sevenhill/QSfera
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

graph/users: Fix http status codes for unprivileged requests

Browse Source 
Neither 'BadRequest' (as expected in the unit test) nor 'Unauthorized' (as expected
in the API tests) seem correct here. We're no returning 'Forbidden' when an unprivileged
users issues a GetUsers request that it is not allowed to perform.
This commit is contained in:
Ralf Haferkamp
2023-12-07 10:21:45 +01:00
committed by Ralf Haferkamp
parent 4cb6d99e88
commit 6fab0ad05a
3 changed files with 7 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/acceptance/features/apiGraph/getUser.feature
+3 -3
View File
@@ -229,7 +229,7 @@ Feature: get users
Scenario Outline: non-admin user tries to get all users
Given the administrator has assigned the role "<userRole>" to user "Alice" using the Graph API
When user "Brian" tries to get all users using the Graph API
Then the HTTP status code should be "401"
Then the HTTP status code should be "403"
And the JSON data of the response should match
"""
{
@@ -831,7 +831,7 @@ Feature: get users
And group "tea-lover" has been created
And user "Alice" has been added to group "tea-lover"
When the user "Brian" gets all users of the group "tea-lover" using the Graph API
Then the HTTP status code should be "401"
Then the HTTP status code should be "403"
And the JSON data of the response should match
"""
{
@@ -968,7 +968,7 @@ Feature: get users
Scenario Outline: non-admin user tries to get users with a certain role
Given the administrator has assigned the role "<userRole>" to user "Alice" using the Graph API
When the user "Alice" gets all users with role "<role>" using the Graph API
Then the HTTP status code should be "401"
Then the HTTP status code should be "403"
And the JSON data of the response should match
"""
{