# -------------------------------------
def test_create
- basic_authorization "test@openstreetmap.org", "test"
+ basic_authorization users(:normal_user).email, "test"
# put the relation in a dummy fixture changset
changeset_id = changesets(:normal_user_first_change).id
+ # create an relation without members
+ content "<osm><relation changeset='#{changeset_id}'><tag k='test' v='yes' /></relation></osm>"
+ put :create
+ # hope for forbidden, due to user
+ assert_response :forbidden,
+ "relation upload should have failed with forbidden"
+
+ ###
+ # create an relation with a node as member
+ # This time try with a role attribute in the relation
+ nid = current_nodes(:used_node_1).id
+ content "<osm><relation changeset='#{changeset_id}'>" +
+ "<member ref='#{nid}' type='node' role='some'/>" +
+ "<tag k='test' v='yes' /></relation></osm>"
+ put :create
+ # hope for forbidden due to user
+ assert_response :forbidden,
+ "relation upload did not return forbidden status"
+
+ ###
+ # create an relation with a node as member, this time test that we don't
+ # need a role attribute to be included
+ nid = current_nodes(:used_node_1).id
+ content "<osm><relation changeset='#{changeset_id}'>" +
+ "<member ref='#{nid}' type='node'/>"+
+ "<tag k='test' v='yes' /></relation></osm>"
+ put :create
+ # hope for forbidden due to user
+ assert_response :forbidden,
+ "relation upload did not return forbidden status"
+
+ ###
+ # create an relation with a way and a node as members
+ nid = current_nodes(:used_node_1).id
+ wid = current_ways(:used_way).id
+ content "<osm><relation changeset='#{changeset_id}'>" +
+ "<member type='node' ref='#{nid}' role='some'/>" +
+ "<member type='way' ref='#{wid}' role='other'/>" +
+ "<tag k='test' v='yes' /></relation></osm>"
+ put :create
+ # hope for forbidden, due to user
+ assert_response :forbidden,
+ "relation upload did not return success status"
+
+
+
+ ## Now try with the public user
+ basic_authorization users(:public_user).email, "test"
+
+ # put the relation in a dummy fixture changset
+ changeset_id = changesets(:public_user_first_change).id
+
# create an relation without members
content "<osm><relation changeset='#{changeset_id}'><tag k='test' v='yes' /></relation></osm>"
put :create
"saved relation does not contain exactly one tag"
assert_equal changeset_id, checkrelation.changeset.id,
"saved relation does not belong in the changeset it was assigned to"
- assert_equal users(:normal_user).id, checkrelation.changeset.user_id,
+ assert_equal users(:public_user).id, checkrelation.changeset.user_id,
"saved relation does not belong to user that created it"
assert_equal true, checkrelation.visible,
"saved relation is not visible"
"saved relation does not contain exactly one tag"
assert_equal changeset_id, checkrelation.changeset.id,
"saved relation does not belong in the changeset it was assigned to"
- assert_equal users(:normal_user).id, checkrelation.changeset.user_id,
+ assert_equal users(:public_user).id, checkrelation.changeset.user_id,
"saved relation does not belong to user that created it"
assert_equal true, checkrelation.visible,
"saved relation is not visible"
"saved relation does not contain exactly one tag"
assert_equal changeset_id, checkrelation.changeset.id,
"saved relation does not belong in the changeset it was assigned to"
- assert_equal users(:normal_user).id, checkrelation.changeset.user_id,
+ assert_equal users(:public_user).id, checkrelation.changeset.user_id,
"saved relation does not belong to user that created it"
assert_equal true, checkrelation.visible,
"saved relation is not visible"
"saved relation does not contain exactly one tag"
assert_equal changeset_id, checkrelation.changeset.id,
"saved relation does not belong in the changeset it was assigned to"
- assert_equal users(:normal_user).id, checkrelation.changeset.user_id,
+ assert_equal users(:public_user).id, checkrelation.changeset.user_id,
"saved relation does not belong to user that created it"
assert_equal true, checkrelation.visible,
"saved relation is not visible"
# happen to the correct tables and the API gives sensible results.
# this is to test a case that gregory marler noticed and posted to
# josm-dev.
+ ## FIXME Move this to an integration test
def test_update_relation_tags
basic_authorization "test@example.com", "test"
rel_id = current_relations(:multi_tag_relation).id
# and the API gives sensible results. this is to test a case that
# gregory marler noticed and posted to josm-dev.
def test_update_relation_tags_via_upload
- basic_authorization "test@example.com", "test"
+ basic_authorization users(:public_user).email, "test"
rel_id = current_relations(:multi_tag_relation).id
cs_id = changesets(:public_user_first_change).id
# -------------------------------------
def test_create_invalid
- basic_authorization "test@openstreetmap.org", "test"
+ basic_authorization users(:public_user).email, "test"
# put the relation in a dummy fixture changset
- changeset_id = changesets(:normal_user_first_change).id
+ changeset_id = changesets(:public_user_first_change).id
# create a relation with non-existing node as member
content "<osm><relation changeset='#{changeset_id}'>" +
# expect failure
assert_response :precondition_failed,
"relation upload with invalid node did not return 'precondition failed'"
+ assert_equal "Precondition failed: Relation with id cannot be saved due to Node with id 0", @response.body
end
# -------------------------------------
# Test creating a relation, with some invalid XML
# -------------------------------------
def test_create_invalid_xml
- basic_authorization "test@openstreetmap.org", "test"
+ basic_authorization users(:public_user).email, "test"
# put the relation in a dummy fixture changeset that works
- changeset_id = changesets(:normal_user_first_change).id
+ changeset_id = changesets(:public_user_first_change).id
# create some xml that should return an error
content "<osm><relation changeset='#{changeset_id}'>" +
# -------------------------------------
def test_delete
- # first try to delete relation without auth
+ ## First try to delete relation without auth
delete :delete, :id => current_relations(:visible_relation).id
assert_response :unauthorized
+
+
+ ## Then try with the private user, to make sure that you get a forbidden
+ basic_authorization(users(:normal_user).email, "test")
+
+ # this shouldn't work, as we should need the payload...
+ delete :delete, :id => current_relations(:visible_relation).id
+ assert_response :forbidden
- # now set auth
- basic_authorization("test@openstreetmap.org", "test");
+ # try to delete without specifying a changeset
+ content "<osm><relation id='#{current_relations(:visible_relation).id}'/></osm>"
+ delete :delete, :id => current_relations(:visible_relation).id
+ assert_response :forbidden
+
+ # try to delete with an invalid (closed) changeset
+ content update_changeset(current_relations(:visible_relation).to_xml,
+ changesets(:normal_user_closed_change).id)
+ delete :delete, :id => current_relations(:visible_relation).id
+ assert_response :forbidden
+
+ # try to delete with an invalid (non-existent) changeset
+ content update_changeset(current_relations(:visible_relation).to_xml,0)
+ delete :delete, :id => current_relations(:visible_relation).id
+ assert_response :forbidden
+
+ # this won't work because the relation is in-use by another relation
+ content(relations(:used_relation).to_xml)
+ delete :delete, :id => current_relations(:used_relation).id
+ assert_response :forbidden
+
+ # this should work when we provide the appropriate payload...
+ content(relations(:visible_relation).to_xml)
+ delete :delete, :id => current_relations(:visible_relation).id
+ assert_response :forbidden
+
+ # this won't work since the relation is already deleted
+ content(relations(:invisible_relation).to_xml)
+ delete :delete, :id => current_relations(:invisible_relation).id
+ assert_response :forbidden
+
+ # this works now because the relation which was using this one
+ # has been deleted.
+ content(relations(:used_relation).to_xml)
+ delete :delete, :id => current_relations(:used_relation).id
+ assert_response :forbidden
+
+ # this won't work since the relation never existed
+ delete :delete, :id => 0
+ assert_response :forbidden
+
+
+
+ ## now set auth for the public user
+ basic_authorization(users(:public_user).email, "test");
# this shouldn't work, as we should need the payload...
delete :delete, :id => current_relations(:visible_relation).id
delete :delete, :id => current_relations(:visible_relation).id
assert_response :conflict
- # this won't work because the relation is in-use by another relation
+ # this won't work because the relation is in a changeset owned by someone else
content(relations(:used_relation).to_xml)
delete :delete, :id => current_relations(:used_relation).id
+ assert_response :conflict,
+ "shouldn't be able to delete a relation in a changeset owned by someone else (#{@response.body})"
+
+ # this won't work because the relation in the payload is different to that passed
+ content(relations(:public_used_relation).to_xml)
+ delete :delete, :id => current_relations(:used_relation).id
+ assert_not_equal relations(:public_used_relation).id, current_relations(:used_relation).id
+ assert_response :bad_request, "shouldn't be able to delete a relation when payload is different to the url"
+
+ # this won't work because the relation is in-use by another relation
+ content(relations(:public_used_relation).to_xml)
+ delete :delete, :id => current_relations(:public_used_relation).id
assert_response :precondition_failed,
"shouldn't be able to delete a relation used in a relation (#{@response.body})"
+ assert_equal "Precondition failed: The relation 5 is used in relation 6.", @response.body
# this should work when we provide the appropriate payload...
- content(relations(:visible_relation).to_xml)
- delete :delete, :id => current_relations(:visible_relation).id
+ content(relations(:multi_tag_relation).to_xml)
+ delete :delete, :id => current_relations(:multi_tag_relation).id
assert_response :success
# valid delete should return the new version number, which should
content(relations(:invisible_relation).to_xml)
delete :delete, :id => current_relations(:invisible_relation).id
assert_response :gone
+
+ # Public visible relation needs to be deleted
+ content(relations(:public_visible_relation).to_xml)
+ delete :delete, :id => current_relations(:public_visible_relation).id
+ assert_response :success
# this works now because the relation which was using this one
# has been deleted.
- content(relations(:used_relation).to_xml)
- delete :delete, :id => current_relations(:used_relation).id
+ content(relations(:public_used_relation).to_xml)
+ delete :delete, :id => current_relations(:public_used_relation).id
assert_response :success,
"should be able to delete a relation used in an old relation (#{@response.body})"
##
# check that relations are ordered
def test_relation_member_ordering
- basic_authorization("test@openstreetmap.org", "test");
-
+ basic_authorization(users(:public_user).email, "test")
+
doc_str = <<OSM
<osm>
- <relation changeset='1'>
+ <relation changeset='4'>
<member ref='1' type='node' role='first'/>
<member ref='3' type='node' role='second'/>
<member ref='1' type='way' role='third'/>
##
# check that relations can contain duplicate members
def test_relation_member_duplicates
- basic_authorization("test@openstreetmap.org", "test");
+ ## First try with the private user
+ basic_authorization(users(:normal_user).email, "test");
doc_str = <<OSM
<osm>
- <relation changeset='1'>
+ <relation changeset='4'>
+ <member ref='1' type='node' role='forward'/>
+ <member ref='3' type='node' role='forward'/>
+ <member ref='1' type='node' role='forward'/>
+ <member ref='3' type='node' role='forward'/>
+ </relation>
+</osm>
+OSM
+ doc = XML::Parser.string(doc_str).parse
+
+ content doc
+ put :create
+ assert_response :forbidden
+
+
+ ## Now try with the public user
+ basic_authorization(users(:public_user).email, "test");
+
+ doc_str = <<OSM
+<osm>
+ <relation changeset='4'>
<member ref='1' type='node' role='forward'/>
<member ref='3' type='node' role='forward'/>
<member ref='1' type='node' role='forward'/>
# create a changeset and yield to the caller to set it up, then assert
# that the changeset bounding box is +bbox+.
def check_changeset_modify(bbox)
- basic_authorization("test@openstreetmap.org", "test");
+ ## First test with the private user to check that you get a forbidden
+ basic_authorization(users(:normal_user).email, "test");
+
+ # create a new changeset for this operation, so we are assured
+ # that the bounding box will be newly-generated.
+ changeset_id = with_controller(ChangesetController.new) do
+ content "<osm><changeset/></osm>"
+ put :create
+ assert_response :forbidden, "shouldn't be able to create changeset for modify test, as should get forbidden"
+ end
+
+ ## Now do the whole thing with the public user
+ basic_authorization(users(:public_user).email, "test")
+
# create a new changeset for this operation, so we are assured
# that the bounding box will be newly-generated.
changeset_id = with_controller(ChangesetController.new) do