Require terms agreement for abilities and capabilities related to api write methods

[rails.git] / test / controllers / changeset_comments_controller_test.rb

diff --git a/test/controllers/changeset_comments_controller_test.rb b/test/controllers/changeset_comments_controller_test.rb
index 215f45957a11cd31af314acb7899165809e2bd46..2b661a7a9bf4be795454bb06636c99661351f464 100644 (file)
--- a/test/controllers/changeset_comments_controller_test.rb
+++ b/test/controllers/changeset_comments_controller_test.rb
@@ -6,23 +6,23 @@ class ChangesetCommentsControllerTest < ActionController::TestCase
   def test_routes
     assert_routing(
       { :path => "/api/0.6/changeset/1/comment", :method => :post },
   def test_routes
     assert_routing(
       { :path => "/api/0.6/changeset/1/comment", :method => :post },

-      { :controller => "changeset_comments", :action => "comment", :id => "1" }
+      { :controller => "changeset_comments", :action => "create", :id => "1" }

     )
     assert_routing(
       { :path => "/api/0.6/changeset/comment/1/hide", :method => :post },
     )
     assert_routing(
       { :path => "/api/0.6/changeset/comment/1/hide", :method => :post },

-      { :controller => "changeset_comments", :action => "hide_comment", :id => "1" }
+      { :controller => "changeset_comments", :action => "destroy", :id => "1" }

     )
     assert_routing(
       { :path => "/api/0.6/changeset/comment/1/unhide", :method => :post },
     )
     assert_routing(
       { :path => "/api/0.6/changeset/comment/1/unhide", :method => :post },

-      { :controller => "changeset_comments", :action => "unhide_comment", :id => "1" }
+      { :controller => "changeset_comments", :action => "restore", :id => "1" }

     )
     assert_routing(
       { :path => "/changeset/1/comments/feed", :method => :get },
     )
     assert_routing(
       { :path => "/changeset/1/comments/feed", :method => :get },

-      { :controller => "changeset_comments", :action => "comments_feed", :id => "1", :format => "rss" }
+      { :controller => "changeset_comments", :action => "index", :id => "1", :format => "rss" }

     )
     assert_routing(
       { :path => "/history/comments/feed", :method => :get },
     )
     assert_routing(
       { :path => "/history/comments/feed", :method => :get },

-      { :controller => "changeset_comments", :action => "comments_feed", :format => "rss" }
+      { :controller => "changeset_comments", :action => "index", :format => "rss" }

     )
   end
 
     )
   end
 


@@ -41,7 +41,7 @@ class ChangesetCommentsControllerTest < ActionController::TestCase
     assert_difference "ChangesetComment.count", 1 do
       assert_no_difference "ActionMailer::Base.deliveries.size" do
         perform_enqueued_jobs do
     assert_difference "ChangesetComment.count", 1 do
       assert_no_difference "ActionMailer::Base.deliveries.size" do
         perform_enqueued_jobs do

-          post :comment, :params => { :id => private_user_closed_changeset.id, :text => "This is a comment" }
+          post :create, :params => { :id => private_user_closed_changeset.id, :text => "This is a comment" }

         end
       end
     end
         end
       end
     end


@@ -56,7 +56,7 @@ class ChangesetCommentsControllerTest < ActionController::TestCase
     assert_difference "ChangesetComment.count", 1 do
       assert_difference "ActionMailer::Base.deliveries.size", 1 do
         perform_enqueued_jobs do
     assert_difference "ChangesetComment.count", 1 do
       assert_difference "ActionMailer::Base.deliveries.size", 1 do
         perform_enqueued_jobs do

-          post :comment, :params => { :id => changeset.id, :text => "This is a comment" }
+          post :create, :params => { :id => changeset.id, :text => "This is a comment" }

         end
       end
     end
         end
       end
     end


@@ -74,7 +74,7 @@ class ChangesetCommentsControllerTest < ActionController::TestCase
     assert_difference "ChangesetComment.count", 1 do
       assert_difference "ActionMailer::Base.deliveries.size", 2 do
         perform_enqueued_jobs do
     assert_difference "ChangesetComment.count", 1 do
       assert_difference "ActionMailer::Base.deliveries.size", 2 do
         perform_enqueued_jobs do

-          post :comment, :params => { :id => changeset.id, :text => "This is a comment" }
+          post :create, :params => { :id => changeset.id, :text => "This is a comment" }

         end
       end
     end
         end
       end
     end


@@ -97,58 +97,58 @@ class ChangesetCommentsControllerTest < ActionController::TestCase
   # create comment fail
   def test_create_comment_fail
     # unauthorized
   # create comment fail
   def test_create_comment_fail
     # unauthorized

-    post :comment, :params => { :id => create(:changeset, :closed).id, :text => "This is a comment" }
+    post :create, :params => { :id => create(:changeset, :closed).id, :text => "This is a comment" }

     assert_response :unauthorized
 
     basic_authorization create(:user).email, "test"
 
     # bad changeset id
     assert_no_difference "ChangesetComment.count" do
     assert_response :unauthorized
 
     basic_authorization create(:user).email, "test"
 
     # bad changeset id
     assert_no_difference "ChangesetComment.count" do

-      post :comment, :params => { :id => 999111, :text => "This is a comment" }
+      post :create, :params => { :id => 999111, :text => "This is a comment" }

     end
     assert_response :not_found
 
     # not closed changeset
     assert_no_difference "ChangesetComment.count" do
     end
     assert_response :not_found
 
     # not closed changeset
     assert_no_difference "ChangesetComment.count" do

-      post :comment, :params => { :id => create(:changeset).id, :text => "This is a comment" }
+      post :create, :params => { :id => create(:changeset).id, :text => "This is a comment" }

     end
     assert_response :conflict
 
     # no text
     assert_no_difference "ChangesetComment.count" do
     end
     assert_response :conflict
 
     # no text
     assert_no_difference "ChangesetComment.count" do

-      post :comment, :params => { :id => create(:changeset, :closed).id }
+      post :create, :params => { :id => create(:changeset, :closed).id }

     end
     assert_response :bad_request
 
     # empty text
     assert_no_difference "ChangesetComment.count" do
     end
     assert_response :bad_request
 
     # empty text
     assert_no_difference "ChangesetComment.count" do

-      post :comment, :params => { :id => create(:changeset, :closed).id, :text => "" }
+      post :create, :params => { :id => create(:changeset, :closed).id, :text => "" }

     end
     assert_response :bad_request
   end
 
   ##
   # test hide comment fail
     end
     assert_response :bad_request
   end
 
   ##
   # test hide comment fail

-  def test_hide_comment_fail
+  def test_destroy_comment_fail

     # unauthorized
     comment = create(:changeset_comment)
     assert_equal true, comment.visible
 
     # unauthorized
     comment = create(:changeset_comment)
     assert_equal true, comment.visible
 

-    post :hide_comment, :params => { :id => comment.id }
+    post :destroy, :params => { :id => comment.id }

     assert_response :unauthorized
     assert_equal true, comment.reload.visible
 
     basic_authorization create(:user).email, "test"
 
     # not a moderator
     assert_response :unauthorized
     assert_equal true, comment.reload.visible
 
     basic_authorization create(:user).email, "test"
 
     # not a moderator

-    post :hide_comment, :params => { :id => comment.id }
+    post :destroy, :params => { :id => comment.id }

     assert_response :forbidden
     assert_equal true, comment.reload.visible
 
     basic_authorization create(:moderator_user).email, "test"
 
     # bad comment id
     assert_response :forbidden
     assert_equal true, comment.reload.visible
 
     basic_authorization create(:moderator_user).email, "test"
 
     # bad comment id

-    post :hide_comment, :params => { :id => 999111 }
+    post :destroy, :params => { :id => 999111 }

     assert_response :not_found
     assert_equal true, comment.reload.visible
   end
     assert_response :not_found
     assert_equal true, comment.reload.visible
   end


@@ -161,33 +161,33 @@ class ChangesetCommentsControllerTest < ActionController::TestCase
 
     basic_authorization create(:moderator_user).email, "test"
 
 
     basic_authorization create(:moderator_user).email, "test"
 

-    post :hide_comment, :params => { :id => comment.id }
+    post :destroy, :params => { :id => comment.id }

     assert_response :success
     assert_equal false, comment.reload.visible
   end
 
   ##
   # test unhide comment fail
     assert_response :success
     assert_equal false, comment.reload.visible
   end
 
   ##
   # test unhide comment fail

-  def test_unhide_comment_fail
+  def test_restore_comment_fail

     # unauthorized
     comment = create(:changeset_comment, :visible => false)
     assert_equal false, comment.visible
 
     # unauthorized
     comment = create(:changeset_comment, :visible => false)
     assert_equal false, comment.visible
 

-    post :unhide_comment, :params => { :id => comment.id }
+    post :restore, :params => { :id => comment.id }

     assert_response :unauthorized
     assert_equal false, comment.reload.visible
 
     basic_authorization create(:user).email, "test"
 
     # not a moderator
     assert_response :unauthorized
     assert_equal false, comment.reload.visible
 
     basic_authorization create(:user).email, "test"
 
     # not a moderator

-    post :unhide_comment, :params => { :id => comment.id }
+    post :restore, :params => { :id => comment.id }

     assert_response :forbidden
     assert_equal false, comment.reload.visible
 
     basic_authorization create(:moderator_user).email, "test"
 
     # bad comment id
     assert_response :forbidden
     assert_equal false, comment.reload.visible
 
     basic_authorization create(:moderator_user).email, "test"
 
     # bad comment id

-    post :unhide_comment, :params => { :id => 999111 }
+    post :restore, :params => { :id => 999111 }

     assert_response :not_found
     assert_equal false, comment.reload.visible
   end
     assert_response :not_found
     assert_equal false, comment.reload.visible
   end


@@ -200,18 +200,18 @@ class ChangesetCommentsControllerTest < ActionController::TestCase
 
     basic_authorization create(:moderator_user).email, "test"
 
 
     basic_authorization create(:moderator_user).email, "test"
 

-    post :unhide_comment, :params => { :id => comment.id }
+    post :restore, :params => { :id => comment.id }

     assert_response :success
     assert_equal true, comment.reload.visible
   end
 
   ##
   # test comments feed
     assert_response :success
     assert_equal true, comment.reload.visible
   end
 
   ##
   # test comments feed

-  def test_comments_feed
+  def test_feed

     changeset = create(:changeset, :closed)
     create_list(:changeset_comment, 3, :changeset => changeset)
 
     changeset = create(:changeset, :closed)
     create_list(:changeset_comment, 3, :changeset => changeset)
 

-    get :comments_feed, :params => { :format => "rss" }
+    get :index, :params => { :format => "rss" }

     assert_response :success
     assert_equal "application/rss+xml", @response.content_type
     assert_select "rss", :count => 1 do
     assert_response :success
     assert_equal "application/rss+xml", @response.content_type
     assert_select "rss", :count => 1 do


@@ -220,7 +220,7 @@ class ChangesetCommentsControllerTest < ActionController::TestCase
       end
     end
 
       end
     end
 

-    get :comments_feed, :params => { :format => "rss", :limit => 2 }
+    get :index, :params => { :format => "rss", :limit => 2 }

     assert_response :success
     assert_equal "application/rss+xml", @response.content_type
     assert_select "rss", :count => 1 do
     assert_response :success
     assert_equal "application/rss+xml", @response.content_type
     assert_select "rss", :count => 1 do


@@ -229,7 +229,7 @@ class ChangesetCommentsControllerTest < ActionController::TestCase
       end
     end
 
       end
     end
 

-    get :comments_feed, :params => { :id => changeset.id, :format => "rss" }
+    get :index, :params => { :id => changeset.id, :format => "rss" }

     assert_response :success
     assert_equal "application/rss+xml", @response.content_type
     assert_select "rss", :count => 1 do
     assert_response :success
     assert_equal "application/rss+xml", @response.content_type
     assert_select "rss", :count => 1 do


@@ -241,11 +241,80 @@ class ChangesetCommentsControllerTest < ActionController::TestCase
 
   ##
   # test comments feed
 
   ##
   # test comments feed

-  def test_comments_feed_bad_limit
-    get :comments_feed, :params => { :format => "rss", :limit => 0 }
+  def test_feed_bad_limit
+    get :index, :params => { :format => "rss", :limit => 0 }

     assert_response :bad_request
 
     assert_response :bad_request
 

-    get :comments_feed, :params => { :format => "rss", :limit => 100001 }
+    get :index, :params => { :format => "rss", :limit => 100001 }

     assert_response :bad_request
   end
     assert_response :bad_request
   end

+
+  # This test ensures that token capabilities behave correctly for a method that
+  # requires the terms to have been agreed.
+  # (This would be better as an integration or system testcase, since the changeset_comment
+  # create method is simply a stand-in for any method that requires terms agreement.
+  # But writing oauth tests is hard, and so it's easier to put in a controller test.)
+  def test_api_write_and_terms_agreed_via_token
+    with_terms_agreed(true) do
+      user = create(:user, :terms_agreed => nil)
+      token = create(:access_token, :user => user, :allow_write_api => true)
+      changeset = create(:changeset, :closed)
+
+      # Hack together an oauth request - an alternative would be to sign the request properly
+      @request.env["oauth.version"] = 1
+      @request.env["oauth.strategies"] = [:token]
+      @request.env["oauth.token"] = token
+
+      assert_difference "ChangesetComment.count", 0 do
+        post :create, :params => { :id => changeset.id, :text => "This is a comment" }
+      end
+      assert_response :forbidden
+
+      # Try again, after agreement with the terms
+      user.terms_agreed = Time.now
+      user.save!
+
+      assert_difference "ChangesetComment.count", 1 do
+        post :create, :params => { :id => changeset.id, :text => "This is a comment" }
+      end
+      assert_response :success
+    end
+  end
+
+  # This test does the same as above, but with basic auth, to similarly test that the
+  # abilities take into account terms agreement too.
+  def test_api_write_and_terms_agreed_via_basic_auth
+    with_terms_agreed(true) do
+      user = create(:user, :terms_agreed => nil)
+      changeset = create(:changeset, :closed)
+
+      basic_authorization user.email, "test"
+
+      assert_difference "ChangesetComment.count", 0 do
+        post :create, :params => { :id => changeset.id, :text => "This is a comment" }
+      end
+      assert_response :forbidden
+
+      # Try again, after agreement with the terms
+      user.terms_agreed = Time.now
+      user.save!
+
+      assert_difference "ChangesetComment.count", 1 do
+        post :create, :params => { :id => changeset.id, :text => "This is a comment" }
+      end
+      assert_response :success
+    end
+  end
+
+  private
+
+  def with_terms_agreed(value)
+    require_terms_agreed = Object.send("remove_const", "REQUIRE_TERMS_AGREED")
+    Object.const_set("REQUIRE_TERMS_AGREED", value)
+
+    yield
+
+    Object.send("remove_const", "REQUIRE_TERMS_AGREED")
+    Object.const_set("REQUIRE_TERMS_AGREED", require_terms_agreed)
+  end

 end
 end