server: api permission tests for metrics

3 files changed, 20 insertions, 2 deletions

diff --git a/server/szurubooru/api/post_api.py b/server/szurubooru/api/post_api.py
index 64e2de9..95c0ebc 100644
--- a/server/szurubooru/api/post_api.py
+++ b/server/szurubooru/api/post_api.py
@@ -135,11 +135,11 @@ def update_post(ctx: rest.Context, params: Dict[str, str]) -> rest.Response:
     if ctx.has_file('thumbnail'):
         auth.verify_privilege(ctx.user, 'posts:edit:thumbnail')
         posts.update_post_thumbnail(post, ctx.get_file('thumbnail'))
-    if ctx.has_file('metrics'):
+    if ctx.has_param('metrics'):
         auth.verify_privilege(ctx.user, 'metrics:edit:posts')
         metrics.update_or_create_post_metrics(
             post, ctx.get_param_as_list('metrics'))
-    if ctx.has_file('metricRanges'):
+    if ctx.has_param('metricRanges'):
         auth.verify_privilege(ctx.user, 'metrics:edit:posts')
         metrics.update_or_create_post_metric_ranges(
             post, ctx.get_param_as_list('metricRanges'))
diff --git a/server/szurubooru/tests/api/test_post_updating.py b/server/szurubooru/tests/api/test_post_updating.py
index fa298ea..4f8b7fa 100644
--- a/server/szurubooru/tests/api/test_post_updating.py
+++ b/server/szurubooru/tests/api/test_post_updating.py
@@ -18,6 +18,7 @@ def inject_config(config_injector):
             'posts:edit:flags': model.User.RANK_REGULAR,
             'posts:edit:thumbnail': model.User.RANK_REGULAR,
             'tags:create': model.User.RANK_MODERATOR,
+            'metrics:edit:posts': model.User.RANK_REGULAR,
         },
     })
 
@@ -143,6 +144,8 @@ def test_trying_to_update_non_existing(context_factory, user_factory):
     ({}, {'flags': '...'}),
     ({'content': '...'}, {}),
     ({'thumbnail': '...'}, {}),
+    ({}, {'metrics': '...'}),
+    ({}, {'metricRanges': '...'}),
 ])
 def test_trying_to_update_field_without_privileges(
         context_factory, post_factory, user_factory, files, params):
diff --git a/server/szurubooru/tests/api/test_tag_updating.py b/server/szurubooru/tests/api/test_tag_updating.py
index 0b8aa70..7ae08e0 100644
--- a/server/szurubooru/tests/api/test_tag_updating.py
+++ b/server/szurubooru/tests/api/test_tag_updating.py
@@ -14,6 +14,8 @@ def inject_config(config_injector):
             'tags:edit:description': model.User.RANK_REGULAR,
             'tags:edit:suggestions': model.User.RANK_REGULAR,
             'tags:edit:implications': model.User.RANK_REGULAR,
+            'metrics:create': model.User.RANK_POWER,
+            'metrics:edit:bounds': model.User.RANK_POWER,
         },
     })
 
@@ -104,6 +106,7 @@ def test_trying_to_update_non_existing(user_factory, context_factory):
     {'category': 'whatever'},
     {'suggestions': ['whatever']},
     {'implications': ['whatever']},
+    {'metric': ['whatever']},
 ])
 def test_trying_to_update_without_privileges(
         user_factory, tag_factory, context_factory, params):
@@ -117,6 +120,18 @@ def test_trying_to_update_without_privileges(
             {'tag_name': 'tag'})
 
 
+def test_trying_to_create_metric_without_privileges(
+        user_factory, tag_factory, context_factory):
+    db.session.add(tag_factory(names=['tag']))
+    db.session.commit()
+    with pytest.raises(errors.AuthError):
+        api.tag_api.update_tag(
+            context_factory(
+                params={'metric': {'min': 0, 'max': 10}, **{'version': 1}},
+                user=user_factory(rank=model.User.RANK_ANONYMOUS)),
+            {'tag_name': 'tag'})
+
+
 def test_trying_to_create_tags_without_privileges(
         config_injector, context_factory, tag_factory, user_factory):
     tag = tag_factory(names=['tag'])