cst1/openstreetmap-website
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Simplify write_notes scope check in api notes controller

Browse source
This commit is contained in:
Anton Khorev 2025-01-24 06:16:11 +03:00
parent 8cf77a2f36
commit 47d55a2b0f
2 changed files with 12 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

4
app/controllers/api/notes_controller.rb
View file

@ -384,11 +384,7 @@ module Api
def add_comment(note, text, event, notify: true) def add_comment(note, text, event, notify: true)
attributes = { :visible => true, :event => event, :body => text } attributes = { :visible => true, :event => event, :body => text }
if doorkeeper_token
author = current_user if scope_enabled?(:write_notes) author = current_user if scope_enabled?(:write_notes)
else
author = current_user
end
if author if author
attributes[:author_id] = author.id attributes[:author_id] = author.id

11
test/controllers/api/notes_controller_test.rb
View file

@ -230,6 +230,17 @@ module Api
assert_equal note, subscription.note assert_equal note, subscription.note
end end
def test_create_no_scope_fail
user = create(:user)
auth_header = bearer_authorization_header user, :scopes => %w[read_prefs]
assert_no_difference "Note.count" do
post api_notes_path(:lat => -1.0, :lon => -1.0, :text => "This is a description", :format => "json"), :headers => auth_header
assert_response :forbidden
end
end
def test_comment_success def test_comment_success
open_note_with_comment = create(:note_with_comments) open_note_with_comment = create(:note_with_comments)
user = create(:user) user = create(:user)