Merge remote-tracking branch 'upstream/pull/5731'

[rails.git] / test / abilities / api_capability_test.rb

diff --git a/test/abilities/api_capability_test.rb b/test/abilities/api_capability_test.rb
index 8a98f29e0e6274c6c871e57bbc9b697a1aa6666a..0945b6290045a444b6c35e163a968819fd6a88cc 100644 (file)
--- a/test/abilities/api_capability_test.rb
+++ b/test/abilities/api_capability_test.rb
@@ -2,132 +2,124 @@
 
 require "test_helper"
 
 
 require "test_helper"
 

-class ApiCapabilityTest < ActiveSupport::TestCase
-  def tokens(*toks)
-    AccessToken.new do |token|
-      toks.each do |t|
-        token.public_send("#{t}=", true)
-      end
-    end
+class ChangesetCommentApiCapabilityTest < ActiveSupport::TestCase
+  test "as a normal user without scopes" do
+    user = create(:user)
+    scopes = Set.new
+    ability = ApiAbility.new user, scopes
+
+    assert ability.cannot? :create, ChangesetComment
+    assert ability.cannot? :create, :changeset_comment_visibility
+    assert ability.cannot? :destroy, :changeset_comment_visibility

   end
   end

-end

 
 

-class ChangesetCommentApiCapabilityTest < ApiCapabilityTest
-  test "as a normal user with permissionless token" do
-    token = create(:access_token)
-    capability = ApiCapability.new token
+  test "as a normal user with write_changeset_comments scope" do
+    user = create(:user)
+    scopes = Set.new %w[write_changeset_comments]
+    ability = ApiAbility.new user, scopes

 
 

-    [:create, :destroy, :restore].each do |action|
-      assert capability.cannot? action, ChangesetComment
-    end
+    assert ability.can? :create, ChangesetComment
+    assert ability.cannot? :create, :changeset_comment_visibility
+    assert ability.cannot? :destroy, :changeset_comment_visibility

   end
 
   end
 

-  test "as a normal user with allow_write_api token" do
-    token = create(:access_token, :allow_write_api => true)
-    capability = ApiCapability.new token
-
-    [:destroy, :restore].each do |action|
-      assert capability.cannot? action, ChangesetComment
-    end
+  test "as a moderator without scopes" do
+    user = create(:moderator_user)
+    scopes = Set.new
+    ability = ApiAbility.new user, scopes

 
 

-    [:create].each do |action|
-      assert capability.can? action, ChangesetComment
-    end
+    assert ability.cannot? :create, ChangesetComment
+    assert ability.cannot? :create, :changeset_comment_visibility
+    assert ability.cannot? :destroy, :changeset_comment_visibility

   end
 
   end
 

-  test "as a moderator with permissionless token" do
-    token = create(:access_token, :user => create(:moderator_user))
-    capability = ApiCapability.new token
+  test "as a moderator with write_changeset_comments scope" do
+    user = create(:moderator_user)
+    scopes = Set.new %w[write_changeset_comments]
+    ability = ApiAbility.new user, scopes

 
 

-    [:create, :destroy, :restore].each do |action|
-      assert capability.cannot? action, ChangesetComment
-    end
-  end
-
-  test "as a moderator with allow_write_api token" do
-    token = create(:access_token, :user => create(:moderator_user), :allow_write_api => true)
-    capability = ApiCapability.new token
-
-    [:create, :destroy, :restore].each do |action|
-      assert capability.can? action, ChangesetComment
-    end
+    assert ability.can? :create, ChangesetComment
+    assert ability.can? :create, :changeset_comment_visibility
+    assert ability.can? :destroy, :changeset_comment_visibility

   end
 end
 
   end
 end
 

-class NoteApiCapabilityTest < ApiCapabilityTest
-  test "as a normal user with permissionless token" do
-    token = create(:access_token)
-    capability = ApiCapability.new token
+class NoteApiCapabilityTest < ActiveSupport::TestCase
+  test "as a normal user without scopes" do
+    user = create(:user)
+    scopes = Set.new
+    ability = ApiAbility.new user, scopes

 
     [:create, :comment, :close, :reopen, :destroy].each do |action|
 
     [:create, :comment, :close, :reopen, :destroy].each do |action|

-      assert capability.cannot? action, Note
+      assert ability.cannot? action, Note

     end
   end
 
     end
   end
 

-  test "as a normal user with allow_write_notes token" do
-    token = create(:access_token, :allow_write_notes => true)
-    capability = ApiCapability.new token
+  test "as a normal user with write_notes scope" do
+    user = create(:user)
+    scopes = Set.new %w[write_notes]
+    ability = ApiAbility.new user, scopes

 
     [:destroy].each do |action|
 
     [:destroy].each do |action|

-      assert capability.cannot? action, Note
+      assert ability.cannot? action, Note

     end
 
     [:create, :comment, :close, :reopen].each do |action|
     end
 
     [:create, :comment, :close, :reopen].each do |action|

-      assert capability.can? action, Note
+      assert ability.can? action, Note

     end
   end
 
     end
   end
 

-  test "as a moderator with permissionless token" do
-    token = create(:access_token, :user => create(:moderator_user))
-    capability = ApiCapability.new token
+  test "as a moderator without scopes" do
+    user = create(:moderator_user)
+    scopes = Set.new
+    ability = ApiAbility.new user, scopes

 
     [:destroy].each do |action|
 
     [:destroy].each do |action|

-      assert capability.cannot? action, Note
+      assert ability.cannot? action, Note

     end
   end
 
     end
   end
 

-  test "as a moderator with allow_write_notes token" do
-    token = create(:access_token, :user => create(:moderator_user), :allow_write_notes => true)
-    capability = ApiCapability.new token
+  test "as a moderator with write_notes scope" do
+    user = create(:moderator_user)
+    scopes = Set.new %w[write_notes]
+    ability = ApiAbility.new user, scopes

 
     [:destroy].each do |action|
 
     [:destroy].each do |action|

-      assert capability.can? action, Note
+      assert ability.can? action, Note

     end
   end
 end
 
     end
   end
 end
 

-class UserApiCapabilityTest < ApiCapabilityTest
+class UserApiCapabilityTest < ActiveSupport::TestCase

   test "user preferences" do
   test "user preferences" do

-    # a user with no tokens
-    capability = ApiCapability.new nil
-    [:index, :show, :update_all, :update, :destroy].each do |act|
-      assert capability.cannot? act, UserPreference
-    end
-
-    # A user with empty tokens
-    capability = ApiCapability.new tokens
+    user = create(:user)
+    scopes = Set.new
+    ability = ApiAbility.new user, scopes

 
     [:index, :show, :update_all, :update, :destroy].each do |act|
 
     [:index, :show, :update_all, :update, :destroy].each do |act|

-      assert capability.cannot? act, UserPreference
+      assert ability.cannot? act, UserPreference

     end
 
     end
 

-    capability = ApiCapability.new tokens(:allow_read_prefs)
+    scopes = Set.new %w[read_prefs]
+    ability = ApiAbility.new user, scopes

 
     [:update_all, :update, :destroy].each do |act|
 
     [:update_all, :update, :destroy].each do |act|

-      assert capability.cannot? act, UserPreference
+      assert ability.cannot? act, UserPreference

     end
 
     [:index, :show].each do |act|
     end
 
     [:index, :show].each do |act|

-      assert capability.can? act, UserPreference
+      assert ability.can? act, UserPreference

     end
 
     end
 

-    capability = ApiCapability.new tokens(:allow_write_prefs)
+    scopes = Set.new %w[write_prefs]
+    ability = ApiAbility.new user, scopes
+

     [:index, :show].each do |act|
     [:index, :show].each do |act|

-      assert capability.cannot? act, UserPreference
+      assert ability.cannot? act, UserPreference

     end
 
     [:update_all, :update, :destroy].each do |act|
     end
 
     [:update_all, :update, :destroy].each do |act|

-      assert capability.can? act, UserPreference
+      assert ability.can? act, UserPreference

     end
   end
 end
     end
   end
 end