users_spec.rb 9.14 KB
Newer Older
Nihad Abbasov's avatar
Nihad Abbasov committed
1 2
require 'spec_helper'

3
describe API::API do
4 5
  include ApiHelpers

6 7 8
  let(:user)  { create(:user) }
  let(:admin) { create(:admin) }
  let(:key)   { create(:key, user: user) }
Nihad Abbasov's avatar
Nihad Abbasov committed
9 10

  describe "GET /users" do
11 12 13 14 15
    context "when unauthenticated" do
      it "should return authentication error" do
        get api("/users")
        response.status.should == 401
      end
Nihad Abbasov's avatar
Nihad Abbasov committed
16 17
    end

18
    context "when authenticated" do
Nihad Abbasov's avatar
Nihad Abbasov committed
19
      it "should return an array of users" do
Robert Speicher's avatar
Robert Speicher committed
20
        get api("/users", user)
Nihad Abbasov's avatar
Nihad Abbasov committed
21
        response.status.should == 200
Nihad Abbasov's avatar
Nihad Abbasov committed
22 23
        json_response.should be_an Array
        json_response.first['email'].should == user.email
Nihad Abbasov's avatar
Nihad Abbasov committed
24 25 26 27 28 29
      end
    end
  end

  describe "GET /users/:id" do
    it "should return a user by id" do
Robert Speicher's avatar
Robert Speicher committed
30
      get api("/users/#{user.id}", user)
Nihad Abbasov's avatar
Nihad Abbasov committed
31
      response.status.should == 200
Nihad Abbasov's avatar
Nihad Abbasov committed
32
      json_response['email'].should == user.email
Nihad Abbasov's avatar
Nihad Abbasov committed
33 34
    end

35 36 37 38
    it "should return a 401 if unauthenticated" do
      get api("/users/9998")
      response.status.should == 401
    end
39

40 41
    it "should return a 404 error if user id not found" do
      get api("/users/9999", user)
42 43
      response.status.should == 404
    end
44 45 46 47
  end

  describe "POST /users" do
    before{ admin }
48 49

    it "should create user" do
50
      expect {
51
        post api("/users", admin), attributes_for(:user, projects_limit: 3)
52
      }.to change { User.count }.by(1)
53 54
    end

55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74
    it "should return 201 Created on success" do
      post api("/users", admin), attributes_for(:user, projects_limit: 3)
      response.status.should == 201
    end

    it "should not create user with invalid email" do
      post api("/users", admin), { email: "invalid email", password: 'password' }
      response.status.should == 400
    end

    it "should return 400 error if password not given" do
      post api("/users", admin), { email: 'test@example.com' }
      response.status.should == 400
    end

    it "should return 400 error if email not given" do
      post api("/users", admin), { password: 'pass1234' }
      response.status.should == 400
    end

75
    it "shouldn't available for non admin users" do
76
      post api("/users", user), attributes_for(:user)
77 78
      response.status.should == 403
    end
79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96

    context "with existing user" do
      before { post api("/users", admin), { email: 'test@example.com', password: 'password', username: 'test' } }

      it "should not create user with same email" do
        expect {
          post api("/users", admin), { email: 'test@example.com', password: 'password' }
        }.to change { User.count }.by(0)
      end

      it "should return 409 conflict error if user with email exists" do
        post api("/users", admin), { email: 'test@example.com', password: 'password' }
      end

      it "should return 409 conflict error if same username exists" do
        post api("/users", admin), { email: 'foo@example.com', password: 'pass', username: 'test' }
      end
    end
97 98
  end

Marin Jankovski's avatar
Marin Jankovski committed
99
  describe "GET /users/sign_up" do
100 101 102 103
    context 'enabled' do
      before do
        Gitlab.config.gitlab.stub(:signup_enabled).and_return(true)
      end
Marin Jankovski's avatar
Marin Jankovski committed
104

105 106 107 108
      it "should return sign up page if signup is enabled" do
        get "/users/sign_up"
        response.status.should == 200
      end
Marin Jankovski's avatar
Marin Jankovski committed
109
    end
110 111 112 113 114 115 116 117 118 119 120

    context 'disabled' do
      before do
        Gitlab.config.gitlab.stub(:signup_enabled).and_return(false)
      end

      it "should redirect to sign in page if signup is disabled" do
        get "/users/sign_up"
        response.status.should == 302
        response.should redirect_to(new_user_session_path)
      end
Marin Jankovski's avatar
Marin Jankovski committed
121 122 123
    end
  end

124 125 126
  describe "PUT /users/:id" do
    before { admin }

127
    it "should update user with new bio" do
128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148
      put api("/users/#{user.id}", admin), {bio: 'new test bio'}
      response.status.should == 200
      json_response['bio'].should == 'new test bio'
      user.reload.bio.should == 'new test bio'
    end

    it "should not allow invalid update" do
      put api("/users/#{user.id}", admin), {email: 'invalid email'}
      response.status.should == 404
      user.reload.email.should_not == 'invalid email'
    end

    it "shouldn't available for non admin users" do
      put api("/users/#{user.id}", user), attributes_for(:user)
      response.status.should == 403
    end

    it "should return 404 for non-existing user" do
      put api("/users/999999", admin), {bio: 'update should fail'}
      response.status.should == 404
    end
149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167

    context "with existing user" do
      before {
        post api("/users", admin), { email: 'test@example.com', password: 'password', username: 'test', name: 'test' }
        post api("/users", admin), { email: 'foo@bar.com', password: 'password', username: 'john', name: 'john' }
        @user_id = User.all.last.id
      }

#      it "should return 409 conflict error if email address exists" do
#        put api("/users/#{@user_id}", admin), { email: 'test@example.com' }
#        response.status.should == 409
#      end
#
#      it "should return 409 conflict error if username taken" do
#        @user_id = User.all.last.id
#        put api("/users/#{@user_id}", admin), { username: 'test' }
#        response.status.should == 409
#      end
    end
168 169
  end

Angus MacArthur's avatar
Angus MacArthur committed
170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185
  describe "POST /users/:id/keys" do
    before { admin }

    it "should not create invalid ssh key" do
      post api("/users/#{user.id}/keys", admin), { title: "invalid key" }
      response.status.should == 404
    end

    it "should create ssh key" do
      key_attrs = attributes_for :key
      expect {
        post api("/users/#{user.id}/keys", admin), key_attrs
      }.to change{ user.keys.count }.by(1)
    end
  end

186 187 188 189 190 191 192 193 194 195
  describe "DELETE /users/:id" do
    before { admin }

    it "should delete user" do
      delete api("/users/#{user.id}", admin)
      response.status.should == 200
      expect { User.find(user.id) }.to raise_error ActiveRecord::RecordNotFound
      json_response['email'].should == user.email
    end

196 197 198 199 200
    it "should not delete for unauthenticated user" do
      delete api("/users/#{user.id}")
      response.status.should == 401
    end

201 202 203 204 205 206 207 208 209 210 211
    it "shouldn't available for non admin users" do
      delete api("/users/#{user.id}", user)
      response.status.should == 403
    end

    it "should return 404 for non-existing user" do
      delete api("/users/999999", admin)
      response.status.should == 404
    end
  end

Nihad Abbasov's avatar
Nihad Abbasov committed
212 213
  describe "GET /user" do
    it "should return current user" do
Robert Speicher's avatar
Robert Speicher committed
214
      get api("/user", user)
Nihad Abbasov's avatar
Nihad Abbasov committed
215
      response.status.should == 200
Nihad Abbasov's avatar
Nihad Abbasov committed
216
      json_response['email'].should == user.email
217 218 219 220
      json_response['is_admin'].should == user.is_admin?
      json_response['can_create_team'].should == user.can_create_team?
      json_response['can_create_project'].should == user.can_create_project?
      json_response['can_create_group'].should == user.can_create_group?
Nihad Abbasov's avatar
Nihad Abbasov committed
221
    end
222 223 224 225 226

    it "should return 401 error if user is unauthenticated" do
      get api("/user")
      response.status.should == 401
    end
Nihad Abbasov's avatar
Nihad Abbasov committed
227
  end
228 229 230 231 232 233 234 235

  describe "GET /user/keys" do
    context "when unauthenticated" do
      it "should return authentication error" do
        get api("/user/keys")
        response.status.should == 401
      end
    end
Nihad Abbasov's avatar
Nihad Abbasov committed
236

237 238 239 240 241 242 243 244 245 246 247 248 249
    context "when authenticated" do
      it "should return array of ssh keys" do
        user.keys << key
        user.save
        get api("/user/keys", user)
        response.status.should == 200
        json_response.should be_an Array
        json_response.first["title"].should == key.title
      end
    end
  end

  describe "GET /user/keys/:id" do
Johannes Schleifenbaum's avatar
Johannes Schleifenbaum committed
250
    it "should return single key" do
251 252 253 254 255 256
      user.keys << key
      user.save
      get api("/user/keys/#{key.id}", user)
      response.status.should == 200
      json_response["title"].should == key.title
    end
Nihad Abbasov's avatar
Nihad Abbasov committed
257

258 259 260 261 262
    it "should return 404 Not Found within invalid ID" do
      get api("/user/keys/42", user)
      response.status.should == 404
    end

263 264 265 266 267
    it "should return 404 error if admin accesses user's ssh key" do
      user.keys << key
      user.save
      admin
      get api("/user/keys/#{key.id}", admin)
268 269
      response.status.should == 404
    end
270
  end
Nihad Abbasov's avatar
Nihad Abbasov committed
271

272
  describe "POST /user/keys" do
273
    it "should create ssh key" do
274
      key_attrs = attributes_for :key
275 276 277
      expect {
        post api("/user/keys", user), key_attrs
      }.to change{ user.keys.count }.by(1)
278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293
      response.status.should == 201
    end

    it "should return a 401 error if unauthorized" do
      post api("/user/keys"), title: 'some title', key: 'some key'
      response.status.should == 401
    end

    it "should not create ssh key without key" do
      post api("/user/keys", user), title: 'title'
      response.status.should == 400
    end

    it "should not create ssh key without title" do
      post api("/user/keys", user), key: "somekey"
      response.status.should == 400
294 295 296 297 298 299 300 301 302 303
    end
  end

  describe "DELETE /user/keys/:id" do
    it "should delete existed key" do
      user.keys << key
      user.save
      expect {
        delete api("/user/keys/#{key.id}", user)
      }.to change{user.keys.count}.by(-1)
304
      response.status.should == 200
305
    end
Nihad Abbasov's avatar
Nihad Abbasov committed
306

Kevin Lyda's avatar
Kevin Lyda committed
307
    it "should return success if key ID not found" do
308
      delete api("/user/keys/42", user)
309 310 311 312 313 314 315 316
      response.status.should == 200
    end

    it "should return 401 error if unauthorized" do
      user.keys << key
      user.save
      delete api("/user/keys/#{key.id}")
      response.status.should == 401
317 318
    end
  end
Nihad Abbasov's avatar
Nihad Abbasov committed
319
end