tests: star security tests

endpoints/api/user.py

@@ -700,7 +700,6 @@ class StarredRepositoryList(ApiResource):
     }
   }
 
-  @require_scope(scopes.READ_REPO)
   @nickname('listStarredRepos')
   @parse_args
   @query_param('page', 'Offset page number. (int)', type=int)
@@ -750,12 +749,11 @@ class StarredRepositoryList(ApiResource):
         'repository': repository,
       }, 201
 
-    raise NotFound()
-
 @resource('/v1/user/starred/<repopath:repository>')
 @path_param('repository', 'The full path of the repository. e.g. namespace/name')
 class StarredRepository(RepositoryParamResource):
   """ Operations for managing a specific starred repository. """
+
   @nickname('deleteStar')
   @require_user_admin
   def delete(self, namespace, repository):
@@ -769,5 +767,3 @@ class StarredRepository(RepositoryParamResource):
       #log_action('unstar_repository', user.username, namespace,
       #           {'repo': repository, 'namespace': namespace})
       return 'Deleted', 204
-
-    raise NotFound()