Changeset 14034 for trunk/tests/phpunit/testcases/members/test-controller.php

Timestamp:

10/02/2024 03:23:39 AM (9 months ago)

Author:

espellcaste

Message:

BP REST API: spammed users can not be retrivied from non-admin users.

Align the BP REST API with the web version, and show spammer users to Administrators only.

Props imath and emaralive.

See #9145
Fixes #9231

File:

• trunk/tests/phpunit/testcases/members/test-controller.php (modified) (8 diffs)

trunk/tests/phpunit/testcases/members/test-controller.php

@@ -37 +37 @@
             )
         );
-        $request->set_param( 'context', 'view' );
         $response = $this->server->dispatch( $request );
 
@@ -65 +64 @@
             )
         );
-        $request->set_param( 'context', 'view' );
         $response = $this->server->dispatch( $request );
 
@@ -115 +113 @@
 
         $members = $response->get_data();
+
         $this->assertNotEmpty( $members );
-
-        $this->assertTrue( 3 === count( $members ) );
+        $this->assertCount( 3, $members );
 
         $latest_activities = wp_list_pluck( $members, 'last_activity', 'id' );
@@ -138 +136 @@
 
         $request = new WP_REST_Request( 'GET', $this->endpoint_url );
+        $request->set_param( 'context', 'view' );
         $request->set_query_params(
             array(
@@ -146 +145 @@
         );
 
-        $request->set_param( 'context', 'view' );
         $response = $this->server->dispatch( $request );
 
@@ -183 +181 @@
 
         $request = new WP_REST_Request( 'GET', $this->endpoint_url );
+        $request->set_param( 'context', 'view' );
         $request->set_query_params(
             array(
@@ -188 +187 @@
             )
         );
-        $request->set_param( 'context', 'view' );
         $response = $this->server->dispatch( $request );
 
@@ -541 +539 @@
 
         $this->assertErrorResponse( 'bp_rest_member_invalid_id', $response, 404 );
+    }
+
+    /**
+     * @group get_item
+     */
+    public function test_get_spammed_user() {
+        $u = static::factory()->user->create();
+
+        // Spam the user.
+        bp_core_process_spammer_status( $u, 'spam' );
+
+        $this->assertTrue( bp_is_user_spammer( $u ) );
+
+        $request = new WP_REST_Request( 'GET', sprintf( $this->endpoint_url . '/%d', $u ) );
+        $request->set_param( 'context', 'view' );
+        $response = $this->server->dispatch( $request );
+
+        $this->assertErrorResponse( 'bp_rest_authorization_required', $response, rest_authorization_required_code() );
+    }
+
+    /**
+     * @group get_item
+     */
+    public function test_get_spammed_user_with_random_logged_in_user() {
+        $u  = static::factory()->user->create();
+        $u2 = static::factory()->user->create();
+
+        // Spam the user.
+        bp_core_process_spammer_status( $u, 'spam' );
+
+        $this->assertTrue( bp_is_user_spammer( $u ) );
+
+        wp_set_current_user( $u2 );
+
+        $request = new WP_REST_Request( 'GET', sprintf( $this->endpoint_url . '/%d', $u ) );
+        $request->set_param( 'context', 'view' );
+        $response = $this->server->dispatch( $request );
+
+        $this->assertErrorResponse( 'bp_rest_authorization_required', $response, rest_authorization_required_code() );
+    }
+
+    /**
+     * @group get_item
+     */
+    public function test_get_spammed_user_with_spammed_user() {
+        $u = static::factory()->user->create();
+
+        // Spam the user.
+        bp_core_process_spammer_status( $u, 'spam' );
+
+        $this->assertTrue( bp_is_user_spammer( $u ) );
+
+        wp_set_current_user( $u );
+
+        $request = new WP_REST_Request( 'GET', sprintf( $this->endpoint_url . '/%d', $u ) );
+        $request->set_param( 'context', 'view' );
+        $response = $this->server->dispatch( $request );
+
+        $this->assertErrorResponse( 'bp_rest_authorization_required', $response, rest_authorization_required_code() );
+    }
+
+    /**
+     * @group get_item
+     */
+    public function test_get_spammed_user_as_admin() {
+        $u = static::factory()->user->create();
+
+        // Spam the user.
+        bp_core_process_spammer_status( $u, 'spam' );
+
+        $this->assertTrue( bp_is_user_spammer( $u ) );
+
+        wp_set_current_user( $this->user );
+
+        $request = new WP_REST_Request( 'GET', sprintf( $this->endpoint_url . '/%d', $u ) );
+        $request->set_param( 'context', 'view' );
+        $response = $this->server->dispatch( $request );
+
+        $this->assertEquals( 200, $response->get_status() );
+
+        $member = $response->get_data();
+
+        $this->assertNotEmpty( $member );
+        $this->assertSame( $u, $member['id'] );
     }