8 * @covers ApiUserrights
10 class ApiUserrightsTest
extends ApiTestCase
{
12 * Unsets $wgGroupPermissions['bureaucrat']['userrights'], and sets
13 * $wgAddGroups['bureaucrat'] and $wgRemoveGroups['bureaucrat'] to the
16 * @param array|bool $add Groups bureaucrats should be allowed to add, true for all
17 * @param array|bool $remove Groups bureaucrats should be allowed to remove, true for all
19 protected function setPermissions( $add = [], $remove = [] ) {
20 global $wgAddGroups, $wgRemoveGroups;
22 $this->setGroupPermissions( 'bureaucrat', 'userrights', false );
25 $this->stashMwGlobals( 'wgAddGroups' );
26 $wgAddGroups['bureaucrat'] = $add;
29 $this->stashMwGlobals( 'wgRemoveGroups' );
30 $wgRemoveGroups['bureaucrat'] = $remove;
35 * Perform an API userrights request that's expected to be successful.
37 * @param array|string $expectedGroups Group(s) that the user is expected
38 * to have after the API request
39 * @param array $params Array to pass to doApiRequestWithToken(). 'action'
40 * => 'userrights' is implicit. If no 'user' or 'userid' is specified,
41 * we add a 'user' parameter. If no 'add' or 'remove' is specified, we
42 * add 'add' => 'sysop'.
43 * @param User|null $user The user that we're modifying. The user must be
44 * mutable, because we're going to change its groups! null means that
45 * we'll make up our own user to modify, and doesn't make sense if 'user'
46 * or 'userid' is specified in $params.
48 protected function doSuccessfulRightsChange(
49 $expectedGroups = 'sysop', array $params = [], User
$user = null
51 $expectedGroups = (array)$expectedGroups;
52 $params['action'] = 'userrights';
55 $user = $this->getMutableTestUser()->getUser();
58 $this->assertTrue( TestUserRegistry
::isMutable( $user ),
59 'Immutable user passed to doSuccessfulRightsChange!' );
61 if ( !isset( $params['user'] ) && !isset( $params['userid'] ) ) {
62 $params['user'] = $user->getName();
64 if ( !isset( $params['add'] ) && !isset( $params['remove'] ) ) {
65 $params['add'] = 'sysop';
68 $res = $this->doApiRequestWithToken( $params );
70 $user->clearInstanceCache();
71 $this->assertSame( $expectedGroups, $user->getGroups() );
73 $this->assertArrayNotHasKey( 'warnings', $res[0] );
77 * Perform an API userrights request that's expected to fail.
79 * @param string $expectedException Expected exception text
80 * @param array $params As for doSuccessfulRightsChange()
81 * @param User|null $user As for doSuccessfulRightsChange(). If there's no
82 * user who will possibly be affected (such as if an invalid username is
83 * provided in $params), pass null.
85 protected function doFailedRightsChange(
86 $expectedException, array $params = [], User
$user = null
88 $params['action'] = 'userrights';
90 $this->setExpectedException( ApiUsageException
::class, $expectedException );
93 // If 'user' or 'userid' is specified and $user was not specified,
94 // the user we're creating now will have nothing to do with the API
95 // request, but that's okay, since we're just testing that it has
97 $user = $this->getMutableTestUser()->getUser();
100 $this->assertTrue( TestUserRegistry
::isMutable( $user ),
101 'Immutable user passed to doFailedRightsChange!' );
103 if ( !isset( $params['user'] ) && !isset( $params['userid'] ) ) {
104 $params['user'] = $user->getName();
106 if ( !isset( $params['add'] ) && !isset( $params['remove'] ) ) {
107 $params['add'] = 'sysop';
109 $expectedGroups = $user->getGroups();
112 $this->doApiRequestWithToken( $params );
114 $user->clearInstanceCache();
115 $this->assertSame( $expectedGroups, $user->getGroups() );
119 public function testAdd() {
120 $this->doSuccessfulRightsChange();
123 public function testBlockedWithUserrights() {
126 $block = new Block( [ 'address' => $wgUser, 'by' => $wgUser->getId(), ] );
130 $this->doSuccessfulRightsChange();
133 $wgUser->clearInstanceCache();
137 public function testBlockedWithoutUserrights() {
138 $user = $this->getTestSysop()->getUser();
140 $this->setPermissions( true, true );
142 $block = new Block( [ 'address' => $user, 'by' => $user->getId() ] );
146 $this->doFailedRightsChange( 'You have been blocked from editing.' );
149 $user->clearInstanceCache();
153 public function testAddMultiple() {
154 $this->doSuccessfulRightsChange(
155 [ 'bureaucrat', 'sysop' ],
156 [ 'add' => 'bureaucrat|sysop' ]
160 public function testTooFewExpiries() {
161 $this->doFailedRightsChange(
162 '2 expiry timestamps were provided where 3 were needed.',
163 [ 'add' => 'sysop|bureaucrat|bot', 'expiry' => 'infinity|tomorrow' ]
167 public function testTooManyExpiries() {
168 $this->doFailedRightsChange(
169 '3 expiry timestamps were provided where 2 were needed.',
170 [ 'add' => 'sysop|bureaucrat', 'expiry' => 'infinity|tomorrow|never' ]
174 public function testInvalidExpiry() {
175 $this->doFailedRightsChange( 'Invalid expiry time', [ 'expiry' => 'yummy lollipops!' ] );
178 public function testMultipleInvalidExpiries() {
179 $this->doFailedRightsChange(
180 'Invalid expiry time "foo".',
181 [ 'add' => 'sysop|bureaucrat', 'expiry' => 'foo|bar' ]
185 public function testWithTag() {
186 ChangeTags
::defineTag( 'custom tag' );
188 $user = $this->getMutableTestUser()->getUser();
190 $this->doSuccessfulRightsChange( 'sysop', [ 'tags' => 'custom tag' ], $user );
192 $dbr = wfGetDB( DB_REPLICA
);
196 [ 'change_tag', 'logging' ],
199 'ct_log_id = log_id',
200 'log_namespace' => NS_USER
,
201 'log_title' => strtr( $user->getName(), ' ', '_' )
208 public function testWithoutTagPermission() {
209 global $wgGroupPermissions;
211 ChangeTags
::defineTag( 'custom tag' );
213 $this->stashMwGlobals( 'wgGroupPermissions' );
214 $wgGroupPermissions['user']['applychangetags'] = false;
216 $this->doFailedRightsChange(
217 'You do not have permission to apply change tags along with your changes.',
218 [ 'tags' => 'custom tag' ]
222 public function testNonexistentUser() {
223 $this->doFailedRightsChange(
224 'There is no user by the name "Nonexistent user". Check your spelling.',
225 [ 'user' => 'Nonexistent user' ]
229 public function testWebToken() {
230 $sysop = $this->getTestSysop()->getUser();
231 $user = $this->getMutableTestUser()->getUser();
233 $token = $sysop->getEditToken( $user->getName() );
235 $res = $this->doApiRequest( [
236 'action' => 'userrights',
237 'user' => $user->getName(),
242 $user->clearInstanceCache();
243 $this->assertSame( [ 'sysop' ], $user->getGroups() );
245 $this->assertArrayNotHasKey( 'warnings', $res[0] );
249 * Helper for testCanProcessExpiries that returns a mock ApiUserrights that either can or cannot
250 * process expiries. Although the regular page can process expiries, we use a mock here to
251 * ensure that it's the result of canProcessExpiries() that makes a difference, and not some
252 * error in the way we construct the mock.
254 * @param bool $canProcessExpiries
256 private function getMockForProcessingExpiries( $canProcessExpiries ) {
257 $sysop = $this->getTestSysop()->getUser();
258 $user = $this->getMutableTestUser()->getUser();
260 $token = $sysop->getEditToken( 'userrights' );
262 $main = new ApiMain( new FauxRequest( [
263 'action' => 'userrights',
264 'user' => $user->getName(),
269 $mockUserRightsPage = $this->getMockBuilder( UserrightsPage
::class )
270 ->setMethods( [ 'canProcessExpiries' ] )
272 $mockUserRightsPage->method( 'canProcessExpiries' )->willReturn( $canProcessExpiries );
274 $mockApi = $this->getMockBuilder( ApiUserrights
::class )
275 ->setConstructorArgs( [ $main, 'userrights' ] )
276 ->setMethods( [ 'getUserRightsPage' ] )
278 $mockApi->method( 'getUserRightsPage' )->willReturn( $mockUserRightsPage );
283 public function testCanProcessExpiries() {
284 $mock1 = $this->getMockForProcessingExpiries( true );
285 $this->assertArrayHasKey( 'expiry', $mock1->getAllowedParams() );
287 $mock2 = $this->getMockForProcessingExpiries( false );
288 $this->assertArrayNotHasKey( 'expiry', $mock2->getAllowedParams() );
292 * Tests adding and removing various groups with various permissions.
294 * @dataProvider addAndRemoveGroupsProvider
295 * @param array|null $permissions [ [ $wgAddGroups, $wgRemoveGroups ] ] or null for 'userrights'
296 * to be set in $wgGroupPermissions
297 * @param array $groupsToChange [ [ groups to add ], [ groups to remove ] ]
298 * @param array $expectedGroups Array of expected groups
300 public function testAddAndRemoveGroups(
301 array $permissions = null, array $groupsToChange, array $expectedGroups
303 if ( $permissions !== null ) {
304 $this->setPermissions( $permissions[0], $permissions[1] );
308 'add' => implode( '|', $groupsToChange[0] ),
309 'remove' => implode( '|', $groupsToChange[1] ),
312 // We'll take a bot so we have a group to remove
313 $user = $this->getMutableTestUser( [ 'bot' ] )->getUser();
315 $this->doSuccessfulRightsChange( $expectedGroups, $params, $user );
318 public function addAndRemoveGroupsProvider() {
324 ], 'Add with only remove permission' => [
328 ], 'Add with global remove permission' => [
332 ], 'Simple remove' => [
336 ], 'Remove with only add permission' => [
340 ], 'Remove with global add permission' => [
344 ], 'Add and remove same new group' => [
346 [ [ 'sysop' ], [ 'sysop' ] ],
347 // The userrights code does removals before adds, so it doesn't remove the sysop
348 // group here and only adds it.
350 ], 'Add and remove same existing group' => [
352 [ [ 'bot' ], [ 'bot' ] ],
353 // But here it first removes the existing group and then re-adds it.