Merge remote-tracking branch 'upstream/pull/5410'

[rails.git] / test / controllers / api / users_controller_test.rb

diff --git a/test/controllers/api/users_controller_test.rb b/test/controllers/api/users_controller_test.rb
index d0d1e0dcf1e2a31ce9893bdfcd6c7b153d7d2be3..874d9177105b6cba3b20bc7b8aef312914e47671 100644 (file)
--- a/test/controllers/api/users_controller_test.rb
+++ b/test/controllers/api/users_controller_test.rb
@@ -48,7 +48,7 @@ module Api
       assert_equal "application/xml", response.media_type
 
       # check the data that is returned
       assert_equal "application/xml", response.media_type
 
       # check the data that is returned

-      check_xml_details(user, false)
+      check_xml_details(user, false, false)

 
       # check that a suspended user is not returned
       get api_user_path(:id => create(:user, :suspended).id)
 
       # check that a suspended user is not returned
       get api_user_path(:id => create(:user, :suspended).id)


@@ -72,123 +72,45 @@ module Api
       assert_not_nil js
 
       # check the data that is returned
       assert_not_nil js
 
       # check the data that is returned

-      check_json_details(js, user, false)
-    end
-
-    def test_show_oauth1
-      user = create(:user,
-                    :home_lat => 12.1, :home_lon => 23.4,
-                    :languages => ["en"])
-      good_token = create(:access_token,
-                          :user => user,
-                          :allow_read_prefs => true)
-      bad_token = create(:access_token,
-                         :user => user)
-      other_user = create(:user,
-                          :home_lat => 12.1, :home_lon => 23.4,
-                          :languages => ["en"])
-
-      # check that we can fetch our own details as XML with read_prefs
-      signed_get api_user_path(:id => user.id), :oauth => { :token => good_token }
-      assert_response :success
-      assert_equal "application/xml", response.media_type
-
-      # check the data that is returned
-      check_xml_details(user, true)
-
-      # check that we can fetch a different user's details as XML with read_prefs
-      signed_get api_user_path(:id => other_user.id), :oauth => { :token => good_token }
-      assert_response :success
-      assert_equal "application/xml", response.media_type
-
-      # check the data that is returned
-      check_xml_details(other_user, false)
-
-      # check that we can fetch our own details as XML without read_prefs
-      signed_get api_user_path(:id => user.id), :oauth => { :token => bad_token }
-      assert_response :success
-      assert_equal "application/xml", response.media_type
-
-      # check the data that is returned
-      check_xml_details(user, false)
-
-      # check that we can fetch our own details as JSON with read_prefs
-      signed_get api_user_path(:id => user.id, :format => "json"), :oauth => { :token => good_token }
-      assert_response :success
-      assert_equal "application/json", response.media_type
-
-      # parse the response
-      js = ActiveSupport::JSON.decode(@response.body)
-      assert_not_nil js
-
-      # check the data that is returned
-      check_json_details(js, user, true)
-
-      # check that we can fetch a different user's details as JSON with read_prefs
-      signed_get api_user_path(:id => other_user.id, :format => "json"), :oauth => { :token => good_token }
-      assert_response :success
-      assert_equal "application/json", response.media_type
-
-      # parse the response
-      js = ActiveSupport::JSON.decode(@response.body)
-      assert_not_nil js
-
-      # check the data that is returned
-      check_json_details(js, other_user, false)
-
-      # check that we can fetch our own details as JSON without read_prefs
-      signed_get api_user_path(:id => other_user.id, :format => "json"), :oauth => { :token => bad_token }
-      assert_response :success
-      assert_equal "application/json", response.media_type
-
-      # parse the response
-      js = ActiveSupport::JSON.decode(@response.body)
-      assert_not_nil js
-
-      # check the data that is returned
-      check_json_details(js, other_user, false)
+      check_json_details(js, user, false, false)

     end
 
     def test_show_oauth2
       user = create(:user,
                     :home_lat => 12.1, :home_lon => 23.4,
                     :languages => ["en"])
     end
 
     def test_show_oauth2
       user = create(:user,
                     :home_lat => 12.1, :home_lon => 23.4,
                     :languages => ["en"])

-      good_token = create(:oauth_access_token,
-                          :resource_owner_id => user.id,
-                          :scopes => %w[read_prefs])
-      bad_token = create(:oauth_access_token,
-                         :resource_owner_id => user.id,
-                         :scopes => %w[])
+      good_auth = bearer_authorization_header(user, :scopes => %w[read_prefs])
+      bad_auth = bearer_authorization_header(user, :scopes => %w[])

       other_user = create(:user,
                           :home_lat => 12.1, :home_lon => 23.4,
                           :languages => ["en"])
 
       # check that we can fetch our own details as XML with read_prefs
       other_user = create(:user,
                           :home_lat => 12.1, :home_lon => 23.4,
                           :languages => ["en"])
 
       # check that we can fetch our own details as XML with read_prefs

-      get api_user_path(:id => user.id), :headers => bearer_authorization_header(good_token.token)
+      get api_user_path(:id => user.id), :headers => good_auth

       assert_response :success
       assert_equal "application/xml", response.media_type
 
       # check the data that is returned
       assert_response :success
       assert_equal "application/xml", response.media_type
 
       # check the data that is returned

-      check_xml_details(user, true)
+      check_xml_details(user, true, false)

 
       # check that we can fetch a different user's details as XML with read_prefs
 
       # check that we can fetch a different user's details as XML with read_prefs

-      get api_user_path(:id => other_user.id), :headers => bearer_authorization_header(good_token.token)
+      get api_user_path(:id => other_user.id), :headers => good_auth

       assert_response :success
       assert_equal "application/xml", response.media_type
 
       # check the data that is returned
       assert_response :success
       assert_equal "application/xml", response.media_type
 
       # check the data that is returned

-      check_xml_details(other_user, false)
+      check_xml_details(other_user, false, false)

 
       # check that we can fetch our own details as XML without read_prefs
 
       # check that we can fetch our own details as XML without read_prefs

-      get api_user_path(:id => user.id), :headers => bearer_authorization_header(bad_token.token)
+      get api_user_path(:id => user.id), :headers => bad_auth

       assert_response :success
       assert_equal "application/xml", response.media_type
 
       # check the data that is returned
       assert_response :success
       assert_equal "application/xml", response.media_type
 
       # check the data that is returned

-      check_xml_details(user, false)
+      check_xml_details(user, false, false)

 
       # check that we can fetch our own details as JSON with read_prefs
 
       # check that we can fetch our own details as JSON with read_prefs

-      get api_user_path(:id => user.id, :format => "json"), :headers => bearer_authorization_header(good_token.token)
+      get api_user_path(:id => user.id, :format => "json"), :headers => good_auth

       assert_response :success
       assert_equal "application/json", response.media_type
 
       assert_response :success
       assert_equal "application/json", response.media_type
 


@@ -197,10 +119,10 @@ module Api
       assert_not_nil js
 
       # check the data that is returned
       assert_not_nil js
 
       # check the data that is returned

-      check_json_details(js, user, true)
+      check_json_details(js, user, true, false)

 
       # check that we can fetch a different user's details as JSON with read_prefs
 
       # check that we can fetch a different user's details as JSON with read_prefs

-      get api_user_path(:id => other_user.id, :format => "json"), :headers => bearer_authorization_header(good_token.token)
+      get api_user_path(:id => other_user.id, :format => "json"), :headers => good_auth

       assert_response :success
       assert_equal "application/json", response.media_type
 
       assert_response :success
       assert_equal "application/json", response.media_type
 


@@ -209,10 +131,10 @@ module Api
       assert_not_nil js
 
       # check the data that is returned
       assert_not_nil js
 
       # check the data that is returned

-      check_json_details(js, other_user, false)
+      check_json_details(js, other_user, false, false)

 
       # check that we can fetch our own details as JSON without read_prefs
 
       # check that we can fetch our own details as JSON without read_prefs

-      get api_user_path(:id => user.id, :format => "json"), :headers => bearer_authorization_header(bad_token.token)
+      get api_user_path(:id => user.id, :format => "json"), :headers => bad_auth

       assert_response :success
       assert_equal "application/json", response.media_type
 
       assert_response :success
       assert_equal "application/json", response.media_type
 


@@ -221,7 +143,7 @@ module Api
       assert_not_nil js
 
       # check the data that is returned
       assert_not_nil js
 
       # check the data that is returned

-      check_json_details(js, user, false)
+      check_json_details(js, user, false, false)

     end
 
     def test_details
     end
 
     def test_details


@@ -238,16 +160,16 @@ module Api
       assert_response :unauthorized
 
       # check that we get a response when logged in
       assert_response :unauthorized
 
       # check that we get a response when logged in

-      auth_header = basic_authorization_header user.email, "test"
+      auth_header = bearer_authorization_header user

       get user_details_path, :headers => auth_header
       assert_response :success
       assert_equal "application/xml", response.media_type
 
       # check the data that is returned
       get user_details_path, :headers => auth_header
       assert_response :success
       assert_equal "application/xml", response.media_type
 
       # check the data that is returned

-      check_xml_details(user, true)
+      check_xml_details(user, true, false)

 
       # check that data is returned properly in json
 
       # check that data is returned properly in json

-      auth_header = basic_authorization_header user.email, "test"
+      auth_header = bearer_authorization_header user

       get user_details_path(:format => "json"), :headers => auth_header
       assert_response :success
       assert_equal "application/json", response.media_type
       get user_details_path(:format => "json"), :headers => auth_header
       assert_response :success
       assert_equal "application/json", response.media_type


@@ -257,37 +179,43 @@ module Api
       assert_not_nil js
 
       # check the data that is returned
       assert_not_nil js
 
       # check the data that is returned

-      check_json_details(js, user, true)
+      check_json_details(js, user, true, false)

     end
 
     end
 

-    def test_details_oauth1
+    def test_details_oauth2

       user = create(:user,
                     :home_lat => 12.1, :home_lon => 23.4,
                     :languages => ["en"])
       user = create(:user,
                     :home_lat => 12.1, :home_lon => 23.4,
                     :languages => ["en"])

-      good_token = create(:access_token,
-                          :user => user,
-                          :allow_read_prefs => true)
-      bad_token = create(:access_token,
-                         :user => user)
+      good_auth = bearer_authorization_header(user, :scopes => %w[read_prefs])
+      bad_auth = bearer_authorization_header(user, :scopes => %w[])
+      email_auth = bearer_authorization_header(user, :scopes => %w[read_prefs read_email])

 
       # check that we can't fetch details as XML without read_prefs
 
       # check that we can't fetch details as XML without read_prefs

-      signed_get user_details_path, :oauth => { :token => bad_token }
+      get user_details_path, :headers => bad_auth

       assert_response :forbidden
 
       assert_response :forbidden
 

-      # check that we can fetch details as XML
-      signed_get user_details_path, :oauth => { :token => good_token }
+      # check that we can fetch details as XML without read_email
+      get user_details_path, :headers => good_auth
+      assert_response :success
+      assert_equal "application/xml", response.media_type
+
+      # check the data that is returned
+      check_xml_details(user, true, false)
+
+      # check that we can fetch details as XML with read_email
+      get user_details_path, :headers => email_auth

       assert_response :success
       assert_equal "application/xml", response.media_type
 
       # check the data that is returned
       assert_response :success
       assert_equal "application/xml", response.media_type
 
       # check the data that is returned

-      check_xml_details(user, true)
+      check_xml_details(user, true, true)

 
       # check that we can't fetch details as JSON without read_prefs
 
       # check that we can't fetch details as JSON without read_prefs

-      signed_get user_details_path(:format => "json"), :oauth => { :token => bad_token }
+      get user_details_path(:format => "json"), :headers => bad_auth

       assert_response :forbidden
 
       assert_response :forbidden
 

-      # check that we can fetch details as JSON
-      signed_get user_details_path(:format => "json"), :oauth => { :token => good_token }
+      # check that we can fetch details as JSON without read_email
+      get user_details_path(:format => "json"), :headers => good_auth

       assert_response :success
       assert_equal "application/json", response.media_type
 
       assert_response :success
       assert_equal "application/json", response.media_type
 


@@ -296,37 +224,10 @@ module Api
       assert_not_nil js
 
       # check the data that is returned
       assert_not_nil js
 
       # check the data that is returned

-      check_json_details(js, user, true)
-    end
-
-    def test_details_oauth2
-      user = create(:user,
-                    :home_lat => 12.1, :home_lon => 23.4,
-                    :languages => ["en"])
-      good_token = create(:oauth_access_token,
-                          :resource_owner_id => user.id,
-                          :scopes => %w[read_prefs])
-      bad_token = create(:oauth_access_token,
-                         :resource_owner_id => user.id)
-
-      # check that we can't fetch details as XML without read_prefs
-      get user_details_path, :headers => bearer_authorization_header(bad_token.token)
-      assert_response :forbidden
-
-      # check that we can fetch details as XML
-      get user_details_path, :headers => bearer_authorization_header(good_token.token)
-      assert_response :success
-      assert_equal "application/xml", response.media_type
-
-      # check the data that is returned
-      check_xml_details(user, true)
-
-      # check that we can't fetch details as JSON without read_prefs
-      get user_details_path(:format => "json"), :headers => bearer_authorization_header(bad_token.token)
-      assert_response :forbidden
+      check_json_details(js, user, true, false)

 
 

-      # check that we can fetch details as JSON
-      get user_details_path(:format => "json"), :headers => bearer_authorization_header(good_token.token)
+      # check that we can fetch details as JSON with read_email
+      get user_details_path(:format => "json"), :headers => email_auth

       assert_response :success
       assert_equal "application/json", response.media_type
 
       assert_response :success
       assert_equal "application/json", response.media_type
 


@@ -335,7 +236,7 @@ module Api
       assert_not_nil js
 
       # check the data that is returned
       assert_not_nil js
 
       # check the data that is returned

-      check_json_details(js, user, true)
+      check_json_details(js, user, true, true)

     end
 
     def test_index
     end
 
     def test_index


@@ -347,7 +248,7 @@ module Api
       assert_response :success
       assert_equal "application/xml", response.media_type
       assert_select "user", :count => 1 do
       assert_response :success
       assert_equal "application/xml", response.media_type
       assert_select "user", :count => 1 do

-        check_xml_details(user1, false)
+        check_xml_details(user1, false, false)

         assert_select "user[id='#{user2.id}']", :count => 0
         assert_select "user[id='#{user3.id}']", :count => 0
       end
         assert_select "user[id='#{user2.id}']", :count => 0
         assert_select "user[id='#{user3.id}']", :count => 0
       end


@@ -357,7 +258,7 @@ module Api
       assert_equal "application/xml", response.media_type
       assert_select "user", :count => 1 do
         assert_select "user[id='#{user1.id}']", :count => 0
       assert_equal "application/xml", response.media_type
       assert_select "user", :count => 1 do
         assert_select "user[id='#{user1.id}']", :count => 0

-        check_xml_details(user2, false)
+        check_xml_details(user2, false, false)

         assert_select "user[id='#{user3.id}']", :count => 0
       end
 
         assert_select "user[id='#{user3.id}']", :count => 0
       end
 


@@ -365,9 +266,9 @@ module Api
       assert_response :success
       assert_equal "application/xml", response.media_type
       assert_select "user", :count => 2 do
       assert_response :success
       assert_equal "application/xml", response.media_type
       assert_select "user", :count => 2 do

-        check_xml_details(user1, false)
+        check_xml_details(user1, false, false)

         assert_select "user[id='#{user2.id}']", :count => 0
         assert_select "user[id='#{user2.id}']", :count => 0

-        check_xml_details(user3, false)
+        check_xml_details(user3, false, false)

       end
 
       get api_users_path, :params => { :users => user1.id, :format => "json" }
       end
 
       get api_users_path, :params => { :users => user1.id, :format => "json" }


@@ -376,7 +277,7 @@ module Api
       js = ActiveSupport::JSON.decode(@response.body)
       assert_not_nil js
       assert_equal 1, js["users"].count
       js = ActiveSupport::JSON.decode(@response.body)
       assert_not_nil js
       assert_equal 1, js["users"].count

-      check_json_details(js["users"][0], user1, false)
+      check_json_details(js["users"][0], user1, false, false)

 
       get api_users_path, :params => { :users => user2.id, :format => "json" }
       assert_response :success
 
       get api_users_path, :params => { :users => user2.id, :format => "json" }
       assert_response :success


@@ -384,7 +285,7 @@ module Api
       js = ActiveSupport::JSON.decode(@response.body)
       assert_not_nil js
       assert_equal 1, js["users"].count
       js = ActiveSupport::JSON.decode(@response.body)
       assert_not_nil js
       assert_equal 1, js["users"].count

-      check_json_details(js["users"][0], user2, false)
+      check_json_details(js["users"][0], user2, false, false)

 
       get api_users_path, :params => { :users => "#{user1.id},#{user3.id}", :format => "json" }
       assert_response :success
 
       get api_users_path, :params => { :users => "#{user1.id},#{user3.id}", :format => "json" }
       assert_response :success


@@ -392,191 +293,116 @@ module Api
       js = ActiveSupport::JSON.decode(@response.body)
       assert_not_nil js
       assert_equal 2, js["users"].count
       js = ActiveSupport::JSON.decode(@response.body)
       assert_not_nil js
       assert_equal 2, js["users"].count

-      check_json_details(js["users"][0], user1, false)
-      check_json_details(js["users"][1], user3, false)
+      check_json_details(js["users"][0], user1, false, false)
+      check_json_details(js["users"][1], user3, false, false)

 
       get api_users_path, :params => { :users => create(:user, :suspended).id }
 
       get api_users_path, :params => { :users => create(:user, :suspended).id }

-      assert_response :not_found
+      assert_response :success
+      assert_equal "application/xml", response.media_type
+      assert_select "user", :count => 0

 
       get api_users_path, :params => { :users => create(:user, :deleted).id }
 
       get api_users_path, :params => { :users => create(:user, :deleted).id }

-      assert_response :not_found
+      assert_response :success
+      assert_equal "application/xml", response.media_type
+      assert_select "user", :count => 0

 
       get api_users_path, :params => { :users => 0 }
 
       get api_users_path, :params => { :users => 0 }

-      assert_response :not_found
+      assert_response :success
+      assert_equal "application/xml", response.media_type
+      assert_select "user", :count => 0

     end
 
     end
 

-    def test_index_oauth1
+    def test_index_oauth2

       user1 = create(:user, :description => "test1", :terms_agreed => Date.yesterday)
       user2 = create(:user, :description => "test2", :terms_agreed => Date.yesterday)
       user3 = create(:user, :description => "test3", :terms_agreed => Date.yesterday)
       user1 = create(:user, :description => "test1", :terms_agreed => Date.yesterday)
       user2 = create(:user, :description => "test2", :terms_agreed => Date.yesterday)
       user3 = create(:user, :description => "test3", :terms_agreed => Date.yesterday)

-      good_token = create(:access_token, :user => user1, :allow_read_prefs => true)
-      bad_token = create(:access_token, :user => user1)
+      good_auth = bearer_authorization_header(user1, :scopes => %w[read_prefs])
+      bad_auth = bearer_authorization_header(user1, :scopes => %w[])

 
 

-      signed_get api_users_path, :params => { :users => user1.id }, :oauth => { :token => good_token }
+      get api_users_path, :params => { :users => user1.id }, :headers => good_auth

       assert_response :success
       assert_equal "application/xml", response.media_type
       assert_select "user", :count => 1 do
       assert_response :success
       assert_equal "application/xml", response.media_type
       assert_select "user", :count => 1 do

-        check_xml_details(user1, true)
+        check_xml_details(user1, true, false)

         assert_select "user[id='#{user2.id}']", :count => 0
         assert_select "user[id='#{user3.id}']", :count => 0
       end
 
         assert_select "user[id='#{user2.id}']", :count => 0
         assert_select "user[id='#{user3.id}']", :count => 0
       end
 

-      signed_get api_users_path, :params => { :users => user2.id }, :oauth => { :token => good_token }
+      get api_users_path, :params => { :users => user2.id }, :headers => good_auth

       assert_response :success
       assert_equal "application/xml", response.media_type
       assert_select "user", :count => 1 do
         assert_select "user[id='#{user1.id}']", :count => 0
       assert_response :success
       assert_equal "application/xml", response.media_type
       assert_select "user", :count => 1 do
         assert_select "user[id='#{user1.id}']", :count => 0

-        check_xml_details(user2, false)
+        check_xml_details(user2, false, false)

         assert_select "user[id='#{user3.id}']", :count => 0
       end
 
         assert_select "user[id='#{user3.id}']", :count => 0
       end
 

-      signed_get api_users_path, :params => { :users => "#{user1.id},#{user3.id}" }, :oauth => { :token => good_token }
+      get api_users_path, :params => { :users => "#{user1.id},#{user3.id}" }, :headers => good_auth

       assert_response :success
       assert_equal "application/xml", response.media_type
       assert_select "user", :count => 2 do
       assert_response :success
       assert_equal "application/xml", response.media_type
       assert_select "user", :count => 2 do

-        check_xml_details(user1, true)
+        check_xml_details(user1, true, false)

         assert_select "user[id='#{user2.id}']", :count => 0
         assert_select "user[id='#{user2.id}']", :count => 0

-        check_xml_details(user3, false)
+        check_xml_details(user3, false, false)

       end
 
       end
 

-      signed_get api_users_path, :params => { :users => "#{user1.id},#{user3.id}" }, :oauth => { :token => bad_token }
+      get api_users_path, :params => { :users => "#{user1.id},#{user3.id}" }, :headers => bad_auth

       assert_response :success
       assert_equal "application/xml", response.media_type
       assert_select "user", :count => 2 do
       assert_response :success
       assert_equal "application/xml", response.media_type
       assert_select "user", :count => 2 do

-        check_xml_details(user1, false)
+        check_xml_details(user1, false, false)

         assert_select "user[id='#{user2.id}']", :count => 0
         assert_select "user[id='#{user2.id}']", :count => 0

-        check_xml_details(user3, false)
+        check_xml_details(user3, false, false)

       end
 
       end
 

-      signed_get api_users_path, :params => { :users => user1.id, :format => "json" }, :oauth => { :token => good_token }
+      get api_users_path, :params => { :users => user1.id, :format => "json" }, :headers => good_auth

       assert_response :success
       assert_equal "application/json", response.media_type
       js = ActiveSupport::JSON.decode(@response.body)
       assert_not_nil js
       assert_equal 1, js["users"].count
       assert_response :success
       assert_equal "application/json", response.media_type
       js = ActiveSupport::JSON.decode(@response.body)
       assert_not_nil js
       assert_equal 1, js["users"].count

-      check_json_details(js["users"][0], user1, true)
+      check_json_details(js["users"][0], user1, true, false)

 
 

-      signed_get api_users_path, :params => { :users => user2.id, :format => "json" }, :oauth => { :token => good_token }
+      get api_users_path, :params => { :users => user2.id, :format => "json" }, :headers => good_auth

       assert_response :success
       assert_equal "application/json", response.media_type
       js = ActiveSupport::JSON.decode(@response.body)
       assert_not_nil js
       assert_equal 1, js["users"].count
       assert_response :success
       assert_equal "application/json", response.media_type
       js = ActiveSupport::JSON.decode(@response.body)
       assert_not_nil js
       assert_equal 1, js["users"].count

-      check_json_details(js["users"][0], user2, false)
+      check_json_details(js["users"][0], user2, false, false)

 
 

-      signed_get api_users_path, :params => { :users => "#{user1.id},#{user3.id}", :format => "json" }, :oauth => { :token => good_token }
+      get api_users_path, :params => { :users => "#{user1.id},#{user3.id}", :format => "json" }, :headers => good_auth

       assert_response :success
       assert_equal "application/json", response.media_type
       js = ActiveSupport::JSON.decode(@response.body)
       assert_not_nil js
       assert_equal 2, js["users"].count
       assert_response :success
       assert_equal "application/json", response.media_type
       js = ActiveSupport::JSON.decode(@response.body)
       assert_not_nil js
       assert_equal 2, js["users"].count

-      check_json_details(js["users"][0], user1, true)
-      check_json_details(js["users"][1], user3, false)
+      check_json_details(js["users"][0], user1, true, false)
+      check_json_details(js["users"][1], user3, false, false)

 
 

-      signed_get api_users_path, :params => { :users => "#{user1.id},#{user3.id}", :format => "json" }, :oauth => { :token => bad_token }
+      get api_users_path, :params => { :users => "#{user1.id},#{user3.id}", :format => "json" }, :headers => bad_auth

       assert_response :success
       assert_equal "application/json", response.media_type
       js = ActiveSupport::JSON.decode(@response.body)
       assert_not_nil js
       assert_equal 2, js["users"].count
       assert_response :success
       assert_equal "application/json", response.media_type
       js = ActiveSupport::JSON.decode(@response.body)
       assert_not_nil js
       assert_equal 2, js["users"].count

-      check_json_details(js["users"][0], user1, false)
-      check_json_details(js["users"][1], user3, false)
-
-      signed_get api_users_path, :params => { :users => create(:user, :suspended).id }, :oauth => { :token => good_token }
-      assert_response :not_found
-
-      signed_get api_users_path, :params => { :users => create(:user, :deleted).id }, :oauth => { :token => good_token }
-      assert_response :not_found
+      check_json_details(js["users"][0], user1, false, false)
+      check_json_details(js["users"][1], user3, false, false)

 
 

-      signed_get api_users_path, :params => { :users => 0 }, :oauth => { :token => good_token }
-      assert_response :not_found
-    end
-
-    def test_index_oauth2
-      user1 = create(:user, :description => "test1", :terms_agreed => Date.yesterday)
-      user2 = create(:user, :description => "test2", :terms_agreed => Date.yesterday)
-      user3 = create(:user, :description => "test3", :terms_agreed => Date.yesterday)
-      good_token = create(:oauth_access_token, :resource_owner_id => user1.id, :scopes => %w[read_prefs])
-      bad_token = create(:oauth_access_token, :resource_owner_id => user1.id, :scopes => %w[])
-
-      get api_users_path, :params => { :users => user1.id }, :headers => bearer_authorization_header(good_token.token)
+      get api_users_path, :params => { :users => create(:user, :suspended).id }, :headers => good_auth

       assert_response :success
       assert_equal "application/xml", response.media_type
       assert_response :success
       assert_equal "application/xml", response.media_type

-      assert_select "user", :count => 1 do
-        check_xml_details(user1, true)
-        assert_select "user[id='#{user2.id}']", :count => 0
-        assert_select "user[id='#{user3.id}']", :count => 0
-      end
+      assert_select "user", :count => 0

 
 

-      get api_users_path, :params => { :users => user2.id }, :headers => bearer_authorization_header(good_token.token)
+      get api_users_path, :params => { :users => create(:user, :deleted).id }, :headers => good_auth

       assert_response :success
       assert_equal "application/xml", response.media_type
       assert_response :success
       assert_equal "application/xml", response.media_type

-      assert_select "user", :count => 1 do
-        assert_select "user[id='#{user1.id}']", :count => 0
-        check_xml_details(user2, false)
-        assert_select "user[id='#{user3.id}']", :count => 0
-      end
+      assert_select "user", :count => 0

 
 

-      get api_users_path, :params => { :users => "#{user1.id},#{user3.id}" }, :headers => bearer_authorization_header(good_token.token)
+      get api_users_path, :params => { :users => 0 }, :headers => good_auth

       assert_response :success
       assert_equal "application/xml", response.media_type
       assert_response :success
       assert_equal "application/xml", response.media_type

-      assert_select "user", :count => 2 do
-        check_xml_details(user1, true)
-        assert_select "user[id='#{user2.id}']", :count => 0
-        check_xml_details(user3, false)
-      end
-
-      get api_users_path, :params => { :users => "#{user1.id},#{user3.id}" }, :headers => bearer_authorization_header(bad_token.token)
-      assert_response :success
-      assert_equal "application/xml", response.media_type
-      assert_select "user", :count => 2 do
-        check_xml_details(user1, false)
-        assert_select "user[id='#{user2.id}']", :count => 0
-        check_xml_details(user3, false)
-      end
-
-      get api_users_path, :params => { :users => user1.id, :format => "json" }, :headers => bearer_authorization_header(good_token.token)
-      assert_response :success
-      assert_equal "application/json", response.media_type
-      js = ActiveSupport::JSON.decode(@response.body)
-      assert_not_nil js
-      assert_equal 1, js["users"].count
-      check_json_details(js["users"][0], user1, true)
-
-      get api_users_path, :params => { :users => user2.id, :format => "json" }, :headers => bearer_authorization_header(good_token.token)
-      assert_response :success
-      assert_equal "application/json", response.media_type
-      js = ActiveSupport::JSON.decode(@response.body)
-      assert_not_nil js
-      assert_equal 1, js["users"].count
-      check_json_details(js["users"][0], user2, false)
-
-      get api_users_path, :params => { :users => "#{user1.id},#{user3.id}", :format => "json" }, :headers => bearer_authorization_header(good_token.token)
-      assert_response :success
-      assert_equal "application/json", response.media_type
-      js = ActiveSupport::JSON.decode(@response.body)
-      assert_not_nil js
-      assert_equal 2, js["users"].count
-      check_json_details(js["users"][0], user1, true)
-      check_json_details(js["users"][1], user3, false)
-
-      get api_users_path, :params => { :users => "#{user1.id},#{user3.id}", :format => "json" }, :headers => bearer_authorization_header(bad_token.token)
-      assert_response :success
-      assert_equal "application/json", response.media_type
-      js = ActiveSupport::JSON.decode(@response.body)
-      assert_not_nil js
-      assert_equal 2, js["users"].count
-      check_json_details(js["users"][0], user1, false)
-      check_json_details(js["users"][1], user3, false)
-
-      get api_users_path, :params => { :users => create(:user, :suspended).id }, :headers => bearer_authorization_header(good_token.token)
-      assert_response :not_found
-
-      get api_users_path, :params => { :users => create(:user, :deleted).id }, :headers => bearer_authorization_header(good_token.token)
-      assert_response :not_found
-
-      get api_users_path, :params => { :users => 0 }, :headers => bearer_authorization_header(good_token.token)
-      assert_response :not_found
+      assert_select "user", :count => 0

     end
 
     def test_gpx_files
     end
 
     def test_gpx_files


@@ -592,7 +418,7 @@ module Api
       assert_response :unauthorized
 
       # check that we get a response when logged in
       assert_response :unauthorized
 
       # check that we get a response when logged in

-      auth_header = basic_authorization_header user.email, "test"
+      auth_header = bearer_authorization_header user

       get user_gpx_files_path, :headers => auth_header
       assert_response :success
       assert_equal "application/xml", response.media_type
       get user_gpx_files_path, :headers => auth_header
       assert_response :success
       assert_equal "application/xml", response.media_type


@@ -608,7 +434,7 @@ module Api
 
     private
 
 
     private
 

-    def check_xml_details(user, include_private)
+    def check_xml_details(user, include_private, include_email)

       assert_select "user[id='#{user.id}']", :count => 1 do
         assert_select "description", :count => 1, :text => user.description
 
       assert_select "user[id='#{user.id}']", :count => 1 do
         assert_select "description", :count => 1, :text => user.description
 


@@ -678,13 +504,19 @@ module Api
           assert_select "languages", :count => 0
           assert_select "messages", :count => 0
         end
           assert_select "languages", :count => 0
           assert_select "messages", :count => 0
         end

+
+        if include_email
+          assert_select "email", :count => 1, :text => user.email
+        else
+          assert_select "email", :count => 0
+        end

       end
     end
 
       end
     end
 

-    def check_json_details(js, user, include_private)
+    def check_json_details(js, user, include_private, include_email)

       assert_equal user.id, js["user"]["id"]
       assert_equal user.description, js["user"]["description"]
       assert_equal user.id, js["user"]["id"]
       assert_equal user.description, js["user"]["description"]

-      assert js["user"]["contributor_terms"]["agreed"]
+      assert_operator js["user"]["contributor_terms"], :[], "agreed"

 
       if include_private
         assert_not js["user"]["contributor_terms"]["pd"]
 
       if include_private
         assert_not js["user"]["contributor_terms"]["pd"]


@@ -721,6 +553,12 @@ module Api
       else
         assert_nil js["user"]["messages"]
       end
       else
         assert_nil js["user"]["messages"]
       end

+
+      if include_email
+        assert_equal user.email, js["user"]["email"]
+      else
+        assert_nil js["user"]["email"]
+      end

     end
   end
 end
     end
   end
 end