openproject/spec/requests/api/v3/query_resource_spec.rb

#-- copyright
# OpenProject is a project management system.
# Copyright (C) 2012-2014 the OpenProject Foundation (OPF)
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License version 3.
#
# OpenProject is a fork of ChiliProject, which is a fork of Redmine. The copyright follows:
# Copyright (C) 2006-2013 Jean-Philippe Lang
# Copyright (C) 2010-2013 the ChiliProject Team
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation; either version 2
# of the License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
#
# See doc/COPYRIGHT.rdoc for more details.
#++

require 'spec_helper'
require 'rack/test'

describe 'API v3 Query resource', :type => :request do
  include Rack::Test::Methods

  let(:project) { FactoryGirl.create(:project, :identifier => 'test_project', :is_public => false) }
  let(:current_user) { FactoryGirl.create(:user) }
  let(:manage_public_queries_role) { FactoryGirl.create(:role, permissions: [:manage_public_queries]) }
  let(:save_queries_role) { FactoryGirl.create(:role, permissions: [:save_queries]) }
  let(:role_without_query_permissions) { FactoryGirl.create(:role, permissions: [:view_work_packages]) }
  let(:unauthorize_user) { FactoryGirl.create(:user) }

  describe '#star' do
    let(:star_path) { "/api/v3/queries/#{query.id}/star" }
    let(:filters) do
        query.filters.map{ |f| {f.field.to_s => { "operator" => f.operator, "values" => f.values }}}
      end
    let(:expected_response) do
      {
        "_type" => 'Query',
        "_links" => {
          "self" => {
            "href" => "/api/v3/queries/#{query.id}",
            "title" => query.name
          }
        },
        "id" => query.id,
        "name" => query.name,
        "projectId" => query.project_id,
        "projectName" => query.project.name,
        "userId" => query.user_id,
        "userName" => query.user.try(:name),
        "userLogin" => query.user.try(:login),
        "userMail" => query.user.try(:mail),
        "filters" => filters,
        "isPublic" => query.is_public.to_s,
        "columnNames" => query.column_names,
        "sortCriteria" => query.sort_criteria,
        "groupBy" => query.group_by,
        "displaySums" => query.display_sums.to_s,
        "isStarred" => "true"
      }
    end

    describe 'public queries' do
      let(:query) { FactoryGirl.create(:public_query, project: project) }

      context 'user with permission to manage public queries' do
        before(:each) do
          allow(User).to receive(:current).and_return current_user
          member = FactoryGirl.build(:member, user: current_user, project: project)
          member.role_ids = [manage_public_queries_role.id]
          member.save!
        end

        context 'when starring an unstarred query' do
          before(:each) { patch star_path }

          it 'should respond with 200' do
            expect(last_response.status).to eq(200)
          end

          it 'should return the query in HAL+JSON format' do
            parsed_response = JSON.parse(last_response.body)
            expect(parsed_response).to eq(expected_response)
          end

          it 'should return the query with "isStarred" property set to true' do
            parsed_response = JSON.parse(last_response.body)
            expect(parsed_response['isStarred']).to eq('true')
          end
        end

        context 'when starring already starred query' do
          before(:each) { patch star_path }

          it 'should respond with 200' do
            expect(last_response.status).to eq(200)
          end

          it 'should return the query in HAL+JSON format' do
            parsed_response = JSON.parse(last_response.body)
            expect(parsed_response).to eq(expected_response)
          end

          it 'should return the query with "isStarred" property set to true' do
            parsed_response = JSON.parse(last_response.body)
            expect(parsed_response['isStarred']).to eq('true')
          end
        end

        context 'when trying to star nonexistent query' do
          let(:star_path) { "/api/v3/queries/999/star" }
          before(:each) { patch star_path }

          it 'should respond with 404' do
            expect(last_response.status).to eq(404)
          end

          it 'should respond with explanatory error message' do
            parsed_errors = JSON.parse(last_response.body)['errors']
            expect(parsed_errors).to eq([{ 'key' => 'not_found', 'messages' => ['Couldn\'t find Query with id=999']}])
          end
        end
      end

      context 'user without permission to manage public queries' do
        before(:each) do
          allow(User).to receive(:current).and_return current_user
          member = FactoryGirl.build(:member, user: current_user, project: project)
          member.role_ids = [role_without_query_permissions.id]
          member.save!
          patch star_path
        end

        it 'should respond with 403' do
          expect(last_response.status).to eq(403)
        end

        it 'should respond with explanatory error message' do
          parsed_errors = JSON.parse(last_response.body)['errors']
          expect(parsed_errors).to eq([{ 'key' => 'not_authorized', 'messages' => ['You are not authorize to access this resource']}])
        end
      end
    end

    describe 'private queries' do
      context 'user with permission to save queries' do
        let(:query) { FactoryGirl.create(:private_query, project: project, user: current_user) }
        before(:each) do
          allow(User).to receive(:current).and_return current_user
          member = FactoryGirl.build(:member, user: current_user, project: project)
          member.role_ids = [save_queries_role.id]
          member.save!
          patch star_path
        end

        context 'starring his own query' do

          it 'should respond with 200' do
            expect(last_response.status).to eq(200)
          end

          it 'should return the query in HAL+JSON format' do
            parsed_response = JSON.parse(last_response.body)
            expect(parsed_response).to eq(expected_response)
          end

          it 'should return the query with "isStarred" property set to true' do
            parsed_response = JSON.parse(last_response.body)
            expect(parsed_response['isStarred']).to eq('true')
          end
        end

        context 'trying to star somebody else\'s query' do
          let(:another_user) { FactoryGirl.create(:user) }
          let(:query) { FactoryGirl.create(:private_query, project: project, user: another_user) }

          it 'should respond with 403' do
            expect(last_response.status).to eq(403)
          end

          it 'should respond with explanatory error message' do
            parsed_errors = JSON.parse(last_response.body)['errors']
            expect(parsed_errors).to eq([{ 'key' => 'not_authorized', 'messages' => ['You are not authorize to access this resource']}])
          end
        end
      end

      context 'user without permission to save queries' do
        let(:query) { FactoryGirl.create(:private_query, project: project, user: current_user) }
        before(:each) do
          allow(User).to receive(:current).and_return current_user
          member = FactoryGirl.build(:member, user: current_user, project: project)
          member.role_ids = [role_without_query_permissions.id]
          member.save!
          patch star_path
        end

        it 'should respond with 403' do
          expect(last_response.status).to eq(403)
        end

        it 'should respond with explanatory error message' do
          parsed_errors = JSON.parse(last_response.body)['errors']
          expect(parsed_errors).to eq([{ 'key' => 'not_authorized', 'messages' => ['You are not authorize to access this resource']}])
        end
      end

    end
  end

  describe '#unstar' do
    let(:unstar_path) { "/api/v3/queries/#{query.id}/unstar" }
    let(:filters) do
        query.filters.map{ |f| {f.field.to_s => { "operator" => f.operator, "values" => f.values }}}
      end
    let(:expected_response) do
      {
        "_type" => 'Query',
        "_links" => {
          "self" => {
            "href" => "/api/v3/queries/#{query.id}",
            "title" => query.name
          }
        },
        "id" => query.id,
        "name" => query.name,
        "projectId" => query.project_id,
        "projectName" => query.project.name,
        "userId" => query.user_id,
        "userName" => query.user.try(:name),
        "userLogin" => query.user.try(:login),
        "userMail" => query.user.try(:mail),
        "filters" => filters,
        "isPublic" => query.is_public.to_s,
        "columnNames" => query.column_names,
        "sortCriteria" => query.sort_criteria,
        "groupBy" => query.group_by,
        "displaySums" => query.display_sums.to_s,
        "isStarred" => "true"
      }
    end

    describe 'public queries' do
      let(:query) { FactoryGirl.create(:public_query, project: project) }

      context 'user with permission to manage public queries' do
        before(:each) do
          allow(User).to receive(:current).and_return current_user
          member = FactoryGirl.build(:member, user: current_user, project: project)
          member.role_ids = [manage_public_queries_role.id]
          member.save!
        end

        context 'when unstarring a starred query' do
          before(:each) do
            FactoryGirl.create(:query_menu_item, query: query)
            patch unstar_path
          end

          it 'should respond with 200' do
            expect(last_response.status).to eq(200)
          end

          it 'should return the query in HAL+JSON format' do
            parsed_response = JSON.parse(last_response.body)
            expect(parsed_response).to eq(expected_response.tap{ |r| r["isStarred"] = "false" })
          end

          it 'should return the query with "isStarred" property set to false' do
            parsed_response = JSON.parse(last_response.body)
            expect(parsed_response['isStarred']).to eq('false')
          end
        end

        context 'when unstarring an unstarred query' do
          before(:each) { patch unstar_path }

          it 'should respond with 200' do
            expect(last_response.status).to eq(200)
          end

          it 'should return the query in HAL+JSON format' do
            parsed_response = JSON.parse(last_response.body)
            expect(parsed_response).to eq(expected_response.tap{ |r| r["isStarred"] = "false" })
          end

          it 'should return the query with "isStarred" property set to true' do
            parsed_response = JSON.parse(last_response.body)
            expect(parsed_response['isStarred']).to eq('false')
          end

        end

        context 'when trying to unstar nonexistent query' do
          let(:unstar_path) { "/api/v3/queries/999/unstar" }
          before(:each) { patch unstar_path }

          it 'should respond with 404' do
            expect(last_response.status).to eq(404)
          end

          it 'should respond with explanatory error message' do
            parsed_errors = JSON.parse(last_response.body)['errors']
            expect(parsed_errors).to eq([{ 'key' => 'not_found', 'messages' => ['Couldn\'t find Query with id=999']}])
          end
        end
      end

      context 'user without permission to manage public queries' do
        before(:each) do
          allow(User).to receive(:current).and_return current_user
          member = FactoryGirl.build(:member, user: current_user, project: project)
          member.role_ids = [role_without_query_permissions.id]
          member.save!
          patch unstar_path
        end

        it 'should respond with 403' do
          expect(last_response.status).to eq(403)
        end

        it 'should respond with explanatory error message' do
          parsed_errors = JSON.parse(last_response.body)['errors']
          expect(parsed_errors).to eq([{ 'key' => 'not_authorized', 'messages' => ['You are not authorize to access this resource']}])
        end
      end
    end

    describe 'private queries' do
      context 'user with permission to save queries' do
        let(:query) { FactoryGirl.create(:private_query, project: project, user: current_user) }
        before(:each) do
          allow(User).to receive(:current).and_return current_user
          member = FactoryGirl.build(:member, user: current_user, project: project)
          member.role_ids = [save_queries_role.id]
          member.save!
          patch unstar_path
        end

        context 'unstarring his own query' do

          it 'should respond with 200' do
            expect(last_response.status).to eq(200)
          end

          it 'should return the query in HAL+JSON format' do
            parsed_response = JSON.parse(last_response.body)
            expect(parsed_response).to eq(expected_response.tap{ |r| r["isStarred"] = "false" })
          end

          it 'should return the query with "isStarred" property set to true' do
            parsed_response = JSON.parse(last_response.body)
            expect(parsed_response['isStarred']).to eq('false')
          end
        end

        context 'trying to unstar somebody else\'s query' do
          let(:another_user) { FactoryGirl.create(:user) }
          let(:query) { FactoryGirl.create(:private_query, project: project, user: another_user) }

          it 'should respond with 403' do
            expect(last_response.status).to eq(403)
          end

          it 'should respond with explanatory error message' do
            parsed_errors = JSON.parse(last_response.body)['errors']
            expect(parsed_errors).to eq([{ 'key' => 'not_authorized', 'messages' => ['You are not authorize to access this resource']}])
          end
        end
      end

      context 'user without permission to save queries' do
        let(:query) { FactoryGirl.create(:private_query, project: project, user: current_user) }
        before(:each) do
          allow(User).to receive(:current).and_return current_user
          member = FactoryGirl.build(:member, user: current_user, project: project)
          member.role_ids = [role_without_query_permissions.id]
          member.save!
          patch unstar_path
        end

        it 'should respond with 403' do
          expect(last_response.status).to eq(403)
        end

        it 'should respond with explanatory error message' do
          parsed_errors = JSON.parse(last_response.body)['errors']
          expect(parsed_errors).to eq([{ 'key' => 'not_authorized', 'messages' => ['You are not authorize to access this resource']}])
        end
      end
    end

  end
end