feat: vendor gitea 1.16.2

package/gitea/source/tests/integration/api_notification_test.go

@@ -200,7 +200,7 @@ func TestAPINotificationPUT(t *testing.T) {
 	assert.False(t, apiNL[0].Pinned)
 
 	//
-	// Now nofication ID 2 is the first in the list and is unread.
+	// Now notification ID 2 is the first in the list and is unread.
 	//
 	req = NewRequest(t, "GET", "/api/v1/notifications?all=true").
 		AddTokenAuth(token)
@@ -212,3 +212,23 @@ func TestAPINotificationPUT(t *testing.T) {
 	assert.True(t, apiNL[0].Unread)
 	assert.False(t, apiNL[0].Pinned)
 }
+
+func TestAPINotificationPublicOnly(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+
+	user2 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
+	thread5 := unittest.AssertExistsAndLoadBean(t, &activities_model.Notification{ID: 5})
+
+	token := getUserToken(t, user2.Name, auth_model.AccessTokenScopeReadNotification, auth_model.AccessTokenScopePublicOnly)
+	req := NewRequest(t, "GET", "/api/v1/notifications").
+		AddTokenAuth(token)
+	MakeRequest(t, req, http.StatusForbidden)
+
+	req = NewRequest(t, "GET", "/api/v1/notifications/new").
+		AddTokenAuth(token)
+	MakeRequest(t, req, http.StatusForbidden)
+
+	req = NewRequest(t, "GET", fmt.Sprintf("/api/v1/notifications/threads/%d", thread5.ID)).
+		AddTokenAuth(token)
+	MakeRequest(t, req, http.StatusForbidden)
+}