Change API to POST

Author: dklimpel

docs/admin_api/media_admin_api.md

@@ -84,7 +84,7 @@ This API removes a single piece of local or remote media from quarantine.
 Request:
 
 ```
-DELETE /_synapse/admin/v1/media/quarantine/<server_name>/<media_id>
+POST /_synapse/admin/v1/media/unquarantine/<server_name>/<media_id>
 
 {}
 ```

synapse/rest/admin/media.py

@@ -119,7 +119,21 @@ async def on_POST(
 
         return 200, {}
 
-    async def on_DELETE(
+
+class UnquarantineMediaByID(RestServlet):
+    """Quarantines local or remote media by a given ID so that no one can download
+    it via this server.
+    """
+
+    PATTERNS = admin_patterns(
+        "/media/unquarantine/(?P<server_name>[^/]+)/(?P<media_id>[^/]+)"
+    )
+
+    def __init__(self, hs: "HomeServer"):
+        self.store = hs.get_datastore()
+        self.auth = hs.get_auth()
+
+    async def on_POST(
         self, request: SynapseRequest, server_name: str, media_id: str
     ) -> Tuple[int, JsonDict]:
         requester = await self.auth.get_user_by_req(request)
@@ -282,6 +296,7 @@ def register_servlets_for_media_repo(hs: "HomeServer", http_server):
     PurgeMediaCacheRestServlet(hs).register(http_server)
     QuarantineMediaInRoom(hs).register(http_server)
     QuarantineMediaByID(hs).register(http_server)
+    UnquarantineMediaByID(hs).register(http_server)
     QuarantineMediaByUser(hs).register(http_server)
     ProtectMediaByID(hs).register(http_server)
     ListMediaInRoom(hs).register(http_server)

tests/rest/admin/test_media.py

@@ -577,7 +577,7 @@ class QuarantineMediaByIDTestCase(unittest.HomeserverTestCase):
     def prepare(self, reactor, clock, hs):
         media_repo = hs.get_media_repository_resource()
         self.store = hs.get_datastore()
-        server_name = hs.hostname
+        self.server_name = hs.hostname
 
         self.admin_user = self.register_user("admin", "pass", admin=True)
         self.admin_user_tok = self.login("admin", "pass")
@@ -599,33 +599,34 @@ def prepare(self, reactor, clock, hs):
         server_and_media_id = response["content_uri"][6:]  # Cut off 'mxc://'
         self.media_id = server_and_media_id.split("/")[1]
 
-        self.url = "/_synapse/admin/v1/media/quarantine/%s/%s" % (
-            server_name,
-            self.media_id,
-        )
+        self.url = "/_synapse/admin/v1/media/%s/%s/%s"
 
-    @parameterized.expand(["POST", "DELETE"])
-    def test_no_auth(self, method: str):
+    @parameterized.expand(["quarantine", "unquarantine"])
+    def test_no_auth(self, action: str):
         """
         Try to protect media without authentication.
         """
 
-        channel = self.make_request(method, self.url, b"{}")
+        channel = self.make_request(
+            "POST",
+            self.url % (action, self.server_name, self.media_id),
+            b"{}",
+        )
 
         self.assertEqual(401, int(channel.result["code"]), msg=channel.result["body"])
         self.assertEqual(Codes.MISSING_TOKEN, channel.json_body["errcode"])
 
-    @parameterized.expand(["POST", "DELETE"])
-    def test_requester_is_no_admin(self, method: str):
+    @parameterized.expand(["quarantine", "unquarantine"])
+    def test_requester_is_no_admin(self, action: str):
         """
         If the user is not a server admin, an error is returned.
         """
         self.other_user = self.register_user("user", "pass")
         self.other_user_token = self.login("user", "pass")
 
         channel = self.make_request(
-            method,
-            self.url,
+            "POST",
+            self.url % (action, self.server_name, self.media_id),
             access_token=self.other_user_token,
         )
 
@@ -641,7 +642,11 @@ def test_quarantine_media(self):
         self.assertFalse(media_info["quarantined_by"])
 
         # quarantining
-        channel = self.make_request("POST", self.url, access_token=self.admin_user_tok)
+        channel = self.make_request(
+            "POST",
+            self.url % ("quarantine", self.server_name, self.media_id),
+            access_token=self.admin_user_tok,
+        )
 
         self.assertEqual(200, channel.code, msg=channel.json_body)
         self.assertFalse(channel.json_body)
@@ -651,7 +656,9 @@ def test_quarantine_media(self):
 
         # remove from quarantine
         channel = self.make_request(
-            "DELETE", self.url, access_token=self.admin_user_tok
+            "POST",
+            self.url % ("unquarantine", self.server_name, self.media_id),
+            access_token=self.admin_user_tok,
         )
 
         self.assertEqual(200, channel.code, msg=channel.json_body)