diff options
Diffstat (limited to 'server/szurubooru/tests/api/test_post_retrieving.py')
| -rw-r--r-- | server/szurubooru/tests/api/test_post_retrieving.py | 26 |
1 files changed, 25 insertions, 1 deletions
diff --git a/server/szurubooru/tests/api/test_post_retrieving.py b/server/szurubooru/tests/api/test_post_retrieving.py index ac984c2..a40ab0e 100644 --- a/server/szurubooru/tests/api/test_post_retrieving.py +++ b/server/szurubooru/tests/api/test_post_retrieving.py @@ -14,6 +14,7 @@ def inject_config(config_injector): "privileges": { "posts:list": model.User.RANK_REGULAR, "posts:view": model.User.RANK_REGULAR, + "posts:view:unsafe": model.User.RANK_REGULAR, }, } ) @@ -73,7 +74,10 @@ def test_trying_to_use_special_tokens_without_logging_in( ): config_injector( { - "privileges": {"posts:list": "anonymous"}, + "privileges": { + "posts:list": "anonymous", + "posts:list:unsafe": "regular", + }, } ) with pytest.raises(errors.SearchError): @@ -125,3 +129,23 @@ def test_trying_to_retrieve_single_without_privileges( context_factory(user=user_factory(rank=model.User.RANK_ANONYMOUS)), {"post_id": 999}, ) + + +def test_trying_to_retrieve_unsafe_without_privileges( + user_factory, context_factory, post_factory, config_injector +): + config_injector( + { + "privileges": { + "posts:view": "anonymous", + "posts:view:unsafe": "regular", + }, + } + ) + db.session.add(post_factory(id=1, safety=model.Post.SAFETY_UNSAFE)) + db.session.flush() + with pytest.raises(errors.AuthError): + api.post_api.get_post( + context_factory(user=user_factory(rank=model.User.RANK_ANONYMOUS)), + {"post_id": 1}, + ) |