mirrors/hedgedoc
1
0
Fork 0
mirror of https://github.com/hedgedoc/hedgedoc.git synced 2025-05-24 03:57:06 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

feat: Add guest file uploads and add deletion for note owners

Browse source 
Signed-off-by: Yannick Bungers <git@innay.de>
Signed-off-by: Tilman Vatteroth <git@tilmanvatteroth.de>
This commit is contained in:
Yannick Bungers 2023-03-25 17:47:46 +01:00 • committed by Yannick Bungers
parent 0f464dedfe
commit 485f7cd338
8 changed files with 244 additions and 68 deletions
Download patch file Download diff file Expand all files Collapse all files

79
backend/test/public-api/media.e2e-spec.ts
View file

@ -126,5 +126,84 @@ describe('Media', () => {
.set('Authorization', `Bearer ${testSetup.authTokens[1].secret}`)
.expect(403);
});
it('deleting user is owner of file', async () => {
// upload a file with the default test user
const testNote = await testSetup.notesService.createNote(
'test content',
null,
'test_delete_media_file',
);
const testImage = await fs.readFile('test/public-api/fixtures/test.png');
const upload = await testSetup.mediaService.saveFile(
testImage,
testSetup.users[0],
testNote,
);
const filename = upload.fileUrl.split('/').pop() || '';
const agent2 = request.agent(testSetup.app.getHttpServer());
// try to delete upload with second user
await agent2
.delete('/api/v2/media/' + filename)
.set('Authorization', `Bearer ${testSetup.authTokens[1].secret}`)
.expect(403);
await agent2
.get('/uploads/' + filename)
.set('Authorization', `Bearer ${testSetup.authTokens[1].secret}`)
.expect(200);
// delete upload for real
await agent2
.delete('/api/v2/media/' + filename)
.set('Authorization', `Bearer ${testSetup.authTokens[0].secret}`)
.expect(204);
// Test if file is really deleted
await agent2
.get('/uploads/' + filename)
.set('Authorization', `Bearer ${testSetup.authTokens[1].secret}`)
.expect(404);
});
it('deleting user is owner of note', async () => {
// upload a file with the default test user
const testNote = await testSetup.notesService.createNote(
'test content',
testSetup.users[2],
'test_delete_media_note',
);
const testImage = await fs.readFile('test/public-api/fixtures/test.png');
const upload = await testSetup.mediaService.saveFile(
testImage,
testSetup.users[0],
testNote,
);
const filename = upload.fileUrl.split('/').pop() || '';
const agent2 = request.agent(testSetup.app.getHttpServer());
// try to delete upload with second user
await agent2
.delete('/api/v2/media/' + filename)
.set('Authorization', `Bearer ${testSetup.authTokens[1].secret}`)
.expect(403);
await agent2
.get('/uploads/' + filename)
.set('Authorization', `Bearer ${testSetup.authTokens[1].secret}`)
.expect(200);
// delete upload for real
await agent2
.delete('/api/v2/media/' + filename)
.set('Authorization', `Bearer ${testSetup.authTokens[2].secret}`)
.expect(204);
// Test if file is really deleted
await agent2
.get('/uploads/' + filename)
.set('Authorization', `Bearer ${testSetup.authTokens[1].secret}`)
.expect(404);
});
});
});