Template for tests

config/routes.rb

@@ -30,7 +30,7 @@
 
 OpenProject::Application.routes.draw do
   root :to => 'welcome#index', :as => 'home'
-
+  mount API::Root => '/'
   rails_relative_url_root = OpenProject::Configuration['rails_relative_url_root'] || ''
 
   # Redirect deprecated issue links to new work packages uris
@@ -113,7 +113,7 @@ OpenProject::Application.routes.draw do
 
     end
 
-    namespace :v3_experimental do
+    namespace :v3 do
       resources :work_packages, only: [:index] do
         get :column_data, on: :collection
         get :column_sums, on: :collection
@@ -519,6 +519,4 @@ OpenProject::Application.routes.draw do
   match '/:controller(/:action(/:id))'
   match '/robots' => 'welcome#robots', :defaults => { :format => :txt }
   root :to => 'account#login'
-
-  mount API::Root => '/'
 end

lib/api/v3/queries/queries_api.rb

@@ -17,7 +17,7 @@ module API
             end
 
             patch :star do
-              # authorize(:queries_api, :patch, @query.project)
+              authorize(:queries_api, :star, @query.project)
               normalized_query_name = @query.name.parameterize.underscore
               query_menu_item = MenuItems::QueryMenuItem.find_or_initialize_by_name_and_navigatable_id normalized_query_name, @query.id, title: @query.name
 
@@ -30,6 +30,7 @@ module API
             end
 
             patch :unstar do
+              authorize(:queries_api, :unstar, @query.project)
               query_menu_item = @query.query_menu_item
               query_menu_item.destroy
               @representer.to_json

lib/redmine.rb

@@ -109,7 +109,7 @@ Redmine::AccessControl.map do |map|
                                          :queries => [:index, :create, :update, :available_columns, :custom_field_filters, :grouped],
                                          :work_packages => [:show, :index],
                                          :work_packages_api => [:get],
-                                         :queries_api => [:get],
+                                         :queries_api => [:star, :unstar],
                                          :'work_packages/reports' => [:report, :report_details],
                                          :planning_elements => [:index, :all, :show, :recycle_bin],
                                          :planning_element_journals => [:index]}

spec/api/query_resource_spec.rb

@@ -12,58 +12,19 @@ describe 'API v3 Query resource' do
   let(:query) { FactoryGirl.create(:public_query) }
   let(:private_query) { FactoryGirl.create(:private_query, project: project) }
 
-  describe '#get' do
-    let(:get_path) { "/api/v3/queries/#{private_query.id}" }
-    let(:expected_response) do
-      {
-        "_type" => 'Query',
-        "_links" => {
-          "self" => {
-            "href" => "http://localhost:3000/api/v3/queries/#{private_query.id}",
-            "title" => private_query.name
-          }
-        },
-        "id" => private_query.id,
-        "name" => private_query.name,
-        "projectId" => private_query.project_id,
-        "projectName" => private_query.project.name,
-        "userId" => private_query.user_id,
-        "userName" => private_query.user.try(:name),
-        "userLogin" => private_query.user.try(:login),
-        "userMail" => private_query.user.try(:mail),
-        "filters" => private_query.filters,
-        "isPublic" => private_query.is_public.to_s,
-        "columnNames" => private_query.column_names,
-        "sortCriteria" => private_query.sort_criteria,
-        "groupBy" => private_query.group_by,
-        "displaySums" => private_query.display_sums.to_s
-      }
-    end
+  describe '#star' do
+    context 'anonymous user' do
 
-    context 'accessing private queries' do
-      context 'when acting as a user with permission to view query' do
-        before(:each) do
-          allow(User).to receive(:current).and_return current_user
-          member = FactoryGirl.build(:member, user: current_user, project: work_package.project)
-          member.role_ids = [role.id]
-          member.save!
-          get get_path
-        end
+    end
 
-        it 'should respond with 200' do
-          last_response.status.should eq(200)
-        end
+    context 'user with permissions for the project' do
 
-        it 'should respond with work package in HAL+JSON format' do
-          parsed_response = JSON.parse(last_response.body)
-          parsed_response.should eq(expected_response)
-        end
-      end
     end
 
+    context 'user without permissions for the project'
   end
 
-  describe '#star' do
+  describe '#unstar' do
 
   end
 end