treehouse
/
mastodon
21
8
Fork 5
Code Issues 32 Pull Requests Projects 1 Releases Wiki Activity

Merge `api/v1/accounts/credentials` controller spec into existing request spec (#29006)

main-rebase-security-fix
Matt Jankowski 2024-03-13 05:22:43 -04:00 committed by GitHub
parent 2c0441acd7
commit 46e902f1f3
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 61 additions and 118 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

105
spec/controllers/api/v1/accounts/credentials_controller_spec.rb
View File

@ -1,105 +0,0 @@
# frozen_string_literal: true
require 'rails_helper'
describe Api::V1::Accounts::CredentialsController do
render_views
let(:user) { Fabricate(:user) }
let(:token) { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: scopes) }
context 'with an oauth token' do
before do
allow(controller).to receive(:doorkeeper_token) { token }
end
describe 'GET #show' do
let(:scopes) { 'read:accounts' }
it 'returns http success' do
get :show
expect(response).to have_http_status(200)
end
end
describe 'PATCH #update' do
let(:scopes) { 'write:accounts' }
describe 'with valid data' do
before do
allow(ActivityPub::UpdateDistributionWorker).to receive(:perform_async)
patch :update, params: {
display_name: "Alice Isn't Dead",
note: "Hi!\n\nToot toot!",
avatar: fixture_file_upload('avatar.gif', 'image/gif'),
header: fixture_file_upload('attachment.jpg', 'image/jpeg'),
source: {
privacy: 'unlisted',
sensitive: true,
},
}
end
it 'updates account info', :aggregate_failures do
expect(response).to have_http_status(200)
user.reload
user.account.reload
expect(user.account.display_name).to eq("Alice Isn't Dead")
expect(user.account.note).to eq("Hi!\n\nToot toot!")
expect(user.account.avatar).to exist
expect(user.account.header).to exist
expect(user.setting_default_privacy).to eq('unlisted')
expect(user.setting_default_sensitive).to be(true)
expect(ActivityPub::UpdateDistributionWorker).to have_received(:perform_async).with(user.account_id)
end
end
describe 'with empty source list' do
before do
patch :update, params: {
display_name: "I'm a cat",
source: {},
}, as: :json
end
it 'returns http success' do
expect(response).to have_http_status(200)
end
end
describe 'with invalid data' do
before do
patch :update, params: { note: 'This is too long. ' * 30 }
end
it 'returns http unprocessable entity' do
expect(response).to have_http_status(422)
end
end
end
end
context 'without an oauth token' do
before do
allow(controller).to receive(:doorkeeper_token).and_return(nil)
end
describe 'GET #show' do
it 'returns http unauthorized' do
get :show
expect(response).to have_http_status(401)
end
end
describe 'PATCH #update' do
it 'returns http unauthorized' do
patch :update, params: { note: 'Foo' }
expect(response).to have_http_status(401)
end
end
end
end

74
spec/requests/api/v1/accounts/credentials_spec.rb
View File

@ -15,15 +15,11 @@ RSpec.describe 'credentials API' do
it_behaves_like 'forbidden for wrong scope', 'write write:accounts'
it 'returns http success' do
subject
expect(response).to have_http_status(200)
end
it 'returns the expected content' do
it 'returns http success with expected content' do
subject
expect(response)
.to have_http_status(200)
expect(body_as_json).to include({
source: hash_including({
discoverable: false,
@ -34,24 +30,55 @@ RSpec.describe 'credentials API' do
end
end
describe 'POST /api/v1/accounts/update_credentials' do
describe 'PATCH /api/v1/accounts/update_credentials' do
subject do
patch '/api/v1/accounts/update_credentials', headers: headers, params: params
end
let(:params) { { discoverable: true, locked: false, indexable: true } }
before { allow(ActivityPub::UpdateDistributionWorker).to receive(:perform_async) }
let(:params) do
{
avatar: fixture_file_upload('avatar.gif', 'image/gif'),
discoverable: true,
display_name: "Alice Isn't Dead",
header: fixture_file_upload('attachment.jpg', 'image/jpeg'),
indexable: true,
locked: false,
note: 'Hello!',
source: {
privacy: 'unlisted',
sensitive: true,
},
}
end
it_behaves_like 'forbidden for wrong scope', 'read read:accounts'
it 'returns http success' do
subject
describe 'with empty source list' do
let(:params) { { display_name: "I'm a cat", source: {} } }
expect(response).to have_http_status(200)
it 'returns http success' do
subject
expect(response).to have_http_status(200)
end
end
it 'returns JSON with updated attributes' do
describe 'with invalid data' do
let(:params) { { note: 'This is too long. ' * 30 } }
it 'returns http unprocessable entity' do
subject
expect(response).to have_http_status(422)
end
end
it 'returns http success with updated JSON attributes' do
subject
expect(response)
.to have_http_status(200)
expect(body_as_json).to include({
source: hash_including({
discoverable: true,
@ -59,6 +86,27 @@ RSpec.describe 'credentials API' do
}),
locked: false,
})
expect(ActivityPub::UpdateDistributionWorker)
.to have_received(:perform_async).with(user.account_id)
end
def expect_account_updates
expect(user.account.reload)
.to have_attributes(
display_name: eq("Alice Isn't Dead"),
note: 'Hello!',
avatar: exist,
header: exist
)
end
def expect_user_updates
expect(user.reload)
.to have_attributes(
setting_default_privacy: eq('unlisted'),
setting_default_sensitive: be(true)
)
end
end
end