4 class NodesControllerTest < ActionDispatch::IntegrationTest
6 # test all routes which lead to this controller
9 { :path => "/api/0.6/node/create", :method => :put },
10 { :controller => "api/nodes", :action => "create" }
13 { :path => "/api/0.6/node/1", :method => :get },
14 { :controller => "api/nodes", :action => "show", :id => "1" }
17 { :path => "/api/0.6/node/1.json", :method => :get },
18 { :controller => "api/nodes", :action => "show", :id => "1", :format => "json" }
21 { :path => "/api/0.6/node/1", :method => :put },
22 { :controller => "api/nodes", :action => "update", :id => "1" }
25 { :path => "/api/0.6/node/1", :method => :delete },
26 { :controller => "api/nodes", :action => "delete", :id => "1" }
29 { :path => "/api/0.6/nodes", :method => :get },
30 { :controller => "api/nodes", :action => "index" }
33 { :path => "/api/0.6/nodes.json", :method => :get },
34 { :controller => "api/nodes", :action => "index", :format => "json" }
39 private_user = create(:user, :data_public => false)
40 private_changeset = create(:changeset, :user => private_user)
42 changeset = create(:changeset, :user => user)
44 # create a node with random lat/lon
45 lat = rand(-50..50) + rand
46 lon = rand(-50..50) + rand
48 ## First try with no auth
49 # create a minimal xml file
50 xml = "<osm><node lat='#{lat}' lon='#{lon}' changeset='#{changeset.id}'/></osm>"
51 assert_difference("OldNode.count", 0) do
52 put node_create_path, :params => xml
54 # hope for unauthorized
55 assert_response :unauthorized, "node upload did not return unauthorized status"
57 ## Now try with the user which doesn't have their data public
58 auth_header = basic_authorization_header private_user.email, "test"
60 # create a minimal xml file
61 xml = "<osm><node lat='#{lat}' lon='#{lon}' changeset='#{private_changeset.id}'/></osm>"
62 assert_difference("Node.count", 0) do
63 put node_create_path, :params => xml, :headers => auth_header
66 assert_require_public_data "node create did not return forbidden status"
68 ## Now try with the user that has the public data
69 auth_header = basic_authorization_header user.email, "test"
71 # create a minimal xml file
72 xml = "<osm><node lat='#{lat}' lon='#{lon}' changeset='#{changeset.id}'/></osm>"
73 put node_create_path, :params => xml, :headers => auth_header
75 assert_response :success, "node upload did not return success status"
77 # read id of created node and search for it
78 nodeid = @response.body
79 checknode = Node.find(nodeid)
80 assert_not_nil checknode, "uploaded node not found in data base after upload"
82 assert_in_delta lat * 10000000, checknode.latitude, 1, "saved node does not match requested latitude"
83 assert_in_delta lon * 10000000, checknode.longitude, 1, "saved node does not match requested longitude"
84 assert_equal changeset.id, checknode.changeset_id, "saved node does not belong to changeset that it was created in"
85 assert checknode.visible, "saved node is not visible"
88 def test_create_invalid_xml
89 ## Only test public user here, as test_create should cover what's the forbidden
90 ## that would occur here
93 changeset = create(:changeset, :user => user)
95 auth_header = basic_authorization_header user.email, "test"
99 # test that the upload is rejected when xml is valid, but osm doc isn't
101 put node_create_path, :params => xml, :headers => auth_header
102 assert_response :bad_request, "node upload did not return bad_request status"
103 assert_equal "Cannot parse valid node from xml string <create/>. XML doesn't contain an osm/node element.", @response.body
105 # test that the upload is rejected when no lat is supplied
106 # create a minimal xml file
107 xml = "<osm><node lon='#{lon}' changeset='#{changeset.id}'/></osm>"
108 put node_create_path, :params => xml, :headers => auth_header
110 assert_response :bad_request, "node upload did not return bad_request status"
111 assert_equal "Cannot parse valid node from xml string <node lon=\"3.23\" changeset=\"#{changeset.id}\"/>. lat missing", @response.body
113 # test that the upload is rejected when no lon is supplied
114 # create a minimal xml file
115 xml = "<osm><node lat='#{lat}' changeset='#{changeset.id}'/></osm>"
116 put node_create_path, :params => xml, :headers => auth_header
118 assert_response :bad_request, "node upload did not return bad_request status"
119 assert_equal "Cannot parse valid node from xml string <node lat=\"3.434\" changeset=\"#{changeset.id}\"/>. lon missing", @response.body
121 # test that the upload is rejected when lat is non-numeric
122 # create a minimal xml file
123 xml = "<osm><node lat='abc' lon='#{lon}' changeset='#{changeset.id}'/></osm>"
124 put node_create_path, :params => xml, :headers => auth_header
126 assert_response :bad_request, "node upload did not return bad_request status"
127 assert_equal "Cannot parse valid node from xml string <node lat=\"abc\" lon=\"#{lon}\" changeset=\"#{changeset.id}\"/>. lat not a number", @response.body
129 # test that the upload is rejected when lon is non-numeric
130 # create a minimal xml file
131 xml = "<osm><node lat='#{lat}' lon='abc' changeset='#{changeset.id}'/></osm>"
132 put node_create_path, :params => xml, :headers => auth_header
134 assert_response :bad_request, "node upload did not return bad_request status"
135 assert_equal "Cannot parse valid node from xml string <node lat=\"#{lat}\" lon=\"abc\" changeset=\"#{changeset.id}\"/>. lon not a number", @response.body
137 # test that the upload is rejected when we have a tag which is too long
138 xml = "<osm><node lat='#{lat}' lon='#{lon}' changeset='#{changeset.id}'><tag k='foo' v='#{'x' * 256}'/></node></osm>"
139 put node_create_path, :params => xml, :headers => auth_header
140 assert_response :bad_request, "node upload did not return bad_request status"
141 assert_match(/ v: is too long \(maximum is 255 characters\) /, @response.body)
145 # check that a visible node is returned properly
146 get api_node_path(create(:node))
147 assert_response :success
149 # check that an deleted node is not returned
150 get api_node_path(create(:node, :deleted))
151 assert_response :gone
153 # check chat a non-existent node is not returned
154 get api_node_path(:id => 0)
155 assert_response :not_found
158 # Ensure the lat/lon is formatted as a decimal e.g. not 4.0e-05
159 def test_lat_lon_xml_format
160 node = create(:node, :latitude => (0.00004 * OldNode::SCALE).to_i, :longitude => (0.00008 * OldNode::SCALE).to_i)
162 get api_node_path(node)
163 assert_match(/lat="0.0000400"/, response.body)
164 assert_match(/lon="0.0000800"/, response.body)
167 # this tests deletion restrictions - basic deletion is tested in the unit
170 private_user = create(:user, :data_public => false)
171 private_user_changeset = create(:changeset, :user => private_user)
172 private_user_closed_changeset = create(:changeset, :closed, :user => private_user)
173 private_node = create(:node, :changeset => private_user_changeset)
174 private_deleted_node = create(:node, :deleted, :changeset => private_user_changeset)
176 ## first try to delete node without auth
177 delete api_node_path(private_node)
178 assert_response :unauthorized
180 ## now set auth for the non-data public user
181 auth_header = basic_authorization_header private_user.email, "test"
183 # try to delete with an invalid (closed) changeset
184 xml = update_changeset(xml_for_node(private_node), private_user_closed_changeset.id)
185 delete api_node_path(private_node), :params => xml.to_s, :headers => auth_header
186 assert_require_public_data("non-public user shouldn't be able to delete node")
188 # try to delete with an invalid (non-existent) changeset
189 xml = update_changeset(xml_for_node(private_node), 0)
190 delete api_node_path(private_node), :params => xml.to_s, :headers => auth_header
191 assert_require_public_data("shouldn't be able to delete node, when user's data is private")
193 # valid delete now takes a payload
194 xml = xml_for_node(private_node)
195 delete api_node_path(private_node), :params => xml.to_s, :headers => auth_header
196 assert_require_public_data("shouldn't be able to delete node when user's data isn't public'")
198 # this won't work since the node is already deleted
199 xml = xml_for_node(private_deleted_node)
200 delete api_node_path(private_deleted_node), :params => xml.to_s, :headers => auth_header
201 assert_require_public_data
203 # this won't work since the node never existed
204 delete api_node_path(:id => 0), :headers => auth_header
205 assert_require_public_data
207 ## these test whether nodes which are in-use can be deleted:
209 private_used_node = create(:node, :changeset => private_user_changeset)
210 create(:way_node, :node => private_used_node)
212 xml = xml_for_node(private_used_node)
213 delete api_node_path(private_used_node), :params => xml.to_s, :headers => auth_header
214 assert_require_public_data "shouldn't be able to delete a node used in a way (#{@response.body})"
217 private_used_node2 = create(:node, :changeset => private_user_changeset)
218 create(:relation_member, :member => private_used_node2)
220 xml = xml_for_node(private_used_node2)
221 delete api_node_path(private_used_node2), :params => xml.to_s, :headers => auth_header
222 assert_require_public_data "shouldn't be able to delete a node used in a relation (#{@response.body})"
224 ## now setup for the public data user
225 user = create(:user, :data_public => true)
226 changeset = create(:changeset, :user => user)
227 closed_changeset = create(:changeset, :closed, :user => user)
228 node = create(:node, :changeset => changeset)
229 auth_header = basic_authorization_header user.email, "test"
231 # try to delete with an invalid (closed) changeset
232 xml = update_changeset(xml_for_node(node), closed_changeset.id)
233 delete api_node_path(node), :params => xml.to_s, :headers => auth_header
234 assert_response :conflict
236 # try to delete with an invalid (non-existent) changeset
237 xml = update_changeset(xml_for_node(node), 0)
238 delete api_node_path(node), :params => xml.to_s, :headers => auth_header
239 assert_response :conflict
241 # try to delete a node with a different ID
242 other_node = create(:node)
243 xml = xml_for_node(other_node)
244 delete api_node_path(node.id), :params => xml.to_s, :headers => auth_header
245 assert_response :bad_request,
246 "should not be able to delete a node with a different ID from the XML"
248 # try to delete a node rubbish in the payloads
250 delete api_node_path(node), :params => xml.to_s, :headers => auth_header
251 assert_response :bad_request,
252 "should not be able to delete a node without a valid XML payload"
254 # valid delete now takes a payload
255 xml = xml_for_node(node)
256 delete api_node_path(node), :params => xml.to_s, :headers => auth_header
257 assert_response :success
259 # valid delete should return the new version number, which should
260 # be greater than the old version number
261 assert_operator @response.body.to_i, :>, node.version, "delete request should return a new version number for node"
263 # deleting the same node twice doesn't work
264 xml = xml_for_node(node)
265 delete api_node_path(node), :params => xml.to_s, :headers => auth_header
266 assert_response :gone
268 # this won't work since the node never existed
269 delete api_node_path(:id => 0), :headers => auth_header
270 assert_response :not_found
272 ## these test whether nodes which are in-use can be deleted:
274 used_node = create(:node, :changeset => create(:changeset, :user => user))
275 way_node = create(:way_node, :node => used_node)
276 way_node2 = create(:way_node, :node => used_node)
278 xml = xml_for_node(used_node)
279 delete api_node_path(used_node), :params => xml.to_s, :headers => auth_header
280 assert_response :precondition_failed,
281 "shouldn't be able to delete a node used in a way (#{@response.body})"
282 assert_equal "Precondition failed: Node #{used_node.id} is still used by ways #{way_node.way.id},#{way_node2.way.id}.", @response.body
285 used_node2 = create(:node, :changeset => create(:changeset, :user => user))
286 relation_member = create(:relation_member, :member => used_node2)
287 relation_member2 = create(:relation_member, :member => used_node2)
289 xml = xml_for_node(used_node2)
290 delete api_node_path(used_node2), :params => xml.to_s, :headers => auth_header
291 assert_response :precondition_failed,
292 "shouldn't be able to delete a node used in a relation (#{@response.body})"
293 assert_equal "Precondition failed: Node #{used_node2.id} is still used by relations #{relation_member.relation.id},#{relation_member2.relation.id}.", @response.body
297 # tests whether the API works and prevents incorrect use while trying
300 ## First test with no user credentials
301 # try and update a node without authorisation
302 # first try to delete node without auth
303 private_user = create(:user, :data_public => false)
304 private_node = create(:node, :changeset => create(:changeset, :user => private_user))
306 node = create(:node, :changeset => create(:changeset, :user => user))
308 xml = xml_for_node(node)
309 put api_node_path(node), :params => xml.to_s
310 assert_response :unauthorized
312 ## Second test with the private user
315 auth_header = basic_authorization_header private_user.email, "test"
317 ## trying to break changesets
319 # try and update in someone else's changeset
320 xml = update_changeset(xml_for_node(private_node),
321 create(:changeset).id)
322 put api_node_path(private_node), :params => xml.to_s, :headers => auth_header
323 assert_require_public_data "update with other user's changeset should be forbidden when data isn't public"
325 # try and update in a closed changeset
326 xml = update_changeset(xml_for_node(private_node),
327 create(:changeset, :closed, :user => private_user).id)
328 put api_node_path(private_node), :params => xml.to_s, :headers => auth_header
329 assert_require_public_data "update with closed changeset should be forbidden, when data isn't public"
331 # try and update in a non-existant changeset
332 xml = update_changeset(xml_for_node(private_node), 0)
333 put api_node_path(private_node), :params => xml.to_s, :headers => auth_header
334 assert_require_public_data "update with changeset=0 should be forbidden, when data isn't public"
336 ## try and submit invalid updates
337 xml = xml_attr_rewrite(xml_for_node(private_node), "lat", 91.0)
338 put api_node_path(private_node), :params => xml.to_s, :headers => auth_header
339 assert_require_public_data "node at lat=91 should be forbidden, when data isn't public"
341 xml = xml_attr_rewrite(xml_for_node(private_node), "lat", -91.0)
342 put api_node_path(private_node), :params => xml.to_s, :headers => auth_header
343 assert_require_public_data "node at lat=-91 should be forbidden, when data isn't public"
345 xml = xml_attr_rewrite(xml_for_node(private_node), "lon", 181.0)
346 put api_node_path(private_node), :params => xml.to_s, :headers => auth_header
347 assert_require_public_data "node at lon=181 should be forbidden, when data isn't public"
349 xml = xml_attr_rewrite(xml_for_node(private_node), "lon", -181.0)
350 put api_node_path(private_node), :params => xml.to_s, :headers => auth_header
351 assert_require_public_data "node at lon=-181 should be forbidden, when data isn't public"
353 ## finally, produce a good request which still won't work
354 xml = xml_for_node(private_node)
355 put api_node_path(private_node), :params => xml.to_s, :headers => auth_header
356 assert_require_public_data "should have failed with a forbidden when data isn't public"
358 ## Finally test with the public user
360 # try and update a node without authorisation
361 # first try to update node without auth
362 xml = xml_for_node(node)
363 put api_node_path(node.id), :params => xml.to_s, :headers => auth_header
364 assert_response :forbidden
367 auth_header = basic_authorization_header user.email, "test"
369 ## trying to break changesets
371 # try and update in someone else's changeset
372 xml = update_changeset(xml_for_node(node),
373 create(:changeset).id)
374 put api_node_path(node), :params => xml.to_s, :headers => auth_header
375 assert_response :conflict, "update with other user's changeset should be rejected"
377 # try and update in a closed changeset
378 xml = update_changeset(xml_for_node(node),
379 create(:changeset, :closed, :user => user).id)
380 put api_node_path(node), :params => xml.to_s, :headers => auth_header
381 assert_response :conflict, "update with closed changeset should be rejected"
383 # try and update in a non-existant changeset
384 xml = update_changeset(xml_for_node(node), 0)
385 put api_node_path(node), :params => xml.to_s, :headers => auth_header
386 assert_response :conflict, "update with changeset=0 should be rejected"
388 ## try and submit invalid updates
389 xml = xml_attr_rewrite(xml_for_node(node), "lat", 91.0)
390 put api_node_path(node), :params => xml.to_s, :headers => auth_header
391 assert_response :bad_request, "node at lat=91 should be rejected"
393 xml = xml_attr_rewrite(xml_for_node(node), "lat", -91.0)
394 put api_node_path(node), :params => xml.to_s, :headers => auth_header
395 assert_response :bad_request, "node at lat=-91 should be rejected"
397 xml = xml_attr_rewrite(xml_for_node(node), "lon", 181.0)
398 put api_node_path(node), :params => xml.to_s, :headers => auth_header
399 assert_response :bad_request, "node at lon=181 should be rejected"
401 xml = xml_attr_rewrite(xml_for_node(node), "lon", -181.0)
402 put api_node_path(node), :params => xml.to_s, :headers => auth_header
403 assert_response :bad_request, "node at lon=-181 should be rejected"
405 ## next, attack the versioning
406 current_node_version = node.version
408 # try and submit a version behind
409 xml = xml_attr_rewrite(xml_for_node(node),
410 "version", current_node_version - 1)
411 put api_node_path(node), :params => xml.to_s, :headers => auth_header
412 assert_response :conflict, "should have failed on old version number"
414 # try and submit a version ahead
415 xml = xml_attr_rewrite(xml_for_node(node),
416 "version", current_node_version + 1)
417 put api_node_path(node), :params => xml.to_s, :headers => auth_header
418 assert_response :conflict, "should have failed on skipped version number"
420 # try and submit total crap in the version field
421 xml = xml_attr_rewrite(xml_for_node(node),
422 "version", "p1r4t3s!")
423 put api_node_path(node), :params => xml.to_s, :headers => auth_header
424 assert_response :conflict,
425 "should not be able to put 'p1r4at3s!' in the version field"
427 ## try an update with the wrong ID
428 xml = xml_for_node(create(:node))
429 put api_node_path(node), :params => xml.to_s, :headers => auth_header
430 assert_response :bad_request,
431 "should not be able to update a node with a different ID from the XML"
433 ## try an update with a minimal valid XML doc which isn't a well-formed OSM doc.
435 put api_node_path(node), :params => xml.to_s, :headers => auth_header
436 assert_response :bad_request,
437 "should not be able to update a node with non-OSM XML doc."
439 ## finally, produce a good request which should work
440 xml = xml_for_node(node)
441 put api_node_path(node), :params => xml.to_s, :headers => auth_header
442 assert_response :success, "a valid update request failed"
446 # test fetching multiple nodes
448 node1 = create(:node)
449 node2 = create(:node, :deleted)
450 node3 = create(:node)
451 node4 = create(:node, :with_history, :version => 2)
452 node5 = create(:node, :deleted, :with_history, :version => 2)
454 # check error when no parameter provided
456 assert_response :bad_request
458 # check error when no parameter value provided
459 get nodes_path, :params => { :nodes => "" }
460 assert_response :bad_request
462 # test a working call
463 get nodes_path, :params => { :nodes => "#{node1.id},#{node2.id},#{node3.id},#{node4.id},#{node5.id}" }
464 assert_response :success
465 assert_select "osm" do
466 assert_select "node", :count => 5
467 assert_select "node[id='#{node1.id}'][visible='true']", :count => 1
468 assert_select "node[id='#{node2.id}'][visible='false']", :count => 1
469 assert_select "node[id='#{node3.id}'][visible='true']", :count => 1
470 assert_select "node[id='#{node4.id}'][visible='true']", :count => 1
471 assert_select "node[id='#{node5.id}'][visible='false']", :count => 1
474 # test a working call with json format
475 get nodes_path, :params => { :nodes => "#{node1.id},#{node2.id},#{node3.id},#{node4.id},#{node5.id}", :format => "json" }
477 js = ActiveSupport::JSON.decode(@response.body)
479 assert_equal 5, js["elements"].count
480 assert_equal 5, (js["elements"].count { |a| a["type"] == "node" })
481 assert_equal 1, (js["elements"].count { |a| a["id"] == node1.id && a["visible"].nil? })
482 assert_equal 1, (js["elements"].count { |a| a["id"] == node2.id && a["visible"] == false })
483 assert_equal 1, (js["elements"].count { |a| a["id"] == node3.id && a["visible"].nil? })
484 assert_equal 1, (js["elements"].count { |a| a["id"] == node4.id && a["visible"].nil? })
485 assert_equal 1, (js["elements"].count { |a| a["id"] == node5.id && a["visible"] == false })
487 # check error when a non-existent node is included
488 get nodes_path, :params => { :nodes => "#{node1.id},#{node2.id},#{node3.id},#{node4.id},#{node5.id},0" }
489 assert_response :not_found
493 # test adding tags to a node
494 def test_duplicate_tags
495 existing_tag = create(:node_tag)
496 assert existing_tag.node.changeset.user.data_public
498 auth_header = basic_authorization_header existing_tag.node.changeset.user.email, "test"
500 # add an identical tag to the node
501 tag_xml = XML::Node.new("tag")
502 tag_xml["k"] = existing_tag.k
503 tag_xml["v"] = existing_tag.v
505 # add the tag into the existing xml
506 node_xml = xml_for_node(existing_tag.node)
507 node_xml.find("//osm/node").first << tag_xml
510 put api_node_path(existing_tag.node), :params => node_xml.to_s, :headers => auth_header
511 assert_response :bad_request,
512 "adding duplicate tags to a node should fail with 'bad request'"
513 assert_equal "Element node/#{existing_tag.node.id} has duplicate tags with key #{existing_tag.k}", @response.body
516 # test whether string injection is possible
517 def test_string_injection
518 private_user = create(:user, :data_public => false)
519 private_changeset = create(:changeset, :user => private_user)
521 changeset = create(:changeset, :user => user)
523 ## First try with the non-data public user
524 auth_header = basic_authorization_header private_user.email, "test"
526 # try and put something into a string that the API might
527 # use unquoted and therefore allow code injection...
528 xml = "<osm><node lat='0' lon='0' changeset='#{private_changeset.id}'>" \
529 "<tag k='\#{@user.inspect}' v='0'/>" \
531 put node_create_path, :params => xml, :headers => auth_header
532 assert_require_public_data "Shouldn't be able to create with non-public user"
534 ## Then try with the public data user
535 auth_header = basic_authorization_header user.email, "test"
537 # try and put something into a string that the API might
538 # use unquoted and therefore allow code injection...
539 xml = "<osm><node lat='0' lon='0' changeset='#{changeset.id}'>" \
540 "<tag k='\#{@user.inspect}' v='0'/>" \
542 put node_create_path, :params => xml, :headers => auth_header
543 assert_response :success
544 nodeid = @response.body
546 # find the node in the database
547 checknode = Node.find(nodeid)
548 assert_not_nil checknode, "node not found in data base after upload"
550 # and grab it using the api
551 get api_node_path(:id => nodeid)
552 assert_response :success
553 apinode = Node.from_xml(@response.body)
554 assert_not_nil apinode, "downloaded node is nil, but shouldn't be"
556 # check the tags are not corrupted
557 assert_equal checknode.tags, apinode.tags
558 assert_includes apinode.tags, "\#{@user.inspect}"
564 # update the changeset_id of a node element
565 def update_changeset(xml, changeset_id)
566 xml_attr_rewrite(xml, "changeset", changeset_id)
570 # update an attribute in the node element
571 def xml_attr_rewrite(xml, name, value)
572 xml.find("//osm/node").first[name] = value.to_s
579 parser = XML::Parser.string(xml)