From f12b4aebe9080b15e0e4742643f1ee016605bab7 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: May 22 2015 08:49:24 +0000
Subject: Expand the unit-tests for closing/merging a pull-request and adjust the error message


---

diff --git a/pagure/api/__init__.py b/pagure/api/__init__.py
index 2d0aea6..c2af9a7 100644
--- a/pagure/api/__init__.py
+++ b/pagure/api/__init__.py
@@ -36,7 +36,7 @@ API_ERROR_CODE = {
     7: 'You are not allowed to view this issue',
     8: 'Pull-Request have been deactivated for this project',
     9: 'Pull-Request not found',
-    10: 'You are not allowed to merge pull-request for this project',
+    10: 'You are not allowed to merge/close pull-request for this project',
     11: 'This request does not have the minimum review score necessary to '
         'be merged',
     12: 'Only the assignee can merge this review',
diff --git a/tests/test_progit_flask_api_fork.py b/tests/test_progit_flask_api_fork.py
index a5fa82c..e9b960c 100644
--- a/tests/test_progit_flask_api_fork.py
+++ b/tests/test_progit_flask_api_fork.py
@@ -236,6 +236,51 @@ class PagureFlaskApiForktests(tests.Modeltests):
             }
         )
 
+        # Invalid PR
+        output = self.app.post(
+            '/api/0/test/pull-request/2/close', headers=headers)
+        self.assertEqual(output.status_code, 404)
+        data = json.loads(output.data)
+        self.assertDictEqual(
+            data,
+            {'error': 'Pull-Request not found', 'error_code': 9}
+        )
+
+        # Create a token for foo for this project
+        item = pagure.lib.model.Token(
+            id='foobar_token',
+            user_id=2,
+            project_id=1,
+            expiration=datetime.datetime.utcnow() + datetime.timedelta(
+                days=30)
+        )
+        self.session.add(item)
+        self.session.commit()
+        item = pagure.lib.model.TokenAcl(
+            token_id='foobar_token',
+            acl_id=6,
+        )
+        self.session.add(item)
+        self.session.commit()
+
+        headers = {'Authorization': 'token foobar_token'}
+
+        # User not admin
+        output = self.app.post(
+            '/api/0/test/pull-request/1/close', headers=headers)
+        self.assertEqual(output.status_code, 403)
+        data = json.loads(output.data)
+        self.assertDictEqual(
+            data,
+            {
+                'error': 'You are not allowed to merge/close pull-request '
+                    'for this project',
+                'error_code': 10
+            }
+        )
+
+        headers = {'Authorization': 'token aaabbbcccddd'}
+
         # Close PR
         output = self.app.post(
             '/api/0/test/pull-request/1/close', headers=headers)
@@ -301,7 +346,52 @@ class PagureFlaskApiForktests(tests.Modeltests):
             }
         )
 
-        # Close PR
+        # Invalid PR
+        output = self.app.post(
+            '/api/0/test/pull-request/2/merge', headers=headers)
+        self.assertEqual(output.status_code, 404)
+        data = json.loads(output.data)
+        self.assertDictEqual(
+            data,
+            {'error': 'Pull-Request not found', 'error_code': 9}
+        )
+
+        # Create a token for foo for this project
+        item = pagure.lib.model.Token(
+            id='foobar_token',
+            user_id=2,
+            project_id=1,
+            expiration=datetime.datetime.utcnow() + datetime.timedelta(
+                days=30)
+        )
+        self.session.add(item)
+        self.session.commit()
+        item = pagure.lib.model.TokenAcl(
+            token_id='foobar_token',
+            acl_id=2,
+        )
+        self.session.add(item)
+        self.session.commit()
+
+        headers = {'Authorization': 'token foobar_token'}
+
+        # User not admin
+        output = self.app.post(
+            '/api/0/test/pull-request/1/merge', headers=headers)
+        self.assertEqual(output.status_code, 403)
+        data = json.loads(output.data)
+        self.assertDictEqual(
+            data,
+            {
+                'error': 'You are not allowed to merge/close pull-request '
+                    'for this project',
+                'error_code': 10
+            }
+        )
+
+        headers = {'Authorization': 'token aaabbbcccddd'}
+
+        # Merge PR
         output = self.app.post(
             '/api/0/test/pull-request/1/merge', headers=headers)
         self.assertEqual(output.status_code, 200)