Fix #4637 - Re-add missing doorkeeper_authorize for /api/v1/verify_credentials (#4650)

main
Eugen Rochko 7 years ago committed by GitHub
parent 110227ac5e
commit 74e5078795

@ -1,6 +1,7 @@
# frozen_string_literal: true # frozen_string_literal: true
class Api::V1::Accounts::CredentialsController < Api::BaseController class Api::V1::Accounts::CredentialsController < Api::BaseController
before_action -> { doorkeeper_authorize! :read }, except: [:update]
before_action -> { doorkeeper_authorize! :write }, only: [:update] before_action -> { doorkeeper_authorize! :write }, only: [:update]
before_action :require_user! before_action :require_user!

@ -4,57 +4,79 @@ describe Api::V1::Accounts::CredentialsController do
render_views render_views
let(:user) { Fabricate(:user, account: Fabricate(:account, username: 'alice')) } let(:user) { Fabricate(:user, account: Fabricate(:account, username: 'alice')) }
let(:token) { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: 'write') } let(:token) { Fabricate(:accessible_access_token, resource_owner_id: user.id, scopes: 'read write') }
before do context 'with an oauth token' do
allow(controller).to receive(:doorkeeper_token) { token } before do
end allow(controller).to receive(:doorkeeper_token) { token }
describe 'GET #show' do
it 'returns http success' do
get :show
expect(response).to have_http_status(:success)
end end
end
describe 'PATCH #update' do
describe 'with valid data' do
before do
allow(ActivityPub::UpdateDistributionWorker).to receive(:perform_async)
patch :update, params: {
display_name: "Alice Isn't Dead",
note: "Hi!\n\nToot toot!",
avatar: fixture_file_upload('files/avatar.gif', 'image/gif'),
header: fixture_file_upload('files/attachment.jpg', 'image/jpeg'),
}
end
describe 'GET #show' do
it 'returns http success' do it 'returns http success' do
get :show
expect(response).to have_http_status(:success) expect(response).to have_http_status(:success)
end end
end
describe 'PATCH #update' do
describe 'with valid data' do
before do
allow(ActivityPub::UpdateDistributionWorker).to receive(:perform_async)
patch :update, params: {
display_name: "Alice Isn't Dead",
note: "Hi!\n\nToot toot!",
avatar: fixture_file_upload('files/avatar.gif', 'image/gif'),
header: fixture_file_upload('files/attachment.jpg', 'image/jpeg'),
}
end
it 'updates account info' do it 'returns http success' do
user.account.reload expect(response).to have_http_status(:success)
end
expect(user.account.display_name).to eq("Alice Isn't Dead") it 'updates account info' do
expect(user.account.note).to eq("Hi!\n\nToot toot!") user.account.reload
expect(user.account.avatar).to exist
expect(user.account.header).to exist expect(user.account.display_name).to eq("Alice Isn't Dead")
expect(user.account.note).to eq("Hi!\n\nToot toot!")
expect(user.account.avatar).to exist
expect(user.account.header).to exist
end
it 'queues up an account update distribution' do
expect(ActivityPub::UpdateDistributionWorker).to have_received(:perform_async).with(user.account_id)
end
end end
it 'queues up an account update distribution' do describe 'with invalid data' do
expect(ActivityPub::UpdateDistributionWorker).to have_received(:perform_async).with(user.account_id) before do
patch :update, params: { note: 'This is too long. ' * 10 }
end
it 'returns http unprocessable entity' do
expect(response).to have_http_status(:unprocessable_entity)
end
end end
end end
end
describe 'with invalid data' do context 'without an oauth token' do
before do before do
patch :update, params: { note: 'This is too long. ' * 10 } allow(controller).to receive(:doorkeeper_token) { nil }
end
describe 'GET #show' do
it 'returns http unauthorized' do
get :show
expect(response).to have_http_status(:unauthorized)
end end
end
it 'returns http unprocessable entity' do describe 'PATCH #update' do
expect(response).to have_http_status(:unprocessable_entity) it 'returns http unauthorized' do
patch :update, params: { note: 'Foo' }
expect(response).to have_http_status(:unauthorized)
end end
end end
end end

Loading…
Cancel
Save