X-Git-Url: https://git.openstreetmap.org./rails.git/blobdiff_plain/e91c02f2ceb2b72a77846a0c31f5eca22b9b0a65..a35f360d5eb96fc553afaf17818a3ace0665a03d:/test/controllers/api/users_controller_test.rb?ds=sidebyside diff --git a/test/controllers/api/users_controller_test.rb b/test/controllers/api/users_controller_test.rb index d0d1e0dcf..874d91771 100644 --- a/test/controllers/api/users_controller_test.rb +++ b/test/controllers/api/users_controller_test.rb @@ -48,7 +48,7 @@ module Api assert_equal "application/xml", response.media_type # check the data that is returned - check_xml_details(user, false) + check_xml_details(user, false, false) # check that a suspended user is not returned get api_user_path(:id => create(:user, :suspended).id) @@ -72,123 +72,45 @@ module Api assert_not_nil js # check the data that is returned - check_json_details(js, user, false) - end - - def test_show_oauth1 - user = create(:user, - :home_lat => 12.1, :home_lon => 23.4, - :languages => ["en"]) - good_token = create(:access_token, - :user => user, - :allow_read_prefs => true) - bad_token = create(:access_token, - :user => user) - other_user = create(:user, - :home_lat => 12.1, :home_lon => 23.4, - :languages => ["en"]) - - # check that we can fetch our own details as XML with read_prefs - signed_get api_user_path(:id => user.id), :oauth => { :token => good_token } - assert_response :success - assert_equal "application/xml", response.media_type - - # check the data that is returned - check_xml_details(user, true) - - # check that we can fetch a different user's details as XML with read_prefs - signed_get api_user_path(:id => other_user.id), :oauth => { :token => good_token } - assert_response :success - assert_equal "application/xml", response.media_type - - # check the data that is returned - check_xml_details(other_user, false) - - # check that we can fetch our own details as XML without read_prefs - signed_get api_user_path(:id => user.id), :oauth => { :token => bad_token } - assert_response :success - assert_equal "application/xml", response.media_type - - # check the data that is returned - check_xml_details(user, false) - - # check that we can fetch our own details as JSON with read_prefs - signed_get api_user_path(:id => user.id, :format => "json"), :oauth => { :token => good_token } - assert_response :success - assert_equal "application/json", response.media_type - - # parse the response - js = ActiveSupport::JSON.decode(@response.body) - assert_not_nil js - - # check the data that is returned - check_json_details(js, user, true) - - # check that we can fetch a different user's details as JSON with read_prefs - signed_get api_user_path(:id => other_user.id, :format => "json"), :oauth => { :token => good_token } - assert_response :success - assert_equal "application/json", response.media_type - - # parse the response - js = ActiveSupport::JSON.decode(@response.body) - assert_not_nil js - - # check the data that is returned - check_json_details(js, other_user, false) - - # check that we can fetch our own details as JSON without read_prefs - signed_get api_user_path(:id => other_user.id, :format => "json"), :oauth => { :token => bad_token } - assert_response :success - assert_equal "application/json", response.media_type - - # parse the response - js = ActiveSupport::JSON.decode(@response.body) - assert_not_nil js - - # check the data that is returned - check_json_details(js, other_user, false) + check_json_details(js, user, false, false) end def test_show_oauth2 user = create(:user, :home_lat => 12.1, :home_lon => 23.4, :languages => ["en"]) - good_token = create(:oauth_access_token, - :resource_owner_id => user.id, - :scopes => %w[read_prefs]) - bad_token = create(:oauth_access_token, - :resource_owner_id => user.id, - :scopes => %w[]) + good_auth = bearer_authorization_header(user, :scopes => %w[read_prefs]) + bad_auth = bearer_authorization_header(user, :scopes => %w[]) other_user = create(:user, :home_lat => 12.1, :home_lon => 23.4, :languages => ["en"]) # check that we can fetch our own details as XML with read_prefs - get api_user_path(:id => user.id), :headers => bearer_authorization_header(good_token.token) + get api_user_path(:id => user.id), :headers => good_auth assert_response :success assert_equal "application/xml", response.media_type # check the data that is returned - check_xml_details(user, true) + check_xml_details(user, true, false) # check that we can fetch a different user's details as XML with read_prefs - get api_user_path(:id => other_user.id), :headers => bearer_authorization_header(good_token.token) + get api_user_path(:id => other_user.id), :headers => good_auth assert_response :success assert_equal "application/xml", response.media_type # check the data that is returned - check_xml_details(other_user, false) + check_xml_details(other_user, false, false) # check that we can fetch our own details as XML without read_prefs - get api_user_path(:id => user.id), :headers => bearer_authorization_header(bad_token.token) + get api_user_path(:id => user.id), :headers => bad_auth assert_response :success assert_equal "application/xml", response.media_type # check the data that is returned - check_xml_details(user, false) + check_xml_details(user, false, false) # check that we can fetch our own details as JSON with read_prefs - get api_user_path(:id => user.id, :format => "json"), :headers => bearer_authorization_header(good_token.token) + get api_user_path(:id => user.id, :format => "json"), :headers => good_auth assert_response :success assert_equal "application/json", response.media_type @@ -197,10 +119,10 @@ module Api assert_not_nil js # check the data that is returned - check_json_details(js, user, true) + check_json_details(js, user, true, false) # check that we can fetch a different user's details as JSON with read_prefs - get api_user_path(:id => other_user.id, :format => "json"), :headers => bearer_authorization_header(good_token.token) + get api_user_path(:id => other_user.id, :format => "json"), :headers => good_auth assert_response :success assert_equal "application/json", response.media_type @@ -209,10 +131,10 @@ module Api assert_not_nil js # check the data that is returned - check_json_details(js, other_user, false) + check_json_details(js, other_user, false, false) # check that we can fetch our own details as JSON without read_prefs - get api_user_path(:id => user.id, :format => "json"), :headers => bearer_authorization_header(bad_token.token) + get api_user_path(:id => user.id, :format => "json"), :headers => bad_auth assert_response :success assert_equal "application/json", response.media_type @@ -221,7 +143,7 @@ module Api assert_not_nil js # check the data that is returned - check_json_details(js, user, false) + check_json_details(js, user, false, false) end def test_details @@ -238,16 +160,16 @@ module Api assert_response :unauthorized # check that we get a response when logged in - auth_header = basic_authorization_header user.email, "test" + auth_header = bearer_authorization_header user get user_details_path, :headers => auth_header assert_response :success assert_equal "application/xml", response.media_type # check the data that is returned - check_xml_details(user, true) + check_xml_details(user, true, false) # check that data is returned properly in json - auth_header = basic_authorization_header user.email, "test" + auth_header = bearer_authorization_header user get user_details_path(:format => "json"), :headers => auth_header assert_response :success assert_equal "application/json", response.media_type @@ -257,37 +179,43 @@ module Api assert_not_nil js # check the data that is returned - check_json_details(js, user, true) + check_json_details(js, user, true, false) end - def test_details_oauth1 + def test_details_oauth2 user = create(:user, :home_lat => 12.1, :home_lon => 23.4, :languages => ["en"]) - good_token = create(:access_token, - :user => user, - :allow_read_prefs => true) - bad_token = create(:access_token, - :user => user) + good_auth = bearer_authorization_header(user, :scopes => %w[read_prefs]) + bad_auth = bearer_authorization_header(user, :scopes => %w[]) + email_auth = bearer_authorization_header(user, :scopes => %w[read_prefs read_email]) # check that we can't fetch details as XML without read_prefs - signed_get user_details_path, :oauth => { :token => bad_token } + get user_details_path, :headers => bad_auth assert_response :forbidden - # check that we can fetch details as XML - signed_get user_details_path, :oauth => { :token => good_token } + # check that we can fetch details as XML without read_email + get user_details_path, :headers => good_auth + assert_response :success + assert_equal "application/xml", response.media_type + + # check the data that is returned + check_xml_details(user, true, false) + + # check that we can fetch details as XML with read_email + get user_details_path, :headers => email_auth assert_response :success assert_equal "application/xml", response.media_type # check the data that is returned - check_xml_details(user, true) + check_xml_details(user, true, true) # check that we can't fetch details as JSON without read_prefs - signed_get user_details_path(:format => "json"), :oauth => { :token => bad_token } + get user_details_path(:format => "json"), :headers => bad_auth assert_response :forbidden - # check that we can fetch details as JSON - signed_get user_details_path(:format => "json"), :oauth => { :token => good_token } + # check that we can fetch details as JSON without read_email + get user_details_path(:format => "json"), :headers => good_auth assert_response :success assert_equal "application/json", response.media_type @@ -296,37 +224,10 @@ module Api assert_not_nil js # check the data that is returned - check_json_details(js, user, true) - end - - def test_details_oauth2 - user = create(:user, - :home_lat => 12.1, :home_lon => 23.4, - :languages => ["en"]) - good_token = create(:oauth_access_token, - :resource_owner_id => user.id, - :scopes => %w[read_prefs]) - bad_token = create(:oauth_access_token, - :resource_owner_id => user.id) - - # check that we can't fetch details as XML without read_prefs - get user_details_path, :headers => bearer_authorization_header(bad_token.token) - assert_response :forbidden - - # check that we can fetch details as XML - get user_details_path, :headers => bearer_authorization_header(good_token.token) - assert_response :success - assert_equal "application/xml", response.media_type - - # check the data that is returned - check_xml_details(user, true) - - # check that we can't fetch details as JSON without read_prefs - get user_details_path(:format => "json"), :headers => bearer_authorization_header(bad_token.token) - assert_response :forbidden + check_json_details(js, user, true, false) - # check that we can fetch details as JSON - get user_details_path(:format => "json"), :headers => bearer_authorization_header(good_token.token) + # check that we can fetch details as JSON with read_email + get user_details_path(:format => "json"), :headers => email_auth assert_response :success assert_equal "application/json", response.media_type @@ -335,7 +236,7 @@ module Api assert_not_nil js # check the data that is returned - check_json_details(js, user, true) + check_json_details(js, user, true, true) end def test_index @@ -347,7 +248,7 @@ module Api assert_response :success assert_equal "application/xml", response.media_type assert_select "user", :count => 1 do - check_xml_details(user1, false) + check_xml_details(user1, false, false) assert_select "user[id='#{user2.id}']", :count => 0 assert_select "user[id='#{user3.id}']", :count => 0 end @@ -357,7 +258,7 @@ module Api assert_equal "application/xml", response.media_type assert_select "user", :count => 1 do assert_select "user[id='#{user1.id}']", :count => 0 - check_xml_details(user2, false) + check_xml_details(user2, false, false) assert_select "user[id='#{user3.id}']", :count => 0 end @@ -365,9 +266,9 @@ module Api assert_response :success assert_equal "application/xml", response.media_type assert_select "user", :count => 2 do - check_xml_details(user1, false) + check_xml_details(user1, false, false) assert_select "user[id='#{user2.id}']", :count => 0 - check_xml_details(user3, false) + check_xml_details(user3, false, false) end get api_users_path, :params => { :users => user1.id, :format => "json" } @@ -376,7 +277,7 @@ module Api js = ActiveSupport::JSON.decode(@response.body) assert_not_nil js assert_equal 1, js["users"].count - check_json_details(js["users"][0], user1, false) + check_json_details(js["users"][0], user1, false, false) get api_users_path, :params => { :users => user2.id, :format => "json" } assert_response :success @@ -384,7 +285,7 @@ module Api js = ActiveSupport::JSON.decode(@response.body) assert_not_nil js assert_equal 1, js["users"].count - check_json_details(js["users"][0], user2, false) + check_json_details(js["users"][0], user2, false, false) get api_users_path, :params => { :users => "#{user1.id},#{user3.id}", :format => "json" } assert_response :success @@ -392,191 +293,116 @@ module Api js = ActiveSupport::JSON.decode(@response.body) assert_not_nil js assert_equal 2, js["users"].count - check_json_details(js["users"][0], user1, false) - check_json_details(js["users"][1], user3, false) + check_json_details(js["users"][0], user1, false, false) + check_json_details(js["users"][1], user3, false, false) get api_users_path, :params => { :users => create(:user, :suspended).id } - assert_response :not_found + assert_response :success + assert_equal "application/xml", response.media_type + assert_select "user", :count => 0 get api_users_path, :params => { :users => create(:user, :deleted).id } - assert_response :not_found + assert_response :success + assert_equal "application/xml", response.media_type + assert_select "user", :count => 0 get api_users_path, :params => { :users => 0 } - assert_response :not_found + assert_response :success + assert_equal "application/xml", response.media_type + assert_select "user", :count => 0 end - def test_index_oauth1 + def test_index_oauth2 user1 = create(:user, :description => "test1", :terms_agreed => Date.yesterday) user2 = create(:user, :description => "test2", :terms_agreed => Date.yesterday) user3 = create(:user, :description => "test3", :terms_agreed => Date.yesterday) - good_token = create(:access_token, :user => user1, :allow_read_prefs => true) - bad_token = create(:access_token, :user => user1) + good_auth = bearer_authorization_header(user1, :scopes => %w[read_prefs]) + bad_auth = bearer_authorization_header(user1, :scopes => %w[]) - signed_get api_users_path, :params => { :users => user1.id }, :oauth => { :token => good_token } + get api_users_path, :params => { :users => user1.id }, :headers => good_auth assert_response :success assert_equal "application/xml", response.media_type assert_select "user", :count => 1 do - check_xml_details(user1, true) + check_xml_details(user1, true, false) assert_select "user[id='#{user2.id}']", :count => 0 assert_select "user[id='#{user3.id}']", :count => 0 end - signed_get api_users_path, :params => { :users => user2.id }, :oauth => { :token => good_token } + get api_users_path, :params => { :users => user2.id }, :headers => good_auth assert_response :success assert_equal "application/xml", response.media_type assert_select "user", :count => 1 do assert_select "user[id='#{user1.id}']", :count => 0 - check_xml_details(user2, false) + check_xml_details(user2, false, false) assert_select "user[id='#{user3.id}']", :count => 0 end - signed_get api_users_path, :params => { :users => "#{user1.id},#{user3.id}" }, :oauth => { :token => good_token } + get api_users_path, :params => { :users => "#{user1.id},#{user3.id}" }, :headers => good_auth assert_response :success assert_equal "application/xml", response.media_type assert_select "user", :count => 2 do - check_xml_details(user1, true) + check_xml_details(user1, true, false) assert_select "user[id='#{user2.id}']", :count => 0 - check_xml_details(user3, false) + check_xml_details(user3, false, false) end - signed_get api_users_path, :params => { :users => "#{user1.id},#{user3.id}" }, :oauth => { :token => bad_token } + get api_users_path, :params => { :users => "#{user1.id},#{user3.id}" }, :headers => bad_auth assert_response :success assert_equal "application/xml", response.media_type assert_select "user", :count => 2 do - check_xml_details(user1, false) + check_xml_details(user1, false, false) assert_select "user[id='#{user2.id}']", :count => 0 - check_xml_details(user3, false) + check_xml_details(user3, false, false) end - signed_get api_users_path, :params => { :users => user1.id, :format => "json" }, :oauth => { :token => good_token } + get api_users_path, :params => { :users => user1.id, :format => "json" }, :headers => good_auth assert_response :success assert_equal "application/json", response.media_type js = ActiveSupport::JSON.decode(@response.body) assert_not_nil js assert_equal 1, js["users"].count - check_json_details(js["users"][0], user1, true) + check_json_details(js["users"][0], user1, true, false) - signed_get api_users_path, :params => { :users => user2.id, :format => "json" }, :oauth => { :token => good_token } + get api_users_path, :params => { :users => user2.id, :format => "json" }, :headers => good_auth assert_response :success assert_equal "application/json", response.media_type js = ActiveSupport::JSON.decode(@response.body) assert_not_nil js assert_equal 1, js["users"].count - check_json_details(js["users"][0], user2, false) + check_json_details(js["users"][0], user2, false, false) - signed_get api_users_path, :params => { :users => "#{user1.id},#{user3.id}", :format => "json" }, :oauth => { :token => good_token } + get api_users_path, :params => { :users => "#{user1.id},#{user3.id}", :format => "json" }, :headers => good_auth assert_response :success assert_equal "application/json", response.media_type js = ActiveSupport::JSON.decode(@response.body) assert_not_nil js assert_equal 2, js["users"].count - check_json_details(js["users"][0], user1, true) - check_json_details(js["users"][1], user3, false) + check_json_details(js["users"][0], user1, true, false) + check_json_details(js["users"][1], user3, false, false) - signed_get api_users_path, :params => { :users => "#{user1.id},#{user3.id}", :format => "json" }, :oauth => { :token => bad_token } + get api_users_path, :params => { :users => "#{user1.id},#{user3.id}", :format => "json" }, :headers => bad_auth assert_response :success assert_equal "application/json", response.media_type js = ActiveSupport::JSON.decode(@response.body) assert_not_nil js assert_equal 2, js["users"].count - check_json_details(js["users"][0], user1, false) - check_json_details(js["users"][1], user3, false) - - signed_get api_users_path, :params => { :users => create(:user, :suspended).id }, :oauth => { :token => good_token } - assert_response :not_found - - signed_get api_users_path, :params => { :users => create(:user, :deleted).id }, :oauth => { :token => good_token } - assert_response :not_found + check_json_details(js["users"][0], user1, false, false) + check_json_details(js["users"][1], user3, false, false) - signed_get api_users_path, :params => { :users => 0 }, :oauth => { :token => good_token } - assert_response :not_found - end - - def test_index_oauth2 - user1 = create(:user, :description => "test1", :terms_agreed => Date.yesterday) - user2 = create(:user, :description => "test2", :terms_agreed => Date.yesterday) - user3 = create(:user, :description => "test3", :terms_agreed => Date.yesterday) - good_token = create(:oauth_access_token, :resource_owner_id => user1.id, :scopes => %w[read_prefs]) - bad_token = create(:oauth_access_token, :resource_owner_id => user1.id, :scopes => %w[]) - - get api_users_path, :params => { :users => user1.id }, :headers => bearer_authorization_header(good_token.token) + get api_users_path, :params => { :users => create(:user, :suspended).id }, :headers => good_auth assert_response :success assert_equal "application/xml", response.media_type - assert_select "user", :count => 1 do - check_xml_details(user1, true) - assert_select "user[id='#{user2.id}']", :count => 0 - assert_select "user[id='#{user3.id}']", :count => 0 - end + assert_select "user", :count => 0 - get api_users_path, :params => { :users => user2.id }, :headers => bearer_authorization_header(good_token.token) + get api_users_path, :params => { :users => create(:user, :deleted).id }, :headers => good_auth assert_response :success assert_equal "application/xml", response.media_type - assert_select "user", :count => 1 do - assert_select "user[id='#{user1.id}']", :count => 0 - check_xml_details(user2, false) - assert_select "user[id='#{user3.id}']", :count => 0 - end + assert_select "user", :count => 0 - get api_users_path, :params => { :users => "#{user1.id},#{user3.id}" }, :headers => bearer_authorization_header(good_token.token) + get api_users_path, :params => { :users => 0 }, :headers => good_auth assert_response :success assert_equal "application/xml", response.media_type - assert_select "user", :count => 2 do - check_xml_details(user1, true) - assert_select "user[id='#{user2.id}']", :count => 0 - check_xml_details(user3, false) - end - - get api_users_path, :params => { :users => "#{user1.id},#{user3.id}" }, :headers => bearer_authorization_header(bad_token.token) - assert_response :success - assert_equal "application/xml", response.media_type - assert_select "user", :count => 2 do - check_xml_details(user1, false) - assert_select "user[id='#{user2.id}']", :count => 0 - check_xml_details(user3, false) - end - - get api_users_path, :params => { :users => user1.id, :format => "json" }, :headers => bearer_authorization_header(good_token.token) - assert_response :success - assert_equal "application/json", response.media_type - js = ActiveSupport::JSON.decode(@response.body) - assert_not_nil js - assert_equal 1, js["users"].count - check_json_details(js["users"][0], user1, true) - - get api_users_path, :params => { :users => user2.id, :format => "json" }, :headers => bearer_authorization_header(good_token.token) - assert_response :success - assert_equal "application/json", response.media_type - js = ActiveSupport::JSON.decode(@response.body) - assert_not_nil js - assert_equal 1, js["users"].count - check_json_details(js["users"][0], user2, false) - - get api_users_path, :params => { :users => "#{user1.id},#{user3.id}", :format => "json" }, :headers => bearer_authorization_header(good_token.token) - assert_response :success - assert_equal "application/json", response.media_type - js = ActiveSupport::JSON.decode(@response.body) - assert_not_nil js - assert_equal 2, js["users"].count - check_json_details(js["users"][0], user1, true) - check_json_details(js["users"][1], user3, false) - - get api_users_path, :params => { :users => "#{user1.id},#{user3.id}", :format => "json" }, :headers => bearer_authorization_header(bad_token.token) - assert_response :success - assert_equal "application/json", response.media_type - js = ActiveSupport::JSON.decode(@response.body) - assert_not_nil js - assert_equal 2, js["users"].count - check_json_details(js["users"][0], user1, false) - check_json_details(js["users"][1], user3, false) - - get api_users_path, :params => { :users => create(:user, :suspended).id }, :headers => bearer_authorization_header(good_token.token) - assert_response :not_found - - get api_users_path, :params => { :users => create(:user, :deleted).id }, :headers => bearer_authorization_header(good_token.token) - assert_response :not_found - - get api_users_path, :params => { :users => 0 }, :headers => bearer_authorization_header(good_token.token) - assert_response :not_found + assert_select "user", :count => 0 end def test_gpx_files @@ -592,7 +418,7 @@ module Api assert_response :unauthorized # check that we get a response when logged in - auth_header = basic_authorization_header user.email, "test" + auth_header = bearer_authorization_header user get user_gpx_files_path, :headers => auth_header assert_response :success assert_equal "application/xml", response.media_type @@ -608,7 +434,7 @@ module Api private - def check_xml_details(user, include_private) + def check_xml_details(user, include_private, include_email) assert_select "user[id='#{user.id}']", :count => 1 do assert_select "description", :count => 1, :text => user.description @@ -678,13 +504,19 @@ module Api assert_select "languages", :count => 0 assert_select "messages", :count => 0 end + + if include_email + assert_select "email", :count => 1, :text => user.email + else + assert_select "email", :count => 0 + end end end - def check_json_details(js, user, include_private) + def check_json_details(js, user, include_private, include_email) assert_equal user.id, js["user"]["id"] assert_equal user.description, js["user"]["description"] - assert js["user"]["contributor_terms"]["agreed"] + assert_operator js["user"]["contributor_terms"], :[], "agreed" if include_private assert_not js["user"]["contributor_terms"]["pd"] @@ -721,6 +553,12 @@ module Api else assert_nil js["user"]["messages"] end + + if include_email + assert_equal user.email, js["user"]["email"] + else + assert_nil js["user"]["email"] + end end end end