Merge pull request cli#2034 from cristiand391/check-gist-ownership

Nate Smith · web-flow · commit 14a5e00c4aa0 · 2020-10-05T16:20:34.000-05:00
Check gist ownership before editing
diff --git a/pkg/cmd/gist/edit/edit.go b/pkg/cmd/gist/edit/edit.go
@@ -81,11 +81,22 @@ func editRun(opts *EditOptions) error {
 		return err
 	}
 
+	apiClient := api.NewClientFromHTTP(client)
+
 	gist, err := shared.GetGist(client, ghinstance.OverridableDefault(), gistID)
 	if err != nil {
 		return err
 	}
 
+	username, err := api.CurrentLoginName(apiClient, ghinstance.OverridableDefault())
+	if err != nil {
+		return err
+	}
+
+	if username != gist.Owner.Login {
+		return fmt.Errorf("You do not own this gist.")
+	}
+
 	filesToUpdate := map[string]string{}
 
 	for {
@@ -178,15 +189,15 @@ func editRun(opts *EditOptions) error {
 		return nil
 	}
 
-	err = updateGist(client, ghinstance.OverridableDefault(), gist)
+	err = updateGist(apiClient, ghinstance.OverridableDefault(), gist)
 	if err != nil {
 		return err
 	}
 
 	return nil
 }
 
-func updateGist(client *http.Client, hostname string, gist *shared.Gist) error {
+func updateGist(apiClient *api.Client, hostname string, gist *shared.Gist) error {
 	body := shared.Gist{
 		Description: gist.Description,
 		Files:       gist.Files,
@@ -203,7 +214,6 @@ func updateGist(client *http.Client, hostname string, gist *shared.Gist) error {
 
 	result := shared.Gist{}
 
-	apiClient := api.NewClientFromHTTP(client)
 	err = apiClient.REST(hostname, "POST", path, requestBody, &result)
 
 	if err != nil {
diff --git a/pkg/cmd/gist/edit/edit_test.go b/pkg/cmd/gist/edit/edit_test.go
@@ -75,6 +75,7 @@ func Test_editRun(t *testing.T) {
 		askStubs   func(*prompt.AskStubber)
 		nontty     bool
 		wantErr    bool
+		wantStderr string
 		wantParams map[string]interface{}
 	}{
 		{
@@ -92,6 +93,7 @@ func Test_editRun(t *testing.T) {
 						Type:     "text/plain",
 					},
 				},
+				Owner: &shared.GistOwner{Login: "octocat"},
 			},
 			httpStubs: func(reg *httpmock.Registry) {
 				reg.Register(httpmock.REST("POST", "gists/1234"),
@@ -131,6 +133,7 @@ func Test_editRun(t *testing.T) {
 						Type:     "application/markdown",
 					},
 				},
+				Owner: &shared.GistOwner{Login: "octocat"},
 			},
 			httpStubs: func(reg *httpmock.Registry) {
 				reg.Register(httpmock.REST("POST", "gists/1234"),
@@ -175,6 +178,7 @@ func Test_editRun(t *testing.T) {
 						Type:     "application/markdown",
 					},
 				},
+				Owner: &shared.GistOwner{Login: "octocat"},
 			},
 		},
 		{
@@ -188,8 +192,25 @@ func Test_editRun(t *testing.T) {
 						Type:     "text/plain",
 					},
 				},
+				Owner: &shared.GistOwner{Login: "octocat"},
 			},
 		},
+		{
+			name: "another user's gist",
+			gist: &shared.Gist{
+				ID: "1234",
+				Files: map[string]*shared.GistFile{
+					"cicada.txt": {
+						Filename: "cicada.txt",
+						Content:  "bwhiizzzbwhuiiizzzz",
+						Type:     "text/plain",
+					},
+				},
+				Owner: &shared.GistOwner{Login: "octocat2"},
+			},
+			wantErr:    true,
+			wantStderr: "You do not own this gist.",
+		},
 	}
 
 	for _, tt := range tests {
@@ -200,6 +221,8 @@ func Test_editRun(t *testing.T) {
 		} else {
 			reg.Register(httpmock.REST("GET", "gists/1234"),
 				httpmock.JSONResponse(tt.gist))
+			reg.Register(httpmock.GraphQL(`query UserCurrent\b`),
+				httpmock.StringResponse(`{"data":{"viewer":{"login":"octocat"}}}`))
 		}
 
 		if tt.httpStubs != nil {
@@ -239,12 +262,15 @@ func Test_editRun(t *testing.T) {
 			reg.Verify(t)
 			if tt.wantErr {
 				assert.Error(t, err)
+				if tt.wantStderr != "" {
+					assert.EqualError(t, err, tt.wantStderr)
+				}
 				return
 			}
 			assert.NoError(t, err)
 
 			if tt.wantParams != nil {
-				bodyBytes, _ := ioutil.ReadAll(reg.Requests[1].Body)
+				bodyBytes, _ := ioutil.ReadAll(reg.Requests[2].Body)
 				reqBody := make(map[string]interface{})
 				err = json.Unmarshal(bodyBytes, &reqBody)
 				if err != nil {
diff --git a/pkg/cmd/gist/shared/shared.go b/pkg/cmd/gist/shared/shared.go
@@ -17,13 +17,18 @@ type GistFile struct {
 	Content  string `json:"content,omitempty"`
 }
 
+type GistOwner struct {
+	Login string `json:"login,omitempty"`
+}
+
 type Gist struct {
 	ID          string               `json:"id,omitempty"`
 	Description string               `json:"description"`
 	Files       map[string]*GistFile `json:"files"`
 	UpdatedAt   time.Time            `json:"updated_at"`
 	Public      bool                 `json:"public"`
 	HTMLURL     string               `json:"html_url,omitempty"`
+	Owner       *GistOwner           `json:"owner,omitempty"`
 }
 
 func GetGist(client *http.Client, hostname, gistID string) (*Gist, error) {
