diff --git a/app/controllers/api/v1/dossiers_controller.rb b/app/controllers/api/v1/dossiers_controller.rb index e85f1548e..40cbcc1fa 100644 --- a/app/controllers/api/v1/dossiers_controller.rb +++ b/app/controllers/api/v1/dossiers_controller.rb @@ -38,7 +38,10 @@ class API::V1::DossiersController < APIController def fetch_procedure_and_check_token @procedure = Procedure.for_api.find(params[:procedure_id]) - if !valid_token_for_procedure?(@procedure) + administrateur = find_administrateur_for_token(@procedure) + if administrateur + Current.administrateur = administrateur + else render json: {}, status: :unauthorized end diff --git a/app/controllers/api/v1/procedures_controller.rb b/app/controllers/api/v1/procedures_controller.rb index 4f35da14f..4915d672f 100644 --- a/app/controllers/api/v1/procedures_controller.rb +++ b/app/controllers/api/v1/procedures_controller.rb @@ -10,7 +10,10 @@ class API::V1::ProceduresController < APIController def fetch_procedure_and_check_token @procedure = Procedure.for_api.find(params[:id]) - if !valid_token_for_procedure?(@procedure) + administrateur = find_administrateur_for_token(@procedure) + if administrateur + Current.administrateur = administrateur + else render json: {}, status: :unauthorized end diff --git a/app/controllers/api_controller.rb b/app/controllers/api_controller.rb index 19ca856de..fca8b7ec3 100644 --- a/app/controllers/api_controller.rb +++ b/app/controllers/api_controller.rb @@ -3,8 +3,8 @@ class APIController < ApplicationController protected - def valid_token_for_procedure?(procedure) - procedure.administrateurs.any? do |administrateur| + def find_administrateur_for_token(procedure) + procedure.administrateurs.find do |administrateur| administrateur.valid_api_token?(token) end end diff --git a/spec/controllers/api_controller_spec.rb b/spec/controllers/api_controller_spec.rb index c9647022e..1c1535b16 100644 --- a/spec/controllers/api_controller_spec.rb +++ b/spec/controllers/api_controller_spec.rb @@ -5,7 +5,7 @@ describe APIController, type: :controller do let(:procedure) { create(:procedure) } let(:admin) { procedure.administrateurs.first } - subject { controller.send(:'valid_token_for_procedure?', procedure) } + subject { !!controller.send(:find_administrateur_for_token, procedure) } context 'when the admin has not any token' do context 'and the token is not given' do