demarches-normaliennes/spec/models/api_token_spec.rb

161 lines
5.4 KiB
Ruby
Raw Normal View History

2022-11-30 10:06:33 +01:00
describe APIToken, type: :model do
let(:administrateur) { create(:administrateur) }
describe '#generate' do
2023-08-03 10:23:05 +02:00
let(:api_token_and_packed_token) { APIToken.generate(administrateur) }
let(:api_token) { api_token_and_packed_token.first }
let(:packed_token) { api_token_and_packed_token.second }
2023-08-03 17:53:34 +02:00
before { api_token_and_packed_token }
it 'with a full access token' do
2022-11-30 10:06:33 +01:00
expect(api_token.administrateur).to eq(administrateur)
expect(api_token.prefix).to eq(packed_token.slice(0, 5))
expect(api_token.version).to eq(3)
expect(api_token.write_access?).to eq(true)
expect(api_token.procedure_ids).to eq([])
expect(api_token.context).to eq(administrateur_id: administrateur.id, procedure_ids: [], write_access: true)
expect(api_token.full_access?).to be_truthy
end
2023-08-03 17:53:34 +02:00
context 'updated read_only' do
before { api_token.update(write_access: false) }
2023-08-03 17:53:34 +02:00
it do
expect(api_token.context).to eq(administrateur_id: administrateur.id, procedure_ids: [], write_access: false)
end
end
2023-08-03 17:53:34 +02:00
context 'with a new added procedure' do
let(:procedure) { create(:procedure, administrateurs: [administrateur]) }
2023-08-03 17:53:34 +02:00
before do
procedure
api_token.reload
end
it do
2023-08-03 17:53:34 +02:00
expect(api_token.full_access?).to be_truthy
expect(api_token.procedure_ids).to eq([procedure.id])
2023-08-03 17:53:34 +02:00
expect(api_token.procedures).to eq([procedure])
expect(api_token.context).to eq(administrateur_id: administrateur.id, procedure_ids: [procedure.id], write_access: true)
end
2023-08-03 17:53:34 +02:00
context 'and another procedure, but access only to the first one' do
let(:other_procedure) { create(:procedure, administrateurs: [administrateur]) }
2023-08-03 17:53:34 +02:00
before do
other_procedure
api_token.update(allowed_procedure_ids: [procedure.id])
api_token.reload
end
it do
2023-08-03 17:53:34 +02:00
expect(api_token.full_access?).to be_falsey
expect(api_token.procedure_ids).to match_array([procedure.id])
expect(api_token.targetable_procedures).to eq([other_procedure])
expect(api_token.context).to eq(administrateur_id: administrateur.id, procedure_ids: [procedure.id], write_access: true)
end
2023-08-03 17:53:34 +02:00
context 'and then gain full access' do
before do
api_token.become_full_access!
api_token.reload
end
it do
expect(api_token.full_access?).to be(true)
expect(api_token.procedure_ids).to match_array([procedure.id, other_procedure.id])
expect(api_token.targetable_procedures).to eq([procedure, other_procedure])
end
end
end
2023-08-03 17:53:34 +02:00
context 'but acces to a wrong procedure_id' do
let(:forbidden_procedure) { create(:procedure) }
before do
api_token.update(allowed_procedure_ids: [forbidden_procedure.id])
api_token.reload
end
it do
expect(api_token.full_access?).to be_falsey
expect(api_token.procedure_ids).to eq([])
2023-08-03 17:53:34 +02:00
expect(api_token.targetable_procedures).to eq([procedure])
expect(api_token.context).to eq(administrateur_id: administrateur.id, procedure_ids: [], write_access: true)
end
end
context 'update with destroyed procedure_id' do
let(:procedure) { create(:procedure, administrateurs: [administrateur]) }
2023-08-03 17:53:34 +02:00
before do
api_token.update(allowed_procedure_ids: [procedure.id])
procedure.destroy
api_token.reload
end
it do
expect(api_token.full_access?).to be_falsey
expect(api_token.procedure_ids).to eq([])
2023-08-03 17:53:34 +02:00
expect(api_token.targetable_procedures).to eq([])
expect(api_token.context).to eq(administrateur_id: administrateur.id, procedure_ids: [], write_access: true)
end
end
context 'update with detached procedure_id' do
let(:procedure) { create(:procedure, administrateurs: [administrateur]) }
2023-08-03 17:53:34 +02:00
let(:other_procedure) { create(:procedure, administrateurs: [administrateur]) }
before do
api_token.update(allowed_procedure_ids: [procedure.id])
other_procedure
administrateur.procedures.delete(procedure)
api_token.reload
end
it do
expect(api_token.full_access?).to be_falsey
2023-08-03 17:53:34 +02:00
expect(api_token.procedure_ids).to eq([])
expect(api_token.targetable_procedures).to eq([other_procedure])
expect(api_token.context).to eq(administrateur_id: administrateur.id, procedure_ids: [], write_access: true)
end
end
end
2022-11-30 10:06:33 +01:00
end
2023-08-03 15:27:33 +02:00
describe '#authenticate' do
2023-08-03 10:23:05 +02:00
let(:api_token_and_packed_token) { APIToken.generate(administrateur) }
let(:api_token) { api_token_and_packed_token.first }
let(:packed_token) { api_token_and_packed_token.second }
let(:bearer_token) { packed_token }
2022-11-30 10:06:33 +01:00
2023-08-03 15:27:33 +02:00
subject { APIToken.authenticate(bearer_token) }
2022-11-30 10:06:33 +01:00
2023-08-03 10:23:05 +02:00
context 'with the legit packed token' do
it { is_expected.to eq(api_token) }
2022-11-30 10:06:33 +01:00
end
context 'with destroyed token' do
before { api_token.destroy }
2023-08-03 10:23:05 +02:00
it { is_expected.to be_nil }
2022-11-30 10:06:33 +01:00
end
context 'with destroyed administrateur' do
before { api_token.administrateur.destroy }
2023-08-03 10:23:05 +02:00
it { is_expected.to be_nil }
2022-11-30 10:06:33 +01:00
end
2023-08-03 10:23:05 +02:00
context "with a bearer token with the wrong plain_token" do
let(:bearer_token) do
2023-08-03 17:53:34 +02:00
APIToken::BearerToken.new(api_token.id, 'wrong').to_string
2022-11-30 10:06:33 +01:00
end
2023-08-03 10:23:05 +02:00
it { is_expected.to be_nil }
2022-11-30 10:06:33 +01:00
end
end
end