Add link to delete an attachment to its representer

doc/apiv3-documentation.apib

@@ -714,6 +714,12 @@ Updates an activity's comment and, on success, returns the updated activity.
 Attachments are files that were uploaded to OpenProject. Each attachment belongs to a single
 container (e.g. a work package or a board message).
 
+## Actions
+
+| Link                | Description                                                          | Condition                                    |
+|:-------------------:|----------------------------------------------------------------------| -------------------------------------------- |
+| delete              | Deletes this attachment                                              | **Permission**: edit on attachment container |
+
 ## Linked Properties
 |  Link            | Description                                         | Type          | Constraints | Supported operations |
 |:----------------:| --------------------------------------------------- | ------------- | ----------- | -------------------- |

lib/api/v3/attachments/attachment_representer.rb

@@ -50,6 +50,14 @@ module API
           }
         end
 
+        # visibility of this link is also work_package specific!
+        link :delete do
+          {
+            href: api_v3_paths.attachment(represented.id),
+            method: :delete
+          } if current_user_allowed_to(:edit_work_packages, context: represented.container.project)
+        end
+
         property :id
         property :file_name,
                  getter: -> (*) { filename }

spec/lib/api/v3/attachments/attachment_representer_spec.rb

@@ -31,8 +31,20 @@ require 'spec_helper'
 describe ::API::V3::Attachments::AttachmentRepresenter do
   include API::V3::Utilities::PathHelper
 
-  let(:attachment) { FactoryGirl.create(:attachment) }
+  let(:current_user) {
-  let(:representer) { ::API::V3::Attachments::AttachmentRepresenter.new(attachment) }
+    FactoryGirl.create(:user, member_in_project: project, member_through_role: role)
+  }
+  let(:project) { FactoryGirl.create(:project) }
+  let(:role) { FactoryGirl.create(:role, permissions: permissions) }
+  let(:all_permissions) { [:view_work_packages, :edit_work_packages] }
+  let(:permissions) { all_permissions }
+
+  let(:container) { FactoryGirl.create(:work_package, project: project) }
+
+  let(:attachment) { FactoryGirl.create(:attachment, container: container) }
+  let(:representer) {
+    ::API::V3::Attachments::AttachmentRepresenter.new(attachment, current_user: current_user)
+  }
 
   subject { representer.to_json }
 
@@ -76,5 +88,24 @@ describe ::API::V3::Attachments::AttachmentRepresenter do
       let(:href) { api_v3_paths.user(attachment.author.id) }
       let(:title) { attachment.author.name }
     end
+
+    describe 'delete link' do
+      it_behaves_like 'has an untitled link' do
+        let(:link) { 'delete' }
+        let(:href) { api_v3_paths.attachment(attachment.id) }
+      end
+
+      it 'has the DELETE method' do
+        is_expected.to be_json_eql('delete'.to_json).at_path('_links/delete/method')
+      end
+
+      context 'user is not allowed to edit the container' do
+        let(:permissions) { all_permissions - [:edit_work_packages] }
+
+        it_behaves_like 'has no link' do
+          let(:link) { 'delete' }
+        end
+      end
+    end
   end
 end