15
15
16
16
from unittest .mock import Mock
17
17
18
- import synapse
18
+ import synapse . rest . admin
19
19
import synapse .api .errors
20
20
from synapse .api .constants import EventTypes
21
21
from synapse .config .room_directory import RoomDirectoryConfig
@@ -433,19 +433,29 @@ def test_allowed(self):
433
433
434
434
435
435
class TestCreatePublishedRoomACL (unittest .HomeserverTestCase ):
436
- user_id = "@admin:test"
437
- denied_user_id = "@test:test"
438
436
data = {"room_alias_name" : "unofficial_test" }
439
437
440
- servlets = [directory .register_servlets , room .register_servlets ]
438
+ servlets = [
439
+ synapse .rest .admin .register_servlets_for_client_rest_resource ,
440
+ login .register_servlets ,
441
+ directory .register_servlets ,
442
+ room .register_servlets
443
+ ]
444
+ hijack_auth = False
441
445
442
446
def prepare (self , reactor , clock , hs ):
447
+ self .allowed_user_id = self .register_user ("allowed" , "pass" )
448
+ self .allowed_access_token = self .login ("allowed" , "pass" )
449
+
450
+ self .denied_user_id = self .register_user ("denied" , "pass" )
451
+ self .denied_access_token = self .login ("denied" , "pass" )
452
+
443
453
# This time we add custom room list publication rules
444
454
config = {}
445
455
config ["alias_creation_rules" ] = []
446
456
config ["room_list_publication_rules" ] = [
447
457
{"user_id" : "*" , "alias" : "*" , "action" : "deny" },
448
- {"user_id" : "@admin:test" , "alias" : "*" , "action" : "allow" },
458
+ {"user_id" : self . allowed_user_id , "alias" : "*" , "action" : "allow" },
449
459
]
450
460
451
461
rd_config = RoomDirectoryConfig ()
@@ -457,33 +467,69 @@ def prepare(self, reactor, clock, hs):
457
467
458
468
return hs
459
469
460
- def test_denied (self ):
461
- # NOTE Setting is_public=True isn't enough
462
- self .data ["visibility" ] = "public"
470
+ def test_denied_without_publication_permission (self ):
471
+ """
472
+ Try to create a room, register an alias for it, and publish it,
473
+ as a user without permission to publish rooms.
474
+ (This is used as both a standalone test & as a helper function.)
475
+ """
463
476
self .helper .create_room_as (
464
- self .denied_user_id , extra_content = self .data , expect_code = 403
477
+ self .denied_user_id ,
478
+ tok = self .denied_access_token ,
479
+ extra_content = self .data ,
480
+ is_public = True ,
481
+ expect_code = 403 ,
465
482
)
466
483
467
- def test_allowed_without_publish (self ):
484
+ def test_allowed_when_creating_private_room (self ):
485
+ """
486
+ Try to create a room, register an alias for it, and NOT publish it,
487
+ as a user without permission to publish rooms.
488
+ (This is used as both a standalone test & as a helper function.)
489
+ """
468
490
self .helper .create_room_as (
469
491
self .denied_user_id ,
492
+ tok = self .denied_access_token ,
470
493
extra_content = self .data ,
471
494
is_public = False ,
472
495
expect_code = 200 ,
473
496
)
474
497
475
- def test_allowed_as_allowed (self ):
498
+ def test_allowed_with_publication_permission (self ):
499
+ """
500
+ Try to create a room, register an alias for it, and publish it,
501
+ as a user WITH permission to publish rooms.
502
+ (This is used as both a standalone test & as a helper function.)
503
+ """
476
504
self .helper .create_room_as (
477
- self .user_id , extra_content = self .data , is_public = False , expect_code = 200
478
- )
479
-
480
- def test_denied_then_retry_without_publish (self ):
481
- self .test_denied ()
482
- self .test_allowed_without_publish ()
483
-
484
- def test_denied_then_retry_as_allowed (self ):
485
- self .test_denied ()
486
- self .test_allowed_as_allowed ()
505
+ self .allowed_user_id ,
506
+ tok = self .allowed_access_token ,
507
+ extra_content = self .data ,
508
+ is_public = False ,
509
+ expect_code = 200
510
+ )
511
+
512
+ def test_can_create_as_private_room_after_rejection (self ):
513
+ """
514
+ After failing to publish a room with an alias as a user without publish permission,
515
+ retry as the same user, but without publishing the room.
516
+
517
+ This should pass, but used to fail because the alias was registered by the first
518
+ request, even though the room creation was denied.
519
+ """
520
+ self .test_denied_without_publication_permission ()
521
+ self .test_allowed_when_creating_private_room ()
522
+
523
+ def test_can_create_with_permission_after_rejection (self ):
524
+ """
525
+ After failing to publish a room with an alias as a user without publish permission,
526
+ retry as someone with permission, using the same alias.
527
+
528
+ This also used to fail because of the alias having been registered by the first
529
+ request, leaving it unavailable for any other user's new rooms.
530
+ """
531
+ self .test_denied_without_publication_permission ()
532
+ self .test_allowed_with_publication_permission ()
487
533
488
534
489
535
class TestRoomListSearchDisabled (unittest .HomeserverTestCase ):
0 commit comments