Skip to content

Commit 20ae5ea

Browse files
Toastbrot236Toastbrot236
committed
Add tests against admin/mod trolling
1 parent e1af304 commit 20ae5ea

2 files changed

Lines changed: 215 additions & 0 deletions

File tree

‎RefreshTests.GameServer/Tests/ApiV3/AdminUserEditApiTests.cs‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -311,4 +311,52 @@ public void OnlyRenameToValidUsernames(string newUsername, bool isValid)
311311
Assert.That(updated!.Username, Is.Not.EqualTo(newUsername));
312312
}
313313
}
314+
315+
[Test]
316+
public void ModeratorsMayNotUpdateMetadataOfAdminsAndModerators()
317+
{
318+
using TestContext context = this.GetServer();
319+
GameUser admin = context.CreateUser(role: GameUserRole.Admin);
320+
GameUser mod = context.CreateUser(role: GameUserRole.Moderator);
321+
GameUser mod2 = context.CreateUser(role: GameUserRole.Moderator);
322+
GameUser user = context.CreateUser(role: GameUserRole.User);
323+
HttpClient client = context.GetAuthenticatedClient(TokenType.Api, mod);
324+
ApiAdminUpdateUserRequest request = new()
325+
{
326+
Username = "hahahalol",
327+
Description = "pee"
328+
};
329+
330+
// Admin
331+
ApiResponse<ApiExtendedGameUserResponse>? response = client.PatchData<ApiExtendedGameUserResponse>($"/api/v3/admin/users/uuid/{admin.UserId}", request, false, true);
332+
Assert.That(response?.Error, Is.Not.Null);
333+
Assert.That(response!.Error!.StatusCode, Is.EqualTo(BadRequest));
334+
context.Database.Refresh();
335+
336+
GameUser? updated = context.Database.GetUserByObjectId(admin.UserId);
337+
Assert.That(updated, Is.Not.Null);
338+
Assert.That(updated!.Username, Is.Not.EqualTo(request.Username));
339+
Assert.That(updated!.Description, Is.Not.EqualTo(request.Description));
340+
341+
// Mod
342+
response = client.PatchData<ApiExtendedGameUserResponse>($"/api/v3/admin/users/uuid/{mod2.UserId}", request, false, true);
343+
Assert.That(response?.Error, Is.Not.Null);
344+
Assert.That(response!.Error!.StatusCode, Is.EqualTo(BadRequest));
345+
context.Database.Refresh();
346+
347+
updated = context.Database.GetUserByObjectId(mod2.UserId);
348+
Assert.That(updated, Is.Not.Null);
349+
Assert.That(updated!.Username, Is.Not.EqualTo(request.Username));
350+
Assert.That(updated!.Description, Is.Not.EqualTo(request.Description));
351+
352+
// User
353+
response = client.PatchData<ApiExtendedGameUserResponse>($"/api/v3/admin/users/uuid/{user.UserId}", request, true, false);
354+
Assert.That(response?.Data, Is.Not.Null);
355+
context.Database.Refresh();
356+
357+
updated = context.Database.GetUserByObjectId(user.UserId);
358+
Assert.That(updated, Is.Not.Null);
359+
Assert.That(updated!.Username, Is.EqualTo(request.Username));
360+
Assert.That(updated!.Description, Is.EqualTo(request.Description));
361+
}
314362
}

‎RefreshTests.GameServer/Tests/ApiV3/AdminUserManagementApiTests.cs‎

Lines changed: 167 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
using Refresh.Interfaces.APIv3.Endpoints.DataTypes.Response.Admin;
99
using Refresh.Interfaces.APIv3.Endpoints.ApiTypes;
1010
using Refresh.Common.Extensions;
11+
using Refresh.Interfaces.APIv3.Endpoints.DataTypes.Request;
1112

1213
namespace RefreshTests.GameServer.Tests.ApiV3;
1314

@@ -97,4 +98,170 @@ public async Task GetsAndResetsUserPlanetsByUuidAndName()
9798
Assert.That(updated, Is.Not.Null);
9899
Assert.That(updated!.Lbp3PlanetsHash.IsBlankHash(), Is.True);
99100
}
101+
102+
[Test]
103+
public async Task ModeratorsMayNotDeleteAdminsAndModerators()
104+
{
105+
using TestContext context = this.GetServer();
106+
GameUser admin = context.CreateUser(role: GameUserRole.Admin);
107+
GameUser mod = context.CreateUser(role: GameUserRole.Moderator);
108+
GameUser mod2 = context.CreateUser(role: GameUserRole.Moderator);
109+
GameUser user = context.CreateUser(role: GameUserRole.User);
110+
HttpClient client = context.GetAuthenticatedClient(TokenType.Api, mod);
111+
112+
// Admin
113+
HttpResponseMessage response = await client.DeleteAsync($"/api/v3/admin/users/uuid/{admin.UserId}");
114+
Assert.That(response.IsSuccessStatusCode, Is.False);
115+
context.Database.Refresh();
116+
117+
GameUser? updated = context.Database.GetUserByObjectId(admin.UserId);
118+
Assert.That(updated, Is.Not.Null);
119+
Assert.That(updated!.Role, Is.EqualTo(GameUserRole.Admin));
120+
121+
// Mod
122+
response = await client.DeleteAsync($"/api/v3/admin/users/uuid/{mod2.UserId}");
123+
Assert.That(response.IsSuccessStatusCode, Is.False);
124+
context.Database.Refresh();
125+
126+
updated = context.Database.GetUserByObjectId(mod2.UserId);
127+
Assert.That(updated, Is.Not.Null);
128+
Assert.That(updated!.Role, Is.EqualTo(GameUserRole.Moderator));
129+
130+
// User
131+
response = await client.DeleteAsync($"/api/v3/admin/users/uuid/{user.UserId}");
132+
Assert.That(response.IsSuccessStatusCode, Is.True);
133+
context.Database.Refresh();
134+
135+
updated = context.Database.GetUserByObjectId(user.UserId);
136+
Assert.That(updated, Is.Not.Null);
137+
Assert.That(updated!.Role, Is.EqualTo(GameUserRole.Banned));
138+
}
139+
140+
[Test]
141+
public async Task ModeratorsMayNotBanAdminsAndModerators()
142+
{
143+
using TestContext context = this.GetServer();
144+
GameUser admin = context.CreateUser(role: GameUserRole.Admin);
145+
GameUser mod = context.CreateUser(role: GameUserRole.Moderator);
146+
GameUser mod2 = context.CreateUser(role: GameUserRole.Moderator);
147+
GameUser user = context.CreateUser(role: GameUserRole.User);
148+
HttpClient client = context.GetAuthenticatedClient(TokenType.Api, mod);
149+
ApiPunishUserRequest request = new()
150+
{
151+
Reason = "lol",
152+
ExpiryDate = new(2036, 8, 12, 4, 20, 9, 213, new())
153+
};
154+
155+
// Admin
156+
HttpResponseMessage response = await client.PostAsync($"/api/v3/admin/users/uuid/{admin.UserId}/ban", new StringContent(request.AsJson()));
157+
Assert.That(response.IsSuccessStatusCode, Is.False);
158+
context.Database.Refresh();
159+
160+
GameUser? updated = context.Database.GetUserByObjectId(admin.UserId);
161+
Assert.That(updated, Is.Not.Null);
162+
Assert.That(updated!.Role, Is.EqualTo(GameUserRole.Admin));
163+
164+
// Mod
165+
response = await client.PostAsync($"/api/v3/admin/users/uuid/{mod2.UserId}/ban", new StringContent(request.AsJson()));
166+
Assert.That(response.IsSuccessStatusCode, Is.False);
167+
context.Database.Refresh();
168+
169+
updated = context.Database.GetUserByObjectId(mod2.UserId);
170+
Assert.That(updated, Is.Not.Null);
171+
Assert.That(updated!.Role, Is.EqualTo(GameUserRole.Moderator));
172+
173+
// User
174+
response = await client.PostAsync($"/api/v3/admin/users/uuid/{user.UserId}/ban", new StringContent(request.AsJson()));
175+
Assert.That(response.IsSuccessStatusCode, Is.True);
176+
context.Database.Refresh();
177+
178+
updated = context.Database.GetUserByObjectId(user.UserId);
179+
Assert.That(updated, Is.Not.Null);
180+
Assert.That(updated!.Role, Is.EqualTo(GameUserRole.Banned));
181+
}
182+
183+
[Test]
184+
public async Task ModeratorsMayNotRestrictAdminsAndModerators()
185+
{
186+
using TestContext context = this.GetServer();
187+
GameUser admin = context.CreateUser(role: GameUserRole.Admin);
188+
GameUser mod = context.CreateUser(role: GameUserRole.Moderator);
189+
GameUser mod2 = context.CreateUser(role: GameUserRole.Moderator);
190+
GameUser user = context.CreateUser(role: GameUserRole.User);
191+
HttpClient client = context.GetAuthenticatedClient(TokenType.Api, mod);
192+
ApiPunishUserRequest request = new()
193+
{
194+
Reason = "lol",
195+
ExpiryDate = new(2036, 8, 12, 4, 20, 9, 213, new())
196+
};
197+
198+
// Admin
199+
HttpResponseMessage response = await client.PostAsync($"/api/v3/admin/users/uuid/{admin.UserId}/restrict", new StringContent(request.AsJson()));
200+
Assert.That(response.IsSuccessStatusCode, Is.False);
201+
context.Database.Refresh();
202+
203+
GameUser? updated = context.Database.GetUserByObjectId(admin.UserId);
204+
Assert.That(updated, Is.Not.Null);
205+
Assert.That(updated!.Role, Is.EqualTo(GameUserRole.Admin));
206+
207+
// Mod
208+
response = await client.PostAsync($"/api/v3/admin/users/uuid/{mod2.UserId}/restrict", new StringContent(request.AsJson()));
209+
Assert.That(response.IsSuccessStatusCode, Is.False);
210+
context.Database.Refresh();
211+
212+
updated = context.Database.GetUserByObjectId(mod2.UserId);
213+
Assert.That(updated, Is.Not.Null);
214+
Assert.That(updated!.Role, Is.EqualTo(GameUserRole.Moderator));
215+
216+
// User
217+
response = await client.PostAsync($"/api/v3/admin/users/uuid/{user.UserId}/restrict", new StringContent(request.AsJson()));
218+
Assert.That(response.IsSuccessStatusCode, Is.True);
219+
context.Database.Refresh();
220+
221+
updated = context.Database.GetUserByObjectId(user.UserId);
222+
Assert.That(updated, Is.Not.Null);
223+
Assert.That(updated!.Role, Is.EqualTo(GameUserRole.Restricted));
224+
}
225+
226+
[Test]
227+
public async Task ModeratorsMayNotResetPasswordOfAdminsAndModerators()
228+
{
229+
using TestContext context = this.GetServer();
230+
GameUser admin = context.CreateUser(role: GameUserRole.Admin);
231+
GameUser mod = context.CreateUser(role: GameUserRole.Moderator);
232+
GameUser mod2 = context.CreateUser(role: GameUserRole.Moderator);
233+
GameUser user = context.CreateUser(role: GameUserRole.User);
234+
HttpClient client = context.GetAuthenticatedClient(TokenType.Api, mod);
235+
ApiResetPasswordRequest request = new()
236+
{
237+
PasswordSha512 = HexHelper.BytesToHexString(SHA512.HashData("lmao"u8))
238+
};
239+
240+
// Admin
241+
HttpResponseMessage response = await client.PutAsync($"/api/v3/admin/users/uuid/{admin.UserId}/resetPassword", new StringContent(request.AsJson()));
242+
Assert.That(response.IsSuccessStatusCode, Is.False);
243+
context.Database.Refresh();
244+
245+
GameUser? updated = context.Database.GetUserByObjectId(admin.UserId);
246+
Assert.That(updated, Is.Not.Null);
247+
Assert.That(updated!.ShouldResetPassword, Is.False);
248+
249+
// Mod
250+
response = await client.PutAsync($"/api/v3/admin/users/uuid/{mod2.UserId}/resetPassword", new StringContent(request.AsJson()));
251+
Assert.That(response.IsSuccessStatusCode, Is.False);
252+
context.Database.Refresh();
253+
254+
updated = context.Database.GetUserByObjectId(mod2.UserId);
255+
Assert.That(updated, Is.Not.Null);
256+
Assert.That(updated!.ShouldResetPassword, Is.False);
257+
258+
// User
259+
response = await client.PutAsync($"/api/v3/admin/users/uuid/{user.UserId}/resetPassword", new StringContent(request.AsJson()));
260+
Assert.That(response.IsSuccessStatusCode, Is.True);
261+
context.Database.Refresh();
262+
263+
updated = context.Database.GetUserByObjectId(user.UserId);
264+
Assert.That(updated, Is.Not.Null);
265+
Assert.That(updated!.ShouldResetPassword, Is.True);
266+
}
100267
}

0 commit comments

Comments
 (0)