streams: Allow admins to fetch private streams via the get streams API.

We send a list of all private streams to realm admins in
fetch_initial_state since 73c30774cb
anyway and this API code just didn't catch up.
This commit is contained in:
Mateusz Mandera
2021-04-02 23:31:17 +02:00
committed by Tim Abbott
parent ceb7e2d2bd
commit d5871f1005
2 changed files with 3 additions and 19 deletions

View File

@@ -6585,7 +6585,7 @@ def do_get_streams(
) -> List[Dict[str, Any]]:
# This function is only used by API clients now.
if include_all_active and not user_profile.can_forge_sender:
if include_all_active and not user_profile.is_realm_admin:
raise JsonableError(_("User not authorized for this query"))
include_public = include_public and user_profile.can_access_public_streams()

View File

@@ -4583,27 +4583,11 @@ class GetStreamsTest(ZulipTestCase):
result = self.api_get(normal_user, url, data)
self.assertEqual(result.status_code, 400)
# Even realm admin users can't see all
# active streams (without additional privileges).
# Realm admin users can see all active streams.
admin_user = self.example_user("iago")
self.assertTrue(admin_user.is_realm_admin)
result = self.api_get(admin_user, url, data)
self.assertEqual(result.status_code, 400)
"""
HAPPY PATH:
We can get all active streams ONLY if we are
an API "super user". We typically create
api-super-user accounts for things like
Zephyr/Jabber mirror API users, but here
we just "knight" Hamlet for testing expediency.
"""
super_user = self.example_user("hamlet")
super_user.can_forge_sender = True
super_user.save()
result = self.api_get(super_user, url, data)
self.assert_json_success(result)
json = result.json()