Merge remote-tracking branch 'origin/master' into feature/fixed-email-address

Conflicts:
	users/app/views/emails/_email.html.haml

11 files changed, 142 insertions, 11 deletions

diff --git a/users/app/controllers/users_controller.rb b/users/app/controllers/users_controller.rb
index 75ae2da..6cb438b 100644
--- a/users/app/controllers/users_controller.rb
+++ b/users/app/controllers/users_controller.rb
@@ -2,7 +2,9 @@ class UsersController < ApplicationController
 
   skip_before_filter :verify_authenticity_token, :only => [:create]
 
-  before_filter :fetch_user, :only => [:edit, :update, :destroy]
+
+  before_filter :authorize, :only => [:show, :edit, :update, :destroy]
+  before_filter :fetch_user, :only => [:show, :edit, :update, :destroy]
   before_filter :set_anchor, :only => [:edit, :update]
   before_filter :authorize_admin, :only => [:index]
 
@@ -49,7 +51,12 @@ class UsersController < ApplicationController
   protected
 
   def fetch_user
+    # authorize filter has been checked first, so won't get here unless authenticated
     @user = User.find_by_param(params[:id])
+    if !@user and admin?
+      redirect_to users_path, :alert => t(:no_such_thing, :thing => 'user')
+      return
+    end
     access_denied unless admin? or (@user == current_user)
   end
 
diff --git a/users/app/helpers/users_helper.rb b/users/app/helpers/users_helper.rb
index 45ca0e9..5f68085 100644
--- a/users/app/helpers/users_helper.rb
+++ b/users/app/helpers/users_helper.rb
@@ -30,4 +30,10 @@ module UsersHelper
     classes.compact
   end
 
+  def user_field(field)
+    value = @user.send(field)
+    value = value.to_s(:long) if field.end_with? '_at'
+    value || 'not set'
+  end
+
 end
diff --git a/users/app/models/user.rb b/users/app/models/user.rb
index 63f4d0f..292fb13 100644
--- a/users/app/models/user.rb
+++ b/users/app/models/user.rb
@@ -86,6 +86,10 @@ class User < CouchRest::Model::Base
     email_aliases.build(attrs.values.first) if attrs
   end
 
+  def most_recent_tickets(count=3)
+    Ticket.for_user(self).limit(count).all #defaults to having most recent updated first
+  end
+
   protected
 
   ##
diff --git a/users/app/views/emails/_email.html.haml b/users/app/views/emails/_email.html.haml
index f5eb2d0..e96385d 100644
--- a/users/app/views/emails/_email.html.haml
+++ b/users/app/views/emails/_email.html.haml
@@ -1,5 +1,6 @@
 %li.pull-right
   %code= email
-  = link_to(user_email_alias_path(@user, email), :method => :delete) do
-    %i.icon-remove
+  - if params[:action] == 'edit'
+    = link_to(user_email_alias_path(@user, email), :method => :delete) do
+      %i.icon-remove
 .clearfix
diff --git a/users/app/views/users/_user.html.haml b/users/app/views/users/_user.html.haml
index 7db0041..ca03d34 100644
--- a/users/app/views/users/_user.html.haml
+++ b/users/app/views/users/_user.html.haml
@@ -1,5 +1,5 @@
 %tr
-  %td= user.login
+  %td= link_to user.login, user
   %td= time_ago_in_words(user.created_at) + " ago"
   %td
     = link_to edit_user_path(user), :class => "btn btn-mini btn-primary" do
diff --git a/users/app/views/users/show.html.haml b/users/app/views/users/show.html.haml
new file mode 100644
index 0000000..a1eeccb
--- /dev/null
+++ b/users/app/views/users/show.html.haml
@@ -0,0 +1,31 @@
+.span8.offset1
+  %h2= @user.login
+  .small
+    = link_to 'edit', edit_user_path(@user)
+  %dl.offset1
+    - fields = ['login', 'email', 'created_at', 'updated_at', 'email_forward']
+    - fields.each do |field|
+      %dt
+        = field.titleize
+      %dd
+        = user_field(field)
+    %dt
+      =t :email_aliases
+    %dd
+      - aliases = @user.email_aliases
+      - if aliases.present?
+        %ul.pull-left.unstyled
+          = render aliases
+      - else
+        =t :none
+    .clearfix
+    %dt
+      =t :most_recently_updated_tickets
+    %dd
+      - tix = @user.most_recent_tickets
+      - if tix.present?
+        %table
+          %tbody
+            = render @user.most_recent_tickets
+      - else
+        =t :none
\ No newline at end of file
diff --git a/users/config/locales/en.yml b/users/config/locales/en.yml
index 3c71e7e..7a6ab90 100644
--- a/users/config/locales/en.yml
+++ b/users/config/locales/en.yml
@@ -1,4 +1,5 @@
 en:
+  none: "None."
   signup: "Sign up"
   signup_message: "Please create an account."
   cancel: "Cancel"
diff --git a/users/config/routes.rb b/users/config/routes.rb
index 8985502..0c2d8d9 100644
--- a/users/config/routes.rb
+++ b/users/config/routes.rb
@@ -1,8 +1,12 @@
 Rails.application.routes.draw do
 
-  scope "/1", :module => "V1", defaults: {format: 'json'} do
-    resources :sessions, :only => [:new, :create, :update, :destroy]
-    resources :users, :only => [:create]
+  constraints :subdomain => "api" do
+    namespace "api", { module: "V1",
+        path: "/1/",
+        defaults: {format: 'json'} } do
+      resources :sessions, :only => [:new, :create, :update, :destroy]
+      resources :users, :only => [:create]
+    end
   end
 
   get "login" => "sessions#new", :as => "login"
diff --git a/users/test/functional/users_controller_test.rb b/users/test/functional/users_controller_test.rb
index 8f1ee15..9fb06c9 100644
--- a/users/test/functional/users_controller_test.rb
+++ b/users/test/functional/users_controller_test.rb
@@ -9,13 +9,85 @@ class UsersControllerTest < ActionController::TestCase
     assert_response :success
   end
 
+  test "failed show without login" do
+    user = FactoryGirl.build(:user)
+    user.save
+    get :show, :id => user.id
+    assert_response :redirect
+    assert_redirected_to login_path
+    user.destroy
+  end
+
+  test "user can see user" do
+    user = find_record :user,
+      :email => nil,
+      :email_forward => nil,
+      :email_aliases => [],
+      :created_at => Time.now,
+      :updated_at => Time.now,
+      :most_recent_tickets => []
+    login user
+    get :show, :id => user.id
+    assert_response :success
+  end
+
+  test "admin can see other user" do
+    user = find_record :user,
+      :email => nil,
+      :email_forward => nil,
+      :email_aliases => [],
+      :created_at => Time.now,
+      :updated_at => Time.now,
+      :most_recent_tickets => []
+    login :is_admin? => true
+    get :show, :id => user.id
+    assert_response :success
+
+  end
+
+  test "user cannot see other user" do
+    user = find_record :user,
+      :email => nil,
+      :email_forward => nil,
+      :email_aliases => [],
+      :created_at => Time.now,
+      :updated_at => Time.now,
+      :most_recent_tickets => []
+    login
+    get :show, :id => user.id
+    assert_response :redirect
+    assert_access_denied
+  end
+
+  test "show for non-existing user" do
+    nonid = 'thisisnotanexistinguserid'
+
+    # when unauthenticated:
+    get :show, :id => nonid
+    assert_access_denied(true, false)
+
+    # when authenticated but not admin:
+    login
+    get :show, :id => nonid
+    assert_access_denied
+
+    # when authenticated as admin:
+    login :is_admin? => true
+    get :show, :id => nonid
+    assert_response :redirect
+    assert_equal({:alert => "No such user."}, flash.to_hash)
+    assert_redirected_to users_path
+  end
+
   test "should create new user" do
     user_attribs = record_attributes_for :user
     user = User.new(user_attribs)
     User.expects(:create).with(user_attribs).returns(user)
 
+
     post :create, :user => user_attribs, :format => :json
 
+
     assert_nil session[:user_id]
     assert_json_response user
     assert_response :success
diff --git a/users/test/integration/api/account_flow_test.rb b/users/test/integration/api/account_flow_test.rb
index b9e2a4e..268fb5e 100644
--- a/users/test/integration/api/account_flow_test.rb
+++ b/users/test/integration/api/account_flow_test.rb
@@ -22,7 +22,7 @@ class AccountFlowTest < ActiveSupport::TestCase
       :password_verifier => @srp.verifier.to_s(16),
       :password_salt => @srp.salt.to_s(16)
     }
-    post '/1/users.json', :user => @user_params
+    post 'http://api.lvh.me:3000/1/users.json', :user => @user_params
     @user = User.find_by_param(@login)
   end
 
@@ -33,7 +33,10 @@ class AccountFlowTest < ActiveSupport::TestCase
 
   # this test wraps the api and implements the interface the ruby-srp client.
   def handshake(login, aa)
-    post "/1/sessions.json", :login => login, 'A' => aa.to_s(16), :format => :json
+    post "http://api.lvh.me:3000/1/sessions.json",
+      :login => login,
+      'A' => aa.to_s(16),
+      :format => :json
     response = JSON.parse(last_response.body)
     if response['errors']
       raise RECORD_NOT_FOUND.new(response['errors'])
@@ -43,7 +46,9 @@ class AccountFlowTest < ActiveSupport::TestCase
   end
 
   def validate(m)
-    put "/1/sessions/" + @login + '.json', :client_auth => m.to_s(16), :format => :json
+    put "http://api.lvh.me:3000/1/sessions/" + @login + '.json',
+      :client_auth => m.to_s(16),
+      :format => :json
     return JSON.parse(last_response.body)
   end
 
diff --git a/users/test/integration/api/python/flow_with_srp.py b/users/test/integration/api/python/flow_with_srp.py
index f28aeda..df83dfb 100755
--- a/users/test/integration/api/python/flow_with_srp.py
+++ b/users/test/integration/api/python/flow_with_srp.py
@@ -16,7 +16,7 @@ def id_generator(size=6, chars=string.ascii_uppercase + string.digits):
   return ''.join(random.choice(chars) for x in range(size))
 
 # using globals for a start
-server = 'http://localhost:3000/1'
+server = 'http://api.lvh.me:3000/1'
 login = id_generator()
 password = id_generator() + id_generator()