Fixed local_secure_restricted preventing attachment uploads

[bookstack] / tests / Api / PagesApiTest.php

diff --git a/tests/Api/PagesApiTest.php b/tests/Api/PagesApiTest.php
index d52c6b513892374d955a5c758ad8ca5a46562837..539a7da4e25087c6e1cf8c59e7421135ce81bf9a 100644 (file)
--- a/tests/Api/PagesApiTest.php
+++ b/tests/Api/PagesApiTest.php
@@ -5,13 +5,15 @@ namespace Tests\Api;
 use BookStack\Entities\Models\Book;
 use BookStack\Entities\Models\Chapter;
 use BookStack\Entities\Models\Page;
 use BookStack\Entities\Models\Book;
 use BookStack\Entities\Models\Chapter;
 use BookStack\Entities\Models\Page;

+use Carbon\Carbon;
+use Illuminate\Support\Facades\DB;

 use Tests\TestCase;
 
 class PagesApiTest extends TestCase
 {
     use TestsApi;
 
 use Tests\TestCase;
 
 class PagesApiTest extends TestCase
 {
     use TestsApi;
 

-    protected $baseEndpoint = '/api/pages';
+    protected string $baseEndpoint = '/api/pages';

 
     public function test_index_endpoint_returns_expected_page()
     {
 
     public function test_index_endpoint_returns_expected_page()
     {


@@ -219,6 +221,44 @@ class PagesApiTest extends TestCase
         $resp->assertStatus(403);
     }
 
         $resp->assertStatus(403);
     }
 

+    public function test_update_endpoint_does_not_wipe_content_if_no_html_or_md_provided()
+    {
+        $this->actingAsApiEditor();
+        $page = Page::visible()->first();
+        $originalContent = $page->html;
+        $details = [
+            'name' => 'My updated API page',
+            'tags' => [
+                [
+                    'name'  => 'freshtag',
+                    'value' => 'freshtagval',
+                ],
+            ],
+        ];
+
+        $this->putJson($this->baseEndpoint . "/{$page->id}", $details);
+        $page->refresh();
+
+        $this->assertEquals($originalContent, $page->html);
+    }
+
+    public function test_update_increments_updated_date_if_only_tags_are_sent()
+    {
+        $this->actingAsApiEditor();
+        $page = Page::visible()->first();
+        DB::table('pages')->where('id', '=', $page->id)->update(['updated_at' => Carbon::now()->subWeek()]);
+
+        $details = [
+            'tags' => [['name' => 'Category', 'value' => 'Testing']],
+        ];
+
+        $resp = $this->putJson($this->baseEndpoint . "/{$page->id}", $details);
+        $resp->assertOk();
+
+        $page->refresh();
+        $this->assertGreaterThan(Carbon::now()->subDay()->unix(), $page->updated_at->unix());
+    }
+

     public function test_delete_endpoint()
     {
         $this->actingAsApiEditor();
     public function test_delete_endpoint()
     {
         $this->actingAsApiEditor();


@@ -271,4 +311,17 @@ class PagesApiTest extends TestCase
         $resp->assertSee('# ' . $page->name);
         $resp->assertHeader('Content-Disposition', 'attachment; filename="' . $page->slug . '.md"');
     }
         $resp->assertSee('# ' . $page->name);
         $resp->assertHeader('Content-Disposition', 'attachment; filename="' . $page->slug . '.md"');
     }

+
+    public function test_cant_export_when_not_have_permission()
+    {
+        $types = ['html', 'plaintext', 'pdf', 'markdown'];
+        $this->actingAsApiEditor();
+        $this->removePermissionFromUser($this->getEditor(), 'content-export');
+
+        $page = Page::visible()->first();
+        foreach ($types as $type) {
+            $resp = $this->get($this->baseEndpoint . "/{$page->id}/export/{$type}");
+            $this->assertPermissionError($resp);
+        }
+    }

 }
 }