8 * @covers ApiUserrights
10 class ApiUserrightsTest
extends ApiTestCase
{
12 protected function setUp() {
14 $this->tablesUsed
= array_merge(
16 [ 'change_tag', 'change_tag_def', 'logging' ]
21 * Unsets $wgGroupPermissions['bureaucrat']['userrights'], and sets
22 * $wgAddGroups['bureaucrat'] and $wgRemoveGroups['bureaucrat'] to the
25 * @param array|bool $add Groups bureaucrats should be allowed to add, true for all
26 * @param array|bool $remove Groups bureaucrats should be allowed to remove, true for all
28 protected function setPermissions( $add = [], $remove = [] ) {
29 $this->setGroupPermissions( 'bureaucrat', 'userrights', false );
32 $this->mergeMwGlobalArrayValue( 'wgAddGroups', [ 'bureaucrat' => $add ] );
35 $this->mergeMwGlobalArrayValue( 'wgRemoveGroups', [ 'bureaucrat' => $remove ] );
40 * Perform an API userrights request that's expected to be successful.
42 * @param array|string $expectedGroups Group(s) that the user is expected
43 * to have after the API request
44 * @param array $params Array to pass to doApiRequestWithToken(). 'action'
45 * => 'userrights' is implicit. If no 'user' or 'userid' is specified,
46 * we add a 'user' parameter. If no 'add' or 'remove' is specified, we
47 * add 'add' => 'sysop'.
48 * @param User|null $user The user that we're modifying. The user must be
49 * mutable, because we're going to change its groups! null means that
50 * we'll make up our own user to modify, and doesn't make sense if 'user'
51 * or 'userid' is specified in $params.
53 protected function doSuccessfulRightsChange(
54 $expectedGroups = 'sysop', array $params = [], User
$user = null
56 $expectedGroups = (array)$expectedGroups;
57 $params['action'] = 'userrights';
60 $user = $this->getMutableTestUser()->getUser();
63 $this->assertTrue( TestUserRegistry
::isMutable( $user ),
64 'Immutable user passed to doSuccessfulRightsChange!' );
66 if ( !isset( $params['user'] ) && !isset( $params['userid'] ) ) {
67 $params['user'] = $user->getName();
69 if ( !isset( $params['add'] ) && !isset( $params['remove'] ) ) {
70 $params['add'] = 'sysop';
73 $res = $this->doApiRequestWithToken( $params );
75 $user->clearInstanceCache();
76 $this->assertSame( $expectedGroups, $user->getGroups() );
78 $this->assertArrayNotHasKey( 'warnings', $res[0] );
82 * Perform an API userrights request that's expected to fail.
84 * @param string $expectedException Expected exception text
85 * @param array $params As for doSuccessfulRightsChange()
86 * @param User|null $user As for doSuccessfulRightsChange(). If there's no
87 * user who will possibly be affected (such as if an invalid username is
88 * provided in $params), pass null.
90 protected function doFailedRightsChange(
91 $expectedException, array $params = [], User
$user = null
93 $params['action'] = 'userrights';
95 $this->setExpectedException( ApiUsageException
::class, $expectedException );
98 // If 'user' or 'userid' is specified and $user was not specified,
99 // the user we're creating now will have nothing to do with the API
100 // request, but that's okay, since we're just testing that it has
102 $user = $this->getMutableTestUser()->getUser();
105 $this->assertTrue( TestUserRegistry
::isMutable( $user ),
106 'Immutable user passed to doFailedRightsChange!' );
108 if ( !isset( $params['user'] ) && !isset( $params['userid'] ) ) {
109 $params['user'] = $user->getName();
111 if ( !isset( $params['add'] ) && !isset( $params['remove'] ) ) {
112 $params['add'] = 'sysop';
114 $expectedGroups = $user->getGroups();
117 $this->doApiRequestWithToken( $params );
119 $user->clearInstanceCache();
120 $this->assertSame( $expectedGroups, $user->getGroups() );
124 public function testAdd() {
125 $this->doSuccessfulRightsChange();
128 public function testBlockedWithUserrights() {
131 $block = new Block( [ 'address' => $wgUser, 'by' => $wgUser->getId(), ] );
135 $this->doSuccessfulRightsChange();
138 $wgUser->clearInstanceCache();
142 public function testBlockedWithoutUserrights() {
143 $user = $this->getTestSysop()->getUser();
145 $this->setPermissions( true, true );
147 $block = new Block( [ 'address' => $user, 'by' => $user->getId() ] );
151 $this->doFailedRightsChange( 'You have been blocked from editing.' );
154 $user->clearInstanceCache();
158 public function testAddMultiple() {
159 $this->doSuccessfulRightsChange(
160 [ 'bureaucrat', 'sysop' ],
161 [ 'add' => 'bureaucrat|sysop' ]
165 public function testTooFewExpiries() {
166 $this->doFailedRightsChange(
167 '2 expiry timestamps were provided where 3 were needed.',
168 [ 'add' => 'sysop|bureaucrat|bot', 'expiry' => 'infinity|tomorrow' ]
172 public function testTooManyExpiries() {
173 $this->doFailedRightsChange(
174 '3 expiry timestamps were provided where 2 were needed.',
175 [ 'add' => 'sysop|bureaucrat', 'expiry' => 'infinity|tomorrow|never' ]
179 public function testInvalidExpiry() {
180 $this->doFailedRightsChange( 'Invalid expiry time', [ 'expiry' => 'yummy lollipops!' ] );
183 public function testMultipleInvalidExpiries() {
184 $this->doFailedRightsChange(
185 'Invalid expiry time "foo".',
186 [ 'add' => 'sysop|bureaucrat', 'expiry' => 'foo|bar' ]
190 public function testWithTag() {
191 $this->setMwGlobals( 'wgChangeTagsSchemaMigrationStage', MIGRATION_WRITE_BOTH
);
192 ChangeTags
::defineTag( 'custom tag' );
194 $user = $this->getMutableTestUser()->getUser();
196 $this->doSuccessfulRightsChange( 'sysop', [ 'tags' => 'custom tag' ], $user );
198 $dbr = wfGetDB( DB_REPLICA
);
202 [ 'change_tag', 'logging' ],
205 'ct_log_id = log_id',
206 'log_namespace' => NS_USER
,
207 'log_title' => strtr( $user->getName(), ' ', '_' )
214 public function testWithTagNewBackend() {
215 $this->setMwGlobals( 'wgChangeTagsSchemaMigrationStage', MIGRATION_NEW
);
216 ChangeTags
::defineTag( 'custom tag' );
218 $user = $this->getMutableTestUser()->getUser();
220 $this->doSuccessfulRightsChange( 'sysop', [ 'tags' => 'custom tag' ], $user );
222 $dbr = wfGetDB( DB_REPLICA
);
226 [ 'change_tag', 'logging', 'change_tag_def' ],
229 'ct_log_id = log_id',
230 'log_namespace' => NS_USER
,
231 'log_title' => strtr( $user->getName(), ' ', '_' )
234 [ 'change_tag_def' => [ 'INNER JOIN', 'ctd_id = ct_tag_id' ] ]
239 public function testWithoutTagPermission() {
240 ChangeTags
::defineTag( 'custom tag' );
242 $this->setGroupPermissions( 'user', 'applychangetags', false );
244 $this->doFailedRightsChange(
245 'You do not have permission to apply change tags along with your changes.',
246 [ 'tags' => 'custom tag' ]
250 public function testNonexistentUser() {
251 $this->doFailedRightsChange(
252 'There is no user by the name "Nonexistent user". Check your spelling.',
253 [ 'user' => 'Nonexistent user' ]
257 public function testWebToken() {
258 $sysop = $this->getTestSysop()->getUser();
259 $user = $this->getMutableTestUser()->getUser();
261 $token = $sysop->getEditToken( $user->getName() );
263 $res = $this->doApiRequest( [
264 'action' => 'userrights',
265 'user' => $user->getName(),
270 $user->clearInstanceCache();
271 $this->assertSame( [ 'sysop' ], $user->getGroups() );
273 $this->assertArrayNotHasKey( 'warnings', $res[0] );
277 * Helper for testCanProcessExpiries that returns a mock ApiUserrights that either can or cannot
278 * process expiries. Although the regular page can process expiries, we use a mock here to
279 * ensure that it's the result of canProcessExpiries() that makes a difference, and not some
280 * error in the way we construct the mock.
282 * @param bool $canProcessExpiries
284 private function getMockForProcessingExpiries( $canProcessExpiries ) {
285 $sysop = $this->getTestSysop()->getUser();
286 $user = $this->getMutableTestUser()->getUser();
288 $token = $sysop->getEditToken( 'userrights' );
290 $main = new ApiMain( new FauxRequest( [
291 'action' => 'userrights',
292 'user' => $user->getName(),
297 $mockUserRightsPage = $this->getMockBuilder( UserrightsPage
::class )
298 ->setMethods( [ 'canProcessExpiries' ] )
300 $mockUserRightsPage->method( 'canProcessExpiries' )->willReturn( $canProcessExpiries );
302 $mockApi = $this->getMockBuilder( ApiUserrights
::class )
303 ->setConstructorArgs( [ $main, 'userrights' ] )
304 ->setMethods( [ 'getUserRightsPage' ] )
306 $mockApi->method( 'getUserRightsPage' )->willReturn( $mockUserRightsPage );
311 public function testCanProcessExpiries() {
312 $mock1 = $this->getMockForProcessingExpiries( true );
313 $this->assertArrayHasKey( 'expiry', $mock1->getAllowedParams() );
315 $mock2 = $this->getMockForProcessingExpiries( false );
316 $this->assertArrayNotHasKey( 'expiry', $mock2->getAllowedParams() );
320 * Tests adding and removing various groups with various permissions.
322 * @dataProvider addAndRemoveGroupsProvider
323 * @param array|null $permissions [ [ $wgAddGroups, $wgRemoveGroups ] ] or null for 'userrights'
324 * to be set in $wgGroupPermissions
325 * @param array $groupsToChange [ [ groups to add ], [ groups to remove ] ]
326 * @param array $expectedGroups Array of expected groups
328 public function testAddAndRemoveGroups(
329 array $permissions = null, array $groupsToChange, array $expectedGroups
331 if ( $permissions !== null ) {
332 $this->setPermissions( $permissions[0], $permissions[1] );
336 'add' => implode( '|', $groupsToChange[0] ),
337 'remove' => implode( '|', $groupsToChange[1] ),
340 // We'll take a bot so we have a group to remove
341 $user = $this->getMutableTestUser( [ 'bot' ] )->getUser();
343 $this->doSuccessfulRightsChange( $expectedGroups, $params, $user );
346 public function addAndRemoveGroupsProvider() {
352 ], 'Add with only remove permission' => [
356 ], 'Add with global remove permission' => [
360 ], 'Simple remove' => [
364 ], 'Remove with only add permission' => [
368 ], 'Remove with global add permission' => [
372 ], 'Add and remove same new group' => [
374 [ [ 'sysop' ], [ 'sysop' ] ],
375 // The userrights code does removals before adds, so it doesn't remove the sysop
376 // group here and only adds it.
378 ], 'Add and remove same existing group' => [
380 [ [ 'bot' ], [ 'bot' ] ],
381 // But here it first removes the existing group and then re-adds it.