Edouard Vanbelle
595273277b
add a full coverage of Webdav and Nextcloud
purpose: prepare move to Drives and ensure no regression at all
test scenarios are in docs/plan/BASELINE_TESTS_NC_WEBDAV.md
current existing bugs identified via these tests:
┌──────────┬─────────┬────────────────────────────────────────────────────────────────────────────────────────────────────┐
│ Bug │ Surface │ Pin location │
├──────────┼─────────┼────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ G4/G5/K5 │ NC │ AlreadyExists → 500 instead of 412 (handle_move + trashbin restore) │
├──────────┼─────────┼────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ G9 │ NC │ Folder DELETE not row-recursive — orphan descendants stay live │
├──────────┼─────────┼────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ M5/M7 │ Native │ resolve_path_for_user mismatch — PUT writes, GET reads via lenient lookup, MOVE/DELETE can't find │
│ │ │ via strict │
├──────────┼─────────┼────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ M8 │ Native │ COPY discards destination filename — collides with source │
├──────────┼─────────┼────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ N2 │ Native │ LOCK creates the token, mutators don't check it — class-2 advertisement is aspirational │
└──────────┴─────────┴────────────────────────────────────────────────────────────────────────────────────────────────────┘
55 lines
2.5 KiB
Plaintext
55 lines
2.5 KiB
Plaintext
# =============================================================
|
|
# OxiCloud — Baseline: second-user fixture (bob)
|
|
# =============================================================
|
|
# (Re)creates the `bob` user so the Group O cross-user
|
|
# isolation scenarios (and Group C's C4 admin-reads-another-
|
|
# user case) have a real second principal to test against.
|
|
#
|
|
# Run-order: this file runs AFTER `external_users.hurl`, which
|
|
# deletes bob at its end, and AFTER `permissions.hurl`, which
|
|
# creates+uses bob via the admin API. By the time this file
|
|
# runs, bob may or may not exist — the anti-enumeration
|
|
# registration endpoint returns 200 either way, so this is
|
|
# safe in both states. The login step that follows is the
|
|
# actual existence assertion: if bob can log in, downstream
|
|
# bob-dependent tests (nc_admin_views_other_user.hurl here
|
|
# and test_nc_cross_user_isolation.sh in the webdav suite)
|
|
# will work.
|
|
#
|
|
# Bob's credentials are hardcoded fixtures (not env-driven) so
|
|
# downstream test files don't need to coordinate via test.env.
|
|
# Bob's password is unique per fixture; no overlap with admin.
|
|
# =============================================================
|
|
|
|
|
|
# ─────────────────────────────────────────────────────────────
|
|
# Step 1 — Register bob via the email-anti-enumeration flow.
|
|
# ─────────────────────────────────────────────────────────────
|
|
POST {{base_url}}/api/auth/register
|
|
Content-Type: application/json
|
|
{
|
|
"username": "bob",
|
|
"email": "bob@example.com",
|
|
"password": "BobPassword1!"
|
|
}
|
|
|
|
HTTP 200
|
|
[Asserts]
|
|
jsonpath "$.message" contains "request received"
|
|
|
|
|
|
# ─────────────────────────────────────────────────────────────
|
|
# Step 2 — Confirm bob can log in (proves registration
|
|
# actually landed the account — the anti-enum response
|
|
# alone wouldn't tell us).
|
|
# ─────────────────────────────────────────────────────────────
|
|
POST {{base_url}}/api/auth/login
|
|
Content-Type: application/json
|
|
{ "username": "bob", "password": "BobPassword1!" }
|
|
|
|
HTTP 200
|
|
[Asserts]
|
|
jsonpath "$.access_token" exists
|
|
jsonpath "$.user.username" == "bob"
|
|
jsonpath "$.user.email" == "bob@example.com"
|