diff options
Diffstat (limited to 'users/test')
| -rw-r--r-- | users/test/functional/users_controller_test.rb | 72 | ||||
| -rw-r--r-- | users/test/integration/api/account_flow_test.rb | 11 | ||||
| -rwxr-xr-x | users/test/integration/api/python/flow_with_srp.py | 2 |
3 files changed, 81 insertions, 4 deletions
diff --git a/users/test/functional/users_controller_test.rb b/users/test/functional/users_controller_test.rb index 8f1ee15..9fb06c9 100644 --- a/users/test/functional/users_controller_test.rb +++ b/users/test/functional/users_controller_test.rb @@ -9,13 +9,85 @@ class UsersControllerTest < ActionController::TestCase assert_response :success end + test "failed show without login" do + user = FactoryGirl.build(:user) + user.save + get :show, :id => user.id + assert_response :redirect + assert_redirected_to login_path + user.destroy + end + + test "user can see user" do + user = find_record :user, + :email => nil, + :email_forward => nil, + :email_aliases => [], + :created_at => Time.now, + :updated_at => Time.now, + :most_recent_tickets => [] + login user + get :show, :id => user.id + assert_response :success + end + + test "admin can see other user" do + user = find_record :user, + :email => nil, + :email_forward => nil, + :email_aliases => [], + :created_at => Time.now, + :updated_at => Time.now, + :most_recent_tickets => [] + login :is_admin? => true + get :show, :id => user.id + assert_response :success + + end + + test "user cannot see other user" do + user = find_record :user, + :email => nil, + :email_forward => nil, + :email_aliases => [], + :created_at => Time.now, + :updated_at => Time.now, + :most_recent_tickets => [] + login + get :show, :id => user.id + assert_response :redirect + assert_access_denied + end + + test "show for non-existing user" do + nonid = 'thisisnotanexistinguserid' + + # when unauthenticated: + get :show, :id => nonid + assert_access_denied(true, false) + + # when authenticated but not admin: + login + get :show, :id => nonid + assert_access_denied + + # when authenticated as admin: + login :is_admin? => true + get :show, :id => nonid + assert_response :redirect + assert_equal({:alert => "No such user."}, flash.to_hash) + assert_redirected_to users_path + end + test "should create new user" do user_attribs = record_attributes_for :user user = User.new(user_attribs) User.expects(:create).with(user_attribs).returns(user) + post :create, :user => user_attribs, :format => :json + assert_nil session[:user_id] assert_json_response user assert_response :success diff --git a/users/test/integration/api/account_flow_test.rb b/users/test/integration/api/account_flow_test.rb index b9e2a4e..268fb5e 100644 --- a/users/test/integration/api/account_flow_test.rb +++ b/users/test/integration/api/account_flow_test.rb @@ -22,7 +22,7 @@ class AccountFlowTest < ActiveSupport::TestCase :password_verifier => @srp.verifier.to_s(16), :password_salt => @srp.salt.to_s(16) } - post '/1/users.json', :user => @user_params + post 'http://api.lvh.me:3000/1/users.json', :user => @user_params @user = User.find_by_param(@login) end @@ -33,7 +33,10 @@ class AccountFlowTest < ActiveSupport::TestCase # this test wraps the api and implements the interface the ruby-srp client. def handshake(login, aa) - post "/1/sessions.json", :login => login, 'A' => aa.to_s(16), :format => :json + post "http://api.lvh.me:3000/1/sessions.json", + :login => login, + 'A' => aa.to_s(16), + :format => :json response = JSON.parse(last_response.body) if response['errors'] raise RECORD_NOT_FOUND.new(response['errors']) @@ -43,7 +46,9 @@ class AccountFlowTest < ActiveSupport::TestCase end def validate(m) - put "/1/sessions/" + @login + '.json', :client_auth => m.to_s(16), :format => :json + put "http://api.lvh.me:3000/1/sessions/" + @login + '.json', + :client_auth => m.to_s(16), + :format => :json return JSON.parse(last_response.body) end diff --git a/users/test/integration/api/python/flow_with_srp.py b/users/test/integration/api/python/flow_with_srp.py index f28aeda..df83dfb 100755 --- a/users/test/integration/api/python/flow_with_srp.py +++ b/users/test/integration/api/python/flow_with_srp.py @@ -16,7 +16,7 @@ def id_generator(size=6, chars=string.ascii_uppercase + string.digits): return ''.join(random.choice(chars) for x in range(size)) # using globals for a start -server = 'http://localhost:3000/1' +server = 'http://api.lvh.me:3000/1' login = id_generator() password = id_generator() + id_generator() |