From cc154b7dbb676a034433e5d7b8e655a8b09e3daf Mon Sep 17 00:00:00 2001
From: Stefan Berthold <stefan.berthold@wire.com>
Date: Wed, 31 Jan 2024 09:32:27 +0000
Subject: [PATCH] add test for team settings auth

---
 integration/integration.cabal         |  1 +
 integration/test/API/Galley.hs        | 33 +++++++++++++++++++++++
 integration/test/Test/TeamSettings.hs | 38 +++++++++++++++++++++++++++
 3 files changed, 72 insertions(+)
 create mode 100644 integration/test/Test/TeamSettings.hs

diff --git a/integration/integration.cabal b/integration/integration.cabal
index eac22727130..d0267b8c9b6 100644
--- a/integration/integration.cabal
+++ b/integration/integration.cabal
@@ -137,6 +137,7 @@ library
     Test.Search
     Test.Services
     Test.Swagger
+    Test.TeamSettings
     Test.User
     Test.Version
     Testlib.App
diff --git a/integration/test/API/Galley.hs b/integration/test/API/Galley.hs
index d64db7af1cd..ab692f3a1f5 100644
--- a/integration/test/API/Galley.hs
+++ b/integration/test/API/Galley.hs
@@ -515,6 +515,39 @@ getTeamMembers user tid = do
   req <- baseRequest user Galley Versioned (joinHttpPath ["teams", tidStr, "members"])
   submit "GET" req
 
+data AppLockSettings = AppLockSettings
+  { status :: String,
+    enforce :: Bool,
+    inactivityTimeoutSecs :: Int
+  }
+
+instance Default AppLockSettings where
+  def = AppLockSettings "disabled" False 60
+
+-- | https://staging-nginz-https.zinfra.io/v6/api/swagger-ui/#/default/put_teams__tid__features_appLock
+putAppLockSettings ::
+  (HasCallStack, MakesValue tid, MakesValue caller) =>
+  tid ->
+  caller ->
+  AppLockSettings ->
+  App Response
+putAppLockSettings tid caller settings = do
+  tidStr <- asString tid
+  req <- baseRequest caller Galley Versioned (joinHttpPath ["teams", tidStr, "features", "appLock"])
+  submit
+    "PUT"
+    ( addJSONObject
+        [ "status" .= settings.status,
+          "ttl" .= "unlimited",
+          "config"
+            .= object
+              [ "enforceAppLock" .= settings.enforce,
+                "inactivityTimeoutSecs" .= settings.inactivityTimeoutSecs
+              ]
+        ]
+        req
+    )
+
 -- | https://staging-nginz-https.zinfra.io/v5/api/swagger-ui/#/default/post_teams__tid__legalhold_settings
 enableLegalHold :: (HasCallStack, MakesValue tid, MakesValue ownerid) => tid -> ownerid -> App Response
 enableLegalHold tid ownerid = do
diff --git a/integration/test/Test/TeamSettings.hs b/integration/test/Test/TeamSettings.hs
new file mode 100644
index 00000000000..84e8cd920cf
--- /dev/null
+++ b/integration/test/Test/TeamSettings.hs
@@ -0,0 +1,38 @@
+{-# OPTIONS_GHC -Wno-ambiguous-fields #-}
+
+-- This file is part of the Wire Server implementation.
+--
+-- Copyright (C) 2023 Wire Swiss GmbH <opensource@wire.com>
+--
+-- This program is free software: you can redistribute it and/or modify it under
+-- the terms of the GNU Affero General Public License as published by the Free
+-- Software Foundation, either version 3 of the License, or (at your option) any
+-- later version.
+--
+-- This program is distributed in the hope that it will be useful, but WITHOUT
+-- ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+-- FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
+-- details.
+--
+-- You should have received a copy of the GNU Affero General Public License along
+-- with this program. If not, see <https://www.gnu.org/licenses/>.
+
+module Test.TeamSettings where
+
+import API.Galley
+import SetupHelpers
+import Testlib.Prelude
+
+testTeamSettingsUpdate :: HasCallStack => App ()
+testTeamSettingsUpdate = do
+  (owner, tid, [mem]) <- createTeam OwnDomain 2
+  partner <- createTeamMemberWithRole owner tid "partner"
+
+  bindResponse (putAppLockSettings tid owner def) $ \resp -> do
+    resp.status `shouldMatchInt` 200
+  bindResponse (putAppLockSettings tid mem def) $ \resp -> do
+    resp.status `shouldMatchInt` 403
+    resp.json %. "label" `shouldMatch` "operation-denied"
+  bindResponse (putAppLockSettings tid partner def) $ \resp -> do
+    resp.status `shouldMatchInt` 403
+    resp.json %. "label" `shouldMatch` "operation-denied"