mirrors/btcpayserver
1
0
Fork 0
mirror of https://github.com/btcpayserver/btcpayserver.git synced 2024-11-19 01:43:50 +01:00
Code Issues Packages Projects Releases Wiki Activity

Do not through missing-permission error when no store on /api/v1/stores (Close #4735) (#4748)

Browse Source
This commit is contained in:
Nicolas Dorier 2023-03-08 21:36:51 +09:00 committed by GitHub
parent 7b5ce8f70c
commit 98d62e826b
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
6 changed files with 20 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
BTCPayServer.Tests/ApiKeysTests.cs
View File

@ -286,7 +286,7 @@ namespace BTCPayServer.Tests
if (permissions.Contains(canModifyAllStores) || storePermissions.Any())
{
var resultStores =
await TestApiAgainstAccessToken<StoreData[]>(accessToken, $"{TestApiPath}/me/stores",
await TestApiAgainstAccessToken<Client.Models.StoreData[]>(accessToken, $"{TestApiPath}/me/stores",
tester.PayTester.HttpClient);
foreach (var selectiveStorePermission in storePermissions)

12
BTCPayServer.Tests/GreenfieldAPITests.cs
View File

@ -1305,15 +1305,21 @@ namespace BTCPayServer.Tests
await user.CreateClient(Permission.Create(Policies.CanViewStoreSettings, user.StoreId).ToString());
Assert.Single(await scopedClient.GetStores());
var noauth = await user.CreateClient(Array.Empty<string>());
await AssertAPIError("missing-permission", () => noauth.GetStores());
// We strip the user's Owner right, so the key should not work
using var ctx = tester.PayTester.GetService<Data.ApplicationDbContextFactory>().CreateContext();
var storeEntity = await ctx.UserStore.SingleAsync(u => u.ApplicationUserId == user.UserId && u.StoreDataId == newStore.Id);
storeEntity.Role = "Guest";
await ctx.SaveChangesAsync();
await AssertHttpError(403, async () => await client.UpdateStore(newStore.Id, new UpdateStoreRequest() { Name = "B" }));
client = await user.CreateClient(Policies.Unrestricted);
stores = await client.GetStores();
foreach (var s2 in stores)
{
await tester.PayTester.StoreRepository.DeleteStore(s2.Id);
}
tester.DeleteStore = false;
Assert.Empty(await client.GetStores());
}
private async Task<GreenfieldValidationException> AssertValidationError(string[] fields, Func<Task> act)

9
BTCPayServer.Tests/ServerTester.cs
View File

@ -246,15 +246,18 @@ namespace BTCPayServer.Tests
}
public List<string> Stores { get; internal set; } = new List<string>();
public bool DeleteStore { get; set; } = true;
public void Dispose()
{
foreach (var r in this.Resources)
r.Dispose();
TestLogs.LogInformation("Disposing the BTCPayTester...");
foreach (var store in Stores)
if (DeleteStore)
{
Xunit.Assert.True(PayTester.StoreRepository.DeleteStore(store).GetAwaiter().GetResult());
foreach (var store in Stores)
{
Xunit.Assert.True(PayTester.StoreRepository.DeleteStore(store).GetAwaiter().GetResult());
}
}
if (PayTester != null)
PayTester.Dispose();

2
BTCPayServer/Controllers/GreenField/GreenfieldStoresController.cs
View File

@ -112,7 +112,7 @@ namespace BTCPayServer.Controllers.Greenfield
return Ok(FromModel(store));
}
private Client.Models.StoreData FromModel(Data.StoreData data)
internal static Client.Models.StoreData FromModel(Data.StoreData data)
{
var storeBlob = data.GetStoreBlob();
return new Client.Models.StoreData()

5
BTCPayServer/Controllers/GreenField/GreenfieldTestApiKeyController.cs
View File

@ -1,3 +1,4 @@
using System.Linq;
using System.Threading.Tasks;
using BTCPayServer.Abstractions.Constants;
using BTCPayServer.Client;
@ -52,9 +53,9 @@ namespace BTCPayServer.Controllers.Greenfield
[HttpGet("me/stores")]
[Authorize(Policy = Policies.CanViewStoreSettings, AuthenticationSchemes = AuthenticationSchemes.Greenfield)]
public StoreData[] GetCurrentUserStores()
public BTCPayServer.Client.Models.StoreData[] GetCurrentUserStores()
{
return this.HttpContext.GetStoresData();
return this.HttpContext.GetStoresData().Select(Greenfield.GreenfieldStoresController.FromModel).ToArray();
}
[HttpGet("me/stores/{storeId}/can-view")]

2
BTCPayServer/Security/GreenField/GreenFieldAuthorizationHandler.cs
View File

@ -118,8 +118,6 @@ namespace BTCPayServer.Security.Greenfield
if (context.HasPermission(Permission.Create(policy, store.Id), requiredUnscoped))
permissionedStores.Add(store);
}
if (!requiredUnscoped && permissionedStores.Count is 0)
break;
_httpContext.SetStoresData(permissionedStores.ToArray());
success = true;
}