Merge branch 'dev'

app/controllers/api/v1/dossiers_controller.rb

@@ -1,7 +1,14 @@
 class API::V1::DossiersController < APIController
+  DEFAULT_PAGE_SIZE = 100
+
+  resource_description do
+    description AUTHENTICATION_TOKEN_DESCRIPTION
+  end
+
   api :GET, '/procedures/:procedure_id/dossiers/', 'Liste de tous les dossiers d\'une procédure'
   param :procedure_id, Integer, desc: "L'identifiant de la procédure", required: true
-  param :token, String, desc: "Token administrateur", required: true
+  param :page, String, desc: "Numéro de la page", required: false
+  param :resultats_par_page, String, desc: "Nombre de résultats par page (#{DEFAULT_PAGE_SIZE} par défaut, maximum 1 000)", required: false
   error code: 401, desc: "Non authorisé"
   error code: 404, desc: "Procédure inconnue"
 
@@ -17,7 +24,6 @@ class API::V1::DossiersController < APIController
   api :GET, '/procedures/:procedure_id/dossiers/:id', 'Informations du dossier d\'une procédure'
   param :procedure_id, Integer, desc: "L'identifiant de la procédure", required: true
   param :dossier_id, Integer, desc: "L'identifiant du dossier", required: true
-  param :token, String, desc: "Token administrateur", required: true
   error code: 401, desc: "Non authorisé"
   error code: 404, desc: "Procédure ou dossier inconnu"
 
@@ -41,6 +47,6 @@ class API::V1::DossiersController < APIController
   end
 
   def per_page # inherited value from will_paginate
-    12
+    [params[:resultats_par_page] || DEFAULT_PAGE_SIZE, 1000].min
   end
 end

app/controllers/api/v1/procedures_controller.rb

@@ -1,7 +1,10 @@
 class API::V1::ProceduresController < APIController
+  resource_description do
+    description AUTHENTICATION_TOKEN_DESCRIPTION
+  end
+
   api :GET, '/procedures/:id', 'Informations concernant une procédure'
   param :id, Integer, desc: "L'identifiant de la procédure", required: true
-  param :token, String, desc: "Token administrateur", required: true
   error code: 401, desc: "Non authorisé"
   error code: 404, desc: "Procédure inconnue"
 

app/controllers/api_controller.rb

@@ -1,9 +1,19 @@
 class APIController < ApplicationController
+  AUTHENTICATION_TOKEN_DESCRIPTION = <<-EOS
+    L'authentification de l'API se fait via un header HTTP :
+
+    ```
+      Authorization: Bearer &lt;Token administrateur&gt;
+    ```
+  EOS
+
   before_action :authenticate_user
   before_action :default_format_json
 
   def authenticate_user
-    render json: {}, status: 401 if !valid_token?
+    if !valid_token?
+      request_http_token_authentication
+    end
   end
 
   protected
@@ -13,7 +23,17 @@ class APIController < ApplicationController
   end
 
   def current_administrateur
-    @administrateur ||= Administrateur.find_by(api_token: params[:token])
+    @administrateur ||= (authenticate_with_bearer_token || authenticate_with_param_token)
+  end
+
+  def authenticate_with_bearer_token
+    authenticate_with_http_token do |token, options|
+      Administrateur.find_by(api_token: token)
+    end
+  end
+
+  def authenticate_with_param_token
+    Administrateur.find_by(api_token: params[:token])
   end
 
   def default_format_json

app/lib/siade/api.rb

@@ -6,24 +6,24 @@ class SIADE::API
   def initialize
   end
 
-  def self.entreprise(siren)
+  def self.entreprise(siren, procedure_id)
     endpoint = "/v2/entreprises/#{siren}"
-    call(base_url + endpoint)
+    call(base_url + endpoint, mandatory_params(siren, procedure_id))
   end
 
-  def self.etablissement(siret)
+  def self.etablissement(siret, procedure_id)
     endpoint = "/v2/etablissements/#{siret}"
-    call(base_url + endpoint)
+    call(base_url + endpoint, mandatory_params(siret, procedure_id))
   end
 
-  def self.exercices(siret)
+  def self.exercices(siret, procedure_id)
     endpoint = "/v2/exercices/#{siret}"
-    call(base_url + endpoint)
+    call(base_url + endpoint, mandatory_params(siret, procedure_id))
   end
 
-  def self.rna(siret)
+  def self.rna(siret, procedure_id)
     endpoint = "/v2/associations/#{siret}"
-    call(base_url + endpoint)
+    call(base_url + endpoint, mandatory_params(siret, procedure_id))
   end
 
   def self.call(url, params = {})
@@ -37,6 +37,14 @@ class SIADE::API
     ).get(params: params)
   end
 
+  def self.mandatory_params(siret_or_siren, procedure_id)
+    {
+      context: "demarches-simplifiees.fr",
+      recipient: siret_or_siren,
+      object: "procedure_id: #{procedure_id}"
+    }
+  end
+
   def self.base_url
     SIADEURL
   end

app/lib/siade/entreprise_adapter.rb

@@ -1,10 +1,11 @@
 class SIADE::EntrepriseAdapter
-  def initialize(siren)
+  def initialize(siren, procedure_id)
     @siren = siren
+    @procedure_id = procedure_id
   end
 
   def data_source
-    @data_source ||= JSON.parse(SIADE::API.entreprise(@siren), symbolize_names: true)
+    @data_source ||= JSON.parse(SIADE::API.entreprise(@siren, @procedure_id), symbolize_names: true)
   rescue
     @data_source = nil
   end

app/lib/siade/etablissement_adapter.rb

@@ -1,10 +1,11 @@
 class SIADE::EtablissementAdapter
-  def initialize(siret)
+  def initialize(siret, procedure_id)
     @siret = siret
+    @procedure_id = procedure_id
   end
 
   def data_source
-    @data_source ||= JSON.parse(SIADE::API.etablissement(@siret), symbolize_names: true)
+    @data_source ||= JSON.parse(SIADE::API.etablissement(@siret, @procedure_id), symbolize_names: true)
   end
 
   def success?

app/lib/siade/exercices_adapter.rb

@@ -1,10 +1,11 @@
 class SIADE::ExercicesAdapter
-  def initialize(siret)
+  def initialize(siret, procedure_id)
     @siret = siret
+    @procedure_id = procedure_id
   end
 
   def data_source
-    @data_source ||= JSON.parse(SIADE::API.exercices(@siret), symbolize_names: true)
+    @data_source ||= JSON.parse(SIADE::API.exercices(@siret, @procedure_id), symbolize_names: true)
   rescue
     @data_source = nil
   end

app/lib/siade/rna_adapter.rb

@@ -1,10 +1,11 @@
 class SIADE::RNAAdapter
-  def initialize(siret)
+  def initialize(siret, procedure_id)
     @siret = siret
+    @procedure_id = procedure_id
   end
 
   def data_source
-    @data_source ||= JSON.parse(SIADE::API.rna(@siret), symbolize_names: true)
+    @data_source ||= JSON.parse(SIADE::API.rna(@siret, @procedure_id), symbolize_names: true)
   end
 
   def to_params

app/services/siret_service.rb

@@ -1,11 +1,11 @@
 class SIRETService
   def self.fetch(siret, dossier = nil)
-    etablissement = SIADE::EtablissementAdapter.new(siret)
-    entreprise = SIADE::EntrepriseAdapter.new(siren(siret))
+    etablissement = SIADE::EtablissementAdapter.new(siret, dossier&.procedure_id)
+    entreprise = SIADE::EntrepriseAdapter.new(siren(siret), dossier&.procedure_id)
 
     if etablissement.success? && entreprise.success?
-      association = SIADE::RNAAdapter.new(siret)
-      exercices = SIADE::ExercicesAdapter.new(siret)
+      association = SIADE::RNAAdapter.new(siret, dossier&.procedure_id)
+      exercices = SIADE::ExercicesAdapter.new(siret, dossier&.procedure_id)
 
       params = etablissement.to_params
         .merge(entreprise.to_params.map { |k,v| ["entreprise_#{k}", v] }.to_h)

app/views/layouts/_new_header.haml

@@ -26,7 +26,7 @@
               .contact-details
                 Vous avez besoin d’aide ? Contactez-nous :
                 %br
-                – par téléphone : 09 72 62 57 12
+                – par téléphone : 01 76 42 02 87
                 %br
                 – par email : <a href="mailto:contact@demarches-simplifiees.fr">contact@demarches-simplifiees.fr</a>
 

config/deploy.rb

@@ -61,7 +61,6 @@ set :shared_paths, [
   'config/initializers/features.yml',
   "config/environments/#{rails_env}.rb",
   "config/initializers/token.rb",
-  "config/initializers/urls.rb",
   "config/initializers/super_admin.rb",
   "config/unicorn.rb",
   "config/initializers/raven.rb",

spec/controllers/api/v1/dossiers_controller_spec.rb

@@ -7,6 +7,21 @@ describe API::V1::DossiersController do
 
   it { expect(described_class).to be < APIController }
 
+  describe 'GET index (with bearer token)' do
+    let(:authorization_header) { ActionController::HttpAuthentication::Token.encode_credentials(admin.api_token) }
+    let(:retour) do
+      request.env['HTTP_AUTHORIZATION'] = authorization_header
+      get :index, params: { procedure_id: procedure_id }
+    end
+
+    subject { retour }
+
+    context 'when procedure is not found' do
+      let(:procedure_id) { 99_999_999 }
+      it { expect(subject.code).to eq('404') }
+    end
+  end
+
   describe 'GET index' do
     let(:retour) { get :index, params: { token: admin.api_token, procedure_id: procedure_id } }
 
@@ -41,7 +56,7 @@ describe API::V1::DossiersController do
         it { is_expected.to have_key(:page) }
         it { expect(subject[:page]).to eq(1) }
         it { is_expected.to have_key(:resultats_par_page) }
-        it { expect(subject[:resultats_par_page]).to eq(12) }
+        it { expect(subject[:resultats_par_page]).to eq(described_class.const_get(:DEFAULT_PAGE_SIZE)) }
         it { is_expected.to have_key(:nombre_de_page) }
         it { expect(subject[:nombre_de_page]).to eq(1) }
       end

spec/controllers/users/dossiers_controller_spec.rb

@@ -178,19 +178,19 @@ describe Users::DossiersController, type: :controller do
     let(:user) { create(:user) }
 
     before do
-      stub_request(:get, "https://staging.entreprise.api.gouv.fr/v2/etablissements/#{siret_not_found}?token=#{SIADETOKEN}")
+      stub_request(:get, /https:\/\/staging.entreprise.api.gouv.fr\/v2\/etablissements\/#{siret_not_found}?.*token=/)
         .to_return(status: 404, body: 'fake body')
 
-      stub_request(:get, "https://staging.entreprise.api.gouv.fr/v2/etablissements/#{siret}?token=#{SIADETOKEN}")
+      stub_request(:get, /https:\/\/staging.entreprise.api.gouv.fr\/v2\/etablissements\/#{siret}?.*token=/)
         .to_return(status: status_entreprise_call, body: File.read('spec/support/files/etablissement.json'))
 
-      stub_request(:get, "https://staging.entreprise.api.gouv.fr/v2/entreprises/#{siren}?token=#{SIADETOKEN}")
+      stub_request(:get, /https:\/\/staging.entreprise.api.gouv.fr\/v2\/entreprises\/#{siren}?.*token=/)
         .to_return(status: status_entreprise_call, body: File.read('spec/support/files/entreprise.json'))
 
-      stub_request(:get, "https://staging.entreprise.api.gouv.fr/v2/exercices/#{siret}?token=#{SIADETOKEN}")
+      stub_request(:get, /https:\/\/staging.entreprise.api.gouv.fr\/v2\/exercices\/#{siret}?.*token=/)
         .to_return(status: exercices_status, body: exercices_body)
 
-      stub_request(:get, "https://staging.entreprise.api.gouv.fr/v2/associations/#{siret}?token=#{SIADETOKEN}")
+      stub_request(:get, /https:\/\/staging.entreprise.api.gouv.fr\/v2\/associations\/#{siret}?.*token=/)
         .to_return(status: rna_status, body: rna_body)
 
       dossier

spec/features/users/complete_demande_spec.rb

@@ -30,14 +30,14 @@ feature 'user path for dossier creation' do
       end
       context 'sets siret' do
         before do
-          stub_request(:get, "https://staging.entreprise.api.gouv.fr/v2/etablissements/#{siret}?token=#{SIADETOKEN}")
+          stub_request(:get, /https:\/\/staging.entreprise.api.gouv.fr\/v2\/etablissements\/#{siret}?.*token=/)
             .to_return(body: File.read('spec/support/files/etablissement.json', status: 200))
-          stub_request(:get, "https://staging.entreprise.api.gouv.fr/v2/entreprises/#{siren}?token=#{SIADETOKEN}")
+          stub_request(:get, /https:\/\/staging.entreprise.api.gouv.fr\/v2\/entreprises\/#{siren}?.*token=/)
             .to_return(status: 200, body: File.read('spec/support/files/entreprise.json'))
 
-          stub_request(:get, "https://staging.entreprise.api.gouv.fr/v2/exercices/#{siret}?token=#{SIADETOKEN}")
+          stub_request(:get, /https:\/\/staging.entreprise.api.gouv.fr\/v2\/exercices\/#{siret}?.*token=/)
             .to_return(status: 200, body: File.read('spec/support/files/exercices.json'))
-          stub_request(:get, "https://staging.entreprise.api.gouv.fr/v2/associations/#{siret}?token=#{SIADETOKEN}")
+          stub_request(:get, /https:\/\/staging.entreprise.api.gouv.fr\/v2\/associations\/#{siret}?.*token=/)
             .to_return(status: 404, body: '')
 
           page.find_by_id('dossier-siret').set siret

spec/features/users/dossier_creation_spec.rb

@@ -67,13 +67,13 @@ feature 'As a User I wanna create a dossier' do
       visit commencer_path(procedure_path: procedure_with_siret.path)
       expect(page).to have_current_path(users_dossier_path(procedure_with_siret.dossiers.last.id.to_s))
       fill_in 'dossier-siret', with: siret
-      stub_request(:get, "https://staging.entreprise.api.gouv.fr/v2/etablissements/#{siret}?token=#{SIADETOKEN}")
+      stub_request(:get, /https:\/\/staging.entreprise.api.gouv.fr\/v2\/etablissements\/#{siret}?.*token=/)
         .to_return(status: 200, body: File.read('spec/support/files/etablissement.json'))
-      stub_request(:get, "https://staging.entreprise.api.gouv.fr/v2/entreprises/#{siren}?token=#{SIADETOKEN}")
+      stub_request(:get, /https:\/\/staging.entreprise.api.gouv.fr\/v2\/entreprises\/#{siren}?.*token=/)
         .to_return(status: 200, body: File.read('spec/support/files/entreprise.json'))
-      stub_request(:get, "https://staging.entreprise.api.gouv.fr/v2/exercices/#{siret}?token=#{SIADETOKEN}")
+      stub_request(:get, /https:\/\/staging.entreprise.api.gouv.fr\/v2\/exercices\/#{siret}?.*token=/)
         .to_return(status: 200, body: File.read('spec/support/files/exercices.json'))
-      stub_request(:get, "https://staging.entreprise.api.gouv.fr/v2/associations/#{siret}?token=#{SIADETOKEN}")
+      stub_request(:get, /https:\/\/staging.entreprise.api.gouv.fr\/v2\/associations\/#{siret}?.*token=/)
         .to_return(status: 404, body: '')
       page.find_by_id('dossier-siret').set siret
       page.find_by_id('submit-siret').click

spec/features/users/start_demande_spec.rb

@@ -26,13 +26,13 @@ feature 'user arrive on siret page' do
       end
       context 'when enter a siret', js: true do
         before do
-          stub_request(:get, "https://staging.entreprise.api.gouv.fr/v2/etablissements/#{siret}?token=#{SIADETOKEN}")
+          stub_request(:get, /https:\/\/staging.entreprise.api.gouv.fr\/v2\/etablissements\/#{siret}?.*token=/)
             .to_return(status: 200, body: File.read('spec/support/files/etablissement.json'))
-          stub_request(:get, "https://staging.entreprise.api.gouv.fr/v2/entreprises/#{siren}?token=#{SIADETOKEN}")
+          stub_request(:get, /https:\/\/staging.entreprise.api.gouv.fr\/v2\/entreprises\/#{siren}?.*token=/)
             .to_return(status: 200, body: File.read('spec/support/files/entreprise.json'))
-          stub_request(:get, "https://staging.entreprise.api.gouv.fr/v2/exercices/#{siret}?token=#{SIADETOKEN}")
+          stub_request(:get, /https:\/\/staging.entreprise.api.gouv.fr\/v2\/exercices\/#{siret}?.*token=/)
             .to_return(status: 200, body: File.read('spec/support/files/exercices.json'))
-          stub_request(:get, "https://staging.entreprise.api.gouv.fr/v2/associations/#{siret}?token=#{SIADETOKEN}")
+          stub_request(:get, /https:\/\/staging.entreprise.api.gouv.fr\/v2\/associations\/#{siret}?.*token=/)
             .to_return(status: 404, body: '')
 
           page.find_by_id('dossier-siret').set siret

spec/lib/siade/api_spec.rb

@@ -1,10 +1,11 @@
 require 'spec_helper'
 
 describe SIADE::API do
+  let(:procedure_id) { 12 }
   describe '.entreprise' do
-    subject { described_class.entreprise(siren) }
+    subject { described_class.entreprise(siren, procedure_id) }
     before do
-      stub_request(:get, "https://staging.entreprise.api.gouv.fr/v2/entreprises/#{siren}?token=#{SIADETOKEN}")
+      stub_request(:get, /https:\/\/staging.entreprise.api.gouv.fr\/v2\/entreprises\/#{siren}?.*token=/)
         .to_return(status: status, body: body)
     end
     context 'when siren does not exist' do
@@ -28,9 +29,9 @@ describe SIADE::API do
   end
 
   describe '.etablissement' do
-    subject { described_class.etablissement(siret) }
+    subject { described_class.etablissement(siret, procedure_id) }
     before do
-      stub_request(:get, "https://staging.entreprise.api.gouv.fr/v2/etablissements/#{siret}?token=#{SIADETOKEN}")
+      stub_request(:get, /https:\/\/staging.entreprise.api.gouv.fr\/v2\/etablissements\/#{siret}?.*token=/)
         .to_return(status: status, body: body)
     end
 
@@ -62,7 +63,7 @@ describe SIADE::API do
     end
 
     context 'when siret does not exist' do
-      subject { described_class.exercices(siret) }
+      subject { described_class.exercices(siret, procedure_id) }
 
       let(:siret) { '11111111111111' }
       let(:status) { 404 }
@@ -74,7 +75,7 @@ describe SIADE::API do
     end
 
     context 'when siret exists' do
-      subject { described_class.exercices(siret) }
+      subject { described_class.exercices(siret, procedure_id) }
 
       let(:siret) { '41816609600051' }
       let(:status) { 200 }
@@ -92,7 +93,7 @@ describe SIADE::API do
         .to_return(status: status, body: body)
     end
 
-    subject { described_class.rna(siren) }
+    subject { described_class.rna(siren, procedure_id) }
 
     context 'when siren does not exist' do
       let(:siren) { '111111111' }

spec/lib/siade/entreprise_adapter_spec.rb

@@ -2,11 +2,12 @@ require 'spec_helper'
 
 describe SIADE::EntrepriseAdapter do
   let(:siren) { '418166096' }
-  let(:adapter) { described_class.new(siren) }
+  let(:procedure_id) { 22 }
+  let(:adapter) { described_class.new(siren, procedure_id) }
   subject { adapter.to_params }
 
   before do
-    stub_request(:get, "https://staging.entreprise.api.gouv.fr/v2/entreprises/#{siren}?token=#{SIADETOKEN}")
+    stub_request(:get, /https:\/\/staging.entreprise.api.gouv.fr\/v2\/entreprises\/#{siren}?.*token=/)
       .to_return(body: File.read('spec/support/files/entreprise.json', status: 200))
   end
 
@@ -69,7 +70,7 @@ describe SIADE::EntrepriseAdapter do
   end
 
   context 'Mandataire sociaux' do
-    subject { described_class.new(siren).to_params[:mandataires_sociaux] }
+    subject { described_class.new(siren, procedure_id).to_params[:mandataires_sociaux] }
 
     it '#to_params class est une Hash ?' do
       expect(subject).to be_an_instance_of(Array)

spec/lib/siade/etablissement_adapter_spec.rb

@@ -1,12 +1,14 @@
 require 'spec_helper'
 
 describe SIADE::EtablissementAdapter do
+  let(:procedure_id) { 33 }
+
   context 'SIRET valide' do
     let(:siret) { '41816609600051' }
-    subject { described_class.new(siret).to_params }
+    subject { described_class.new(siret, procedure_id).to_params }
 
     before do
-      stub_request(:get, "https://staging.entreprise.api.gouv.fr/v2/etablissements/#{siret}?token=#{SIADETOKEN}")
+      stub_request(:get, /https:\/\/staging.entreprise.api.gouv.fr\/v2\/etablissements\/#{siret}?.*token=/)
         .to_return(body: File.read('spec/support/files/etablissement.json', status: 200))
     end
 
@@ -70,10 +72,10 @@ describe SIADE::EtablissementAdapter do
 
   context 'when siret is not found' do
     let(:bad_siret) { 11_111_111_111_111 }
-    subject { described_class.new(bad_siret).to_params }
+    subject { described_class.new(bad_siret, 12).to_params }
 
     before do
-      stub_request(:get, "https://staging.entreprise.api.gouv.fr/v2/etablissements/#{bad_siret}?token=#{SIADETOKEN}")
+      stub_request(:get, /https:\/\/staging.entreprise.api.gouv.fr\/v2\/etablissements\/#{bad_siret}?.*token=/)
         .to_return(body: 'Fake body', status: 404)
     end
 

spec/lib/siade/exercices_adapter_spec.rb

@@ -2,7 +2,8 @@ require 'spec_helper'
 
 describe SIADE::ExercicesAdapter do
   let(:siret) { '41816609600051' }
-  subject { described_class.new(siret).to_params }
+  let(:procedure_id) { 11 }
+  subject { described_class.new(siret, procedure_id).to_params }
 
   before do
     stub_request(:get, /https:\/\/staging.entreprise.api.gouv.fr\/v2\/exercices\/.*token=/)

spec/lib/siade/rna_adapter_spec.rb

@@ -2,9 +2,10 @@ require 'spec_helper'
 
 describe SIADE::RNAAdapter do
   let(:siret) { '50480511000013' }
+  let(:procedure_id) { 22 }
   let(:body) { File.read('spec/support/files/rna.json') }
   let(:status) { 200 }
-  let(:adapter) { described_class.new(siret) }
+  let(:adapter) { described_class.new(siret, procedure_id) }
 
   subject { adapter.to_params }