+ assert_dom "osm relation[id='#{relation.id}'][version='1']", 1,
+ "relation #{relation.id} version 1 should still be present in the history for moderators when passing flag."
+ end
+
+ def test_show
+ relation = create(:relation, :with_history, :version => 2)
+ create(:old_relation_tag, :old_relation => relation.old_relations[0], :k => "k1", :v => "v1")
+ create(:old_relation_tag, :old_relation => relation.old_relations[1], :k => "k2", :v => "v2")
+
+ get api_relation_version_path(relation, 1)
+
+ assert_response :success
+ assert_dom "osm:root", 1 do
+ assert_dom "> relation", 1 do
+ assert_dom "> @id", relation.id.to_s
+ assert_dom "> @version", "1"
+ assert_dom "> tag", 1 do
+ assert_dom "> @k", "k1"
+ assert_dom "> @v", "v1"
+ end
+ end
+ end
+
+ get api_relation_version_path(relation, 2)
+
+ assert_response :success
+ assert_dom "osm:root", 1 do
+ assert_dom "> relation", 1 do
+ assert_dom "> @id", relation.id.to_s
+ assert_dom "> @version", "2"
+ assert_dom "> tag", 1 do
+ assert_dom "> @k", "k2"
+ assert_dom "> @v", "v2"
+ end
+ end
+ end
+ end
+
+ ##
+ # test that redacted relations aren't visible, regardless of
+ # authorisation except as moderator...
+ def test_show_redacted_unauthorised
+ relation = create(:relation, :with_history, :version => 2)
+ relation.old_relations.find_by(:version => 1).redact!(create(:redaction))
+
+ get api_relation_version_path(relation, 1)
+
+ assert_response :forbidden, "Redacted relation shouldn't be visible via the version API."
+
+ get api_relation_version_path(relation, 1, :show_redactions => "true")
+
+ assert_response :forbidden, "Redacted relation shouldn't be visible via the version API when passing flag."
+ end
+
+ def test_show_redacted_normal_user
+ relation = create(:relation, :with_history, :version => 2)
+ relation.old_relations.find_by(:version => 1).redact!(create(:redaction))
+
+ get api_relation_version_path(relation, 1), :headers => bearer_authorization_header
+
+ assert_response :forbidden, "Redacted relation shouldn't be visible via the version API, even when logged in."
+
+ get api_relation_version_path(relation, 1, :show_redactions => "true"), :headers => bearer_authorization_header
+
+ assert_response :forbidden, "Redacted relation shouldn't be visible via the version API, even when logged in and passing flag."
+ end
+
+ def test_show_redacted_moderator
+ relation = create(:relation, :with_history, :version => 2)
+ relation.old_relations.find_by(:version => 1).redact!(create(:redaction))
+ auth_header = bearer_authorization_header create(:moderator_user)
+
+ get api_relation_version_path(relation, 1), :headers => auth_header
+
+ assert_response :forbidden, "Redacted relation should be gone for moderator, when flag not passed."
+
+ get api_relation_version_path(relation, 1, :show_redactions => "true"), :headers => auth_header
+
+ assert_response :success, "Redacted relation should not be gone for moderator, when flag passed."