Till Breuer
11 years ago
commit
8df7b9f6f3
Binary file not shown.
|
Before Width: | Height: | Size: 76 KiB After Width: | Height: | Size: 79 KiB |
Binary file not shown.
Binary file not shown.
@ -0,0 +1,125 @@ |
|||||||
|
#-- copyright |
||||||
|
# OpenProject is a project management system. |
||||||
|
# Copyright (C) 2012-2014 the OpenProject Foundation (OPF) |
||||||
|
# |
||||||
|
# This program is free software; you can redistribute it and/or |
||||||
|
# modify it under the terms of the GNU General Public License version 3. |
||||||
|
# |
||||||
|
# OpenProject is a fork of ChiliProject, which is a fork of Redmine. The copyright follows: |
||||||
|
# Copyright (C) 2006-2013 Jean-Philippe Lang |
||||||
|
# Copyright (C) 2010-2013 the ChiliProject Team |
||||||
|
# |
||||||
|
# This program is free software; you can redistribute it and/or |
||||||
|
# modify it under the terms of the GNU General Public License |
||||||
|
# as published by the Free Software Foundation; either version 2 |
||||||
|
# of the License, or (at your option) any later version. |
||||||
|
# |
||||||
|
# This program is distributed in the hope that it will be useful, |
||||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||||
|
# GNU General Public License for more details. |
||||||
|
# |
||||||
|
# You should have received a copy of the GNU General Public License |
||||||
|
# along with this program; if not, write to the Free Software |
||||||
|
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. |
||||||
|
# |
||||||
|
# See doc/COPYRIGHT.rdoc for more details. |
||||||
|
#++ |
||||||
|
|
||||||
|
# This capsulates permissions a user has for a work package. It caches based |
||||||
|
# on the work package's project and is thus optimized for the context menu. |
||||||
|
# |
||||||
|
# This is no conern but it was placed here so that it will be removed together |
||||||
|
# with the rest of the experimental API. |
||||||
|
|
||||||
|
module Api |
||||||
|
module Experimental |
||||||
|
module Concerns |
||||||
|
class Can |
||||||
|
attr_accessor :user |
||||||
|
|
||||||
|
def initialize(user) |
||||||
|
self.user = user |
||||||
|
end |
||||||
|
|
||||||
|
def actions(wp) |
||||||
|
cache[wp].each_with_object([]) { |(k, v), a| a << k if v } |
||||||
|
end |
||||||
|
|
||||||
|
def allowed?(work_package, action) |
||||||
|
cache[work_package][action] |
||||||
|
end |
||||||
|
|
||||||
|
private |
||||||
|
|
||||||
|
def cache |
||||||
|
@cache ||= Hash.new do |hash, work_package| |
||||||
|
# copy checks for the move_work_packages permission. This makes |
||||||
|
# sense only because the work_packages/moves controller handles |
||||||
|
# copying multiple work packages. |
||||||
|
hash[work_package] = { |
||||||
|
:edit => edit_allowed?(work_package), |
||||||
|
:log_time => log_time_allowed?(work_package), |
||||||
|
:move => move_allowed?(work_package), |
||||||
|
:copy => move_allowed?(work_package), |
||||||
|
:duplicate => copy_allowed?(work_package), # duplicating is another form of copying |
||||||
|
:delete => delete_allowed?(work_package) |
||||||
|
} |
||||||
|
end |
||||||
|
end |
||||||
|
|
||||||
|
def edit_allowed?(work_package) |
||||||
|
@edit_cache ||= Hash.new do |hash, project| |
||||||
|
hash[project] = user.allowed_to?(:edit_work_packages, project) |
||||||
|
end |
||||||
|
|
||||||
|
@edit_cache[work_package.project] || work_package.new_statuses_allowed_to(user).present? |
||||||
|
end |
||||||
|
|
||||||
|
def log_time_allowed?(work_package) |
||||||
|
@log_time_cache ||= Hash.new do |hash, project| |
||||||
|
hash[project] = user.allowed_to?(:log_time, project) |
||||||
|
end |
||||||
|
|
||||||
|
@log_time_cache[work_package.project] |
||||||
|
end |
||||||
|
|
||||||
|
def move_allowed?(work_package) |
||||||
|
@move_cache ||= Hash.new do |hash, project| |
||||||
|
hash[project] = user.allowed_to?(:move_work_packages, project) |
||||||
|
end |
||||||
|
|
||||||
|
@move_cache[work_package.project] |
||||||
|
end |
||||||
|
|
||||||
|
def copy_allowed?(work_package) |
||||||
|
type_active_in_project?(work_package) && add_allowed?(work_package) |
||||||
|
end |
||||||
|
|
||||||
|
def delete_allowed?(work_package) |
||||||
|
@delete_cache ||= Hash.new do |hash, project| |
||||||
|
hash[project] = user.allowed_to?(:delete_work_packages, project) |
||||||
|
end |
||||||
|
|
||||||
|
@delete_cache[work_package.project] |
||||||
|
end |
||||||
|
|
||||||
|
def add_allowed?(work_package) |
||||||
|
@add_cache ||= Hash.new do |hash, project| |
||||||
|
hash[project] = user.allowed_to?(:add_work_packages, project) |
||||||
|
end |
||||||
|
|
||||||
|
@add_cache[work_package.project] |
||||||
|
end |
||||||
|
|
||||||
|
def type_active_in_project?(work_package) |
||||||
|
@type_active_cache ||= Hash.new do |hash, project| |
||||||
|
hash[project] = project.types.pluck(:id) |
||||||
|
end |
||||||
|
|
||||||
|
@type_active_cache[work_package.project].include?(work_package.type_id) |
||||||
|
end |
||||||
|
end |
||||||
|
end |
||||||
|
end |
||||||
|
end |
||||||
@ -0,0 +1,38 @@ |
|||||||
|
#-- encoding: UTF-8 |
||||||
|
#-- copyright |
||||||
|
# OpenProject is a project management system. |
||||||
|
# Copyright (C) 2012-2014 the OpenProject Foundation (OPF) |
||||||
|
# |
||||||
|
# This program is free software; you can redistribute it and/or |
||||||
|
# modify it under the terms of the GNU General Public License version 3. |
||||||
|
# |
||||||
|
# OpenProject is a fork of ChiliProject, which is a fork of Redmine. The copyright follows: |
||||||
|
# Copyright (C) 2006-2013 Jean-Philippe Lang |
||||||
|
# Copyright (C) 2010-2013 the ChiliProject Team |
||||||
|
# |
||||||
|
# This program is free software; you can redistribute it and/or |
||||||
|
# modify it under the terms of the GNU General Public License |
||||||
|
# as published by the Free Software Foundation; either version 2 |
||||||
|
# of the License, or (at your option) any later version. |
||||||
|
# |
||||||
|
# This program is distributed in the hope that it will be useful, |
||||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||||
|
# GNU General Public License for more details. |
||||||
|
# |
||||||
|
# You should have received a copy of the GNU General Public License |
||||||
|
# along with this program; if not, write to the Free Software |
||||||
|
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. |
||||||
|
# |
||||||
|
# See doc/COPYRIGHT.rdoc for more details. |
||||||
|
#++ |
||||||
|
|
||||||
|
|
||||||
|
class ChangeAttachmentJournalsDescriptionLength < ActiveRecord::Migration |
||||||
|
def change |
||||||
|
change_column :attachment_journals, |
||||||
|
:description, |
||||||
|
:text |
||||||
|
end |
||||||
|
end |
||||||
|
|
||||||
@ -0,0 +1,52 @@ |
|||||||
|
module API |
||||||
|
module V3 |
||||||
|
module Queries |
||||||
|
class QueriesAPI < Grape::API |
||||||
|
|
||||||
|
resources :queries do |
||||||
|
|
||||||
|
params do |
||||||
|
requires :id, desc: 'Query id' |
||||||
|
end |
||||||
|
namespace ':id' do |
||||||
|
|
||||||
|
before do |
||||||
|
@query = Query.find(params[:id]) |
||||||
|
model = QueryModel.new(query: @query) |
||||||
|
@representer = QueryRepresenter.new(model) |
||||||
|
end |
||||||
|
|
||||||
|
helpers do |
||||||
|
def allowed_to_manage_stars? |
||||||
|
(@query.is_public? && current_user.allowed_to?(:manage_public_queries, @query.project)) || |
||||||
|
(!@query.is_public? && (current_user.admin? || |
||||||
|
(current_user.allowed_to?(:save_queries, @query.project) && @query.user_id == current_user.id))) |
||||||
|
end |
||||||
|
end |
||||||
|
|
||||||
|
patch :star do |
||||||
|
authorize(:queries, :star, project: @query.project, allow: allowed_to_manage_stars?) |
||||||
|
normalized_query_name = @query.name.parameterize.underscore |
||||||
|
query_menu_item = MenuItems::QueryMenuItem.find_or_initialize_by_name_and_navigatable_id( |
||||||
|
normalized_query_name, @query.id, title: @query.name |
||||||
|
) |
||||||
|
query_menu_item.save! |
||||||
|
@representer.to_json |
||||||
|
end |
||||||
|
|
||||||
|
patch :unstar do |
||||||
|
authorize(:queries, :unstar, project: @query.project, allow: allowed_to_manage_stars?) |
||||||
|
query_menu_item = @query.query_menu_item |
||||||
|
return @representer.to_json if @query.query_menu_item.nil? |
||||||
|
query_menu_item.destroy |
||||||
|
@query.reload |
||||||
|
@representer.to_json |
||||||
|
end |
||||||
|
end |
||||||
|
|
||||||
|
end |
||||||
|
|
||||||
|
end |
||||||
|
end |
||||||
|
end |
||||||
|
end |
||||||
@ -0,0 +1,54 @@ |
|||||||
|
#-- encoding: UTF-8 |
||||||
|
#-- copyright |
||||||
|
# OpenProject is a project management system. |
||||||
|
# Copyright (C) 2012-2014 the OpenProject Foundation (OPF) |
||||||
|
# |
||||||
|
# This program is free software; you can redistribute it and/or |
||||||
|
# modify it under the terms of the GNU General Public License version 3. |
||||||
|
# |
||||||
|
# OpenProject is a fork of ChiliProject, which is a fork of Redmine. The copyright follows: |
||||||
|
# Copyright (C) 2006-2013 Jean-Philippe Lang |
||||||
|
# Copyright (C) 2010-2013 the ChiliProject Team |
||||||
|
# |
||||||
|
# This program is free software; you can redistribute it and/or |
||||||
|
# modify it under the terms of the GNU General Public License |
||||||
|
# as published by the Free Software Foundation; either version 2 |
||||||
|
# of the License, or (at your option) any later version. |
||||||
|
# |
||||||
|
# This program is distributed in the hope that it will be useful, |
||||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||||
|
# GNU General Public License for more details. |
||||||
|
# |
||||||
|
# You should have received a copy of the GNU General Public License |
||||||
|
# along with this program; if not, write to the Free Software |
||||||
|
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. |
||||||
|
# |
||||||
|
# See doc/COPYRIGHT.rdoc for more details. |
||||||
|
#++ |
||||||
|
|
||||||
|
require 'reform' |
||||||
|
require 'reform/form/coercion' |
||||||
|
|
||||||
|
module API |
||||||
|
module V3 |
||||||
|
module Queries |
||||||
|
class QueryModel < Reform::Form |
||||||
|
include Composition |
||||||
|
include Coercion |
||||||
|
|
||||||
|
model :query |
||||||
|
|
||||||
|
property :name, on: :query, type: String |
||||||
|
property :project_id, on: :query, type: Integer |
||||||
|
property :user_id, on: :query, type: Integer |
||||||
|
property :filters, on: :query, type: String |
||||||
|
property :is_public, on: :query, type: String |
||||||
|
property :column_names, on: :query, type: String |
||||||
|
property :sort_criteria, on: :query, type: String |
||||||
|
property :group_by, on: :query, type: String |
||||||
|
property :display_sums, on: :query, type: String |
||||||
|
end |
||||||
|
end |
||||||
|
end |
||||||
|
end |
||||||
@ -0,0 +1,76 @@ |
|||||||
|
#-- encoding: UTF-8 |
||||||
|
#-- copyright |
||||||
|
# OpenProject is a project management system. |
||||||
|
# Copyright (C) 2012-2014 the OpenProject Foundation (OPF) |
||||||
|
# |
||||||
|
# This program is free software; you can redistribute it and/or |
||||||
|
# modify it under the terms of the GNU General Public License version 3. |
||||||
|
# |
||||||
|
# OpenProject is a fork of ChiliProject, which is a fork of Redmine. The copyright follows: |
||||||
|
# Copyright (C) 2006-2013 Jean-Philippe Lang |
||||||
|
# Copyright (C) 2010-2013 the ChiliProject Team |
||||||
|
# |
||||||
|
# This program is free software; you can redistribute it and/or |
||||||
|
# modify it under the terms of the GNU General Public License |
||||||
|
# as published by the Free Software Foundation; either version 2 |
||||||
|
# of the License, or (at your option) any later version. |
||||||
|
# |
||||||
|
# This program is distributed in the hope that it will be useful, |
||||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of |
||||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||||||
|
# GNU General Public License for more details. |
||||||
|
# |
||||||
|
# You should have received a copy of the GNU General Public License |
||||||
|
# along with this program; if not, write to the Free Software |
||||||
|
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. |
||||||
|
# |
||||||
|
# See doc/COPYRIGHT.rdoc for more details. |
||||||
|
#++ |
||||||
|
|
||||||
|
require 'roar/decorator' |
||||||
|
require 'roar/representer/json/hal' |
||||||
|
|
||||||
|
module API |
||||||
|
module V3 |
||||||
|
module Queries |
||||||
|
class QueryRepresenter < Roar::Decorator |
||||||
|
include Roar::Representer::JSON::HAL |
||||||
|
include Roar::Representer::Feature::Hypermedia |
||||||
|
include Rails.application.routes.url_helpers |
||||||
|
|
||||||
|
self.as_strategy = API::Utilities::CamelCasingStrategy.new |
||||||
|
|
||||||
|
property :_type, exec_context: :decorator |
||||||
|
|
||||||
|
link :self do |
||||||
|
{ href: "http://localhost:3000/api/v3/queries/#{represented.query.id}", title: "#{represented.name}" } |
||||||
|
end |
||||||
|
|
||||||
|
property :id, getter: -> (*) { query.id }, render_nil: true |
||||||
|
property :name, render_nil: true |
||||||
|
property :project_id, getter: -> (*) { query.project.id } |
||||||
|
property :project_name, getter: -> (*) { query.project.try(:name) } |
||||||
|
property :user_id, getter: -> (*) { query.user.try(:id) }, render_nil: true |
||||||
|
property :user_name, getter: -> (*) { query.user.try(:name) }, render_nil: true |
||||||
|
property :user_login, getter: -> (*) { query.user.try(:login) }, render_nil: true |
||||||
|
property :user_mail, getter: -> (*) { query.user.try(:mail) }, render_nil: true |
||||||
|
property :filters, render_nil: true |
||||||
|
property :is_public, getter: -> (*) { query.is_public.to_s }, render_nil: true |
||||||
|
property :column_names, render_nil: true |
||||||
|
property :sort_criteria, render_nil: true |
||||||
|
property :group_by, render_nil: true |
||||||
|
property :display_sums, getter: -> (*) { query.display_sums.to_s }, render_nil: true |
||||||
|
property :is_starred, getter: -> (*) { is_starred.to_s }, exec_context: :decorator |
||||||
|
|
||||||
|
def _type |
||||||
|
"Query" |
||||||
|
end |
||||||
|
|
||||||
|
def is_starred |
||||||
|
return true if !represented.query.query_menu_item.nil? |
||||||
|
false |
||||||
|
end |
||||||
|
end |
||||||
|
end |
||||||
|
end |
||||||
|
end |
||||||
@ -0,0 +1,377 @@ |
|||||||
|
require 'spec_helper' |
||||||
|
require 'rack/test' |
||||||
|
|
||||||
|
describe 'API v3 Query resource' do |
||||||
|
include Rack::Test::Methods |
||||||
|
|
||||||
|
let(:project) { FactoryGirl.create(:project, :identifier => 'test_project', :is_public => false) } |
||||||
|
let(:current_user) { FactoryGirl.create(:user) } |
||||||
|
let(:manage_public_queries_role) { FactoryGirl.create(:role, permissions: [:manage_public_queries]) } |
||||||
|
let(:save_queries_role) { FactoryGirl.create(:role, permissions: [:save_queries]) } |
||||||
|
let(:role_without_query_permissions) { FactoryGirl.create(:role, permissions: [:view_work_packages]) } |
||||||
|
let(:unauthorize_user) { FactoryGirl.create(:user) } |
||||||
|
|
||||||
|
describe '#star' do |
||||||
|
let(:star_path) { "/api/v3/queries/#{query.id}/star" } |
||||||
|
let(:filters) do |
||||||
|
query.filters.map{ |f| {f.field.to_s => { "operator" => f.operator, "values" => f.values }}} |
||||||
|
end |
||||||
|
let(:expected_response) do |
||||||
|
{ |
||||||
|
"_type" => 'Query', |
||||||
|
"_links" => { |
||||||
|
"self" => { |
||||||
|
"href" => "http://localhost:3000/api/v3/queries/#{query.id}", |
||||||
|
"title" => query.name |
||||||
|
} |
||||||
|
}, |
||||||
|
"id" => query.id, |
||||||
|
"name" => query.name, |
||||||
|
"projectId" => query.project_id, |
||||||
|
"projectName" => query.project.name, |
||||||
|
"userId" => query.user_id, |
||||||
|
"userName" => query.user.try(:name), |
||||||
|
"userLogin" => query.user.try(:login), |
||||||
|
"userMail" => query.user.try(:mail), |
||||||
|
"filters" => filters, |
||||||
|
"isPublic" => query.is_public.to_s, |
||||||
|
"columnNames" => query.column_names, |
||||||
|
"sortCriteria" => query.sort_criteria, |
||||||
|
"groupBy" => query.group_by, |
||||||
|
"displaySums" => query.display_sums.to_s, |
||||||
|
"isStarred" => "true" |
||||||
|
} |
||||||
|
end |
||||||
|
|
||||||
|
describe 'public queries' do |
||||||
|
let(:query) { FactoryGirl.create(:public_query, project: project) } |
||||||
|
|
||||||
|
context 'user with permission to manage public queries' do |
||||||
|
before(:each) do |
||||||
|
allow(User).to receive(:current).and_return current_user |
||||||
|
member = FactoryGirl.build(:member, user: current_user, project: project) |
||||||
|
member.role_ids = [manage_public_queries_role.id] |
||||||
|
member.save! |
||||||
|
end |
||||||
|
|
||||||
|
context 'when starring an unstarred query' do |
||||||
|
before(:each) { patch star_path } |
||||||
|
|
||||||
|
it 'should respond with 200' do |
||||||
|
last_response.status.should eq(200) |
||||||
|
end |
||||||
|
|
||||||
|
it 'should return the query in HAL+JSON format' do |
||||||
|
parsed_response = JSON.parse(last_response.body) |
||||||
|
parsed_response.should eq(expected_response) |
||||||
|
end |
||||||
|
|
||||||
|
it 'should return the query with "isStarred" property set to true' do |
||||||
|
parsed_response = JSON.parse(last_response.body) |
||||||
|
parsed_response['isStarred'].should eq('true') |
||||||
|
end |
||||||
|
end |
||||||
|
|
||||||
|
context 'when starring already starred query' do |
||||||
|
before(:each) { patch star_path } |
||||||
|
|
||||||
|
it 'should respond with 200' do |
||||||
|
last_response.status.should eq(200) |
||||||
|
end |
||||||
|
|
||||||
|
it 'should return the query in HAL+JSON format' do |
||||||
|
parsed_response = JSON.parse(last_response.body) |
||||||
|
parsed_response.should eq(expected_response) |
||||||
|
end |
||||||
|
|
||||||
|
it 'should return the query with "isStarred" property set to true' do |
||||||
|
parsed_response = JSON.parse(last_response.body) |
||||||
|
parsed_response['isStarred'].should eq('true') |
||||||
|
end |
||||||
|
end |
||||||
|
|
||||||
|
context 'when trying to star nonexistent query' do |
||||||
|
let(:star_path) { "/api/v3/queries/999/star" } |
||||||
|
before(:each) { patch star_path } |
||||||
|
|
||||||
|
it 'should respond with 404' do |
||||||
|
last_response.status.should eq(404) |
||||||
|
end |
||||||
|
|
||||||
|
it 'should respond with explanatory error message' do |
||||||
|
parsed_errors = JSON.parse(last_response.body)['errors'] |
||||||
|
parsed_errors.should eq([{ 'key' => 'not_found', 'messages' => ['Couldn\'t find Query with id=999']}]) |
||||||
|
end |
||||||
|
end |
||||||
|
end |
||||||
|
|
||||||
|
context 'user without permission to manage public queries' do |
||||||
|
before(:each) do |
||||||
|
allow(User).to receive(:current).and_return current_user |
||||||
|
member = FactoryGirl.build(:member, user: current_user, project: project) |
||||||
|
member.role_ids = [role_without_query_permissions.id] |
||||||
|
member.save! |
||||||
|
patch star_path |
||||||
|
end |
||||||
|
|
||||||
|
it 'should respond with 403' do |
||||||
|
last_response.status.should eq(403) |
||||||
|
end |
||||||
|
|
||||||
|
it 'should respond with explanatory error message' do |
||||||
|
parsed_errors = JSON.parse(last_response.body)['errors'] |
||||||
|
parsed_errors.should eq([{ 'key' => 'not_authorized', 'messages' => ['You are not authorize to access this resource']}]) |
||||||
|
end |
||||||
|
end |
||||||
|
end |
||||||
|
|
||||||
|
describe 'private queries' do |
||||||
|
context 'user with permission to save queries' do |
||||||
|
let(:query) { FactoryGirl.create(:private_query, project: project, user: current_user) } |
||||||
|
before(:each) do |
||||||
|
allow(User).to receive(:current).and_return current_user |
||||||
|
member = FactoryGirl.build(:member, user: current_user, project: project) |
||||||
|
member.role_ids = [save_queries_role.id] |
||||||
|
member.save! |
||||||
|
patch star_path |
||||||
|
end |
||||||
|
|
||||||
|
context 'starring his own query' do |
||||||
|
|
||||||
|
it 'should respond with 200' do |
||||||
|
last_response.status.should eq(200) |
||||||
|
end |
||||||
|
|
||||||
|
it 'should return the query in HAL+JSON format' do |
||||||
|
parsed_response = JSON.parse(last_response.body) |
||||||
|
parsed_response.should eq(expected_response) |
||||||
|
end |
||||||
|
|
||||||
|
it 'should return the query with "isStarred" property set to true' do |
||||||
|
parsed_response = JSON.parse(last_response.body) |
||||||
|
parsed_response['isStarred'].should eq('true') |
||||||
|
end |
||||||
|
end |
||||||
|
|
||||||
|
context 'trying to star somebody else\'s query' do |
||||||
|
let(:another_user) { FactoryGirl.create(:user) } |
||||||
|
let(:query) { FactoryGirl.create(:private_query, project: project, user: another_user) } |
||||||
|
|
||||||
|
it 'should respond with 403' do |
||||||
|
last_response.status.should eq(403) |
||||||
|
end |
||||||
|
|
||||||
|
it 'should respond with explanatory error message' do |
||||||
|
parsed_errors = JSON.parse(last_response.body)['errors'] |
||||||
|
parsed_errors.should eq([{ 'key' => 'not_authorized', 'messages' => ['You are not authorize to access this resource']}]) |
||||||
|
end |
||||||
|
end |
||||||
|
end |
||||||
|
|
||||||
|
context 'user without permission to save queries' do |
||||||
|
let(:query) { FactoryGirl.create(:private_query, project: project, user: current_user) } |
||||||
|
before(:each) do |
||||||
|
allow(User).to receive(:current).and_return current_user |
||||||
|
member = FactoryGirl.build(:member, user: current_user, project: project) |
||||||
|
member.role_ids = [role_without_query_permissions.id] |
||||||
|
member.save! |
||||||
|
patch star_path |
||||||
|
end |
||||||
|
|
||||||
|
it 'should respond with 403' do |
||||||
|
last_response.status.should eq(403) |
||||||
|
end |
||||||
|
|
||||||
|
it 'should respond with explanatory error message' do |
||||||
|
parsed_errors = JSON.parse(last_response.body)['errors'] |
||||||
|
parsed_errors.should eq([{ 'key' => 'not_authorized', 'messages' => ['You are not authorize to access this resource']}]) |
||||||
|
end |
||||||
|
end |
||||||
|
|
||||||
|
end |
||||||
|
end |
||||||
|
|
||||||
|
describe '#unstar' do |
||||||
|
let(:unstar_path) { "/api/v3/queries/#{query.id}/unstar" } |
||||||
|
let(:filters) do |
||||||
|
query.filters.map{ |f| {f.field.to_s => { "operator" => f.operator, "values" => f.values }}} |
||||||
|
end |
||||||
|
let(:expected_response) do |
||||||
|
{ |
||||||
|
"_type" => 'Query', |
||||||
|
"_links" => { |
||||||
|
"self" => { |
||||||
|
"href" => "http://localhost:3000/api/v3/queries/#{query.id}", |
||||||
|
"title" => query.name |
||||||
|
} |
||||||
|
}, |
||||||
|
"id" => query.id, |
||||||
|
"name" => query.name, |
||||||
|
"projectId" => query.project_id, |
||||||
|
"projectName" => query.project.name, |
||||||
|
"userId" => query.user_id, |
||||||
|
"userName" => query.user.try(:name), |
||||||
|
"userLogin" => query.user.try(:login), |
||||||
|
"userMail" => query.user.try(:mail), |
||||||
|
"filters" => filters, |
||||||
|
"isPublic" => query.is_public.to_s, |
||||||
|
"columnNames" => query.column_names, |
||||||
|
"sortCriteria" => query.sort_criteria, |
||||||
|
"groupBy" => query.group_by, |
||||||
|
"displaySums" => query.display_sums.to_s, |
||||||
|
"isStarred" => "true" |
||||||
|
} |
||||||
|
end |
||||||
|
|
||||||
|
describe 'public queries' do |
||||||
|
let(:query) { FactoryGirl.create(:public_query, project: project) } |
||||||
|
|
||||||
|
context 'user with permission to manage public queries' do |
||||||
|
before(:each) do |
||||||
|
allow(User).to receive(:current).and_return current_user |
||||||
|
member = FactoryGirl.build(:member, user: current_user, project: project) |
||||||
|
member.role_ids = [manage_public_queries_role.id] |
||||||
|
member.save! |
||||||
|
end |
||||||
|
|
||||||
|
context 'when unstarring a starred query' do |
||||||
|
before(:each) do |
||||||
|
FactoryGirl.create(:query_menu_item, query: query) |
||||||
|
patch unstar_path |
||||||
|
end |
||||||
|
|
||||||
|
it 'should respond with 200' do |
||||||
|
last_response.status.should eq(200) |
||||||
|
end |
||||||
|
|
||||||
|
it 'should return the query in HAL+JSON format' do |
||||||
|
parsed_response = JSON.parse(last_response.body) |
||||||
|
parsed_response.should eq(expected_response.tap{ |r| r["isStarred"] = "false" }) |
||||||
|
end |
||||||
|
|
||||||
|
it 'should return the query with "isStarred" property set to false' do |
||||||
|
parsed_response = JSON.parse(last_response.body) |
||||||
|
parsed_response['isStarred'].should eq('false') |
||||||
|
end |
||||||
|
end |
||||||
|
|
||||||
|
context 'when unstarring an unstarred query' do |
||||||
|
before(:each) { patch unstar_path } |
||||||
|
|
||||||
|
it 'should respond with 200' do |
||||||
|
last_response.status.should eq(200) |
||||||
|
end |
||||||
|
|
||||||
|
it 'should return the query in HAL+JSON format' do |
||||||
|
parsed_response = JSON.parse(last_response.body) |
||||||
|
parsed_response.should eq(expected_response.tap{ |r| r["isStarred"] = "false" }) |
||||||
|
end |
||||||
|
|
||||||
|
it 'should return the query with "isStarred" property set to true' do |
||||||
|
parsed_response = JSON.parse(last_response.body) |
||||||
|
parsed_response['isStarred'].should eq('false') |
||||||
|
end |
||||||
|
|
||||||
|
end |
||||||
|
|
||||||
|
context 'when trying to unstar nonexistent query' do |
||||||
|
let(:unstar_path) { "/api/v3/queries/999/unstar" } |
||||||
|
before(:each) { patch unstar_path } |
||||||
|
|
||||||
|
it 'should respond with 404' do |
||||||
|
last_response.status.should eq(404) |
||||||
|
end |
||||||
|
|
||||||
|
it 'should respond with explanatory error message' do |
||||||
|
parsed_errors = JSON.parse(last_response.body)['errors'] |
||||||
|
parsed_errors.should eq([{ 'key' => 'not_found', 'messages' => ['Couldn\'t find Query with id=999']}]) |
||||||
|
end |
||||||
|
end |
||||||
|
end |
||||||
|
|
||||||
|
context 'user without permission to manage public queries' do |
||||||
|
before(:each) do |
||||||
|
allow(User).to receive(:current).and_return current_user |
||||||
|
member = FactoryGirl.build(:member, user: current_user, project: project) |
||||||
|
member.role_ids = [role_without_query_permissions.id] |
||||||
|
member.save! |
||||||
|
patch unstar_path |
||||||
|
end |
||||||
|
|
||||||
|
it 'should respond with 403' do |
||||||
|
last_response.status.should eq(403) |
||||||
|
end |
||||||
|
|
||||||
|
it 'should respond with explanatory error message' do |
||||||
|
parsed_errors = JSON.parse(last_response.body)['errors'] |
||||||
|
parsed_errors.should eq([{ 'key' => 'not_authorized', 'messages' => ['You are not authorize to access this resource']}]) |
||||||
|
end |
||||||
|
end |
||||||
|
end |
||||||
|
|
||||||
|
describe 'private queries' do |
||||||
|
context 'user with permission to save queries' do |
||||||
|
let(:query) { FactoryGirl.create(:private_query, project: project, user: current_user) } |
||||||
|
before(:each) do |
||||||
|
allow(User).to receive(:current).and_return current_user |
||||||
|
member = FactoryGirl.build(:member, user: current_user, project: project) |
||||||
|
member.role_ids = [save_queries_role.id] |
||||||
|
member.save! |
||||||
|
patch unstar_path |
||||||
|
end |
||||||
|
|
||||||
|
context 'unstarring his own query' do |
||||||
|
|
||||||
|
it 'should respond with 200' do |
||||||
|
last_response.status.should eq(200) |
||||||
|
end |
||||||
|
|
||||||
|
it 'should return the query in HAL+JSON format' do |
||||||
|
parsed_response = JSON.parse(last_response.body) |
||||||
|
parsed_response.should eq(expected_response.tap{ |r| r["isStarred"] = "false" }) |
||||||
|
end |
||||||
|
|
||||||
|
it 'should return the query with "isStarred" property set to true' do |
||||||
|
parsed_response = JSON.parse(last_response.body) |
||||||
|
parsed_response['isStarred'].should eq('false') |
||||||
|
end |
||||||
|
end |
||||||
|
|
||||||
|
context 'trying to unstar somebody else\'s query' do |
||||||
|
let(:another_user) { FactoryGirl.create(:user) } |
||||||
|
let(:query) { FactoryGirl.create(:private_query, project: project, user: another_user) } |
||||||
|
|
||||||
|
it 'should respond with 403' do |
||||||
|
last_response.status.should eq(403) |
||||||
|
end |
||||||
|
|
||||||
|
it 'should respond with explanatory error message' do |
||||||
|
parsed_errors = JSON.parse(last_response.body)['errors'] |
||||||
|
parsed_errors.should eq([{ 'key' => 'not_authorized', 'messages' => ['You are not authorize to access this resource']}]) |
||||||
|
end |
||||||
|
end |
||||||
|
end |
||||||
|
|
||||||
|
context 'user without permission to save queries' do |
||||||
|
let(:query) { FactoryGirl.create(:private_query, project: project, user: current_user) } |
||||||
|
before(:each) do |
||||||
|
allow(User).to receive(:current).and_return current_user |
||||||
|
member = FactoryGirl.build(:member, user: current_user, project: project) |
||||||
|
member.role_ids = [role_without_query_permissions.id] |
||||||
|
member.save! |
||||||
|
patch unstar_path |
||||||
|
end |
||||||
|
|
||||||
|
it 'should respond with 403' do |
||||||
|
last_response.status.should eq(403) |
||||||
|
end |
||||||
|
|
||||||
|
it 'should respond with explanatory error message' do |
||||||
|
parsed_errors = JSON.parse(last_response.body)['errors'] |
||||||
|
parsed_errors.should eq([{ 'key' => 'not_authorized', 'messages' => ['You are not authorize to access this resource']}]) |
||||||
|
end |
||||||
|
end |
||||||
|
end |
||||||
|
|
||||||
|
end |
||||||
|
end |
||||||
Loading…
Reference in new issue