From 235cd3592eecd6ee20941c1e16b4b29c7a588dd8 Mon Sep 17 00:00:00 2001 From: Pradip Subedi Date: Thu, 13 Aug 2026 14:53:57 +0545 Subject: [PATCH] test: add vault public link rejection scenarios --- tests/acceptance/TestHelpers/GraphHelper.php | 16 ++- .../acceptance/bootstrap/SharingNgContext.php | 19 ++- .../features/apiVault/vault.feature | 117 ++++++++++++++++++ 3 files changed, 143 insertions(+), 9 deletions(-) diff --git a/tests/acceptance/TestHelpers/GraphHelper.php b/tests/acceptance/TestHelpers/GraphHelper.php index c8456269f75..d3304986128 100644 --- a/tests/acceptance/TestHelpers/GraphHelper.php +++ b/tests/acceptance/TestHelpers/GraphHelper.php @@ -1799,29 +1799,33 @@ public static function sendSharingInvitation( /** * @param string $baseUrl - * @param string $user - * @param string $password + * @param string|null $user + * @param string|null $password * @param string $spaceId * @param string $itemId * @param mixed $body + * @param array $headers + * @param boolean $isVault * * @return ResponseInterface * @throws GuzzleException */ public static function createLinkShare( string $baseUrl, - string $user, - string $password, + ?string $user, + ?string $password, string $spaceId, string $itemId, $body, + array $headers = [], + bool $isVault = false, ): ResponseInterface { - $url = self::getBetaFullUrl($baseUrl, "drives/$spaceId/items/$itemId/createLink"); + $url = self::getBetaFullUrl($baseUrl, "drives/$spaceId/items/$itemId/createLink", $isVault); return HttpRequestHelper::post( $url, $user, $password, - self::getRequestHeaders(), + array_merge(self::getRequestHeaders(), $headers), $body, ); } diff --git a/tests/acceptance/bootstrap/SharingNgContext.php b/tests/acceptance/bootstrap/SharingNgContext.php index 57a6202ebcb..a9383ff579e 100644 --- a/tests/acceptance/bootstrap/SharingNgContext.php +++ b/tests/acceptance/bootstrap/SharingNgContext.php @@ -71,14 +71,15 @@ public function before(BeforeScenarioScope $scope): void { public function createLinkShare(string $user, TableNode $body): ResponseInterface { $bodyRows = $body->getRowsHash(); $resource = $bodyRows['resource'] ?? ""; + $isVault = isset($bodyRows['storage']) && $bodyRows['storage'] === 'vault'; - $space = $this->spacesContext->getSpaceByName($user, $bodyRows['space']); + $space = $this->spacesContext->getSpaceByName($user, $bodyRows['space'], $isVault); $spaceId = $space['id']; if ($resource === '' && !\in_array($bodyRows['space'], ['Personal', 'Shares'])) { $itemId = $space['fileId']; } else { - $itemId = $this->spacesContext->getResourceId($user, $bodyRows['space'], $resource); + $itemId = $this->spacesContext->getResourceId($user, $bodyRows['space'], $resource, $isVault); } $bodyRows['quickLink'] = $bodyRows['quickLink'] ?? false; @@ -97,13 +98,25 @@ public function createLinkShare(string $user, TableNode $body): ResponseInterfac 'password' => $this->featureContext->getActualPassword($bodyRows['password']), ]; + $headers = []; + if (KeycloakHelper::isTestingWithKeycloak()) { + $accessToken = $this->featureContext->getOcisUserToken($user)['token']['accessToken']; + $headers['Authorization'] = 'Bearer ' . $accessToken; + $user = null; + $password = null; + } else { + $password = $this->featureContext->getPasswordForUser($user); + } + $response = GraphHelper::createLinkShare( $this->featureContext->getBaseUrl(), $user, - $this->featureContext->getPasswordForUser($user), + $password, $spaceId, $itemId, \json_encode($body), + $headers, + $isVault, ); if ($response->getStatusCode() == 200) { diff --git a/tests/acceptance/features/apiVault/vault.feature b/tests/acceptance/features/apiVault/vault.feature index 8a713bd55ef..5c468556dc5 100644 --- a/tests/acceptance/features/apiVault/vault.feature +++ b/tests/acceptance/features/apiVault/vault.feature @@ -275,6 +275,123 @@ Feature: vault | testfile.txt | + Scenario: user tries to create a public link of a folder inside vault + Given user "Alice" has logged in via web UI + And user "Alice" has created a folder "vaultFolder" in space "Personal" in vault + When user "Alice" creates the following resource link share using the Graph API: + | resource | vaultFolder | + | space | Personal | + | permissionsRole | View | + | storage | vault | + Then the HTTP status code should be "400" + And the JSON data of the response should match + """ + { + "type": "object", + "required": ["error"], + "properties": { + "error": { + "type": "object", + "required": ["code", "innererror", "message"], + "properties": { + "code": { + "const": "invalidRequest" + }, + "innererror": { + "type": "object", + "required": [ + "date", + "request-id" + ] + }, + "message": { + "const": "public links are not allowed for vault resources" + } + } + } + } + } + """ + + + Scenario: user tries to create a public link of a file inside vault + Given user "Alice" has logged in via web UI + And user "Alice" has uploaded a file inside space "Personal" with content "some content" to "testfile.txt" in vault + When user "Alice" creates the following resource link share using the Graph API: + | resource | testfile.txt | + | space | Personal | + | permissionsRole | View | + | storage | vault | + Then the HTTP status code should be "400" + And the JSON data of the response should match + """ + { + "type": "object", + "required": ["error"], + "properties": { + "error": { + "type": "object", + "required": ["code", "innererror", "message"], + "properties": { + "code": { + "const": "invalidRequest" + }, + "innererror": { + "type": "object", + "required": [ + "date", + "request-id" + ] + }, + "message": { + "const": "public links are not allowed for vault resources" + } + } + } + } + } + """ + + + Scenario: user tries to create a public link of a space root inside vault + Given the administrator has assigned the role "Space Admin" to user "Alice" using the Graph API + And user "Alice" has logged in via web UI + And user "Alice" has created a space "vault-space" in vault with the default quota using the Graph API + When user "Alice" tries to create the following space link share using permissions endpoint of the Graph API: + | space | vault-space | + | permissionsRole | View | + | storage | vault | + Then the HTTP status code should be "400" + And the JSON data of the response should match + """ + { + "type": "object", + "required": ["error"], + "properties": { + "error": { + "type": "object", + "required": ["code", "innererror", "message"], + "properties": { + "code": { + "const": "invalidRequest" + }, + "innererror": { + "type": "object", + "required": [ + "date", + "request-id" + ] + }, + "message": { + "const": "public links are not allowed for vault resources" + } + } + } + } + } + """ + + Scenario Outline: send share invitation for project space in vault to user with different roles (permissions endpoint) Given the administrator has assigned the role "Space Admin" to user "Alice" using the Graph API And user "Alice" has logged in via web UI