Merge "Test ApiUserrights"

diff --combined tests/phpunit/includes/api/ApiTestCase.php
index 6506ea4,00ef2ea..a5ee7dd
--- 1/tests/phpunit/includes/api/ApiTestCase.php
--- 2/tests/phpunit/includes/api/ApiTestCase.php
+++ b/tests/phpunit/includes/api/ApiTestCase.php
@@@ -56,28 -56,6 +56,28 @@@ abstract class ApiTestCase extends Medi
                return $page->doEditContent( ContentHandler::makeContent( $text, $title ), $summary );
        }
  
 +      /**
 +       * Revision-deletes a revision.
 +       *
 +       * @param Revision|int $rev Revision to delete
 +       * @param array $value Keys are Revision::DELETED_* flags.  Values are 1 to set the bit, 0 to
 +       *   clear, -1 to leave alone.  (All other values also clear the bit.)
 +       * @param string $comment Deletion comment
 +       */
 +      protected function revisionDelete(
 +              $rev, array $value = [ Revision::DELETED_TEXT => 1 ], $comment = ''
 +      ) {
 +              if ( is_int( $rev ) ) {
 +                      $rev = Revision::newFromId( $rev );
 +              }
 +              RevisionDeleter::createList(
 +                      'revision', RequestContext::getMain(), $rev->getTitle(), [ $rev->getId() ]
 +              )->setVisibility( [
 +                      'value' => $value,
 +                      'comment' => $comment,
 +              ] );
 +      }
 +
        /**
         * Does the API request and returns the result.
         *
@@@ -121,6 -99,10 +121,10 @@@
                }
  
                if ( $tokenType !== null ) {
+                       if ( $tokenType === 'auto' ) {
+                               $tokenType = ( new ApiMain() )->getModuleManager()
+                                       ->getModule( $params['action'], 'action' )->needsToken();
+                       }
                        $params['token'] = ApiQueryTokens::getToken(
                                $wgUser, $sessionObj, ApiQueryTokens::getTokenTypeSalts()[$tokenType]
                        )->toString();
@@@ -164,34 -146,45 +168,34 @@@
         * @return array Result of the API call
         */
        protected function doApiRequestWithToken( array $params, array $session = null,
-               User $user = null, $tokenType = 'csrf'
+               User $user = null, $tokenType = 'auto'
        ) {
                return $this->doApiRequest( $params, $session, false, $user, $tokenType );
        }
  
 -      protected function doLogin( $testUser = 'sysop' ) {
 +      /**
 +       * Previously this would do API requests to log in, as well as setting $wgUser and the request
 +       * context's user.  The API requests are unnecessary, and the global-setting is unwanted, so
 +       * this method should not be called.  Instead, pass appropriate User values directly to
 +       * functions that need them.  For functions that still rely on $wgUser, set that directly.  If
 +       * you just want to log in the test sysop user, don't do anything -- that's the default.
 +       *
 +       * @param TestUser|string $testUser Object, or key to self::$users such as 'sysop' or 'uploader'
 +       * @deprecated since 1.31
 +       */
 +      protected function doLogin( $testUser = null ) {
 +              global $wgUser;
 +
                if ( $testUser === null ) {
                        $testUser = static::getTestSysop();
                } elseif ( is_string( $testUser ) && array_key_exists( $testUser, self::$users ) ) {
 -                      $testUser = self::$users[ $testUser ];
 +                      $testUser = self::$users[$testUser];
                } elseif ( !$testUser instanceof TestUser ) {
 -                      throw new MWException( "Can not log in to undefined user $testUser" );
 +                      throw new MWException( "Can't log in to undefined user $testUser" );
                }
  
 -              $data = $this->doApiRequest( [
 -                      'action' => 'login',
 -                      'lgname' => $testUser->getUser()->getName(),
 -                      'lgpassword' => $testUser->getPassword() ] );
 -
 -              $token = $data[0]['login']['token'];
 -
 -              $data = $this->doApiRequest(
 -                      [
 -                              'action' => 'login',
 -                              'lgtoken' => $token,
 -                              'lgname' => $testUser->getUser()->getName(),
 -                              'lgpassword' => $testUser->getPassword(),
 -                      ],
 -                      $data[2]
 -              );
 -
 -              if ( $data[0]['login']['result'] === 'Success' ) {
 -                      // DWIM
 -                      global $wgUser;
 -                      $wgUser = $testUser->getUser();
 -                      RequestContext::getMain()->setUser( $wgUser );
 -              }
 -
 -              return $data;
 +              $wgUser = $testUser->getUser();
 +              RequestContext::getMain()->setUser( $wgUser );
        }
  
        protected function getTokenList( TestUser $user, $session = null ) {