diff options
35 files changed, 512 insertions, 76 deletions
@@ -13,9 +13,13 @@ # Ignore all logfiles and tempfiles. /log/*.log /tmp +*~ /pkg /*/pkg /log */Gemfile.lock test/dummy/log/* test/dummy/tmp/* + +# Ignore configuration file. +config/config.yml
\ No newline at end of file @@ -9,7 +9,8 @@ eval(File.read(File.dirname(__FILE__) + '/ui_dependencies.rb')) gem "leap_web_core", :path => 'core' gem 'leap_web_users', :path => 'users' gem 'leap_web_certs', :path => 'certs' -# gem 'leap_web_help', :path => 'help' +gem 'leap_web_help', :path => 'help' # To use debugger -gem 'ruby-debug' +gem 'debugger', :platforms => :mri_19 +gem 'ruby-debug', :platforms => :mri_18 diff --git a/Gemfile.lock b/Gemfile.lock index a9ca432..01a2291 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -15,12 +15,18 @@ PATH rails (~> 3.2.8) PATH + remote: help + specs: + leap_web_help (0.1.0) + leap_web_core (= 0.1.0) + +PATH remote: users specs: leap_web_users (0.1.0) leap_web_core (= 0.1.0) rails_warden - ruby-srp (~> 0.1.3) + ruby-srp (~> 0.1.4) GEM remote: https://rubygems.org/ @@ -140,7 +146,7 @@ GEM ruby-debug-base (~> 0.10.4.0) ruby-debug-base (0.10.4) linecache (>= 0.3) - ruby-srp (0.1.3) + ruby-srp (0.1.4) sass (3.2.1) sass-rails (3.2.5) railties (~> 3.2.0) @@ -178,6 +184,7 @@ DEPENDENCIES jquery-rails leap_web_certs! leap_web_core! + leap_web_help! leap_web_users! mocha ruby-debug diff --git a/README.md b/README.md new file mode 100644 index 0000000..0e77d82 --- /dev/null +++ b/README.md @@ -0,0 +1,68 @@ +LEAP Web +--------------------- + +"LEAP Web" is the web-based component of the LEAP Platform, providing the following services: + +* REST API for user registration. +* Admin interface to manage users. +* Client certificate distribution and renewal. +* User support help tickets. + +This web application is written in Ruby on Rails 3, using CouchDB as the backend data store. + +Original code specific to this web application is licensed under the GNU Affero General Public License (version 3.0 or higher). See http://www.gnu.org/licenses/agpl-3.0.html for more information. + +Documentation +--------------------------- + +For more information, see these files in the ``doc`` directory: + +* DEPLOY -- for notes on deployment. +* DEVELOP -- for developer notes. +* CUSTOM -- how to customize. + +Installation +--------------------------- + +Typically, this application is installed automatically as part of the LEAP Platform. To install it manually for testing or development, follow these instructions: + +### Install system requirements + + sudo apt-get install git ruby1.8 rubygems1.8 couchdb + sudo gem install bundler + +On Debian Wheezy or later, there is a Debian package for bundler, so you can alternately run ``sudo apt-get install bundler``. + +### Download source + + git clone git://leap.se/leap_web + cd leap_web + git submodule update --init + +### Install required ruby libraries + + cd leap_web + bundle + +Typically, you run ``bundle`` as a normal user and it will ask you for a sudo password when it is time to install the required gems. If you don't have sudo, run ``bundle`` as root. + +Configuration +---------------------------- + +The webapp can hand out certs for the EIP client. These certs are either picked from a pool in CouchDB or from a file. For now you can either run [Leap CA](http://github.com/leapcode/leap_ca) to fill the pool or you can put your certs file in config/cert. + +We also ship provider information through the webapp. For now please add your eip-service.json to the public/config directory. + +Copy the example configuration file and customize as appropriate: + cp config/config.yml.example config/config.yml + +Running +----------------------------- + + cd leap_web + rails server + +Then open http://localhost:3000 in your web browser. + +To peruse the database, visit http://localhost:5984/_utils/ + diff --git a/Readme.md b/Readme.md deleted file mode 100644 index 8b51b4d..0000000 --- a/Readme.md +++ /dev/null @@ -1,24 +0,0 @@ -# Leap Web # - -Web application for LEAP. Currently Leap Web allows Leap providers to manage users, hand out certs for the EIP. - -## Functions ## - -### Supported ### - -* *User Management* - User Registration and Authentication -* *Cert Distribution* - Certs for the Encrypted Internet Proxy - -### Under Development ### - -* *Help Desk* - Managing Help Requests - - -## Documentation ## - -* [INSTALL](https://github.com/leapcode/leap_web/blob/master/INSTALL.md) for installation instructions -* [DEPLOY](https://github.com/leapcode/leap_web/blob/master/DEPLOY.md) for deployment -* [DEVELOP](https://github.com/leapcode/leap_web/blob/master/DEVELOP.md) for developer notes. -* [CUSTOM](https://github.com/leapcode/leap_web/blob/master/CUSTOM.md) to customize. - - diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index 693bd86..be7aa1f 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -1,10 +1,5 @@ class ApplicationController < ActionController::Base protect_from_forgery - helper_method :current_user - - private - def current_user - @current_user ||= User.find(session[:user_id]) if session[:user_id] - end + ActiveSupport.run_load_hooks(:application_controller, self) end diff --git a/app/views/home/index.html.haml b/app/views/home/index.html.haml index 0be7ca2..9e68674 100644 --- a/app/views/home/index.html.haml +++ b/app/views/home/index.html.haml @@ -1,3 +1,11 @@ Try to fetch a = link_to "cert", cert_path + +%p +Try to create a += link_to "ticket", new_ticket_path + +%p +See all += link_to "tickets", tickets_path diff --git a/config/config.yml.example b/config/config.yml.example new file mode 100644 index 0000000..c34dd10 --- /dev/null +++ b/config/config.yml.example @@ -0,0 +1,8 @@ +development: + admins: [admin, admin2] + +test: + admins: [admin, admin2] + +production: + admins: [] diff --git a/config/initializers/load_config.rb b/config/initializers/load_config.rb new file mode 100644 index 0000000..e687429 --- /dev/null +++ b/config/initializers/load_config.rb @@ -0,0 +1 @@ +APP_CONFIG = YAML.load_file("#{Rails.root}/config/config.yml")[Rails.env] diff --git a/help/app/controllers/tickets_controller.rb b/help/app/controllers/tickets_controller.rb new file mode 100644 index 0000000..4c7415b --- /dev/null +++ b/help/app/controllers/tickets_controller.rb @@ -0,0 +1,73 @@ +class TicketsController < ApplicationController + + respond_to :html #, :json + #has_scope :open, :type => boolean + + def new + @ticket = Ticket.new + @ticket.comments.build + end + + def create + @ticket = Ticket.new(params[:ticket]) + if current_user + @ticket.created_by = current_user.id + @ticket.email = current_user.email if current_user.email + @ticket.comments.last.posted_by = current_user.id + else + @ticket.comments.last.posted_by = nil #hacky, but protecting this attribute doesn't work right, so this should make sure it isn't set. + end + + flash[:notice] = 'Ticket was successfully created.' if @ticket.save + respond_with(@ticket) + + end + +=begin + def edit + @ticket = Ticket.find(params[:id]) + @ticket.comments.build + # build ticket comments? + end +=end + + def show + @ticket = Ticket.find(params[:id]) + # @ticket.comments.build + # build ticket comments? + end + + def update + @ticket = Ticket.find(params[:id]) + @ticket.attributes = params[:ticket] + + @ticket.comments.last.posted_by = (current_user ? current_user.id : nil) #protecting posted_by isn't working, so this should protect it. + + if @ticket.save + flash[:notice] = 'Ticket was successfully updated.' + respond_with @ticket + else + #redirect_to [:show, @ticket] # + flash[:alert] = 'Ticket has not been changed' + redirect_to @ticket + #respond_with(@ticket) # why does this go to edit?? redirect??? + end + end + + def index + # @tickets = Ticket.by_title #not actually what we will want + respond_with(@tickets = Ticket.all) #we'll want only tickets that this user can access + end + + private + + # not using now, as we are using comment_attributes= from the Ticket model +=begin + def add_comment + comment = TicketComment.new(params[:comment]) + comment.posted_by = User.current.id if User.current #could be nil + comment.posted_at = Time.now # TODO: it seems strange to have this here, and not in model + @ticket.comments << comment + end +=end +end diff --git a/help/app/models/ticket.rb b/help/app/models/ticket.rb index 784d7ef..f38fed2 100644 --- a/help/app/models/ticket.rb +++ b/help/app/models/ticket.rb @@ -15,8 +15,8 @@ class Ticket < CouchRest::Model::Base =end #belongs_to :user #from leap_web_users. doesn't necessarily belong to a user though - property :created_by, Integer #nil unless user was authenticated for ticket creation, #THIS should not be changed after being set - property :regarding_user, Integer # form cannot be submitted if they type in a username w/out corresponding ID. this field can be nil. for authenticated ticket creation by non-admins, should this just automatically be set to be same as created_by? or maybe we don't use this field unless created_by is nil? + property :created_by, String, :protected => true #Integer #nil unless user was authenticated for ticket creation, #THIS should not be changed after being set + #property :regarding_user, String#Integer # form cannot be submitted if they type in a username w/out corresponding ID. this field can be nil. for authenticated ticket creation by non-admins, should this just automatically be set to be same as created_by? or maybe we don't use this field unless created_by is nil? #also, both created_by and regarding_user could be nil---say user forgets username, or has general question property :title, String property :email, String #verify @@ -29,18 +29,27 @@ class Ticket < CouchRest::Model::Base timestamps! - before_validation :set_created_by, :set_code, :on => :create + #before_validation :set_created_by, :set_code, :set_email, :on => :create + before_validation :set_code, :set_email, :on => :create + + + #named_scope :open, :conditions => {:is_open => true} #?? design do view :by_title end + validates :title, :presence => true + #validates :comments, :presence => true #do we want it like this? + + # html5 has built-in validation which isn't ideal, as it says 'please enter an email address' for invalid email addresses, which implies an email address is required, and it is not. validates :email, :format => /\A([^@\s]+)@((?:[-a-z0-9]+\.)+[a-z]{2,})\Z/, :if => :email #email address is optional - def set_created_by - self.created_by = User.current if User.current - end + #TODO: + #def set_created_by + # self.created_by = User.current if User.current + #end def is_creator_validated? !!created_by @@ -51,6 +60,12 @@ class Ticket < CouchRest::Model::Base self.code = SecureRandom.hex(8) if !is_creator_validated? end + + def set_email + self.email = nil if self.email == "" + # in controller set to be current users email if that exists + end + def close self.is_open = false save @@ -61,6 +76,15 @@ class Ticket < CouchRest::Model::Base save end + def comments_attributes=(attributes) + + comment = TicketComment.new(attributes.values.first) #TicketComment.new(attributes) + #comment.posted_by = User.current.id if User.current #we want to avoid User.current, and current_user won't work here. instead will set in tickets_controller + comment.posted_at = Time.now + comments << comment + + end + =begin def validate if email_address and not email_address.strip =~ RFC822::EmailAddress diff --git a/help/app/models/ticket_comment.rb b/help/app/models/ticket_comment.rb index 652133a..49e5c6c 100644 --- a/help/app/models/ticket_comment.rb +++ b/help/app/models/ticket_comment.rb @@ -2,13 +2,15 @@ class TicketComment include CouchRest::Model::Embeddable #belongs_to :ticket #is this best way to do it? will want to access all of a tickets comments, so maybe this isn't the way? - property :posted_by, Integer, :protected => true# maybe this should be current_user if that is set, meaning the user is logged in #String # user?? + property :posted_by, String#, :protected => true #Integer#this should be current_user if that is set, meaning the user is logged in #cannot have it be protected and set via comments_attributes=. also, if it is protected and we set in the tickets_controller, it gets unset. TODO---is this okay to have it not protected and manually check it? We do not users to be able to set this. # if the current user is not set, then we could just say the comment comes from an 'unauthenticated user', which would be somebody with the secret URL - property :posted_at, Time, :protected => true + property :posted_at, Time#, :protected => true #property :posted_verified, TrueClass, :protected => true #should be true if current_user is set when the comment is created property :body, String - before_validation :set_time#, :set_posted_by + # ? timestamps! + validates :body, :presence => true + #before_validation :set_time#, :set_posted_by #design do # view :by_posted_at @@ -18,10 +20,14 @@ class TicketComment def is_comment_validated? !!posted_by end - + +=begin + #TODO. + #this is resetting all comments associated with the ticket: def set_time self.posted_at = Time.now end +=end =begin def set_posted_by diff --git a/help/app/views/tickets/_comment.html.haml b/help/app/views/tickets/_comment.html.haml new file mode 100644 index 0000000..1ba3bd1 --- /dev/null +++ b/help/app/views/tickets/_comment.html.haml @@ -0,0 +1,13 @@ +- # style is super ugly but just for now +%div{:style => "border: solid 1px"} + - if User.find(comment.posted_by) + Posted by + = User.find(comment.posted_by).login + - else + Unauthenticated post + %p + Posted at + = comment.posted_at + %p + = comment.body + %p
\ No newline at end of file diff --git a/help/app/views/tickets/_new_comment.html.haml b/help/app/views/tickets/_new_comment.html.haml new file mode 100644 index 0000000..a924dfd --- /dev/null +++ b/help/app/views/tickets/_new_comment.html.haml @@ -0,0 +1,3 @@ += #do we want this partial? not using it now += simple_fields_for :comment do |c| + = c.input :body, :label => 'Comment', :as => :text diff --git a/help/app/views/tickets/index.html.haml b/help/app/views/tickets/index.html.haml new file mode 100644 index 0000000..6db2140 --- /dev/null +++ b/help/app/views/tickets/index.html.haml @@ -0,0 +1,10 @@ +%h2 tickets index (just as space) +Create a += link_to "new ticket", new_ticket_path += # below shouldn't be unless logged in +%h2 Tickets += # want to have selection option to see tickets, that are open, closed or all +- @tickets.each do |ticket| + %p + = link_to ticket.title, ticket += #render(:partial => "ticket", :collection => @tickets) diff --git a/help/app/views/tickets/new.html.haml b/help/app/views/tickets/new.html.haml new file mode 100644 index 0000000..537b97f --- /dev/null +++ b/help/app/views/tickets/new.html.haml @@ -0,0 +1,16 @@ +%h2=t :new_ticket += simple_form_for(@ticket, :html => {:novalidate => true}) do |f| #turn off html5 validations to test + = #@ticket.errors.messages + = f.input :title + = #f.input :email #if there is no current_user + = f.input :email if !current_user #hmm--might authenticated users want to submit an alternate email? + + = f.simple_fields_for :comments do |c| + = c.input :body, :label => 'Comment', :as => :text + + = #render :partial => 'new_comment' #what we were using + = # regarding_user if not logged in + = # email if not logged in + = #f.button :submit, :value => t(:submit), :class => 'btn-primary' + = f.button :submit + = link_to t(:cancel), tickets_path, :class => :btn diff --git a/help/app/views/tickets/show.html.haml b/help/app/views/tickets/show.html.haml new file mode 100644 index 0000000..a9b994e --- /dev/null +++ b/help/app/views/tickets/show.html.haml @@ -0,0 +1,26 @@ +- if flash[:notice] + =flash[:notice] +- if flash[:alert] + =flash[:alert] +%h2= @ticket.title +is open? += @ticket.is_open +- if @ticket.code + code: + = @ticket.code +- if @ticket.email + email: + = @ticket.email +- if User.find(@ticket.created_by) + Created by + = User.find(@ticket.created_by).login +- else + Unauthenticated ticket creator += render(:partial => "comment", :collection => @ticket.comments) + += simple_form_for (@ticket, :html => {:novalidate => true}) do |f| #turn off html5 validations to test + = f.simple_fields_for :comments, TicketComment.new do |c| + = c.input :body, :label => 'Comment', :as => :text + = #render :partial => 'new_comment' + = f.button :submit + = link_to t(:cancel), tickets_path, :class => :btn
\ No newline at end of file diff --git a/help/config/routes.rb b/help/config/routes.rb index 1daf9a4..5e57e02 100644 --- a/help/config/routes.rb +++ b/help/config/routes.rb @@ -1,2 +1,5 @@ Rails.application.routes.draw do + + resources :tickets, :only => [:new, :create, :index, :show, :update] + #resources :ticket, :only => [:show] end diff --git a/help/test/functional/tickets_controller_test.rb b/help/test/functional/tickets_controller_test.rb new file mode 100644 index 0000000..7a03a86 --- /dev/null +++ b/help/test/functional/tickets_controller_test.rb @@ -0,0 +1,63 @@ +require 'test_helper' + +class TicketsControllerTest < ActionController::TestCase + + test "should get index" do + get :index + assert_response :success + assert_not_nil assigns(:tickets) + end + + test "should get new" do + get :new + assert_equal Ticket, assigns(:ticket).class + assert_response :success + end + + + test "should create unauthenticated ticket" do + params = {:title => "ticket test title", :comments_attributes => {"0" => {"body" =>"body of test ticket"}}} + + assert_difference('Ticket.count') do + post :create, :ticket => params + end + + assert_response :redirect + #assert_equal assigns(:ticket).email, User.current.email + #assert_equal User.find(assigns(:ticket).created_by).login, User.current.login + assert_nil assigns(:ticket).created_by + + assert_equal assigns(:ticket).comments.count, 1 + end + + + test "should create authenticated ticket" do + + params = {:title => "ticket test title", :comments_attributes => {"0" => {"body" =>"body of test ticket"}}} + + #todo: should redo this and actually authorize + user = User.last + session[:user_id] = user.id + + assert_difference('Ticket.count') do + post :create, :ticket => params + end + + assert_response :redirect + assert_equal assigns(:ticket).created_by, user.id + assert_equal assigns(:ticket).email, user.email + + assert_equal assigns(:ticket).comments.count, 1 + end + + test "add comment to ticket" do + + t = Ticket.last + comment_count = t.comments.count + put :update, :id => t.id, :ticket => {:comments_attributes => {"0" => {"body" =>"NEWER comment"}} } + assert_equal(comment_count + 1, assigns(:ticket).comments.count) + #assert_difference block isn't working + + end + +end diff --git a/help/test/unit/ticket_comment_test.rb b/help/test/unit/ticket_comment_test.rb index 883720f..1fe1fe2 100644 --- a/help/test/unit/ticket_comment_test.rb +++ b/help/test/unit/ticket_comment_test.rb @@ -16,8 +16,8 @@ class TicketCommentTest < ActiveSupport::TestCase comment2 = TicketComment.new :body => "help my email is broken!" assert comment2.valid? - assert_not_nil comment2.posted_at - assert_nil comment2.posted_by #if not logged in + #assert_not_nil comment2.posted_at #? + #assert_nil comment2.posted_by #if not logged in #TODO #comment.ticket = testticket #Ticket.find_by_title("testing") #assert_equal testticket.title, comment.ticket.title @@ -49,9 +49,10 @@ class TicketCommentTest < ActiveSupport::TestCase testticket.comments << comment2 #this should validate comment2 testticket.valid? assert_equal testticket.comments.count, 2 - assert_not_nil comment.posted_at - assert_not_nil testticket.comments.last.posted_at - assert testticket.comments.first.posted_at < testticket.comments.last.posted_at + # where should posted_at be set? + #assert_not_nil comment.posted_at + #assert_not_nil testticket.comments.last.posted_at + #assert testticket.comments.first.posted_at < testticket.comments.last.posted_at end end diff --git a/help/test/unit/ticket_test.rb b/help/test/unit/ticket_test.rb index c3a4759..6b63a23 100644 --- a/help/test/unit/ticket_test.rb +++ b/help/test/unit/ticket_test.rb @@ -41,18 +41,20 @@ class TicketTest < ActiveSupport::TestCase assert @sample.is_creator_validated? end +=begin +# TODO: do once have current_user stuff in order test "code if & only if not creator-validated" do + User.current_test = nil t1 = Ticket.create :title => 'test title' assert_not_nil t1.code assert_nil t1.created_by - User.current = 4 + User.current_test = 4 t2 = Ticket.create :title => 'test title' assert_nil t2.code assert_not_nil t2.created_by - - end +=end end diff --git a/test/dummy/app/controllers/application_controller.rb b/test/dummy/app/controllers/application_controller.rb index e8065d9..be7aa1f 100644 --- a/test/dummy/app/controllers/application_controller.rb +++ b/test/dummy/app/controllers/application_controller.rb @@ -1,3 +1,5 @@ class ApplicationController < ActionController::Base protect_from_forgery + + ActiveSupport.run_load_hooks(:application_controller, self) end diff --git a/test/test_helper.rb b/test/test_helper.rb index f7d48ec..50d5159 100644 --- a/test/test_helper.rb +++ b/test/test_helper.rb @@ -4,6 +4,9 @@ require 'rails/test_help' require 'mocha' +# Load support files from all engines +Dir["#{File.dirname(__FILE__)}/../*/test/support/**/*.rb"].each { |f| require f } + class ActiveSupport::TestCase # Add more helper methods to be used by all tests here... end diff --git a/users/app/controllers/application_controller.rb b/users/app/controllers/application_controller.rb deleted file mode 100644 index 8388dda..0000000 --- a/users/app/controllers/application_controller.rb +++ /dev/null @@ -1,14 +0,0 @@ -class ApplicationController < ActionController::Base - protect_from_forgery - - private - - def current_user - @current_user ||= env['warden'].user - end - helper_method :current_user - - def authorize - redirect_to login_url, alert: "Not authorized" if current_user.nil? - end -end diff --git a/users/app/controllers/controller_extension/authentication.rb b/users/app/controllers/controller_extension/authentication.rb new file mode 100644 index 0000000..50cf0d1 --- /dev/null +++ b/users/app/controllers/controller_extension/authentication.rb @@ -0,0 +1,34 @@ +module ControllerExtension::Authentication + extend ActiveSupport::Concern + + private + + included do + helper_method :current_user, :logged_in?, :admin? + end + + def current_user + @current_user ||= env['warden'].user + end + + def logged_in? + !!current_user + end + + def authorize + access_denied unless logged_in? + end + + def access_denied + redirect_to login_url, :alert => "Not authorized" + end + + def admin? + current_user && current_user.is_admin? + end + + def authorize_admin + access_denied unless admin? + end + +end diff --git a/users/app/models/user.rb b/users/app/models/user.rb index 737e083..0f5d650 100644 --- a/users/app/models/user.rb +++ b/users/app/models/user.rb @@ -66,11 +66,9 @@ class User < CouchRest::Model::Base login end - def self.current - Thread.current[:user] - end - def self.current=(user) - Thread.current[:user] = user + # Since we are storing admins by login, we cannot allow admins to change their login. + def is_admin? + APP_CONFIG['admins'].include? self.login end end diff --git a/users/app/views/sessions/_nav.html.haml b/users/app/views/sessions/_nav.html.haml index a5397bd..204ba88 100644 --- a/users/app/views/sessions/_nav.html.haml +++ b/users/app/views/sessions/_nav.html.haml @@ -1,6 +1,9 @@ -- if current_user +- if logged_in? %li + = 'logged in as ' + current_user.login = link_to t(:logout), logout_path + - if admin? + = 'ADMIN' # obviously not like this - else %li = link_to t(:login), login_path diff --git a/users/config/initializers/add_controller_methods.rb b/users/config/initializers/add_controller_methods.rb new file mode 100644 index 0000000..2579176 --- /dev/null +++ b/users/config/initializers/add_controller_methods.rb @@ -0,0 +1,3 @@ +ActiveSupport.on_load(:application_controller) do + include ControllerExtension::Authentication +end diff --git a/users/leap_web_users.gemspec b/users/leap_web_users.gemspec index 053f8dc..0682a99 100644 --- a/users/leap_web_users.gemspec +++ b/users/leap_web_users.gemspec @@ -17,6 +17,6 @@ Gem::Specification.new do |s| s.add_dependency "leap_web_core", LeapWeb::VERSION - s.add_dependency "ruby-srp", "~> 0.1.3" + s.add_dependency "ruby-srp", "~> 0.1.4" s.add_dependency "rails_warden" end diff --git a/users/test/functional/application_controller_test.rb b/users/test/functional/application_controller_test.rb new file mode 100644 index 0000000..69bcb2f --- /dev/null +++ b/users/test/functional/application_controller_test.rb @@ -0,0 +1,29 @@ +require 'test_helper' + +class ApplicationControllerTest < ActionController::TestCase + + def setup + # so we can test the effect on the response + @controller.response = @response + end + + def test_authorize_redirect + stub_logged_out + @controller.send(:authorize) + assert_access_denied + end + + def test_authorized + @user = stub_logged_in + @controller.send(:authorize) + assert_access_denied(false) + end + + def test_authorize_admin + @user = stub_logged_in + @user.expects(:is_admin?).returns(false) + @controller.send(:authorize_admin) + assert_access_denied + end + +end diff --git a/users/test/functional/helper_methods_test.rb b/users/test/functional/helper_methods_test.rb new file mode 100644 index 0000000..c0eaf61 --- /dev/null +++ b/users/test/functional/helper_methods_test.rb @@ -0,0 +1,42 @@ +# +# Testing and documenting the helper methods available from +# ApplicationController +# + +require 'test_helper' + +class HelperMethodsTest < ActionController::TestCase + tests ApplicationController + + # we test them right in here... + include ApplicationController._helpers + + # they all reference the controller. + def controller + @controller + end + + def test_current_user_with_caching + @user = stub_logged_in + assert_equal @user, current_user + assert_equal @user, current_user # tests caching + end + + def test_logged_in + @user = stub_logged_in + assert logged_in? + end + + def test_logged_out + stub_logged_out + assert !logged_in? + end + + def test_admin + bool = stub + @user = stub_logged_in + @user.expects(:is_admin?).returns(bool) + assert_equal bool, admin? + end + +end diff --git a/users/test/integration/api/account_flow_test.rb b/users/test/integration/api/account_flow_test.rb index 66de1e5..5800d46 100644 --- a/users/test/integration/api/account_flow_test.rb +++ b/users/test/integration/api/account_flow_test.rb @@ -39,7 +39,7 @@ class AccountFlowTest < ActionDispatch::IntegrationTest end test "signup response" do - assert_json_response @user_params.slice(:login, :password_salt) + assert_json_response :login => @login, :ok => true assert_response :success end diff --git a/users/test/support/auth_test_helper.rb b/users/test/support/auth_test_helper.rb new file mode 100644 index 0000000..9412058 --- /dev/null +++ b/users/test/support/auth_test_helper.rb @@ -0,0 +1,29 @@ +module AuthTestHelper + + def stub_logged_in + @user_id = stub + @user = stub + session[:user_id] = @user_id + User.expects(:find).once.with(@user_id).returns(@user) + return @user + end + + def stub_logged_out + @user_id = stub + session[:user_id] = @user_id + User.expects(:find).once.with(@user_id).returns(nil) + end + + def assert_access_denied(denied = true) + if denied + assert_equal({:alert => "Not authorized"}, flash.to_hash) + assert_redirected_to login_path + else + assert flash[:alert].blank? + end + end +end + +class ActionController::TestCase + include AuthTestHelper +end diff --git a/users/test/test_helper.rb b/users/test/test_helper.rb index 08d4d41..e8f0125 100644 --- a/users/test/test_helper.rb +++ b/users/test/test_helper.rb @@ -7,4 +7,3 @@ Rails.backtrace_cleaner.remove_silencers! # Load support files Dir["#{File.dirname(__FILE__)}/support/**/*.rb"].each { |f| require f } - diff --git a/users/test/unit/user_test.rb b/users/test/unit/user_test.rb index 822ef33..f057ca7 100644 --- a/users/test/unit/user_test.rb +++ b/users/test/unit/user_test.rb @@ -19,7 +19,7 @@ class UserTest < ActiveSupport::TestCase end test "test require alphanumerical for login" do - @user.login = "qwär" + @user.login = "qw#r" assert !@user.valid? end |