review update+delete

radicale/tests/test_sharing.py

@@ -705,6 +705,7 @@ class TestSharingApiSanity(BaseTest):
                                     "type": "csv",
                                     "permit_create_map": True,
                                     "permit_create_token": True,
+                                    "permit_properties_overlay": True,
                                     "collection_by_map": "True",
                                     "collection_by_token": "True"},
                         "logging": {"request_header_on_debug": "False",
@@ -874,6 +875,106 @@ class TestSharingApiSanity(BaseTest):
             json_dict['PathOrToken'] = path_shared
             _, headers, answer = self._sharing_api_json("map", "delete", check=403, login="user:userpw", json_dict=json_dict)
 
+            logging.info("\n*** update map by user related to user flags (json->json)")
+            json_dict = {}
+            json_dict['PathOrToken'] = path_shared
+            json_dict['Enabled'] = True
+            json_dict['Hidden'] = True
+            _, headers, answer = self._sharing_api_json("map", "update", check=200, login="user:userpw", json_dict=json_dict)
+
+            logging.info("\n*** list as user and check user flags (json->json)")
+            json_dict = {}
+            json_dict['User'] = "user"
+            json_dict['PathOrToken'] = path_shared
+            _, headers, answer = self._sharing_api_json("map", "list", check=200, login="user:userpw", json_dict=json_dict)
+            answer_dict = json.loads(answer)
+            assert answer_dict['Status'] == "success"
+            assert answer_dict['Lines'] == 1
+            assert answer_dict['Content'][0]['EnabledByUser'] is True
+            assert answer_dict['Content'][0]['HiddenByUser'] is True
+
+            logging.info("\n*** update map by user related to user flags (json->json)")
+            json_dict = {}
+            json_dict['PathOrToken'] = path_shared
+            json_dict['Enabled'] = False
+            _, headers, answer = self._sharing_api_json("map", "update", check=200, login="user:userpw", json_dict=json_dict)
+
+            logging.info("\n*** list as user and check EnabledByUser==False (json->json)")
+            json_dict = {}
+            json_dict['User'] = "user"
+            json_dict['PathOrToken'] = path_shared
+            _, headers, answer = self._sharing_api_json("map", "list", check=200, login="user:userpw", json_dict=json_dict)
+            answer_dict = json.loads(answer)
+            assert answer_dict['Status'] == "success"
+            assert answer_dict['Lines'] == 1
+            assert answer_dict['Content'][0]['EnabledByUser'] is False
+
+            logging.info("\n*** update map by owner related to owner flags (json->json)")
+            json_dict = {}
+            json_dict['PathOrToken'] = path_shared
+            json_dict['Enabled'] = False
+            json_dict['Hidden'] = False
+            _, headers, answer = self._sharing_api_json("map", "update", check=200, login="owner:ownerpw", json_dict=json_dict)
+
+            logging.info("\n*** list as user and check owner flags (json->json)")
+            json_dict = {}
+            json_dict['User'] = "user"
+            json_dict['PathOrToken'] = path_shared
+            _, headers, answer = self._sharing_api_json("map", "list", check=200, login="user:userpw", json_dict=json_dict)
+            answer_dict = json.loads(answer)
+            assert answer_dict['Status'] == "success"
+            assert answer_dict['Lines'] == 1
+            assert answer_dict['Content'][0]['EnabledByOwner'] is False
+            assert answer_dict['Content'][0]['HiddenByOwner'] is False
+
+            logging.info("\n*** update map by owner related to owner flag Enabled->True (json->json)")
+            json_dict = {}
+            json_dict['PathOrToken'] = path_shared
+            json_dict['Enabled'] = True
+            _, headers, answer = self._sharing_api_json("map", "update", check=200, login="owner:ownerpw", json_dict=json_dict)
+
+            logging.info("\n*** list as user and check owner flags (json->json)")
+            json_dict = {}
+            json_dict['User'] = "user"
+            json_dict['PathOrToken'] = path_shared
+            _, headers, answer = self._sharing_api_json("map", "list", check=200, login="user:userpw", json_dict=json_dict)
+            answer_dict = json.loads(answer)
+            assert answer_dict['Status'] == "success"
+            assert answer_dict['Lines'] == 1
+            assert answer_dict['Content'][0]['EnabledByOwner'] is True
+
+            logging.info("\n*** update map by owner related to Properties -> 200")
+            json_dict = {}
+            json_dict['PathOrToken'] = path_shared
+            json_dict['Properties'] = {"ICAL:calendar-color": "#CCCCCC"}
+            _, headers, answer = self._sharing_api_json("map", "update", check=200, login="owner:ownerpw", json_dict=json_dict)
+
+            logging.info("\n*** list as user and check Properties (json->json)")
+            json_dict = {}
+            json_dict['User'] = "user"
+            json_dict['PathOrToken'] = path_shared
+            _, headers, answer = self._sharing_api_json("map", "list", check=200, login="user:userpw", json_dict=json_dict)
+            answer_dict = json.loads(answer)
+            assert answer_dict['Status'] == "success"
+            assert answer_dict['Lines'] == 1
+            assert answer_dict['Content'][0]['Properties']["ICAL:calendar-color"] == "#CCCCCC"
+
+            logging.info("\n*** update map by user related to Properties -> 200")
+            json_dict = {}
+            json_dict['PathOrToken'] = path_shared
+            json_dict['Properties'] = {"ICAL:calendar-color": "#DDDDDD"}
+            _, headers, answer = self._sharing_api_json("map", "update", check=200, login="user:userpw", json_dict=json_dict)
+
+            logging.info("\n*** list as user and check Properties (json->json)")
+            json_dict = {}
+            json_dict['User'] = "user"
+            json_dict['PathOrToken'] = path_shared
+            _, headers, answer = self._sharing_api_json("map", "list", check=200, login="user:userpw", json_dict=json_dict)
+            answer_dict = json.loads(answer)
+            assert answer_dict['Status'] == "success"
+            assert answer_dict['Lines'] == 1
+            assert answer_dict['Content'][0]['Properties']["ICAL:calendar-color"] == "#DDDDDD"
+
             logging.info("\n*** delete map by owner (json->json) -> ok")
             json_dict = {}
             json_dict['User'] = "user"
@@ -883,6 +984,164 @@ class TestSharingApiSanity(BaseTest):
             answer_dict = json.loads(answer)
             assert answer_dict['Status'] == "success"
 
+    def test_sharing_api_map_update_delete_permissions(self) -> None:
+        """share-by-map API usage tests."""
+        self.configure({"auth": {"type": "htpasswd",
+                                 "htpasswd_filename": self.htpasswd_file_path,
+                                 "htpasswd_encryption": "plain"},
+                        "sharing": {
+                                    "type": "csv",
+                                    "permit_create_map": True,
+                                    "permit_create_token": True,
+                                    "permit_properties_overlay": True,
+                                    "collection_by_map": "True",
+                                    "collection_by_token": "True"},
+                        "logging": {"request_header_on_debug": "False",
+                                    "request_content_on_debug": "False"},
+                        "rights": {"type": "owner_only"}})
+
+        json_dict: dict
+
+        path_shared = "/user/calendarUP-shared-by-owner.ics/"
+        path_mapped = "/owner/calendarUP.ics/"
+        path_mapped2 = "/owner/calendarUP2.ics/"
+        path_mapped_o2 = "/owner2/calendarUP3.ics/"
+
+        logging.info("\n*** prepare and test access")
+        self.mkcalendar(path_mapped, login="owner:ownerpw")
+        self.mkcalendar(path_mapped2, login="owner:ownerpw")
+        self.mkcalendar(path_mapped_o2, login="owner2:owner2pw")
+
+        for db_type in list(filter(lambda item: item != "none", sharing.INTERNAL_TYPES)):
+            logging.info("\n*** test: %s", db_type)
+            self.configure({"sharing": {"type": db_type}})
+
+            logging.info("\n*** create map with PathMapped and User and PathOrToken (json)")
+            json_dict = {}
+            json_dict['User'] = "user"
+            json_dict['PathMapped'] = path_mapped
+            json_dict['PathOrToken'] = path_shared
+            _, headers, answer = self._sharing_api_json("map", "create", check=200, login="owner:ownerpw", json_dict=json_dict)
+            answer_dict = json.loads(answer)
+            assert answer_dict['Status'] == "success"
+
+            logging.info("\n*** update map by owner: User (json->json) -> 200")
+            json_dict = {}
+            json_dict['User'] = "owner"
+            json_dict['PathOrToken'] = path_shared
+            _, headers, answer = self._sharing_api_json("map", "update", check=200, login="owner:ownerpw", json_dict=json_dict)
+
+            logging.info("\n*** update map by owner: PathMapped (json->json) -> 200")
+            json_dict = {}
+            json_dict['PathMapped'] = path_mapped2
+            json_dict['PathOrToken'] = path_shared
+            _, headers, answer = self._sharing_api_json("map", "update", check=200, login="owner:ownerpw", json_dict=json_dict)
+
+            logging.info("\n*** update map by owner: PathMapped(owner2) (json->json) -> 403")
+            json_dict = {}
+            json_dict['PathMapped'] = path_mapped_o2
+            json_dict['PathOrToken'] = path_shared
+            _, headers, answer = self._sharing_api_json("map", "update", check=403, login="owner:ownerpw", json_dict=json_dict)
+
+            logging.info("\n*** update map by owner: PathOrToken (json->json) -> 404")
+            json_dict = {}
+            json_dict['PathOrToken'] = path_mapped
+            _, headers, answer = self._sharing_api_json("map", "update", check=404, login="owner:ownerpw", json_dict=json_dict)
+
+            logging.info("\n*** update map by owner: Permissions without PathOrToken (json->json) -> 400")
+            json_dict = {}
+            json_dict['Permissions'] = "rw"
+            _, headers, answer = self._sharing_api_json("map", "update", check=400, login="owner:ownerpw", json_dict=json_dict)
+
+            logging.info("\n*** update map by owner: Permissions (json->json) -> 200")
+            json_dict = {}
+            json_dict['PathOrToken'] = path_shared
+            json_dict['Permissions'] = "rw"
+            _, headers, answer = self._sharing_api_json("map", "update", check=200, login="owner:ownerpw", json_dict=json_dict)
+
+            logging.info("\n*** update map by owner: Enabled (json->json) -> 200")
+            json_dict = {}
+            json_dict['PathOrToken'] = path_shared
+            json_dict['Enabled'] = True
+            _, headers, answer = self._sharing_api_json("map", "update", check=200, login="owner:ownerpw", json_dict=json_dict)
+
+            logging.info("\n*** update map by owner: Hidden (json->json) -> 200")
+            json_dict = {}
+            json_dict['PathOrToken'] = path_shared
+            json_dict['Hidden'] = False
+            _, headers, answer = self._sharing_api_json("map", "update", check=200, login="owner:ownerpw", json_dict=json_dict)
+
+            logging.info("\n*** update map by owner: Properties (json->json) -> 200")
+            json_dict = {}
+            json_dict['PathOrToken'] = path_shared
+            json_dict['Properties'] = {}
+            _, headers, answer = self._sharing_api_json("map", "update", check=200, login="owner:ownerpw", json_dict=json_dict)
+
+            logging.info("\n*** update map by user: Enabled user-mispatch (json->json) -> 403")
+            json_dict = {}
+            json_dict['PathOrToken'] = path_shared
+            json_dict['Enabled'] = True
+            _, headers, answer = self._sharing_api_json("map", "update", check=403, login="user:userpw", json_dict=json_dict)
+
+            logging.info("\n*** update map by owner: User (json->json) -> 200")
+            json_dict = {}
+            json_dict['User'] = "user"
+            json_dict['PathOrToken'] = path_shared
+            _, headers, answer = self._sharing_api_json("map", "update", check=200, login="owner:ownerpw", json_dict=json_dict)
+
+            logging.info("\n*** update map by user: User (same) (json->json) -> 403")
+            json_dict = {}
+            json_dict['User'] = "user"
+            json_dict['PathOrToken'] = path_shared
+            _, headers, answer = self._sharing_api_json("map", "update", check=403, login="user:userpw", json_dict=json_dict)
+
+            logging.info("\n*** update map by user: PathMapped (json->json) -> 403")
+            json_dict = {}
+            json_dict['PathMapped'] = path_shared
+            json_dict['PathOrToken'] = path_shared
+            _, headers, answer = self._sharing_api_json("map", "update", check=403, login="user:userpw", json_dict=json_dict)
+
+            logging.info("\n*** update map by user: PathOrToken (json->json) -> 404")
+            json_dict = {}
+            json_dict['PathOrToken'] = path_mapped
+            _, headers, answer = self._sharing_api_json("map", "update", check=404, login="user:userpw", json_dict=json_dict)
+
+            logging.info("\n*** update map by user: Permissions (json->json) -> 403")
+            json_dict = {}
+            json_dict['PathOrToken'] = path_shared
+            json_dict['Permissions'] = "rw"
+            _, headers, answer = self._sharing_api_json("map", "update", check=403, login="user:userpw", json_dict=json_dict)
+
+            logging.info("\n*** update map by user: Enabled (json->json) -> 200")
+            json_dict = {}
+            json_dict['PathOrToken'] = path_shared
+            json_dict['Enabled'] = True
+            _, headers, answer = self._sharing_api_json("map", "update", check=200, login="user:userpw", json_dict=json_dict)
+
+            logging.info("\n*** update map by user: Hidden (json->json) -> 200")
+            json_dict = {}
+            json_dict['PathOrToken'] = path_shared
+            json_dict['Hidden'] = False
+            _, headers, answer = self._sharing_api_json("map", "update", check=200, login="user:userpw", json_dict=json_dict)
+
+            logging.info("\n*** update map by user: Properties (json->json) -> 200")
+            json_dict = {}
+            json_dict['PathOrToken'] = path_shared
+            json_dict['Properties'] = {}
+            _, headers, answer = self._sharing_api_json("map", "update", check=200, login="user:userpw", json_dict=json_dict)
+
+            logging.info("\n*** delete map by user (json->json) -> 403")
+            json_dict = {}
+            json_dict['PathOrToken'] = path_shared
+            _, headers, answer = self._sharing_api_json("map", "delete", check=403, login="user:userpw", json_dict=json_dict)
+
+            logging.info("\n*** delete map by owner (json->json) -> ok")
+            json_dict = {}
+            json_dict['PathOrToken'] = path_shared
+            _, headers, answer = self._sharing_api_json("map", "delete", check=200, login="owner:ownerpw", json_dict=json_dict)
+            answer_dict = json.loads(answer)
+            assert answer_dict['Status'] == "success"
+
     def test_sharing_api_map_usercheck(self) -> None:
         """share-by-map API usage tests related to usercheck."""
         self.configure({"auth": {"type": "htpasswd",
@@ -2668,7 +2927,6 @@ permissions: RrWw""")
             # update map by user
             logging.info("\n*** update map by user (json)")
             json_dict = {}
-            json_dict['User'] = "user"
             json_dict['PathOrToken'] = path_shared_r
             json_dict['Properties'] = {"C:calendar-description": "ICAL-USER", "ICAL:calendar-color": "#BBBBBB"}
             _, headers, answer = self._sharing_api_json("map", "update", check=200, login="user:userpw", json_dict=json_dict)
@@ -2718,7 +2976,7 @@ permissions: RrWw""")
 
             # update map by user
             logging.info("\n*** update map by user (form)")
-            form_array = ["User=" + "user"]
+            form_array = []
             form_array.append("PathOrToken=" + path_shared_r)
             form_array.append("Properties='C:calendar-description'='ICAL-USER-NEW'")
             form_array.append("Properties='ICAL:calendar-color'='#CCCCCC'")
@@ -2853,7 +3111,6 @@ permissions: RrWw""")
             # update map by user
             logging.info("\n*** update map by user (json) -> 403 (no overlay permitted)")
             json_dict = {}
-            json_dict['User'] = "user"
             json_dict['PathOrToken'] = path_shared_r
             json_dict['Properties'] = {"ICAL:calendar-color": "#BBBBBB"}
             _, headers, answer = self._sharing_api_json("map", "update", check=403, login="user:userpw", json_dict=json_dict)
@@ -2871,7 +3128,6 @@ permissions: RrWw""")
             # update map by owner
             logging.info("\n*** update map by owner (disable property overlay)")
             json_dict = {}
-            json_dict['User'] = "user"
             json_dict['PathMapped'] = path_mapped
             json_dict['PathOrToken'] = path_shared_r
             json_dict['Permissions'] = "rp"
@@ -2891,7 +3147,6 @@ permissions: RrWw""")
 
             logging.info("\n*** update map by user (json) -> 403 (no overlay permitted by share permissions)")
             json_dict = {}
-            json_dict['User'] = "user"
             json_dict['PathOrToken'] = path_shared_r
             json_dict['Properties'] = {"ICAL:calendar-color": "#CCCCCC"}
             _, headers, answer = self._sharing_api_json("map", "update", check=403, login="user:userpw", json_dict=json_dict)
@@ -2904,7 +3159,6 @@ permissions: RrWw""")
             # update map by owner
             logging.info("\n*** update map by owner (disable property overlay)")
             json_dict = {}
-            json_dict['User'] = "user"
             json_dict['PathMapped'] = path_mapped
             json_dict['PathOrToken'] = path_shared_r
             json_dict['Permissions'] = "rP"
@@ -2913,7 +3167,6 @@ permissions: RrWw""")
 
             logging.info("\n*** update map by user (json) -> 200 (overlay permitted by share permissions)")
             json_dict = {}
-            json_dict['User'] = "user"
             json_dict['PathOrToken'] = path_shared_r
             json_dict['Properties'] = {"ICAL:calendar-color": "#CCCCCC"}
             _, headers, answer = self._sharing_api_json("map", "update", check=200, login="user:userpw", json_dict=json_dict)
@@ -2928,16 +3181,13 @@ permissions: RrWw""")
             # update map by owner
             logging.info("\n*** update map by owner (disable property overlay)")
             json_dict = {}
-            json_dict['User'] = "user"
             json_dict['PathMapped'] = path_mapped
             json_dict['PathOrToken'] = path_shared_r
             json_dict['Permissions'] = "rp"
-            json_dict['User'] = "user"
             _, headers, answer = self._sharing_api_json("map", "update", check=200, login="owner:ownerpw", json_dict=json_dict)
 
             logging.info("\n*** update map by user (json) -> 403 (overlay permitted but denied by share permissions)")
             json_dict = {}
-            json_dict['User'] = "user"
             json_dict['PathOrToken'] = path_shared_r
             json_dict['Properties'] = {"ICAL:calendar-color": "#EEEEEE"}
             _, headers, answer = self._sharing_api_json("map", "update", check=403, login="user:userpw", json_dict=json_dict)