Strip away class attributes from sanitized outputs

[rails.git] / test / controllers / api / users_controller_test.rb

diff --git a/test/controllers/api/users_controller_test.rb b/test/controllers/api/users_controller_test.rb
index 5483731db1e25c3a97b2b39ab666a341b047fd1c..5ce30d6a614f4e7f3d84cd5c2af2aaf675f56ac8 100644 (file)
--- a/test/controllers/api/users_controller_test.rb
+++ b/test/controllers/api/users_controller_test.rb
@@ -1,38 +1,46 @@
 require "test_helper"
 
 module Api
 require "test_helper"
 
 module Api

-  class UsersControllerTest < ActionController::TestCase
-    def setup
-      stub_hostip_requests
-    end
-
+  class UsersControllerTest < ActionDispatch::IntegrationTest

     ##
     # test all routes which lead to this controller
     def test_routes
       assert_routing(
         { :path => "/api/0.6/user/1", :method => :get },
     ##
     # test all routes which lead to this controller
     def test_routes
       assert_routing(
         { :path => "/api/0.6/user/1", :method => :get },

-        { :controller => "api/users", :action => "api_read", :id => "1" }
+        { :controller => "api/users", :action => "show", :id => "1" }
+      )
+      assert_routing(
+        { :path => "/api/0.6/user/1.json", :method => :get },
+        { :controller => "api/users", :action => "show", :id => "1", :format => "json" }

       )
       assert_routing(
         { :path => "/api/0.6/user/details", :method => :get },
       )
       assert_routing(
         { :path => "/api/0.6/user/details", :method => :get },

-        { :controller => "api/users", :action => "api_details" }
+        { :controller => "api/users", :action => "details" }
+      )
+      assert_routing(
+        { :path => "/api/0.6/user/details.json", :method => :get },
+        { :controller => "api/users", :action => "details", :format => "json" }

       )
       assert_routing(
         { :path => "/api/0.6/user/gpx_files", :method => :get },
       )
       assert_routing(
         { :path => "/api/0.6/user/gpx_files", :method => :get },

-        { :controller => "api/users", :action => "api_gpx_files" }
+        { :controller => "api/users", :action => "gpx_files" }

       )
       assert_routing(
         { :path => "/api/0.6/users", :method => :get },
       )
       assert_routing(
         { :path => "/api/0.6/users", :method => :get },

-        { :controller => "api/users", :action => "api_users" }
+        { :controller => "api/users", :action => "index" }
+      )
+      assert_routing(
+        { :path => "/api/0.6/users.json", :method => :get },
+        { :controller => "api/users", :action => "index", :format => "json" }

       )
     end
 
       )
     end
 

-    def test_api_read
+    def test_show

       user = create(:user, :description => "test", :terms_agreed => Date.yesterday)
       # check that a visible user is returned properly
       user = create(:user, :description => "test", :terms_agreed => Date.yesterday)
       # check that a visible user is returned properly

-      get :api_read, :params => { :id => user.id }
+      get api_user_path(:id => user.id)

       assert_response :success
       assert_response :success

-      assert_equal "text/xml", response.content_type
+      assert_equal "application/xml", response.media_type

 
       # check the data that is returned
       assert_select "description", :count => 1, :text => "test"
 
       # check the data that is returned
       assert_select "description", :count => 1, :text => "test"


@@ -63,32 +71,41 @@ module Api
       assert_select "messages", false
 
       # check that a suspended user is not returned
       assert_select "messages", false
 
       # check that a suspended user is not returned

-      get :api_read, :params => { :id => create(:user, :suspended).id }
+      get api_user_path(:id => create(:user, :suspended).id)

       assert_response :gone
 
       # check that a deleted user is not returned
       assert_response :gone
 
       # check that a deleted user is not returned

-      get :api_read, :params => { :id => create(:user, :deleted).id }
+      get api_user_path(:id => create(:user, :deleted).id)

       assert_response :gone
 
       # check that a non-existent user is not returned
       assert_response :gone
 
       # check that a non-existent user is not returned

-      get :api_read, :params => { :id => 0 }
+      get api_user_path(:id => 0)

       assert_response :not_found
       assert_response :not_found

+
+      # check that a visible user is returned properly in json
+      get api_user_path(:id => user.id, :format => "json")
+      assert_response :success
+      assert_equal "application/json", response.media_type
+
+      js = ActiveSupport::JSON.decode(@response.body)
+      assert_not_nil js
+      assert_equal user.id, js["user"]["id"]

     end
 
     end
 

-    def test_api_details
+    def test_details

       user = create(:user, :description => "test", :terms_agreed => Date.yesterday, :home_lat => 12.1, :home_lon => 12.1, :languages => ["en"])
       create(:message, :read, :recipient => user)
       create(:message, :sender => user)
 
       # check that nothing is returned when not logged in
       user = create(:user, :description => "test", :terms_agreed => Date.yesterday, :home_lat => 12.1, :home_lon => 12.1, :languages => ["en"])
       create(:message, :read, :recipient => user)
       create(:message, :sender => user)
 
       # check that nothing is returned when not logged in

-      get :api_details
+      get user_details_path

       assert_response :unauthorized
 
       # check that we get a response when logged in
       assert_response :unauthorized
 
       # check that we get a response when logged in

-      basic_authorization user.email, "test"
-      get :api_details
+      auth_header = basic_authorization_header user.email, "test"
+      get user_details_path, :headers => auth_header

       assert_response :success
       assert_response :success

-      assert_equal "text/xml", response.content_type
+      assert_equal "application/xml", response.media_type

 
       # check the data that is returned
       assert_select "description", :count => 1, :text => "test"
 
       # check the data that is returned
       assert_select "description", :count => 1, :text => "test"


@@ -127,49 +144,58 @@ module Api
       end
     end
 
       end
     end
 

-    def test_api_users
+    def test_index

       user1 = create(:user, :description => "test1", :terms_agreed => Date.yesterday)
       user2 = create(:user, :description => "test2", :terms_agreed => Date.yesterday)
       user3 = create(:user, :description => "test3", :terms_agreed => Date.yesterday)
 
       user1 = create(:user, :description => "test1", :terms_agreed => Date.yesterday)
       user2 = create(:user, :description => "test2", :terms_agreed => Date.yesterday)
       user3 = create(:user, :description => "test3", :terms_agreed => Date.yesterday)
 

-      get :api_users, :params => { :users => user1.id }
+      get api_users_path(:users => user1.id)

       assert_response :success
       assert_response :success

-      assert_equal "text/xml", response.content_type
+      assert_equal "application/xml", response.media_type

       assert_select "user", :count => 1 do
         assert_select "user[id='#{user1.id}']", :count => 1
         assert_select "user[id='#{user2.id}']", :count => 0
         assert_select "user[id='#{user3.id}']", :count => 0
       end
 
       assert_select "user", :count => 1 do
         assert_select "user[id='#{user1.id}']", :count => 1
         assert_select "user[id='#{user2.id}']", :count => 0
         assert_select "user[id='#{user3.id}']", :count => 0
       end
 

-      get :api_users, :params => { :users => user2.id }
+      # Test json
+      get api_users_path(:users => user1.id, :format => "json")
+      assert_response :success
+      assert_equal "application/json", response.media_type
+
+      js = ActiveSupport::JSON.decode(@response.body)
+      assert_not_nil js
+      assert_equal 1, js["users"].count
+
+      get api_users_path(:users => user2.id)

       assert_response :success
       assert_response :success

-      assert_equal "text/xml", response.content_type
+      assert_equal "application/xml", response.media_type

       assert_select "user", :count => 1 do
         assert_select "user[id='#{user1.id}']", :count => 0
         assert_select "user[id='#{user2.id}']", :count => 1
         assert_select "user[id='#{user3.id}']", :count => 0
       end
 
       assert_select "user", :count => 1 do
         assert_select "user[id='#{user1.id}']", :count => 0
         assert_select "user[id='#{user2.id}']", :count => 1
         assert_select "user[id='#{user3.id}']", :count => 0
       end
 

-      get :api_users, :params => { :users => "#{user1.id},#{user3.id}" }
+      get api_users_path(:users => "#{user1.id},#{user3.id}")

       assert_response :success
       assert_response :success

-      assert_equal "text/xml", response.content_type
+      assert_equal "application/xml", response.media_type

       assert_select "user", :count => 2 do
         assert_select "user[id='#{user1.id}']", :count => 1
         assert_select "user[id='#{user2.id}']", :count => 0
         assert_select "user[id='#{user3.id}']", :count => 1
       end
 
       assert_select "user", :count => 2 do
         assert_select "user[id='#{user1.id}']", :count => 1
         assert_select "user[id='#{user2.id}']", :count => 0
         assert_select "user[id='#{user3.id}']", :count => 1
       end
 

-      get :api_users, :params => { :users => create(:user, :suspended).id }
+      get api_users_path(:users => create(:user, :suspended).id)

       assert_response :not_found
 
       assert_response :not_found
 

-      get :api_users, :params => { :users => create(:user, :deleted).id }
+      get api_users_path(:users => create(:user, :deleted).id)

       assert_response :not_found
 
       assert_response :not_found
 

-      get :api_users, :params => { :users => 0 }
+      get api_users_path(:users => 0)

       assert_response :not_found
     end
 
       assert_response :not_found
     end
 

-    def test_api_gpx_files
+    def test_gpx_files

       user = create(:user)
       trace1 = create(:trace, :user => user) do |trace|
         create(:tracetag, :trace => trace, :tag => "London")
       user = create(:user)
       trace1 = create(:trace, :user => user) do |trace|
         create(:tracetag, :trace => trace, :tag => "London")


@@ -178,14 +204,14 @@ module Api
         create(:tracetag, :trace => trace, :tag => "Birmingham")
       end
       # check that nothing is returned when not logged in
         create(:tracetag, :trace => trace, :tag => "Birmingham")
       end
       # check that nothing is returned when not logged in

-      get :api_gpx_files
+      get user_gpx_files_path

       assert_response :unauthorized
 
       # check that we get a response when logged in
       assert_response :unauthorized
 
       # check that we get a response when logged in

-      basic_authorization user.email, "test"
-      get :api_gpx_files
+      auth_header = basic_authorization_header user.email, "test"
+      get user_gpx_files_path, :headers => auth_header

       assert_response :success
       assert_response :success

-      assert_equal "application/xml", response.content_type
+      assert_equal "application/xml", response.media_type

 
       # check the data that is returned
       assert_select "gpx_file[id='#{trace1.id}']", 1 do
 
       # check the data that is returned
       assert_select "gpx_file[id='#{trace1.id}']", 1 do