Test that a normal user can't delete another user's ssh key

Author: vtemian

integrations/api_admin_test.go

@@ -47,6 +47,27 @@ func TestAPIAdminDeleteMissingSSHKey(t *testing.T) {
 	// user1 is an admin user
 	session := loginUser(t, "user1")
 
-	req := NewRequestf(t, "DELETE", "/api/v1/admin/users/user1/keys/99999")
+	req := NewRequestf(t, "DELETE", "/api/v1/admin/users/user1/keys/%d", models.NonexistentID)
 	session.MakeRequest(t, req, http.StatusNotFound)
 }
+
+func TestAPIAdminDeleteUnauthorizedKey(t *testing.T) {
+	prepareTestEnv(t)
+	adminUsername := "user1"
+	normalUsername := "user2"
+	session := loginUser(t, adminUsername)
+
+	urlStr := fmt.Sprintf("/api/v1/admin/users/%s/keys", adminUsername)
+	req := NewRequestWithValues(t, "POST", urlStr, map[string]string{
+		"key":   "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQDAu7tvIvX6ZHrRXuZNfkR3XLHSsuCK9Zn3X58lxBcQzuo5xZgB6vRwwm/QtJuF+zZPtY5hsQILBLmF+BZ5WpKZp1jBeSjH2G7lxet9kbcH+kIVj0tPFEoyKI9wvWqIwC4prx/WVk2wLTJjzBAhyNxfEq7C9CeiX9pQEbEqJfkKCQ== nocomment\n",
+		"title": "test-key",
+	})
+	resp := session.MakeRequest(t, req, http.StatusCreated)
+	var newPublicKey api.PublicKey
+	DecodeJSON(t, resp, &newPublicKey)
+
+	session = loginUser(t, normalUsername)
+	req = NewRequestf(t, "DELETE", "/api/v1/admin/users/%s/keys/%d",
+		adminUsername, newPublicKey.ID)
+	session.MakeRequest(t, req, http.StatusForbidden)
+}

routers/api/v1/admin/user.go

@@ -241,7 +241,7 @@ func CreatePublicKey(ctx *context.APIContext, form api.CreateKeyOption) {
 func DeleteUserPublicKey(ctx *context.APIContext) {
 	// swagger:operation DELETE /admin/users/{username}/keys/{id} admin adminDeleteUserPublicKey
 	// ---
-	// summary: Delete a user's public key on behalf of a user
+	// summary: Delete a user's public key
 	// produces:
 	// - application/json
 	// parameters:
@@ -252,8 +252,8 @@ func DeleteUserPublicKey(ctx *context.APIContext) {
 	//   required: true
 	// - name: id
 	//   in: path
-	//   description: key's id to delete
-	//   type: string
+	//   description: id of the key to delete
+	//   type: integer
 	//   required: true
 	// responses:
 	//   "204":