Add privilege :user_deletion
This commit is contained in:
parent
5b19543f0a
commit
9f6c364759
|
@ -257,7 +257,7 @@
|
||||||
password_reset_token_validity: 60 * 60 * 24,
|
password_reset_token_validity: 60 * 60 * 24,
|
||||||
profile_directory: true,
|
profile_directory: true,
|
||||||
privileged_staff: false,
|
privileged_staff: false,
|
||||||
admin_privileges: [],
|
admin_privileges: [:user_deletion],
|
||||||
moderator_privileges: [],
|
moderator_privileges: [],
|
||||||
max_endorsed_users: 20,
|
max_endorsed_users: 20,
|
||||||
birthday_required: false,
|
birthday_required: false,
|
||||||
|
|
|
@ -969,14 +969,16 @@
|
||||||
%{
|
%{
|
||||||
key: :admin_privileges,
|
key: :admin_privileges,
|
||||||
type: {:list, :atom},
|
type: {:list, :atom},
|
||||||
suggestions: [],
|
suggestions: [:user_deletion],
|
||||||
description: "What extra priviledges to allow admins (e.g. updating user credentials, get password reset token, delete users, index and read private statuses and chats)"
|
description:
|
||||||
|
"What extra priviledges to allow admins (e.g. updating user credentials, get password reset token, delete users, index and read private statuses and chats)"
|
||||||
},
|
},
|
||||||
%{
|
%{
|
||||||
key: :moderator_privileges,
|
key: :moderator_privileges,
|
||||||
type: {:list, :atom},
|
type: {:list, :atom},
|
||||||
suggestions: [],
|
suggestions: [:user_deletion],
|
||||||
description: "What extra priviledges to allow moderators (e.g. updating user credentials, get password reset token, delete users, index and read private statuses and chats)"
|
description:
|
||||||
|
"What extra priviledges to allow moderators (e.g. updating user credentials, get password reset token, delete users, index and read private statuses and chats)"
|
||||||
},
|
},
|
||||||
%{
|
%{
|
||||||
key: :birthday_required,
|
key: :birthday_required,
|
||||||
|
|
|
@ -109,6 +109,11 @@ defmodule Pleroma.Web.Router do
|
||||||
plug(Pleroma.Web.Plugs.UserIsAdminPlug)
|
plug(Pleroma.Web.Plugs.UserIsAdminPlug)
|
||||||
end
|
end
|
||||||
|
|
||||||
|
pipeline :require_privileged_role_user_deletion do
|
||||||
|
plug(:admin_api)
|
||||||
|
plug(Pleroma.Web.Plugs.EnsurePrivilegedPlug, :user_deletion)
|
||||||
|
end
|
||||||
|
|
||||||
pipeline :pleroma_html do
|
pipeline :pleroma_html do
|
||||||
plug(:browser)
|
plug(:browser)
|
||||||
plug(:authenticate)
|
plug(:authenticate)
|
||||||
|
@ -231,12 +236,17 @@ defmodule Pleroma.Web.Router do
|
||||||
post("/backups", AdminAPIController, :create_backup)
|
post("/backups", AdminAPIController, :create_backup)
|
||||||
end
|
end
|
||||||
|
|
||||||
|
# AdminAPI: admins and mods (staff) can perform these actions (if privileged by role)
|
||||||
|
scope "/api/v1/pleroma/admin", Pleroma.Web.AdminAPI do
|
||||||
|
pipe_through([:admin_api, :require_privileged_role_user_deletion])
|
||||||
|
|
||||||
|
delete("/users", UserController, :delete)
|
||||||
|
end
|
||||||
|
|
||||||
# AdminAPI: admins and mods (staff) can perform these actions (if enabled by config)
|
# AdminAPI: admins and mods (staff) can perform these actions (if enabled by config)
|
||||||
scope "/api/v1/pleroma/admin", Pleroma.Web.AdminAPI do
|
scope "/api/v1/pleroma/admin", Pleroma.Web.AdminAPI do
|
||||||
pipe_through([:admin_api, :require_privileged_staff])
|
pipe_through([:admin_api, :require_privileged_staff])
|
||||||
|
|
||||||
delete("/users", UserController, :delete)
|
|
||||||
|
|
||||||
get("/users/:nickname/password_reset", AdminAPIController, :get_password_reset)
|
get("/users/:nickname/password_reset", AdminAPIController, :get_password_reset)
|
||||||
patch("/users/:nickname/credentials", AdminAPIController, :update_user_credentials)
|
patch("/users/:nickname/credentials", AdminAPIController, :update_user_credentials)
|
||||||
|
|
||||||
|
|
|
@ -94,6 +94,7 @@ test "GET /api/pleroma/admin/users/:nickname requires admin:read:accounts or bro
|
||||||
describe "DELETE /api/pleroma/admin/users" do
|
describe "DELETE /api/pleroma/admin/users" do
|
||||||
test "single user", %{admin: admin, conn: conn} do
|
test "single user", %{admin: admin, conn: conn} do
|
||||||
clear_config([:instance, :federating], true)
|
clear_config([:instance, :federating], true)
|
||||||
|
clear_config([:instance, :admin_privileges], [:user_deletion])
|
||||||
|
|
||||||
user =
|
user =
|
||||||
insert(:user,
|
insert(:user,
|
||||||
|
@ -149,6 +150,8 @@ test "single user", %{admin: admin, conn: conn} do
|
||||||
end
|
end
|
||||||
|
|
||||||
test "multiple users", %{admin: admin, conn: conn} do
|
test "multiple users", %{admin: admin, conn: conn} do
|
||||||
|
clear_config([:instance, :admin_privileges], [:user_deletion])
|
||||||
|
|
||||||
user_one = insert(:user)
|
user_one = insert(:user)
|
||||||
user_two = insert(:user)
|
user_two = insert(:user)
|
||||||
|
|
||||||
|
@ -168,6 +171,17 @@ test "multiple users", %{admin: admin, conn: conn} do
|
||||||
|
|
||||||
assert response -- [user_one.nickname, user_two.nickname] == []
|
assert response -- [user_one.nickname, user_two.nickname] == []
|
||||||
end
|
end
|
||||||
|
|
||||||
|
test "Needs privileged role", %{conn: conn} do
|
||||||
|
clear_config([:instance, :admin_privileges], [])
|
||||||
|
|
||||||
|
response =
|
||||||
|
conn
|
||||||
|
|> put_req_header("accept", "application/json")
|
||||||
|
|> delete("/api/pleroma/admin/users?nickname=nickname")
|
||||||
|
|
||||||
|
assert json_response(response, :forbidden)
|
||||||
|
end
|
||||||
end
|
end
|
||||||
|
|
||||||
describe "/api/pleroma/admin/users" do
|
describe "/api/pleroma/admin/users" do
|
||||||
|
|
Loading…
Reference in New Issue