diff options
-rw-r--r-- | spec/requests/api/helpers_spec.rb | 4 | ||||
-rw-r--r-- | spec/support/api/scopes/read_user_shared_examples.rb | 67 | ||||
-rw-r--r-- | spec/support/api_helpers.rb | 14 |
3 files changed, 71 insertions, 14 deletions
diff --git a/spec/requests/api/helpers_spec.rb b/spec/requests/api/helpers_spec.rb index 87d6f46533e..25ec44fa036 100644 --- a/spec/requests/api/helpers_spec.rb +++ b/spec/requests/api/helpers_spec.rb @@ -14,7 +14,9 @@ describe API::Helpers do let(:request) { Rack::Request.new(env) } let(:header) { } - before { allow_any_instance_of(self.class).to receive(:options).and_return({}) } + before do + allow_any_instance_of(self.class).to receive(:options).and_return({}) + end def set_env(user_or_token, identifier) clear_env diff --git a/spec/support/api/scopes/read_user_shared_examples.rb b/spec/support/api/scopes/read_user_shared_examples.rb index bb5f493f3fd..cae6099a0c2 100644 --- a/spec/support/api/scopes/read_user_shared_examples.rb +++ b/spec/support/api/scopes/read_user_shared_examples.rb @@ -1,21 +1,68 @@ shared_examples_for 'allows the "read_user" scope' do - describe 'when the requesting token has the "read_user" scope' do - let(:token) { create(:personal_access_token, scopes: ['read_user'], user: user) } + context 'for personal access tokens' do + context 'when the requesting token has the "api" scope' do + let(:token) { create(:personal_access_token, scopes: ['api'], user: user) } + + it 'returns a "200" response' do + get api_call.call(path, user, personal_access_token: token) + + expect(response).to have_http_status(200) + end + end + + context 'when the requesting token has the "read_user" scope' do + let(:token) { create(:personal_access_token, scopes: ['read_user'], user: user) } - it 'returns a "200" response' do - get api_call.call(path, user, personal_access_token: token) + it 'returns a "200" response' do + get api_call.call(path, user, personal_access_token: token) - expect(response).to have_http_status(200) + expect(response).to have_http_status(200) + end + end + + context 'when the requesting token does not have any required scope' do + let(:token) { create(:personal_access_token, scopes: ['read_registry'], user: user) } + + it 'returns a "401" response' do + get api_call.call(path, user, personal_access_token: token) + + expect(response).to have_http_status(401) + end end end - describe 'when the requesting token does not have any required scope' do - let(:token) { create(:personal_access_token, scopes: ['read_registry'], user: user) } + context 'for doorkeeper (OAuth) tokens' do + let!(:user) {create(:user)} + let!(:application) { Doorkeeper::Application.create!(name: "MyApp", redirect_uri: "https://app.com", owner: user) } - it 'returns a "401" response' do - get api_call.call(path, user, personal_access_token: token) + context 'when the requesting token has the "api" scope' do + let!(:token) { Doorkeeper::AccessToken.create! application_id: application.id, resource_owner_id: user.id, scopes: "api" } - expect(response).to have_http_status(401) + it 'returns a "200" response' do + get api_call.call(path, user, oauth_access_token: token) + + expect(response).to have_http_status(200) + end + end + + context 'when the requesting token has the "read_user" scope' do + let!(:token) { Doorkeeper::AccessToken.create! application_id: application.id, resource_owner_id: user.id, scopes: "read_user" } + + it 'returns a "200" response' do + get api_call.call(path, user, oauth_access_token: token) + + expect(response).to have_http_status(200) + end + end + + context 'when the requesting token does not have any required scope' do + let!(:token) { Doorkeeper::AccessToken.create! application_id: application.id, resource_owner_id: user.id, scopes: "invalid" } + + it 'returns a "403" response' do + get api_call.call(path, user, oauth_access_token: token) + + expect(response).to have_http_status(403) + end end end end diff --git a/spec/support/api_helpers.rb b/spec/support/api_helpers.rb index 1becd302d77..ac0aaa524b7 100644 --- a/spec/support/api_helpers.rb +++ b/spec/support/api_helpers.rb @@ -17,7 +17,7 @@ module ApiHelpers # => "/api/v2/issues?foo=bar&private_token=..." # # Returns the relative path to the requested API resource - def api(path, user = nil, version: API::API.version, personal_access_token: nil) + def api(path, user = nil, version: API::API.version, personal_access_token: nil, oauth_access_token: nil) "/api/#{version}#{path}" + # Normalize query string @@ -25,6 +25,8 @@ module ApiHelpers if personal_access_token.present? "&private_token=#{personal_access_token.token}" + elsif oauth_access_token.present? + "&access_token=#{oauth_access_token.token}" # Append private_token if given a User object elsif user.respond_to?(:private_token) "&private_token=#{user.private_token}" @@ -34,8 +36,14 @@ module ApiHelpers end # Temporary helper method for simplifying V3 exclusive API specs - def v3_api(path, user = nil, personal_access_token: nil) - api(path, user, version: 'v3', personal_access_token: personal_access_token) + def v3_api(path, user = nil, personal_access_token: nil, oauth_access_token: nil) + api( + path, + user, + version: 'v3', + personal_access_token: personal_access_token, + oauth_access_token: oauth_access_token + ) end def ci_api(path, user = nil) |