From 6cdc8408a9ac9d0fd157d18b1ff173c8f416cb8d Mon Sep 17 00:00:00 2001 From: Daniel M Brasil Date: Mon, 17 Jul 2023 11:22:33 -0300 Subject: [PATCH] Migrate to request specs in `/api/v1/emails/confirmations` (#25686) --- .../api/v1/emails/confirmations_spec.rb} | 124 +++++++++++------- 1 file changed, 75 insertions(+), 49 deletions(-) rename spec/{controllers/api/v1/emails/confirmations_controller_spec.rb => requests/api/v1/emails/confirmations_spec.rb} (50%) diff --git a/spec/controllers/api/v1/emails/confirmations_controller_spec.rb b/spec/requests/api/v1/emails/confirmations_spec.rb similarity index 50% rename from spec/controllers/api/v1/emails/confirmations_controller_spec.rb rename to spec/requests/api/v1/emails/confirmations_spec.rb index 80d6c8799..8f5171ee7 100644 --- a/spec/controllers/api/v1/emails/confirmations_controller_spec.rb +++ b/spec/requests/api/v1/emails/confirmations_spec.rb @@ -2,27 +2,34 @@ require 'rails_helper' -RSpec.describe Api::V1::Emails::ConfirmationsController do +RSpec.describe 'Confirmations' do let(:confirmed_at) { nil } let(:user) { Fabricate(:user, confirmed_at: confirmed_at) } - let(:app) { Fabricate(:application) } - let(:token) { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: scopes, application: app) } - let(:scopes) { 'write' } + let(:token) { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: scopes) } + let(:scopes) { 'read:accounts write:accounts' } + let(:headers) { { 'Authorization' => "Bearer #{token.token}" } } + + describe 'POST /api/v1/emails/confirmations' do + subject do + post '/api/v1/emails/confirmations', headers: headers, params: params + end + + let(:params) { {} } + + it_behaves_like 'forbidden for wrong scope', 'read read:accounts' - describe '#create' do context 'with an oauth token' do - before do - allow(controller).to receive(:doorkeeper_token) { token } - end + context 'when user was created by a different application' do + let(:user) { Fabricate(:user, confirmed_at: confirmed_at, created_by_application: Fabricate(:application)) } - context 'when from a random app' do it 'returns http forbidden' do - post :create + subject + expect(response).to have_http_status(403) end end - context 'when from an app that created the account' do + context 'when user was created by the same application' do before do user.update(created_by_application: token.application) end @@ -31,55 +38,79 @@ RSpec.describe Api::V1::Emails::ConfirmationsController do let(:confirmed_at) { Time.now.utc } it 'returns http forbidden' do - post :create + subject + expect(response).to have_http_status(403) end - context 'with user changed e-mail and has not confirmed it' do + context 'when user changed e-mail and has not confirmed it' do before do user.update(email: 'foo@bar.com') end it 'returns http success' do - post :create - expect(response).to have_http_status(:success) + subject + + expect(response).to have_http_status(200) end end end context 'when the account is unconfirmed' do it 'returns http success' do - post :create - expect(response).to have_http_status(:success) + subject + + expect(response).to have_http_status(200) + end + end + + context 'with email param' do + let(:params) { { email: 'foo@bar.com' } } + + it "updates the user's e-mail address", :aggregate_failures do + subject + + expect(response).to have_http_status(200) + expect(user.reload.unconfirmed_email).to eq('foo@bar.com') + end + end + + context 'with invalid email param' do + let(:params) { { email: 'invalid' } } + + it 'returns http unprocessable entity' do + subject + + expect(response).to have_http_status(422) end end end end context 'without an oauth token' do + let(:headers) { {} } + it 'returns http unauthorized' do - post :create + subject + expect(response).to have_http_status(401) end end end - describe '#check' do - let(:scopes) { 'read' } + describe 'GET /api/v1/emails/check_confirmation' do + subject do + get '/api/v1/emails/check_confirmation', headers: headers + end + + it_behaves_like 'forbidden for wrong scope', 'write' context 'with an oauth token' do - before do - allow(controller).to receive(:doorkeeper_token) { token } - end - context 'when the account is not confirmed' do - it 'returns http success' do - get :check - expect(response).to have_http_status(200) - end + it 'returns the confirmation status successfully', :aggregate_failures do + subject - it 'returns false' do - get :check + expect(response).to have_http_status(200) expect(body_as_json).to be false end end @@ -87,31 +118,27 @@ RSpec.describe Api::V1::Emails::ConfirmationsController do context 'when the account is confirmed' do let(:confirmed_at) { Time.now.utc } - it 'returns http success' do - get :check - expect(response).to have_http_status(200) - end + it 'returns the confirmation status successfully', :aggregate_failures do + subject - it 'returns true' do - get :check + expect(response).to have_http_status(200) expect(body_as_json).to be true end end end context 'with an authentication cookie' do + let(:headers) { {} } + before do sign_in user, scope: :user end context 'when the account is not confirmed' do - it 'returns http success' do - get :check - expect(response).to have_http_status(200) - end + it 'returns the confirmation status successfully', :aggregate_failures do + subject - it 'returns false' do - get :check + expect(response).to have_http_status(200) expect(body_as_json).to be false end end @@ -119,21 +146,20 @@ RSpec.describe Api::V1::Emails::ConfirmationsController do context 'when the account is confirmed' do let(:confirmed_at) { Time.now.utc } - it 'returns http success' do - get :check - expect(response).to have_http_status(200) - end + it 'returns the confirmation status successfully', :aggregate_failures do + subject - it 'returns true' do - get :check + expect(response).to have_http_status(200) expect(body_as_json).to be true end end end context 'without an oauth token and an authentication cookie' do + let(:headers) { {} } + it 'returns http unauthorized' do - get :check + subject expect(response).to have_http_status(401) end