e2e/orgremove_test.go

 1package e2e
 2
 3import (
 4	"os"
 5	"path/filepath"
 6	"strings"
 7	"testing"
 8)
 9
10// Removing a member from an org ends the access they held through its
11// teams (#196). Before the fix, team_members rows survived removal, so a
12// former member kept pushing.
13func TestOrgMemberRemovalEndsTeamAccess(t *testing.T) {
14	inst := startInstance(t)
15	aliceKey := inst.newKey(t, "alice")
16	bobKey := inst.newKey(t, "bob")
17	inst.admin(t, "admin", "user", "create", "alice", "--key", aliceKey+".pub")
18	inst.admin(t, "admin", "user", "create", "bob", "--key", bobKey+".pub")
19
20	for _, args := range [][]string{
21		{"org", "create", "acme"},
22		{"org", "settings", "members-role", "acme", "none"},
23		{"org", "members", "add", "acme", "bob"},
24		{"repo", "create", "acme/widget", "--private"},
25		{"org", "team", "create", "acme", "core"},
26		{"org", "team", "add", "acme", "core", "bob"},
27		{"org", "team", "grant", "acme", "core", "acme/widget", "write"},
28	} {
29		if _, errOut, code := inst.ssh(t, aliceKey, "", args...); code != 0 {
30			t.Fatalf("%v: %s", args, errOut)
31		}
32	}
33
34	// bob pushes through the team grant.
35	bobEnv := inst.gitEnv(bobKey)
36	work := t.TempDir()
37	mustGit(t, work, bobEnv, "clone", inst.sshURL("acme/widget"), "widget")
38	dir := filepath.Join(work, "widget")
39	if err := os.WriteFile(filepath.Join(dir, "README"), []byte("hi\n"), 0o644); err != nil {
40		t.Fatal(err)
41	}
42	mustGit(t, dir, bobEnv, "checkout", "-q", "-b", "main")
43	mustGit(t, dir, bobEnv, "add", "README")
44	mustGit(t, dir, bobEnv, "commit", "-q", "-m", "one")
45	mustGit(t, dir, bobEnv, "push", "-q", "origin", "main")
46
47	if _, errOut, code := inst.ssh(t, aliceKey, "", "org", "members", "remove", "acme", "bob"); code != 0 {
48		t.Fatalf("members remove: %s", errOut)
49	}
50	out, _, _ := inst.ssh(t, aliceKey, "", "org", "team", "show", "acme", "core", "--json")
51	if strings.Contains(out, `"bob"`) {
52		t.Fatalf("team still lists the removed member: %s", out)
53	}
54	if err := os.WriteFile(filepath.Join(dir, "README"), []byte("again\n"), 0o644); err != nil {
55		t.Fatal(err)
56	}
57	mustGit(t, dir, bobEnv, "commit", "-q", "-am", "two")
58	if out, code := gitRun(t, dir, bobEnv, "push", "-q", "origin", "main"); code == 0 {
59		t.Fatalf("removed member still pushes:\n%s", out)
60	}
61	if _, _, code := inst.ssh(t, bobKey, "", "repo", "show", "acme/widget"); code != 3 {
62		t.Fatalf("removed member still sees the private repo: exit %d", code)
63	}
64
65	// Re-adding to the org does not silently restore the team grant.
66	if _, errOut, code := inst.ssh(t, aliceKey, "", "org", "members", "add", "acme", "bob"); code != 0 {
67		t.Fatalf("members add: %s", errOut)
68	}
69	if _, _, code := inst.ssh(t, bobKey, "", "repo", "show", "acme/widget"); code != 3 {
70		t.Fatalf("re-added member regained the team grant: exit %d", code)
71	}
72}