commit 6eacf987688867d3912d4492798c53cd4cca81c4
author Gal Paikin <paiking@google.com> Mon Oct 14 13:51:32 2019 +0200
committer Gal Paikin <paiking@google.com> Mon Oct 14 13:53:29 2019 +0200
tree e7e5ec5c555c80301b3203051f77d159cf45e708
parent 7819882a04eea2733e53121512ca1cbc2ca19aef

Add missing permission test for Revert

Add permission test that ensures that the user has
RefPermission.CREATE_CHANGE (which is translated to Permission.Push on
"refs/for/*").

Change-Id: I6850cf74e66d3c84b7762728cf892c52f7cf2c88

javatests/com/google/gerrit/acceptance/api/change/ChangeIT.java

diff --git a/javatests/com/google/gerrit/acceptance/api/change/ChangeIT.java b/javatests/com/google/gerrit/acceptance/api/change/ChangeIT.java
index bad37a5..a049685 100644
--- a/javatests/com/google/gerrit/acceptance/api/change/ChangeIT.java
+++ b/javatests/com/google/gerrit/acceptance/api/change/ChangeIT.java
@@ -172,6 +172,7 @@
 import com.google.gerrit.server.patch.IntraLineDiffKey;
 import com.google.gerrit.server.patch.PatchList;
 import com.google.gerrit.server.patch.PatchListKey;
+import com.google.gerrit.server.permissions.PermissionDeniedException;
 import com.google.gerrit.server.project.testing.TestLabels;
 import com.google.gerrit.server.query.change.ChangeData;
 import com.google.gerrit.server.query.change.ChangeQueryBuilder.ChangeOperatorFactory;
@@ -896,6 +897,26 @@
         .contains("project state " + ProjectState.READ_ONLY + " does not permit write");
   }
 
+  @Test
+  public void cantCreateRevertWithoutCreateChangePermission() throws Exception {
+    PushOneCommit.Result r = createChange();
+    gApi.changes().id(r.getChangeId()).revision(r.getCommit().name()).review(ReviewInput.approve());
+    gApi.changes().id(r.getChangeId()).revision(r.getCommit().name()).submit();
+
+    projectOperations
+        .project(project)
+        .forUpdate()
+        .add(block(Permission.PUSH).ref("refs/for/*").group(REGISTERED_USERS))
+        .update();
+
+    PermissionDeniedException thrown =
+        assertThrows(
+            PermissionDeniedException.class, () -> gApi.changes().id(r.getChangeId()).revert());
+    assertThat(thrown)
+        .hasMessageThat()
+        .contains("not permitted: create change on refs/heads/master");
+  }
+
   @FunctionalInterface
   private interface Rebase {
     void call(String id) throws RestApiException;