Rename apiBasic to apiAccountsHashDifficulty

2021-01-28 11:56:07 +05:45
parent 5a44f83bbf
commit 924246c0a6
8 changed files with 51 additions and 33 deletions
@@ -0,0 +1,21 @@
+@api @provisioning_api-app-required @skipOnLDAP
+Feature: add user
+  As an admin
+  I want to be able to add users and store their password with the full hash difficulty
+  So that I can give people controlled individual access to resources on the ownCloud server
+
+  Note - this feature is run in CI with ACCOUNTS_HASH_DIFFICULTY set to the default for production
+  See https://github.com/owncloud/ocis/issues/1542 and https://github.com/owncloud/ocis/pull/839
+
+  Scenario Outline: admin creates a user
+    Given using OCS API version "<ocs_api_version>"
+    And user "brand-new-user" has been deleted
+    When the administrator sends a user creation request for user "brand-new-user" password "%alt1%" using the provisioning API
+    Then the OCS status code should be "<ocs_status_code>"
+    And the HTTP status code should be "200"
+    And user "brand-new-user" should exist
+    And user "brand-new-user" should be able to access a skeleton file
+    Examples:
+      | ocs_api_version | ocs_status_code |
+      | 1               | 100             |
+      | 2               | 200             |
@@ -0,0 +1,24 @@
+@api @files_sharing-app-required
+Feature: sharing
+  As a user
+  I want to be able to share files when passwords are stored with the full hash difficulty
+  So that I can give people secure controlled access to my data
+
+  Note - this feature is run in CI with ACCOUNTS_HASH_DIFFICULTY set to the default for production
+  See https://github.com/owncloud/ocis/issues/1542 and https://github.com/owncloud/ocis/pull/839
+
+  Scenario Outline: Creating a share of a file with a user
+    Given the administrator has set the default folder for received shares to "Shares"
+    And auto-accept shares has been disabled
+    And using OCS API version "<ocs_api_version>"
+    And user "Alice" has been created with default attributes and without skeleton files
+    And user "Alice" has uploaded file with content "ownCloud test text file 0" to "/textfile0.txt"
+    And user "Brian" has been created with default attributes and without skeleton files
+    When user "Alice" shares file "textfile0.txt" with user "Brian" using the sharing API
+    And user "Brian" accepts share "/textfile0.txt" offered by user "Alice" using the sharing API
+    Then the HTTP status code should be "200"
+    And the content of file "/Shares/textfile0.txt" for user "Brian" should be "ownCloud test text file 0"
+    Examples:
+      | ocs_api_version |
+      | 1               |
+      | 2               |
@@ -0,0 +1,21 @@
+@api
+Feature: upload file
+  As a user
+  I want to be able to upload files when passwords are stored with the full hash difficulty
+  So that I can store and share files securely between multiple client systems
+
+  Note - this feature is run in CI with ACCOUNTS_HASH_DIFFICULTY set to the default for production
+  See https://github.com/owncloud/ocis/issues/1542 and https://github.com/owncloud/ocis/pull/839
+
+  Scenario Outline: upload a file and check download content
+    Given using OCS API version "<ocs_api_version>"
+    And user "Alice" has been created with default attributes and without skeleton files
+    And using <dav_version> DAV path
+    When user "Alice" uploads file with content "uploaded content" to "/upload.txt" using the WebDAV API
+    Then the content of file "/upload.txt" for user "Alice" should be "uploaded content"
+    Examples:
+      | ocs_api_version | dav_version |
+      | 1               | old         |
+      | 1               | new         |
+      | 2               | old         |
+      | 2               | new         |
@@ -0,0 +1,32 @@
+@api
+Feature: attempt to PUT files with invalid password
+  As an admin
+  I want to the system to be secure when passwords are stored with the full hash difficulty
+  So that unauthorised users do not have access to data
+
+  Note - this feature is run in CI with ACCOUNTS_HASH_DIFFICULTY set to the default for production
+  See https://github.com/owncloud/ocis/issues/1542 and https://github.com/owncloud/ocis/pull/839
+
+  Background:
+    Given user "Alice" has been created with default attributes and without skeleton files
+    And user "Alice" has created folder "/PARENT"
+
+  Scenario: send PUT requests to webDav endpoints as normal user with wrong password
+    When user "Alice" requests these endpoints with "PUT" including body "doesnotmatter" using password "invalid" about user "Alice"
+      | endpoint                                           |
+      | /remote.php/webdav/textfile0.txt                   |
+      | /remote.php/dav/files/%username%/textfile0.txt     |
+      | /remote.php/webdav/PARENT                          |
+      | /remote.php/dav/files/%username%/PARENT            |
+      | /remote.php/dav/files/%username%/PARENT/parent.txt |
+    Then the HTTP status code of responses on all endpoints should be "401"
+
+  Scenario: send PUT requests to webDav endpoints as normal user with no password
+    When user "Alice" requests these endpoints with "PUT" including body "doesnotmatter" using password "" about user "Alice"
+      | endpoint                                           |
+      | /remote.php/webdav/textfile0.txt                   |
+      | /remote.php/dav/files/%username%/textfile0.txt     |
+      | /remote.php/webdav/PARENT                          |
+      | /remote.php/dav/files/%username%/PARENT            |
+      | /remote.php/dav/files/%username%/PARENT/parent.txt |
+    Then the HTTP status code of responses on all endpoints should be "401"