use a controller method to handle cancan denials

[rails.git] / test / integration / user_terms_seen_test.rb

diff --git a/test/integration/user_terms_seen_test.rb b/test/integration/user_terms_seen_test.rb
index f9c266ba0092a4bc853d8980c60268029d4fa9cd..811883f5fb8d17554c415ee3e507210ffec4b281 100644 (file)
--- a/test/integration/user_terms_seen_test.rb
+++ b/test/integration/user_terms_seen_test.rb
@@ -1,49 +1,89 @@
-require File.dirname(__FILE__) + '/../test_helper'
+require "test_helper"

 
 

-class UserTermsSeenTest < ActionController::IntegrationTest
-  fixtures :users
-
-  def auth_header(user, pass)
-    {"HTTP_AUTHORIZATION" => "Basic %s" % Base64.encode64("#{user}:#{pass}")}
+class UserTermsSeenTest < ActionDispatch::IntegrationTest
+  def setup
+    stub_hostip_requests

   end
 
   def test_api_blocked
   end
 
   def test_api_blocked

-    if REQUIRE_TERMS_SEEN
-      user = users(:terms_not_seen_user)
+    with_terms_seen(true) do
+      user = create(:user, :terms_seen => false)

 
 

-      get "/api/#{API_VERSION}/user/details", nil, auth_header(user.display_name, "test")
+      get "/api/#{API_VERSION}/user/preferences", :headers => auth_header(user.display_name, "test")

       assert_response :forbidden
 
       # touch it so that the user has seen the terms
       user.terms_seen = true
       user.save
 
       assert_response :forbidden
 
       # touch it so that the user has seen the terms
       user.terms_seen = true
       user.save
 

-      get "/api/#{API_VERSION}/user/details", nil, auth_header(user.display_name, "test")
+      get "/api/#{API_VERSION}/user/preferences", :headers => auth_header(user.display_name, "test")

       assert_response :success
     end
   end
 
   def test_terms_presented_at_login
       assert_response :success
     end
   end
 
   def test_terms_presented_at_login

-    if REQUIRE_TERMS_SEEN
-      user = users(:terms_not_seen_user)
+    with_terms_seen(true) do
+      user = create(:user, :terms_seen => false)

 
       # try to log in
 
       # try to log in

-      get_via_redirect "/login"
+      get "/login"
+      follow_redirect!

       assert_response :success
       assert_response :success

-      assert_template 'user/login'
-      post "/login", {'user[email]' => user.email, 'user[password]' => 'test', :referer => "/"}
+      assert_template "user/login"
+      post "/login", :params => { :username => user.email, :password => "test", :referer => "/diary/new" }

       assert_response :redirect
       # but now we need to look at the terms
       assert_response :redirect
       # but now we need to look at the terms

-      assert_redirected_to "controller" => "user", "action" => "terms", :referer => "/"
+      assert_redirected_to :controller => :user, :action => :terms, :referer => "/diary/new"

       follow_redirect!
       assert_response :success
 
       # don't agree to the terms, but hit decline
       follow_redirect!
       assert_response :success
 
       # don't agree to the terms, but hit decline

+      post "/user/save", :params => { :decline => true, :referer => "/diary/new" }
+      assert_redirected_to "/diary/new"
+      follow_redirect!

 
 

-      # should be carried through to a normal login
+      # should be carried through to a normal login with a message
+      assert_response :success
+      assert_not flash[:notice].nil?

     end
   end
 
     end
   end
 

-end
+  def test_terms_cant_be_circumvented
+    with_terms_seen(true) do
+      user = create(:user, :terms_seen => false)
+
+      # try to log in
+      get "/login"
+      follow_redirect!
+      assert_response :success
+      assert_template "user/login"
+      post "/login", :params => { :username => user.email, :password => "test", :referer => "/diary/new" }
+      assert_response :redirect
+      # but now we need to look at the terms
+      assert_redirected_to :controller => :user, :action => :terms, :referer => "/diary/new"

 
 

-    
+      # check that if we go somewhere else now, it redirects
+      # back to the terms page.
+      get "/traces/mine"
+      assert_redirected_to :controller => :user, :action => :terms, :referer => "/traces/mine"
+      get "/traces/mine", :params => { :referer => "/diary/new" }
+      assert_redirected_to :controller => :user, :action => :terms, :referer => "/diary/new"
+    end
+  end
+
+  private
+
+  def auth_header(user, pass)
+    { "HTTP_AUTHORIZATION" => format("Basic %{auth}", :auth => Base64.encode64("#{user}:#{pass}")) }
+  end
+
+  def with_terms_seen(value)
+    require_terms_seen = Object.send("remove_const", "REQUIRE_TERMS_SEEN")
+    Object.const_set("REQUIRE_TERMS_SEEN", value)
+
+    yield
+
+    Object.send("remove_const", "REQUIRE_TERMS_SEEN")
+    Object.const_set("REQUIRE_TERMS_SEEN", require_terms_seen)
+  end
+end