that need to have 2FA, it's unrealistic to build and maintain a separate 2FA implementation for each one. But with this change, you can piggyback on Discourse to take care of all the 2FA details for you for as many sites as you wish. To use Discourse as a 2FA provider, you'll need to follow this guide: https://meta.discourse.org/t/-/32974. It walks you through what you need to implement on your end/site and how to configure your Discourse instance. Once you're done, there is only one additional thing you need to do which is to include `require_2fa=true` in the payload that you send to Discourse. When Discourse sees `require_2fa=true`, it'll prompt the user to confirm their 2FA using whatever methods they've enabled (TOTP or security keys), and once they confirm they'll be redirected back to the return URL you've configured and the payload will contain `confirmed_2fa=true`. If the user has no 2FA methods enabled however, the payload will not contain `confirmed_2fa`, but it will contain `no_2fa_methods=true`. You'll need to be careful to re-run all the security checks and ensure the user can still access the resource on your site after they return from Discourse. This is very important because there's nothing that guarantees the user that will come back from Discourse after they confirm 2FA is the same user that you've redirected to Discourse. Internal ticket: t62183.
1312 lines
43 KiB
Ruby
1312 lines
43 KiB
Ruby
# frozen_string_literal: true
|
|
|
|
require 'discourse_ip_info'
|
|
require 'rotp'
|
|
|
|
RSpec.describe Admin::UsersController do
|
|
fab!(:admin) { Fabricate(:admin) }
|
|
fab!(:user) { Fabricate(:user) }
|
|
fab!(:coding_horror) { Fabricate(:coding_horror) }
|
|
|
|
it 'is a subclass of AdminController' do
|
|
expect(Admin::UsersController < Admin::AdminController).to eq(true)
|
|
end
|
|
|
|
before do
|
|
sign_in(admin)
|
|
end
|
|
|
|
describe '#index' do
|
|
it 'returns success with JSON' do
|
|
get "/admin/users/list.json"
|
|
expect(response.status).to eq(200)
|
|
expect(response.parsed_body).to be_present
|
|
end
|
|
|
|
context 'when showing emails' do
|
|
it "returns email for all the users" do
|
|
get "/admin/users/list.json", params: { show_emails: "true" }
|
|
expect(response.status).to eq(200)
|
|
data = response.parsed_body
|
|
data.each do |user|
|
|
expect(user["email"]).to be_present
|
|
end
|
|
end
|
|
|
|
it "logs only 1 entry" do
|
|
expect do
|
|
get "/admin/users/list.json", params: { show_emails: "true" }
|
|
end.to change { UserHistory.where(action: UserHistory.actions[:check_email], acting_user_id: admin.id).count }.by(1)
|
|
expect(response.status).to eq(200)
|
|
end
|
|
end
|
|
end
|
|
|
|
describe '#show' do
|
|
context 'an existing user' do
|
|
it 'returns success' do
|
|
get "/admin/users/#{user.id}.json"
|
|
expect(response.status).to eq(200)
|
|
end
|
|
|
|
it 'includes associated accounts' do
|
|
user.user_associated_accounts.create!(provider_name: 'pluginauth', provider_uid: 'pluginauth_uid')
|
|
|
|
get "/admin/users/#{user.id}.json"
|
|
expect(response.status).to eq(200)
|
|
expect(response.parsed_body['external_ids'].size).to eq(1)
|
|
expect(response.parsed_body['external_ids']['pluginauth']).to eq('pluginauth_uid')
|
|
end
|
|
end
|
|
|
|
context 'a non-existing user' do
|
|
it 'returns 404 error' do
|
|
get "/admin/users/0.json"
|
|
expect(response.status).to eq(404)
|
|
end
|
|
end
|
|
end
|
|
|
|
describe '#approve' do
|
|
let(:evil_trout) { Fabricate(:evil_trout) }
|
|
before do
|
|
SiteSetting.must_approve_users = true
|
|
end
|
|
|
|
it "raises an error when the user doesn't have permission" do
|
|
sign_in(user)
|
|
put "/admin/users/#{evil_trout.id}/approve.json"
|
|
expect(response.status).to eq(404)
|
|
evil_trout.reload
|
|
expect(evil_trout.approved).to eq(false)
|
|
end
|
|
|
|
it "will create a reviewable if one does not exist" do
|
|
evil_trout.update!(active: true)
|
|
expect(ReviewableUser.find_by(target: evil_trout)).to be_blank
|
|
put "/admin/users/#{evil_trout.id}/approve.json"
|
|
expect(response.code).to eq("200")
|
|
expect(ReviewableUser.find_by(target: evil_trout)).to be_present
|
|
expect(evil_trout.reload).to be_approved
|
|
end
|
|
|
|
it 'calls approve' do
|
|
Jobs.run_immediately!
|
|
evil_trout.activate
|
|
put "/admin/users/#{evil_trout.id}/approve.json"
|
|
expect(response.status).to eq(200)
|
|
evil_trout.reload
|
|
expect(evil_trout.approved).to eq(true)
|
|
expect(UserHistory.where(action: UserHistory.actions[:approve_user], target_user_id: evil_trout.id).count).to eq(1)
|
|
end
|
|
end
|
|
|
|
describe '#approve_bulk' do
|
|
before do
|
|
SiteSetting.must_approve_users = true
|
|
end
|
|
|
|
let(:evil_trout) { Fabricate(:evil_trout) }
|
|
|
|
it "does nothing without users" do
|
|
put "/admin/users/approve-bulk.json"
|
|
evil_trout.reload
|
|
expect(response.status).to eq(200)
|
|
expect(evil_trout.approved).to eq(false)
|
|
end
|
|
|
|
it "won't approve the user when not allowed" do
|
|
sign_in(user)
|
|
put "/admin/users/approve-bulk.json", params: { users: [evil_trout.id] }
|
|
expect(response.status).to eq(404)
|
|
evil_trout.reload
|
|
expect(evil_trout.approved).to eq(false)
|
|
end
|
|
|
|
it "approves the user when permitted" do
|
|
Jobs.run_immediately!
|
|
evil_trout.activate
|
|
put "/admin/users/approve-bulk.json", params: { users: [evil_trout.id] }
|
|
expect(response.status).to eq(200)
|
|
evil_trout.reload
|
|
expect(evil_trout.approved).to eq(true)
|
|
end
|
|
end
|
|
|
|
describe '#suspend' do
|
|
fab!(:created_post) { Fabricate(:post) }
|
|
let(:suspend_params) do
|
|
{ suspend_until: 5.hours.from_now,
|
|
reason: "because of this post",
|
|
post_id: created_post.id }
|
|
end
|
|
|
|
it "works properly" do
|
|
expect(user).not_to be_suspended
|
|
|
|
expect do
|
|
put "/admin/users/#{user.id}/suspend.json", params: {
|
|
suspend_until: 5.hours.from_now,
|
|
reason: "because I said so"
|
|
}
|
|
end.to change { Jobs::CriticalUserEmail.jobs.size }.by(0)
|
|
|
|
expect(response.status).to eq(200)
|
|
|
|
user.reload
|
|
expect(user).to be_suspended
|
|
expect(user.suspended_at).to be_present
|
|
expect(user.suspended_till).to be_present
|
|
|
|
log = UserHistory.where(target_user_id: user.id).order('id desc').first
|
|
expect(log.details).to match(/because I said so/)
|
|
end
|
|
|
|
it "checks if user is suspended" do
|
|
put "/admin/users/#{user.id}/suspend.json", params: {
|
|
suspend_until: 5.hours.from_now,
|
|
reason: "because I said so"
|
|
}
|
|
|
|
put "/admin/users/#{user.id}/suspend.json", params: {
|
|
suspend_until: 5.hours.from_now,
|
|
reason: "because I said so too"
|
|
}
|
|
|
|
expect(response.status).to eq(409)
|
|
expect(response.parsed_body["message"]).to eq(
|
|
I18n.t(
|
|
"user.already_suspended",
|
|
staff: admin.username,
|
|
time_ago: FreedomPatches::Rails4.time_ago_in_words(user.suspend_record.created_at, true, scope: :'datetime.distance_in_words_verbose')
|
|
)
|
|
)
|
|
end
|
|
|
|
it "requires suspend_until and reason" do
|
|
expect(user).not_to be_suspended
|
|
put "/admin/users/#{user.id}/suspend.json", params: {}
|
|
expect(response.status).to eq(400)
|
|
user.reload
|
|
expect(user).not_to be_suspended
|
|
|
|
expect(user).not_to be_suspended
|
|
put "/admin/users/#{user.id}/suspend.json", params: {
|
|
suspend_until: 5.hours.from_now
|
|
}
|
|
expect(response.status).to eq(400)
|
|
user.reload
|
|
expect(user).not_to be_suspended
|
|
end
|
|
|
|
context "with an associated post" do
|
|
it "can have an associated post" do
|
|
put "/admin/users/#{user.id}/suspend.json", params: suspend_params
|
|
|
|
expect(response.status).to eq(200)
|
|
|
|
log = UserHistory.where(target_user_id: user.id).order('id desc').first
|
|
expect(log.post_id).to eq(created_post.id)
|
|
end
|
|
|
|
it "can delete an associated post" do
|
|
put "/admin/users/#{user.id}/suspend.json", params: suspend_params.merge(post_action: 'delete')
|
|
created_post.reload
|
|
expect(created_post.deleted_at).to be_present
|
|
expect(response.status).to eq(200)
|
|
end
|
|
|
|
it "won't delete a category topic" do
|
|
c = Fabricate(:category_with_definition)
|
|
cat_post = c.topic.posts.first
|
|
put(
|
|
"/admin/users/#{user.id}/suspend.json",
|
|
params: suspend_params.merge(
|
|
post_action: 'delete',
|
|
post_id: cat_post.id
|
|
)
|
|
)
|
|
cat_post.reload
|
|
expect(cat_post.deleted_at).to be_blank
|
|
expect(response.status).to eq(200)
|
|
end
|
|
|
|
it "won't delete a category topic by replies" do
|
|
c = Fabricate(:category_with_definition)
|
|
cat_post = c.topic.posts.first
|
|
put(
|
|
"/admin/users/#{user.id}/suspend.json",
|
|
params: suspend_params.merge(
|
|
post_action: 'delete_replies',
|
|
post_id: cat_post.id
|
|
)
|
|
)
|
|
cat_post.reload
|
|
expect(cat_post.deleted_at).to be_blank
|
|
expect(response.status).to eq(200)
|
|
end
|
|
|
|
it "can delete an associated post and its replies" do
|
|
reply = PostCreator.create(
|
|
Fabricate(:user),
|
|
raw: 'this is the reply text',
|
|
reply_to_post_number: created_post.post_number,
|
|
topic_id: created_post.topic_id
|
|
)
|
|
nested_reply = PostCreator.create(
|
|
Fabricate(:user),
|
|
raw: 'this is the reply text2',
|
|
reply_to_post_number: reply.post_number,
|
|
topic_id: created_post.topic_id
|
|
)
|
|
put "/admin/users/#{user.id}/suspend.json", params: suspend_params.merge(post_action: 'delete_replies')
|
|
expect(created_post.reload.deleted_at).to be_present
|
|
expect(reply.reload.deleted_at).to be_present
|
|
expect(nested_reply.reload.deleted_at).to be_present
|
|
expect(response.status).to eq(200)
|
|
end
|
|
|
|
it "can edit an associated post" do
|
|
put "/admin/users/#{user.id}/suspend.json", params: suspend_params.merge(
|
|
post_action: 'edit',
|
|
post_edit: 'this is the edited content'
|
|
)
|
|
|
|
expect(response.status).to eq(200)
|
|
created_post.reload
|
|
expect(created_post.deleted_at).to be_blank
|
|
expect(created_post.raw).to eq("this is the edited content")
|
|
expect(response.status).to eq(200)
|
|
end
|
|
end
|
|
|
|
it "can send a message to the user" do
|
|
put "/admin/users/#{user.id}/suspend.json", params: {
|
|
suspend_until: 10.days.from_now,
|
|
reason: "short reason",
|
|
message: "long reason"
|
|
}
|
|
|
|
expect(response.status).to eq(200)
|
|
|
|
expect(Jobs::CriticalUserEmail.jobs.size).to eq(1)
|
|
job_args = Jobs::CriticalUserEmail.jobs.first["args"].first
|
|
expect(job_args["type"]).to eq("account_suspended")
|
|
expect(job_args["user_id"]).to eq(user.id)
|
|
|
|
log = UserHistory.where(target_user_id: user.id).order('id desc').first
|
|
expect(log).to be_present
|
|
expect(log.details).to match(/short reason/)
|
|
expect(log.details).to match(/long reason/)
|
|
end
|
|
|
|
it "also prevents use of any api keys" do
|
|
api_key = Fabricate(:api_key, user: user)
|
|
post "/bookmarks.json", params: {
|
|
post_id: Fabricate(:post).id
|
|
}, headers: { HTTP_API_KEY: api_key.key }
|
|
expect(response.status).to eq(200)
|
|
|
|
put "/admin/users/#{user.id}/suspend.json", params: suspend_params
|
|
expect(response.status).to eq(200)
|
|
|
|
user.reload
|
|
expect(user).to be_suspended
|
|
|
|
post "/bookmarks.json", params: {
|
|
post_id: Fabricate(:post).id
|
|
}, headers: { HTTP_API_KEY: api_key.key }
|
|
expect(response.status).to eq(403)
|
|
end
|
|
end
|
|
|
|
describe '#revoke_admin' do
|
|
fab!(:another_admin) { Fabricate(:admin) }
|
|
|
|
it 'raises an error unless the user can revoke access' do
|
|
sign_in(user)
|
|
put "/admin/users/#{another_admin.id}/revoke_admin.json"
|
|
expect(response.status).to eq(404)
|
|
another_admin.reload
|
|
expect(another_admin.admin).to eq(true)
|
|
end
|
|
|
|
it 'updates the admin flag' do
|
|
put "/admin/users/#{another_admin.id}/revoke_admin.json"
|
|
expect(response.status).to eq(200)
|
|
another_admin.reload
|
|
expect(another_admin.admin).to eq(false)
|
|
end
|
|
|
|
it 'returns detailed user schema' do
|
|
put "/admin/users/#{another_admin.id}/revoke_admin.json"
|
|
expect(response.parsed_body['can_be_merged']).to eq(true)
|
|
expect(response.parsed_body['can_be_deleted']).to eq(true)
|
|
expect(response.parsed_body['can_be_anonymized']).to eq(true)
|
|
expect(response.parsed_body['can_delete_all_posts']).to eq(true)
|
|
end
|
|
end
|
|
|
|
describe '#grant_admin' do
|
|
fab!(:another_user) { coding_horror }
|
|
|
|
after do
|
|
Discourse.redis.flushdb
|
|
end
|
|
|
|
it "returns a 404 when the acting user doesn't have permission" do
|
|
sign_in(user)
|
|
put "/admin/users/#{another_user.id}/grant_admin.json"
|
|
expect(response.status).to eq(404)
|
|
expect(AdminConfirmation.exists_for?(another_user.id)).to eq(false)
|
|
end
|
|
|
|
it "returns a 404 when the acting user doesn't have permission even if they have 2FA enabled" do
|
|
Fabricate(:user_second_factor_totp, user: user)
|
|
sign_in(user)
|
|
put "/admin/users/#{another_user.id}/grant_admin.json"
|
|
expect(response.status).to eq(404)
|
|
expect(AdminConfirmation.exists_for?(another_user.id)).to eq(false)
|
|
end
|
|
|
|
it "returns a 404 if the username doesn't exist" do
|
|
put "/admin/users/123123/grant_admin.json"
|
|
expect(response.status).to eq(404)
|
|
end
|
|
|
|
it 'sends a confirmation email if the acting admin does not have a second factor method enabled' do
|
|
expect(AdminConfirmation.exists_for?(another_user.id)).to eq(false)
|
|
put "/admin/users/#{another_user.id}/grant_admin.json"
|
|
expect(response.status).to eq(200)
|
|
expect(AdminConfirmation.exists_for?(another_user.id)).to eq(true)
|
|
end
|
|
|
|
it 'asks the acting admin for second factor if it is enabled' do
|
|
Fabricate(:user_second_factor_totp, user: admin)
|
|
|
|
put "/admin/users/#{another_user.id}/grant_admin.json", xhr: true
|
|
|
|
expect(response.parsed_body["second_factor_challenge_nonce"]).to be_present
|
|
expect(another_user.reload.admin).to eq(false)
|
|
end
|
|
|
|
it 'grants admin if second factor is correct' do
|
|
user_second_factor = Fabricate(:user_second_factor_totp, user: admin)
|
|
|
|
put "/admin/users/#{another_user.id}/grant_admin.json", xhr: true
|
|
nonce = response.parsed_body["second_factor_challenge_nonce"]
|
|
expect(nonce).to be_present
|
|
expect(another_user.reload.admin).to eq(false)
|
|
|
|
post "/session/2fa.json", params: {
|
|
nonce: nonce,
|
|
second_factor_token: ROTP::TOTP.new(user_second_factor.data).now,
|
|
second_factor_method: UserSecondFactor.methods[:totp]
|
|
}
|
|
res = response.parsed_body
|
|
expect(response.status).to eq(200)
|
|
expect(res["ok"]).to eq(true)
|
|
expect(res["callback_method"]).to eq("PUT")
|
|
expect(res["callback_path"]).to eq("/admin/users/#{another_user.id}/grant_admin.json")
|
|
expect(res["redirect_url"]).to eq("/admin/users/#{another_user.id}/#{another_user.username}")
|
|
expect(another_user.reload.admin).to eq(false)
|
|
|
|
put res["callback_path"], params: {
|
|
second_factor_nonce: nonce
|
|
}
|
|
expect(response.status).to eq(200)
|
|
expect(another_user.reload.admin).to eq(true)
|
|
end
|
|
|
|
it 'does not grant admin if second factor auth is not successful' do
|
|
user_second_factor = Fabricate(:user_second_factor_totp, user: admin)
|
|
|
|
put "/admin/users/#{another_user.id}/grant_admin.json", xhr: true
|
|
nonce = response.parsed_body["second_factor_challenge_nonce"]
|
|
expect(nonce).to be_present
|
|
expect(another_user.reload.admin).to eq(false)
|
|
|
|
token = ROTP::TOTP.new(user_second_factor.data).now.to_i
|
|
token = (token == 999_999 ? token - 1 : token + 1).to_s
|
|
post "/session/2fa.json", params: {
|
|
nonce: nonce,
|
|
second_factor_token: token,
|
|
second_factor_method: UserSecondFactor.methods[:totp]
|
|
}
|
|
expect(response.status).to eq(400)
|
|
expect(another_user.reload.admin).to eq(false)
|
|
|
|
put "/admin/users/#{another_user.id}/grant_admin.json", params: {
|
|
second_factor_nonce: nonce
|
|
}
|
|
expect(response.status).to eq(401)
|
|
expect(another_user.reload.admin).to eq(false)
|
|
end
|
|
|
|
it 'does not grant admin if the acting admin loses permission in the middle of the process' do
|
|
user_second_factor = Fabricate(:user_second_factor_totp, user: admin)
|
|
|
|
put "/admin/users/#{another_user.id}/grant_admin.json", xhr: true
|
|
nonce = response.parsed_body["second_factor_challenge_nonce"]
|
|
expect(nonce).to be_present
|
|
expect(another_user.reload.admin).to eq(false)
|
|
|
|
post "/session/2fa.json", params: {
|
|
nonce: nonce,
|
|
second_factor_token: ROTP::TOTP.new(user_second_factor.data).now,
|
|
second_factor_method: UserSecondFactor.methods[:totp]
|
|
}
|
|
res = response.parsed_body
|
|
expect(response.status).to eq(200)
|
|
expect(res["ok"]).to eq(true)
|
|
expect(res["callback_method"]).to eq("PUT")
|
|
expect(res["callback_path"]).to eq("/admin/users/#{another_user.id}/grant_admin.json")
|
|
expect(res["redirect_url"]).to eq("/admin/users/#{another_user.id}/#{another_user.username}")
|
|
expect(another_user.reload.admin).to eq(false)
|
|
|
|
admin.update!(admin: false)
|
|
put res["callback_path"], params: {
|
|
second_factor_nonce: nonce
|
|
}
|
|
expect(response.status).to eq(404)
|
|
expect(another_user.reload.admin).to eq(false)
|
|
end
|
|
|
|
it 'does not accept backup codes' do
|
|
Fabricate(:user_second_factor_totp, user: admin)
|
|
Fabricate(:user_second_factor_backup, user: admin)
|
|
|
|
put "/admin/users/#{another_user.id}/grant_admin.json", xhr: true
|
|
nonce = response.parsed_body["second_factor_challenge_nonce"]
|
|
expect(nonce).to be_present
|
|
expect(another_user.reload.admin).to eq(false)
|
|
|
|
post "/session/2fa.json", params: {
|
|
nonce: nonce,
|
|
second_factor_token: "iAmValidBackupCode",
|
|
second_factor_method: UserSecondFactor.methods[:backup_codes]
|
|
}
|
|
expect(response.status).to eq(403)
|
|
expect(another_user.reload.admin).to eq(false)
|
|
end
|
|
end
|
|
|
|
describe '#add_group' do
|
|
fab!(:group) { Fabricate(:group) }
|
|
|
|
it 'adds the user to the group' do
|
|
post "/admin/users/#{user.id}/groups.json", params: {
|
|
group_id: group.id
|
|
}
|
|
|
|
expect(response.status).to eq(200)
|
|
expect(GroupUser.where(user_id: user.id, group_id: group.id).exists?).to eq(true)
|
|
|
|
group_history = GroupHistory.last
|
|
|
|
expect(group_history.action).to eq(GroupHistory.actions[:add_user_to_group])
|
|
expect(group_history.acting_user).to eq(admin)
|
|
expect(group_history.target_user).to eq(user)
|
|
|
|
# Doing it again doesn't raise an error
|
|
post "/admin/users/#{user.id}/groups.json", params: {
|
|
group_id: group.id
|
|
}
|
|
|
|
expect(response.status).to eq(200)
|
|
end
|
|
|
|
it 'returns not-found error when there is no group' do
|
|
group.destroy!
|
|
|
|
put "/admin/users/#{user.id}/groups.json", params: {
|
|
group_id: group.id
|
|
}
|
|
|
|
expect(response.status).to eq(404)
|
|
end
|
|
|
|
it 'does not allow adding users to an automatic group' do
|
|
group.update!(automatic: true)
|
|
|
|
expect do
|
|
post "/admin/users/#{user.id}/groups.json", params: {
|
|
group_id: group.id
|
|
}
|
|
end.to_not change { group.users.count }
|
|
|
|
expect(response.status).to eq(422)
|
|
expect(response.parsed_body["errors"]).to eq(["You cannot modify an automatic group"])
|
|
end
|
|
end
|
|
|
|
describe '#remove_group' do
|
|
it "also clears the user's primary group" do
|
|
group = Fabricate(:group, users: [user])
|
|
user.update!(primary_group_id: group.id)
|
|
delete "/admin/users/#{user.id}/groups/#{group.id}.json"
|
|
|
|
expect(response.status).to eq(200)
|
|
expect(user.reload.primary_group).to eq(nil)
|
|
end
|
|
|
|
it 'returns not-found error when there is no group' do
|
|
delete "/admin/users/#{user.id}/groups/9090.json"
|
|
|
|
expect(response.status).to eq(404)
|
|
end
|
|
|
|
it 'does not allow removing owners from an automatic group' do
|
|
group = Fabricate(:group, users: [user], automatic: true)
|
|
|
|
delete "/admin/users/#{user.id}/groups/#{group.id}.json"
|
|
|
|
expect(response.status).to eq(422)
|
|
expect(response.parsed_body["errors"]).to eq(["You cannot modify an automatic group"])
|
|
end
|
|
end
|
|
|
|
describe '#trust_level' do
|
|
fab!(:another_user) {
|
|
coding_horror.update!(created_at: 1.month.ago)
|
|
coding_horror
|
|
}
|
|
|
|
it "raises an error when the user doesn't have permission" do
|
|
sign_in(user)
|
|
put "/admin/users/#{another_user.id}/trust_level.json"
|
|
expect(response.status).to eq(404)
|
|
end
|
|
|
|
it "returns a 404 if the username doesn't exist" do
|
|
put "/admin/users/123123/trust_level.json"
|
|
expect(response.status).to eq(404)
|
|
end
|
|
|
|
it "upgrades the user's trust level" do
|
|
put "/admin/users/#{another_user.id}/trust_level.json", params: { level: 2 }
|
|
|
|
expect(response.status).to eq(200)
|
|
another_user.reload
|
|
expect(another_user.trust_level).to eq(2)
|
|
|
|
expect(UserHistory.where(
|
|
target_user: another_user,
|
|
acting_user: admin,
|
|
action: UserHistory.actions[:change_trust_level]
|
|
).count).to eq(1)
|
|
end
|
|
|
|
it "raises no error when demoting a user below their current trust level (locks trust level)" do
|
|
stat = another_user.user_stat
|
|
stat.topics_entered = SiteSetting.tl1_requires_topics_entered + 1
|
|
stat.posts_read_count = SiteSetting.tl1_requires_read_posts + 1
|
|
stat.time_read = SiteSetting.tl1_requires_time_spent_mins * 60
|
|
stat.save!
|
|
another_user.update(trust_level: TrustLevel[1])
|
|
|
|
put "/admin/users/#{another_user.id}/trust_level.json", params: {
|
|
level: TrustLevel[0]
|
|
}
|
|
|
|
expect(response.status).to eq(200)
|
|
another_user.reload
|
|
expect(another_user.trust_level).to eq(TrustLevel[0])
|
|
expect(another_user.manual_locked_trust_level).to eq(TrustLevel[0])
|
|
end
|
|
end
|
|
|
|
describe '#grant_moderation' do
|
|
fab!(:another_user) { coding_horror }
|
|
|
|
it "raises an error when the user doesn't have permission" do
|
|
sign_in(user)
|
|
put "/admin/users/#{another_user.id}/grant_moderation.json"
|
|
expect(response.status).to eq(404)
|
|
end
|
|
|
|
it "returns a 404 if the username doesn't exist" do
|
|
put "/admin/users/123123/grant_moderation.json"
|
|
expect(response.status).to eq(404)
|
|
end
|
|
|
|
it 'updates the moderator flag' do
|
|
expect_enqueued_with(job: :send_system_message, args: {
|
|
user_id: another_user.id,
|
|
message_type: 'welcome_staff',
|
|
message_options: { role: :moderator }
|
|
}) do
|
|
put "/admin/users/#{another_user.id}/grant_moderation.json"
|
|
end
|
|
|
|
expect(response.status).to eq(200)
|
|
another_user.reload
|
|
expect(another_user.moderator).to eq(true)
|
|
end
|
|
|
|
it 'returns detailed user schema' do
|
|
put "/admin/users/#{another_user.id}/grant_moderation.json"
|
|
expect(response.parsed_body['can_be_merged']).to eq(false)
|
|
expect(response.parsed_body['can_be_anonymized']).to eq(false)
|
|
end
|
|
end
|
|
|
|
describe '#revoke_moderation' do
|
|
fab!(:moderator) { Fabricate(:moderator) }
|
|
|
|
it 'raises an error unless the user can revoke access' do
|
|
sign_in(user)
|
|
put "/admin/users/#{moderator.id}/revoke_moderation.json"
|
|
expect(response.status).to eq(404)
|
|
moderator.reload
|
|
expect(moderator.moderator).to eq(true)
|
|
end
|
|
|
|
it 'updates the moderator flag' do
|
|
put "/admin/users/#{moderator.id}/revoke_moderation.json"
|
|
expect(response.status).to eq(200)
|
|
moderator.reload
|
|
expect(moderator.moderator).to eq(false)
|
|
end
|
|
|
|
it 'returns detailed user schema' do
|
|
put "/admin/users/#{moderator.id}/revoke_moderation.json"
|
|
expect(response.parsed_body['can_be_merged']).to eq(true)
|
|
expect(response.parsed_body['can_be_anonymized']).to eq(true)
|
|
end
|
|
end
|
|
|
|
describe '#primary_group' do
|
|
fab!(:group) { Fabricate(:group) }
|
|
fab!(:another_user) { coding_horror }
|
|
fab!(:another_group) { Fabricate(:group, title: 'New') }
|
|
|
|
it "raises an error when the user doesn't have permission" do
|
|
sign_in(user)
|
|
put "/admin/users/#{another_user.id}/primary_group.json"
|
|
expect(response.status).to eq(404)
|
|
another_user.reload
|
|
expect(another_user.primary_group_id).to eq(nil)
|
|
end
|
|
|
|
it "returns a 404 if the user doesn't exist" do
|
|
put "/admin/users/123123/primary_group.json"
|
|
expect(response.status).to eq(404)
|
|
end
|
|
|
|
it "changes the user's primary group" do
|
|
group.add(another_user)
|
|
put "/admin/users/#{another_user.id}/primary_group.json", params: {
|
|
primary_group_id: group.id
|
|
}
|
|
|
|
expect(response.status).to eq(200)
|
|
another_user.reload
|
|
expect(another_user.primary_group_id).to eq(group.id)
|
|
end
|
|
|
|
it "doesn't change primary group if they aren't a member of the group" do
|
|
put "/admin/users/#{another_user.id}/primary_group.json", params: {
|
|
primary_group_id: group.id
|
|
}
|
|
|
|
expect(response.status).to eq(200)
|
|
another_user.reload
|
|
expect(another_user.primary_group_id).to eq(nil)
|
|
end
|
|
|
|
it "remove user's primary group" do
|
|
group.add(another_user)
|
|
|
|
put "/admin/users/#{another_user.id}/primary_group.json", params: {
|
|
primary_group_id: ""
|
|
}
|
|
|
|
expect(response.status).to eq(200)
|
|
another_user.reload
|
|
expect(another_user.primary_group_id).to eq(nil)
|
|
end
|
|
|
|
it "updates user's title when it matches the previous primary group title" do
|
|
group.update_columns(primary_group: true, title: 'Previous')
|
|
group.add(another_user)
|
|
another_group.add(another_user)
|
|
|
|
expect(another_user.reload.title).to eq('Previous')
|
|
|
|
put "/admin/users/#{another_user.id}/primary_group.json", params: {
|
|
primary_group_id: another_group.id
|
|
}
|
|
|
|
another_user.reload
|
|
expect(response.status).to eq(200)
|
|
expect(another_user.primary_group_id).to eq(another_group.id)
|
|
expect(another_user.title).to eq('New')
|
|
end
|
|
|
|
it "doesn't update user's title when it does not match the previous primary group title" do
|
|
another_user.update_columns(title: 'Different')
|
|
group.update_columns(primary_group: true, title: 'Previous')
|
|
another_group.add(another_user)
|
|
group.add(another_user)
|
|
|
|
expect(another_user.reload.title).to eq('Different')
|
|
|
|
put "/admin/users/#{another_user.id}/primary_group.json", params: {
|
|
primary_group_id: another_group.id
|
|
}
|
|
|
|
another_user.reload
|
|
expect(response.status).to eq(200)
|
|
expect(another_user.primary_group_id).to eq(another_group.id)
|
|
expect(another_user.title).to eq('Different')
|
|
end
|
|
end
|
|
|
|
describe '#destroy' do
|
|
fab!(:delete_me) { Fabricate(:user) }
|
|
|
|
it "returns a 403 if the user doesn't exist" do
|
|
delete "/admin/users/123123drink.json"
|
|
expect(response.status).to eq(403)
|
|
end
|
|
|
|
context "user has post" do
|
|
let(:topic) { Fabricate(:topic, user: delete_me) }
|
|
let!(:post) { Fabricate(:post, topic: topic, user: delete_me) }
|
|
|
|
it "returns an api response that the user can't be deleted because it has posts" do
|
|
post_count = delete_me.posts.joins(:topic).count
|
|
delete_me_topic = Fabricate(:topic)
|
|
Fabricate(:post, topic: delete_me_topic, user: delete_me)
|
|
PostDestroyer.new(admin, delete_me_topic.first_post, context: "Deleted by admin").destroy
|
|
|
|
delete "/admin/users/#{delete_me.id}.json"
|
|
expect(response.status).to eq(403)
|
|
json = response.parsed_body
|
|
expect(json['deleted']).to eq(false)
|
|
expect(json['message']).to eq(I18n.t("user.cannot_delete_has_posts", username: delete_me.username, count: post_count))
|
|
end
|
|
|
|
it "doesn't return an error if delete_posts == true" do
|
|
delete "/admin/users/#{delete_me.id}.json", params: { delete_posts: true }
|
|
expect(response.status).to eq(200)
|
|
expect(Post.where(id: post.id).count).to eq(0)
|
|
expect(Topic.where(id: topic.id).count).to eq(0)
|
|
expect(User.where(id: delete_me.id).count).to eq(0)
|
|
end
|
|
|
|
context "user has reviewable flagged post which was handled" do
|
|
let!(:reviewable) { Fabricate(:reviewable_flagged_post, created_by: admin, target_created_by: delete_me, target: post, topic: topic, status: 4) }
|
|
|
|
it "deletes the user record" do
|
|
delete "/admin/users/#{delete_me.id}.json", params: { delete_posts: true, delete_as_spammer: true }
|
|
expect(response.status).to eq(200)
|
|
expect(User.where(id: delete_me.id).count).to eq(0)
|
|
end
|
|
end
|
|
end
|
|
|
|
it "deletes the user record" do
|
|
delete "/admin/users/#{delete_me.id}.json"
|
|
expect(response.status).to eq(200)
|
|
expect(User.where(id: delete_me.id).count).to eq(0)
|
|
end
|
|
end
|
|
|
|
describe '#activate' do
|
|
fab!(:reg_user) { Fabricate(:inactive_user) }
|
|
|
|
it "returns success" do
|
|
put "/admin/users/#{reg_user.id}/activate.json"
|
|
expect(response.status).to eq(200)
|
|
json = response.parsed_body
|
|
expect(json['success']).to eq("OK")
|
|
reg_user.reload
|
|
expect(reg_user.active).to eq(true)
|
|
end
|
|
|
|
it "should confirm email even when the tokens are expired" do
|
|
reg_user.email_tokens.update_all(confirmed: false, expired: true)
|
|
|
|
reg_user.reload
|
|
expect(reg_user.email_confirmed?).to eq(false)
|
|
|
|
put "/admin/users/#{reg_user.id}/activate.json"
|
|
expect(response.status).to eq(200)
|
|
|
|
reg_user.reload
|
|
expect(reg_user.email_confirmed?).to eq(true)
|
|
end
|
|
end
|
|
|
|
describe '#deactivate' do
|
|
fab!(:reg_user) { Fabricate(:active_user) }
|
|
|
|
it "returns success" do
|
|
put "/admin/users/#{reg_user.id}/deactivate.json"
|
|
expect(response.status).to eq(200)
|
|
json = response.parsed_body
|
|
expect(json['success']).to eq("OK")
|
|
reg_user.reload
|
|
expect(reg_user.active).to eq(false)
|
|
end
|
|
end
|
|
|
|
describe '#log_out' do
|
|
fab!(:reg_user) { Fabricate(:user) }
|
|
|
|
it "returns success" do
|
|
post "/admin/users/#{reg_user.id}/log_out.json"
|
|
expect(response.status).to eq(200)
|
|
json = response.parsed_body
|
|
expect(json['success']).to eq("OK")
|
|
end
|
|
|
|
it "returns 404 when user_id does not exist" do
|
|
post "/admin/users/123123drink/log_out.json"
|
|
expect(response.status).to eq(404)
|
|
end
|
|
end
|
|
|
|
describe '#silence' do
|
|
fab!(:reg_user) { Fabricate(:user) }
|
|
|
|
it "raises an error when the user doesn't have permission" do
|
|
sign_in(user)
|
|
put "/admin/users/#{reg_user.id}/silence.json"
|
|
expect(response.status).to eq(404)
|
|
reg_user.reload
|
|
expect(reg_user).not_to be_silenced
|
|
end
|
|
|
|
it "returns a 404 if the user doesn't exist" do
|
|
put "/admin/users/123123/silence.json"
|
|
expect(response.status).to eq(404)
|
|
end
|
|
|
|
it "punishes the user for spamming" do
|
|
put "/admin/users/#{reg_user.id}/silence.json"
|
|
expect(response.status).to eq(200)
|
|
reg_user.reload
|
|
expect(reg_user).to be_silenced
|
|
end
|
|
|
|
it "can have an associated post" do
|
|
silence_post = Fabricate(:post, user: reg_user)
|
|
|
|
put "/admin/users/#{reg_user.id}/silence.json", params: {
|
|
post_id: silence_post.id,
|
|
post_action: 'edit',
|
|
post_edit: "this is the new contents for the post"
|
|
}
|
|
expect(response.status).to eq(200)
|
|
|
|
silence_post.reload
|
|
expect(silence_post.raw).to eq("this is the new contents for the post")
|
|
|
|
log = UserHistory.where(
|
|
target_user_id: reg_user.id,
|
|
action: UserHistory.actions[:silence_user]
|
|
).first
|
|
expect(log).to be_present
|
|
expect(log.post_id).to eq(silence_post.id)
|
|
|
|
reg_user.reload
|
|
expect(reg_user).to be_silenced
|
|
end
|
|
|
|
it "will set a length of time if provided" do
|
|
future_date = 1.month.from_now.to_date
|
|
put "/admin/users/#{reg_user.id}/silence.json", params: {
|
|
silenced_till: future_date
|
|
}
|
|
|
|
expect(response.status).to eq(200)
|
|
reg_user.reload
|
|
expect(reg_user).to be_silenced
|
|
expect(reg_user.silenced_till).to eq(future_date)
|
|
end
|
|
|
|
it "will send a message if provided" do
|
|
expect do
|
|
put "/admin/users/#{reg_user.id}/silence.json", params: {
|
|
message: "Email this to the user"
|
|
}
|
|
end.to change { Jobs::CriticalUserEmail.jobs.size }.by(1)
|
|
|
|
expect(response.status).to eq(200)
|
|
reg_user.reload
|
|
expect(reg_user).to be_silenced
|
|
end
|
|
|
|
it "checks if user is silenced" do
|
|
put "/admin/users/#{user.id}/silence.json", params: {
|
|
silenced_till: 5.hours.from_now,
|
|
reason: "because I said so"
|
|
}
|
|
|
|
put "/admin/users/#{user.id}/silence.json", params: {
|
|
silenced_till: 5.hours.from_now,
|
|
reason: "because I said so too"
|
|
}
|
|
|
|
expect(response.status).to eq(409)
|
|
expect(response.parsed_body["message"]).to eq(
|
|
I18n.t(
|
|
"user.already_silenced",
|
|
staff: admin.username,
|
|
time_ago: FreedomPatches::Rails4.time_ago_in_words(user.silenced_record.created_at, true, scope: :'datetime.distance_in_words_verbose')
|
|
)
|
|
)
|
|
end
|
|
end
|
|
|
|
describe '#unsilence' do
|
|
fab!(:reg_user) { Fabricate(:user, silenced_till: 10.years.from_now) }
|
|
|
|
it "raises an error when the user doesn't have permission" do
|
|
sign_in(user)
|
|
put "/admin/users/#{reg_user.id}/unsilence.json"
|
|
expect(response.status).to eq(404)
|
|
end
|
|
|
|
it "returns a 403 if the user doesn't exist" do
|
|
put "/admin/users/123123/unsilence.json"
|
|
expect(response.status).to eq(404)
|
|
end
|
|
|
|
it "unsilences the user" do
|
|
put "/admin/users/#{reg_user.id}/unsilence.json"
|
|
expect(response.status).to eq(200)
|
|
reg_user.reload
|
|
expect(reg_user.silenced?).to eq(false)
|
|
log = UserHistory.where(
|
|
target_user_id: reg_user.id,
|
|
action: UserHistory.actions[:unsilence_user]
|
|
).first
|
|
expect(log).to be_present
|
|
end
|
|
end
|
|
|
|
describe '#ip_info' do
|
|
it "retrieves IP info" do
|
|
ip = "81.2.69.142"
|
|
|
|
DiscourseIpInfo.open_db(File.join(Rails.root, 'spec', 'fixtures', 'mmdb'))
|
|
Resolv::DNS.any_instance.stubs(:getname).with(ip).returns("ip-81-2-69-142.example.com")
|
|
|
|
get "/admin/users/ip-info.json", params: { ip: ip }
|
|
expect(response.status).to eq(200)
|
|
expect(response.parsed_body.symbolize_keys).to eq(
|
|
city: "London",
|
|
country: "United Kingdom",
|
|
country_code: "GB",
|
|
geoname_ids: [6255148, 2635167, 2643743, 6269131],
|
|
hostname: "ip-81-2-69-142.example.com",
|
|
location: "London, England, United Kingdom",
|
|
region: "England",
|
|
latitude: 51.5142,
|
|
longitude: -0.0931,
|
|
)
|
|
end
|
|
end
|
|
|
|
describe '#delete_other_accounts_with_same_ip' do
|
|
it "works" do
|
|
user_a = Fabricate(:user, ip_address: "42.42.42.42")
|
|
user_b = Fabricate(:user, ip_address: "42.42.42.42")
|
|
|
|
delete "/admin/users/delete-others-with-same-ip.json", params: {
|
|
ip: "42.42.42.42", exclude: -1, order: "trust_level DESC"
|
|
}
|
|
expect(response.status).to eq(200)
|
|
expect(User.where(id: user_a.id).count).to eq(0)
|
|
expect(User.where(id: user_b.id).count).to eq(0)
|
|
end
|
|
end
|
|
|
|
describe '#sync_sso' do
|
|
let(:sso) { DiscourseConnectBase.new }
|
|
let(:sso_secret) { "sso secret" }
|
|
|
|
before do
|
|
SiteSetting.email_editable = false
|
|
SiteSetting.discourse_connect_url = "https://www.example.com/sso"
|
|
SiteSetting.enable_discourse_connect = true
|
|
SiteSetting.auth_overrides_email = true
|
|
SiteSetting.auth_overrides_name = true
|
|
SiteSetting.auth_overrides_username = true
|
|
SiteSetting.discourse_connect_secret = sso_secret
|
|
sso.sso_secret = sso_secret
|
|
end
|
|
|
|
it 'can sync up with the sso' do
|
|
sso.name = "Bob The Bob"
|
|
sso.username = "bob"
|
|
sso.email = "bob@bob.com"
|
|
sso.external_id = "1"
|
|
|
|
user = DiscourseConnect.parse(sso.payload, secure_session: read_secure_session).lookup_or_create_user
|
|
|
|
sso.name = "Bill"
|
|
sso.username = "Hokli$$!!"
|
|
sso.email = "bob2@bob.com"
|
|
|
|
post "/admin/users/sync_sso.json", params: Rack::Utils.parse_query(sso.payload)
|
|
expect(response.status).to eq(200)
|
|
|
|
user.reload
|
|
expect(user.email).to eq("bob2@bob.com")
|
|
expect(user.name).to eq("Bill")
|
|
expect(user.username).to eq("Hokli")
|
|
end
|
|
|
|
it 'should create new users' do
|
|
sso.name = "Dr. Claw"
|
|
sso.username = "dr_claw"
|
|
sso.email = "dr@claw.com"
|
|
sso.external_id = "2"
|
|
post "/admin/users/sync_sso.json", params: Rack::Utils.parse_query(sso.payload)
|
|
expect(response.status).to eq(200)
|
|
|
|
user = User.find_by_email('dr@claw.com')
|
|
expect(user).to be_present
|
|
expect(user.ip_address).to be_blank
|
|
end
|
|
|
|
it "triggers :sync_sso DiscourseEvent" do
|
|
sso.name = "Bob The Bob"
|
|
sso.username = "bob"
|
|
sso.email = "bob@bob.com"
|
|
sso.external_id = "1"
|
|
|
|
user = DiscourseConnect.parse(sso.payload, secure_session: read_secure_session).lookup_or_create_user
|
|
|
|
sso.name = "Bill"
|
|
sso.username = "Hokli$$!!"
|
|
sso.email = "bob2@bob.com"
|
|
|
|
events = DiscourseEvent.track_events do
|
|
post "/admin/users/sync_sso.json", params: Rack::Utils.parse_query(sso.payload)
|
|
end
|
|
expect(events).to include(event_name: :sync_sso, params: [user])
|
|
end
|
|
|
|
it 'should return the right message if the record is invalid' do
|
|
sso.email = ""
|
|
sso.name = ""
|
|
sso.external_id = "1"
|
|
|
|
post "/admin/users/sync_sso.json", params: Rack::Utils.parse_query(sso.payload)
|
|
expect(response.status).to eq(403)
|
|
expect(response.parsed_body["message"]).to include("Primary email can't be blank")
|
|
end
|
|
|
|
it 'should return the right message if the signature is invalid' do
|
|
sso.name = "Dr. Claw"
|
|
sso.username = "dr_claw"
|
|
sso.email = "dr@claw.com"
|
|
sso.external_id = "2"
|
|
|
|
correct_payload = Rack::Utils.parse_query(sso.payload)
|
|
post "/admin/users/sync_sso.json", params: correct_payload.merge(sig: "someincorrectsignature")
|
|
expect(response.status).to eq(422)
|
|
expect(response.parsed_body["message"]).to include(I18n.t('discourse_connect.login_error'))
|
|
expect(response.parsed_body["message"]).not_to include(correct_payload["sig"])
|
|
end
|
|
|
|
it "returns 404 if the external id does not exist" do
|
|
sso.name = "Dr. Claw"
|
|
sso.username = "dr_claw"
|
|
sso.email = "dr@claw.com"
|
|
sso.external_id = ""
|
|
post "/admin/users/sync_sso.json", params: Rack::Utils.parse_query(sso.payload)
|
|
expect(response.status).to eq(422)
|
|
expect(response.parsed_body["message"]).to include(I18n.t('discourse_connect.blank_id_error'))
|
|
end
|
|
end
|
|
|
|
describe '#disable_second_factor' do
|
|
let(:second_factor) { user.create_totp(enabled: true) }
|
|
let(:second_factor_backup) { user.generate_backup_codes }
|
|
let(:security_key) { Fabricate(:user_security_key, user: user) }
|
|
|
|
describe 'as an admin' do
|
|
before do
|
|
sign_in(admin)
|
|
second_factor
|
|
second_factor_backup
|
|
security_key
|
|
expect(user.reload.user_second_factors.totps.first).to eq(second_factor)
|
|
end
|
|
|
|
it 'should able to disable the second factor for another user' do
|
|
expect do
|
|
put "/admin/users/#{user.id}/disable_second_factor.json"
|
|
end.to change { Jobs::CriticalUserEmail.jobs.length }.by(1)
|
|
|
|
expect(response.status).to eq(200)
|
|
expect(user.reload.user_second_factors).to be_empty
|
|
expect(user.reload.security_keys).to be_empty
|
|
|
|
job_args = Jobs::CriticalUserEmail.jobs.first["args"].first
|
|
|
|
expect(job_args["user_id"]).to eq(user.id)
|
|
expect(job_args["type"]).to eq('account_second_factor_disabled')
|
|
end
|
|
|
|
it 'should not be able to disable the second factor for the current user' do
|
|
put "/admin/users/#{admin.id}/disable_second_factor.json"
|
|
|
|
expect(response.status).to eq(403)
|
|
end
|
|
|
|
describe 'when user has only one second factor type enabled' do
|
|
it 'should succeed with security keys' do
|
|
user.user_second_factors.destroy_all
|
|
|
|
put "/admin/users/#{user.id}/disable_second_factor.json"
|
|
|
|
expect(response.status).to eq(200)
|
|
end
|
|
it 'should succeed with totp' do
|
|
user.security_keys.destroy_all
|
|
|
|
put "/admin/users/#{user.id}/disable_second_factor.json"
|
|
|
|
expect(response.status).to eq(200)
|
|
end
|
|
end
|
|
|
|
describe 'when user does not have second factor enabled' do
|
|
it 'should raise the right error' do
|
|
user.user_second_factors.destroy_all
|
|
user.security_keys.destroy_all
|
|
|
|
put "/admin/users/#{user.id}/disable_second_factor.json"
|
|
|
|
expect(response.status).to eq(400)
|
|
end
|
|
end
|
|
end
|
|
end
|
|
|
|
describe "#penalty_history" do
|
|
fab!(:moderator) { Fabricate(:moderator) }
|
|
let(:logger) { StaffActionLogger.new(admin) }
|
|
|
|
it "doesn't allow moderators to clear a user's history" do
|
|
sign_in(moderator)
|
|
delete "/admin/users/#{user.id}/penalty_history.json"
|
|
expect(response.code).to eq("404")
|
|
end
|
|
|
|
def find_logs(action)
|
|
UserHistory.where(target_user_id: user.id, action: UserHistory.actions[action])
|
|
end
|
|
|
|
it "allows admins to clear a user's history" do
|
|
logger.log_user_suspend(user, "suspend reason")
|
|
logger.log_user_unsuspend(user)
|
|
logger.log_unsilence_user(user)
|
|
logger.log_silence_user(user)
|
|
|
|
sign_in(admin)
|
|
delete "/admin/users/#{user.id}/penalty_history.json"
|
|
expect(response.code).to eq("200")
|
|
|
|
expect(find_logs(:suspend_user)).to be_blank
|
|
expect(find_logs(:unsuspend_user)).to be_blank
|
|
expect(find_logs(:silence_user)).to be_blank
|
|
expect(find_logs(:unsilence_user)).to be_blank
|
|
|
|
expect(find_logs(:removed_suspend_user)).to be_present
|
|
expect(find_logs(:removed_unsuspend_user)).to be_present
|
|
expect(find_logs(:removed_silence_user)).to be_present
|
|
expect(find_logs(:removed_unsilence_user)).to be_present
|
|
end
|
|
|
|
end
|
|
|
|
describe "#delete_posts_batch" do
|
|
describe 'when user is is invalid' do
|
|
it 'should return the right response' do
|
|
put "/admin/users/nothing/delete_posts_batch.json"
|
|
|
|
expect(response.status).to eq(404)
|
|
end
|
|
end
|
|
|
|
context "when there are user posts" do
|
|
before do
|
|
post = Fabricate(:post, user: user)
|
|
Fabricate(:post, topic: post.topic, user: user)
|
|
Fabricate(:post, user: user)
|
|
end
|
|
|
|
it 'returns how many posts were deleted' do
|
|
put "/admin/users/#{user.id}/delete_posts_batch.json"
|
|
expect(response.status).to eq(200)
|
|
expect(response.parsed_body["posts_deleted"]).to eq(3)
|
|
end
|
|
end
|
|
|
|
context "when there are no posts left to be deleted" do
|
|
it "returns correct json" do
|
|
put "/admin/users/#{user.id}/delete_posts_batch.json"
|
|
expect(response.status).to eq(200)
|
|
expect(response.parsed_body["posts_deleted"]).to eq(0)
|
|
end
|
|
end
|
|
end
|
|
|
|
describe "#merge" do
|
|
fab!(:target_user) { Fabricate(:user) }
|
|
fab!(:topic) { Fabricate(:topic, user: user) }
|
|
fab!(:first_post) { Fabricate(:post, topic: topic, user: user) }
|
|
|
|
it 'should merge source user to target user' do
|
|
Jobs.run_immediately!
|
|
post "/admin/users/#{user.id}/merge.json", params: {
|
|
target_username: target_user.username
|
|
}
|
|
|
|
expect(response.status).to eq(200)
|
|
expect(topic.reload.user_id).to eq(target_user.id)
|
|
expect(first_post.reload.user_id).to eq(target_user.id)
|
|
end
|
|
end
|
|
|
|
describe '#sso_record' do
|
|
fab!(:sso_record) { SingleSignOnRecord.create!(user_id: user.id, external_id: '12345', external_email: user.email, last_payload: '') }
|
|
|
|
it "deletes the record" do
|
|
SiteSetting.discourse_connect_url = "https://www.example.com/sso"
|
|
SiteSetting.enable_discourse_connect = true
|
|
|
|
delete "/admin/users/#{user.id}/sso_record.json"
|
|
expect(response.status).to eq(200)
|
|
expect(user.single_sign_on_record).to eq(nil)
|
|
end
|
|
end
|
|
|
|
describe "#anonymize" do
|
|
it "will make the user anonymous" do
|
|
put "/admin/users/#{user.id}/anonymize.json"
|
|
expect(response.status).to eq(200)
|
|
expect(response.parsed_body['username']).to be_present
|
|
end
|
|
|
|
it "supports `anonymize_ip`" do
|
|
Jobs.run_immediately!
|
|
sl = Fabricate(:search_log, user_id: user.id)
|
|
put "/admin/users/#{user.id}/anonymize.json?anonymize_ip=127.0.0.2"
|
|
expect(response.status).to eq(200)
|
|
expect(response.parsed_body['username']).to be_present
|
|
expect(sl.reload.ip_address).to eq('127.0.0.2')
|
|
end
|
|
end
|
|
|
|
end
|