Merge pull request #5514 from AntonKhorev/pd-declaration

[rails.git] / test / controllers / api / changeset_comments_controller_test.rb

diff --git a/test/controllers/api/changeset_comments_controller_test.rb b/test/controllers/api/changeset_comments_controller_test.rb
index 8a1a286dfe0eb03bb9064a5491214e3f4c6f4179..e456a3ca416f4cf25113827d0dd7c6b302c7746b 100644 (file)
--- a/test/controllers/api/changeset_comments_controller_test.rb
+++ b/test/controllers/api/changeset_comments_controller_test.rb
@@ -77,6 +77,34 @@ module Api
       end
     end
 
       end
     end
 

+    def test_create_without_required_scope
+      user = create(:user)
+      auth_header = bearer_authorization_header user, :scopes => %w[read_prefs]
+      changeset = create(:changeset, :closed)
+
+      assert_difference "ChangesetComment.count", 0 do
+        post changeset_comment_path(changeset), :params => { :text => "This is a comment" }, :headers => auth_header
+        assert_response :forbidden
+      end
+    end
+
+    def test_create_with_write_changeset_comments_scope
+      user = create(:user)
+      auth_header = bearer_authorization_header user, :scopes => %w[write_changeset_comments]
+      changeset = create(:changeset, :closed)
+
+      assert_difference "ChangesetComment.count", 1 do
+        post changeset_comment_path(changeset), :params => { :text => "This is a comment" }, :headers => auth_header
+        assert_response :success
+      end
+
+      comment = ChangesetComment.last
+      assert_equal changeset.id, comment.changeset_id
+      assert_equal user.id, comment.author_id
+      assert_equal "This is a comment", comment.body
+      assert comment.visible
+    end
+

     def test_create_with_write_api_scope
       user = create(:user)
       auth_header = bearer_authorization_header user, :scopes => %w[write_api]
     def test_create_with_write_api_scope
       user = create(:user)
       auth_header = bearer_authorization_header user, :scopes => %w[write_api]


@@ -308,54 +336,89 @@ module Api
       assert_response :not_found
     end
 
       assert_response :not_found
     end
 

-    ##
-    # test hide comment succes
-    def test_hide
+    def test_hide_without_required_scope

       comment = create(:changeset_comment)
       comment = create(:changeset_comment)

-      assert comment.visible
+      auth_header = bearer_authorization_header create(:moderator_user), :scopes => %w[read_prefs]

 
 

-      auth_header = bearer_authorization_header create(:moderator_user)
+      post changeset_comment_hide_path(comment), :headers => auth_header
+
+      assert_response :forbidden
+      assert comment.reload.visible
+    end
+
+    def test_hide_with_write_changeset_comments_scope
+      comment = create(:changeset_comment)
+      auth_header = bearer_authorization_header create(:moderator_user), :scopes => %w[write_changeset_comments]

 
       post changeset_comment_hide_path(comment), :headers => auth_header
 
       post changeset_comment_hide_path(comment), :headers => auth_header

+

       assert_response :success
       assert_not comment.reload.visible
     end
 
       assert_response :success
       assert_not comment.reload.visible
     end
 

-    ##
-    # test unhide comment fail
-    def test_unhide_fail
-      # unauthorized
+    def test_hide_with_write_api_scope
+      comment = create(:changeset_comment)
+      auth_header = bearer_authorization_header create(:moderator_user), :scopes => %w[write_api]
+
+      post changeset_comment_hide_path(comment), :headers => auth_header
+
+      assert_response :success
+      assert_not comment.reload.visible
+    end
+
+    def test_unhide_by_unauthorized

       comment = create(:changeset_comment, :visible => false)
       comment = create(:changeset_comment, :visible => false)

-      assert_not comment.visible

 
       post changeset_comment_unhide_path(comment)
 
       post changeset_comment_unhide_path(comment)

+

       assert_response :unauthorized
       assert_not comment.reload.visible
       assert_response :unauthorized
       assert_not comment.reload.visible

+    end

 
 

+    def test_unhide_by_normal_user
+      comment = create(:changeset_comment, :visible => false)

       auth_header = bearer_authorization_header
 
       auth_header = bearer_authorization_header
 

-      # not a moderator

       post changeset_comment_unhide_path(comment), :headers => auth_header
       post changeset_comment_unhide_path(comment), :headers => auth_header

+

       assert_response :forbidden
       assert_not comment.reload.visible
       assert_response :forbidden
       assert_not comment.reload.visible

+    end

 
 

+    def test_unhide_missing_comment

       auth_header = bearer_authorization_header create(:moderator_user)
 
       auth_header = bearer_authorization_header create(:moderator_user)
 

-      # bad comment id

       post changeset_comment_unhide_path(999111), :headers => auth_header
       post changeset_comment_unhide_path(999111), :headers => auth_header

+

       assert_response :not_found
       assert_response :not_found

+    end
+
+    def test_unhide_without_required_scope
+      comment = create(:changeset_comment, :visible => false)
+      auth_header = bearer_authorization_header create(:moderator_user), :scopes => %w[read_prefs]
+
+      post changeset_comment_unhide_path(comment), :headers => auth_header
+
+      assert_response :forbidden

       assert_not comment.reload.visible
     end
 
       assert_not comment.reload.visible
     end
 

-    ##
-    # test unhide comment succes
-    def test_unhide
+    def test_unhide_with_write_changeset_comments_scope

       comment = create(:changeset_comment, :visible => false)
       comment = create(:changeset_comment, :visible => false)

-      assert_not comment.visible
+      auth_header = bearer_authorization_header create(:moderator_user), :scopes => %w[write_changeset_comments]

 
 

-      auth_header = bearer_authorization_header create(:moderator_user)
+      post changeset_comment_unhide_path(comment), :headers => auth_header
+
+      assert_response :success
+      assert comment.reload.visible
+    end
+
+    def test_unhide_with_write_api_scope
+      comment = create(:changeset_comment, :visible => false)
+      auth_header = bearer_authorization_header create(:moderator_user), :scopes => %w[write_api]

 
       post changeset_comment_unhide_path(comment), :headers => auth_header
 
       post changeset_comment_unhide_path(comment), :headers => auth_header

+

       assert_response :success
       assert comment.reload.visible
     end
       assert_response :success
       assert comment.reload.visible
     end