diff --git a/app/controllers/api/videos.php b/app/controllers/api/videos.php index 6a36ad862e..749f26faa9 100644 --- a/app/controllers/api/videos.php +++ b/app/controllers/api/videos.php @@ -40,9 +40,12 @@ function validateFilePermissions(Database $dbForProject, string $bucketId, strin } $fileSecurity = $bucket->getAttribute('fileSecurity', false); + //var_dump($fileSecurity); + //var_dump($bucket->getRead()); $validator = new Authorization(Database::PERMISSION_READ); $valid = $validator->isValid($bucket->getRead()); + if (!$fileSecurity && !$valid) { throw new Exception(Exception::USER_UNAUTHORIZED); } diff --git a/tests/e2e/Scopes/VideoCustom.php b/tests/e2e/Scopes/VideoCustom.php index a6bd22a4db..65e35aecb7 100644 --- a/tests/e2e/Scopes/VideoCustom.php +++ b/tests/e2e/Scopes/VideoCustom.php @@ -6,7 +6,6 @@ use Tests\E2E\Client; use Utopia\Database\DateTime; use Utopia\Database\Helpers\ID; use Utopia\Database\Helpers\Permission; -use Utopia\Database\validator\DateTimeValidator; use Utopia\Database\Helpers\Role; trait VideoCustom @@ -35,12 +34,12 @@ trait VideoCustom 'x-appwrite-key' => $this->getProject()['apiKey'], ], [ 'bucketId' => 'unique()', - 'name' => 'Test Bucket 2', - 'permissions' => [ - Permission::read(Role::any()), - Permission::create(Role::any()), - Permission::update(Role::any()), - Permission::delete(Role::any()), + 'name' => 'My Video bucket ', + 'permissions' => [ + Permission::read(Role::user($this->getUser()['$id'])), + Permission::create(Role::user($this->getUser()['$id'])), + Permission::update(Role::user($this->getUser()['$id'])), + Permission::delete(Role::user($this->getUser()['$id'])), ], ]); diff --git a/tests/e2e/Services/Videos/VideosCustomClientTest.php b/tests/e2e/Services/Videos/VideosCustomClientTest.php index c577367989..b74154c6aa 100644 --- a/tests/e2e/Services/Videos/VideosCustomClientTest.php +++ b/tests/e2e/Services/Videos/VideosCustomClientTest.php @@ -7,12 +7,15 @@ use Tests\E2E\Scopes\ProjectCustom; use Tests\E2E\Scopes\SideClient; use Tests\E2E\Client; use Tests\E2E\Scopes\VideoCustom; +use Tests\E2E\Services\Videos\VideosPermissionsScope; +use Utopia\Database\Helpers\ID; class VideosCustomClientTest extends Scope { use ProjectCustom; use VideoCustom; use SideClient; + use VideosPermissionsScope; public function testDeleteProfiles() @@ -69,6 +72,19 @@ class VideosCustomClientTest extends Scope $videoId = $response['body']['$id']; + $email = ID::unique() . '@localhost.test'; + $password = 'password'; + $user2 = $this->createUser('user2', $email, $password); + + $file = $this->client->call(Client::METHOD_GET, '/videos/' . $videoId, [ + 'content-type' => 'multipart/form-data', + 'x-appwrite-project' => $this->getProject()['$id'], + 'cookie' => 'a_session_' . $this->getProject()['$id'] . '=' . $user2['session'], + ]); + + $this->assertEquals($file['headers']['status-code'], 401); + + /** * Create subtitles */ @@ -157,56 +173,65 @@ class VideosCustomClientTest extends Scope $this->assertEquals(204, $response['headers']['status-code']); } sleep(30); - $response = $this->client->call(Client::METHOD_GET, '/videos/' . $videoId . '/outputs/hls', [ + + $response = $this->client->call(Client::METHOD_GET, '/videos/' . $videoId . '/outputs/hls', array_merge([ 'content-type' => 'application/json', 'x-appwrite-project' => $this->getProject()['$id'], - ], $this->getHeaders()); + ], $this->getHeaders())); + + $this->assertEquals(200, $response['headers']['status-code']); preg_match_all('#\b/videos[^,\s()<>]+(?:\([\w\d]+\)|([^,[:punct:]\s]|/))#', $response['body'], $match); $this->assertEquals(3, count($match[0])); - $subtitleUri = $match[0][1]; + $subtitleUri = $match[0][1]; $renditionUri = $match[0][2]; - $response = $this->client->call(Client::METHOD_GET, $renditionUri, [ - 'content-type' => 'application/json', - 'x-appwrite-project' => $this->getProject()['$id'], - ], $this->getHeaders()); + $response = $this->client->call( + Client::METHOD_GET, + $renditionUri, + array_merge( + [ + 'content-type' => 'application/json', + 'x-appwrite-project' => $this->getProject()['$id'], + ], + $this->getHeaders() + ) + ); $this->assertEquals(200, $response['headers']['status-code']); preg_match_all('#\b/videos[^,\s()<>]+(?:\([\w\d]+\)|([^,[:punct:]\s]|/))#', $response['body'], $match); $this->assertEquals(10, count($match[0])); $segmentUri = $match[0][0]; - $response = $this->client->call(Client::METHOD_GET, $segmentUri, [ + $response = $this->client->call(Client::METHOD_GET, $segmentUri, array_merge([ 'content-type' => 'application/json', 'x-appwrite-project' => $this->getProject()['$id'], - ], $this->getHeaders()); + ], $this->getHeaders())); $this->assertEquals(200, $response['headers']['status-code']); $this->assertGreaterThan(0, strlen($response['body'])); - $response = $this->client->call(Client::METHOD_GET, $subtitleUri, [ + $response = $this->client->call(Client::METHOD_GET, $subtitleUri, array_merge([ 'content-type' => 'application/json', 'x-appwrite-project' => $this->getProject()['$id'], - ], $this->getHeaders()); + ], $this->getHeaders())); preg_match_all('#\b/videos[^,\s()<>]+(?:\([\w\d]+\)|([^,[:punct:]\s]|/))#', $response['body'], $match); $segmentUri = $match[0][0]; - $response = $this->client->call(Client::METHOD_GET, $segmentUri, [ + $response = $this->client->call(Client::METHOD_GET, $segmentUri, array_merge([ 'content-type' => 'application/json', 'x-appwrite-project' => $this->getProject()['$id'], - ], $this->getHeaders()); + ], $this->getHeaders())); $this->assertEquals(200, $response['headers']['status-code']); $this->assertEquals(1508, strlen($response['body'])); - $response = $this->client->call(Client::METHOD_GET, '/videos/' . $videoId . '/outputs/dash', [ + $response = $this->client->call(Client::METHOD_GET, '/videos/' . $videoId . '/outputs/dash', array_merge([ 'content-type' => 'application/json', 'x-appwrite-project' => $this->getProject()['$id'], - ], $this->getHeaders()); - + ], $this->getHeaders())); $this->assertEquals(200, $response['headers']['status-code']); $xml = simplexml_load_string($response['body']); @@ -263,18 +288,18 @@ class VideosCustomClientTest extends Scope $audioSegmentInitialization = (string)$representation->SegmentList->Initialization['sourceURL']; $audioSegmentId = (string)$representation->SegmentList->SegmentURL['media']; - $response = $this->client->call(Client::METHOD_GET, $audioSegmentBaseUrl . $audioSegmentInitialization, [ + $response = $this->client->call(Client::METHOD_GET, $audioSegmentBaseUrl . $audioSegmentInitialization, array_merge([ 'content-type' => 'application/json', 'x-appwrite-project' => $this->getProject()['$id'], - ], $this->getHeaders()); + ], $this->getHeaders())); $this->assertEquals(200, $response['headers']['status-code']); $this->assertGreaterThan(0, strlen($response['body'])); - $response = $this->client->call(Client::METHOD_GET, $audioSegmentBaseUrl . $audioSegmentId, [ + $response = $this->client->call(Client::METHOD_GET, $audioSegmentBaseUrl . $audioSegmentId, array_merge([ 'content-type' => 'application/json', 'x-appwrite-project' => $this->getProject()['$id'], - ], $this->getHeaders()); + ], $this->getHeaders())); $this->assertEquals(200, $response['headers']['status-code']); $this->assertGreaterThan(0, strlen($response['body'])); diff --git a/tests/e2e/Services/Videos/VideosPermissionsScope.php b/tests/e2e/Services/Videos/VideosPermissionsScope.php new file mode 100644 index 0000000000..d783228814 --- /dev/null +++ b/tests/e2e/Services/Videos/VideosPermissionsScope.php @@ -0,0 +1,87 @@ +client->call(Client::METHOD_POST, '/account', [ + 'origin' => 'http://localhost', + 'content-type' => 'application/json', + 'x-appwrite-project' => $this->getProject()['$id'], + ], [ + 'userId' => $id, + 'email' => $email, + 'password' => $password + ]); + + $this->assertEquals(201, $user['headers']['status-code']); + + $session = $this->client->call(Client::METHOD_POST, '/account/sessions/email', [ + 'origin' => 'http://localhost', + 'content-type' => 'application/json', + 'x-appwrite-project' => $this->getProject()['$id'], + ], [ + 'email' => $email, + 'password' => $password, + ]); + + $session = $this->client->parseCookie((string)$session['headers']['set-cookie'])['a_session_' . $this->getProject()['$id']]; + + + $user = [ + '$id' => $user['body']['$id'], + 'email' => $user['body']['email'], + 'session' => $session, + ]; + $this->users[$id] = $user; + + return $user; + } + + public function getCreatedUser(string $id): array + { + return $this->users[$id] ?? []; + } + + public function createTeam(string $id, string $name): array + { + $team = $this->client->call(Client::METHOD_POST, '/teams', $this->getServerHeader(), [ + 'teamId' => $id, + 'name' => $name + ]); + $this->teams[$id] = $team['body']; + + return $team['body']; + } + + public function addToTeam(string $user, string $team, array $roles = []): array + { + $membership = $this->client->call(Client::METHOD_POST, '/teams/' . $team . '/memberships', $this->getServerHeader(), [ + 'teamId' => $team, + 'email' => $this->getCreatedUser($user)['email'], + 'roles' => $roles, + 'url' => 'http://localhost:5000/join-us#title' + ]); + + return [ + 'user' => $membership['body']['userId'], + 'membership' => $membership['body']['$id'] + ]; + } + + public function getServerHeader(): array + { + return [ + 'content-type' => 'application/json', + 'x-appwrite-project' => $this->getProject()['$id'], + 'x-appwrite-key' => $this->getProject()['apiKey'] + ]; + } +}