cst1/openstreetmap-website
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Move the api trace methods into a separate controller under the api namespace

Browse source
This commit is contained in:
Andy Allan 2019-02-24 16:21:29 +01:00
parent d7dd618d8f
commit 5f59845575
6 changed files with 536 additions and 414 deletions
Download patch file Download diff file Expand all files Collapse all files

1
.rubocop_todo.yml
View file

@ -13,6 +13,7 @@ Lint/AssignmentInCondition:
- 'app/controllers/application_controller.rb'
- 'app/controllers/geocoder_controller.rb'
- 'app/controllers/notes_controller.rb'
- 'app/controllers/api/traces_controller.rb'
- 'app/controllers/traces_controller.rb'
- 'app/controllers/users_controller.rb'
- 'app/controllers/api/user_preferences_controller.rb'

169
app/controllers/api/traces_controller.rb Normal file
View file

@ -0,0 +1,169 @@
module Api
class TracesController < ApplicationController
layout "site", :except => :georss
skip_before_action :verify_authenticity_token
before_action :authorize_web
before_action :set_locale
before_action :authorize
before_action :api_deny_access_handler
authorize_resource
before_action :check_database_readable, :except => [:api_read, :api_data]
before_action :check_database_writable, :only => [:api_create, :api_update, :api_delete]
before_action :check_api_readable, :only => [:api_read, :api_data]
before_action :check_api_writable, :only => [:api_create, :api_update, :api_delete]
before_action :offline_redirect, :only => [:api_create, :api_delete, :api_data]
around_action :api_call_handle_error
def api_read
trace = Trace.visible.find(params[:id])
if trace.public? || trace.user == current_user
render :xml => trace.to_xml.to_s
else
head :forbidden
end
end
def api_update
trace = Trace.visible.find(params[:id])
if trace.user == current_user
trace.update_from_xml(request.raw_post)
trace.save!
head :ok
else
head :forbidden
end
end
def api_delete
trace = Trace.visible.find(params[:id])
if trace.user == current_user
trace.visible = false
trace.save!
head :ok
else
head :forbidden
end
end
def api_data
trace = Trace.visible.find(params[:id])
if trace.public? || trace.user == current_user
if request.format == Mime[:xml]
send_data(trace.xml_file.read, :filename => "#{trace.id}.xml", :type => request.format.to_s, :disposition => "attachment")
elsif request.format == Mime[:gpx]
send_data(trace.xml_file.read, :filename => "#{trace.id}.gpx", :type => request.format.to_s, :disposition => "attachment")
else
send_file(trace.trace_name, :filename => "#{trace.id}#{trace.extension_name}", :type => trace.mime_type, :disposition => "attachment")
end
else
head :forbidden
end
end
def api_create
tags = params[:tags] || ""
description = params[:description] || ""
visibility = params[:visibility]
if visibility.nil?
visibility = if params[:public]&.to_i&.nonzero?
"public"
else
"private"
end
end
if params[:file].respond_to?(:read)
trace = do_create(params[:file], tags, description, visibility)
if trace.id
render :plain => trace.id.to_s
elsif trace.valid?
head :internal_server_error
else
head :bad_request
end
else
head :bad_request
end
end
private
def do_create(file, tags, description, visibility)
# Sanitise the user's filename
name = file.original_filename.gsub(/[^a-zA-Z0-9.]/, "_")
# Get a temporary filename...
filename = "/tmp/#{rand}"
# ...and save the uploaded file to that location
File.open(filename, "wb") { |f| f.write(file.read) }
# Create the trace object, falsely marked as already
# inserted to stop the import daemon trying to load it
trace = Trace.new(
:name => name,
:tagstring => tags,
:description => description,
:visibility => visibility,
:inserted => true,
:user => current_user,
:timestamp => Time.now.getutc
)
if trace.valid?
Trace.transaction do
begin
# Save the trace object
trace.save!
# Rename the temporary file to the final name
FileUtils.mv(filename, trace.trace_name)
rescue StandardError
# Remove the file as we have failed to update the database
FileUtils.rm_f(filename)
# Pass the exception on
raise
end
begin
# Clear the inserted flag to make the import daemon load the trace
trace.inserted = false
trace.save!
rescue StandardError
# Remove the file as we have failed to update the database
FileUtils.rm_f(trace.trace_name)
# Pass the exception on
raise
end
end
end
# Finally save the user's preferred privacy level
if pref = current_user.preferences.where(:k => "gps.trace.visibility").first
pref.v = visibility
pref.save
else
current_user.preferences.create(:k => "gps.trace.visibility", :v => visibility)
end
trace
end
def offline_redirect
redirect_to :action => :offline if STATUS == :gpx_offline
end
end
end

92
app/controllers/traces_controller.rb
View file

@ -1,21 +1,15 @@
class TracesController < ApplicationController
layout "site", :except => :georss
skip_before_action :verify_authenticity_token, :only => [:api_create, :api_read, :api_update, :api_delete, :api_data]
before_action :authorize_web
before_action :set_locale
before_action :authorize, :only => [:api_create, :api_read, :api_update, :api_delete, :api_data]
before_action :api_deny_access_handler, :only => [:api_create, :api_read, :api_update, :api_delete, :api_data]
authorize_resource
before_action :check_database_readable, :except => [:api_read, :api_data]
before_action :check_database_writable, :only => [:new, :create, :edit, :delete, :api_create, :api_update, :api_delete]
before_action :check_api_readable, :only => [:api_read, :api_data]
before_action :check_api_writable, :only => [:api_create, :api_update, :api_delete]
before_action :check_database_readable
before_action :check_database_writable, :only => [:new, :create, :edit, :delete]
before_action :offline_warning, :only => [:mine, :show]
before_action :offline_redirect, :only => [:new, :create, :edit, :delete, :data, :api_create, :api_delete, :api_data]
around_action :api_call_handle_error, :only => [:api_create, :api_read, :api_update, :api_delete, :api_data]
before_action :offline_redirect, :only => [:new, :create, :edit, :delete, :data]
# Counts and selects pages of GPX traces for various criteria (by user, tags, public etc.).
# target_user - if set, specifies the user to fetch traces for. if not set will fetch all traces
@ -263,86 +257,6 @@ class TracesController < ApplicationController
head :not_found
end
def api_read
trace = Trace.visible.find(params[:id])
if trace.public? || trace.user == current_user
render :xml => trace.to_xml.to_s
else
head :forbidden
end
end
def api_update
trace = Trace.visible.find(params[:id])
if trace.user == current_user
trace.update_from_xml(request.raw_post)
trace.save!
head :ok
else
head :forbidden
end
end
def api_delete
trace = Trace.visible.find(params[:id])
if trace.user == current_user
trace.visible = false
trace.save!
head :ok
else
head :forbidden
end
end
def api_data
trace = Trace.visible.find(params[:id])
if trace.public? || trace.user == current_user
if request.format == Mime[:xml]
send_data(trace.xml_file.read, :filename => "#{trace.id}.xml", :type => request.format.to_s, :disposition => "attachment")
elsif request.format == Mime[:gpx]
send_data(trace.xml_file.read, :filename => "#{trace.id}.gpx", :type => request.format.to_s, :disposition => "attachment")
else
send_file(trace.trace_name, :filename => "#{trace.id}#{trace.extension_name}", :type => trace.mime_type, :disposition => "attachment")
end
else
head :forbidden
end
end
def api_create
tags = params[:tags] || ""
description = params[:description] || ""
visibility = params[:visibility]
if visibility.nil?
visibility = if params[:public]&.to_i&.nonzero?
"public"
else
"private"
end
end
if params[:file].respond_to?(:read)
trace = do_create(params[:file], tags, description, visibility)
if trace.id
render :plain => trace.id.to_s
elsif trace.valid?
head :internal_server_error
else
head :bad_request
end
else
head :bad_request
end
end
private
def do_create(file, tags, description, visibility)

12
config/routes.rb
View file

@ -77,12 +77,12 @@ OpenStreetMap::Application.routes.draw do
put "user/preferences/:preference_key" => "api/user_preferences#update_one"
delete "user/preferences/:preference_key" => "api/user_preferences#delete_one"
post "gpx/create" => "traces#api_create"
get "gpx/:id" => "traces#api_read", :id => /\d+/
put "gpx/:id" => "traces#api_update", :id => /\d+/
delete "gpx/:id" => "traces#api_delete", :id => /\d+/
get "gpx/:id/details" => "traces#api_read", :id => /\d+/
get "gpx/:id/data" => "traces#api_data"
post "gpx/create" => "api/traces#api_create"
get "gpx/:id" => "api/traces#api_read", :id => /\d+/
put "gpx/:id" => "api/traces#api_update", :id => /\d+/
delete "gpx/:id" => "api/traces#api_delete", :id => /\d+/
get "gpx/:id/details" => "api/traces#api_read", :id => /\d+/
get "gpx/:id/data" => "api/traces#api_data"
# AMF (ActionScript) API
post "amf/read" => "api/amf#amf_read"

357
test/controllers/api/traces_controller_test.rb Normal file
View file

@ -0,0 +1,357 @@
require "test_helper"
require "minitest/mock"
module Api
class TracesControllerTest < ActionController::TestCase
def setup
@gpx_trace_dir = Object.send("remove_const", "GPX_TRACE_DIR")
Object.const_set("GPX_TRACE_DIR", Rails.root.join("test", "gpx", "traces"))
@gpx_image_dir = Object.send("remove_const", "GPX_IMAGE_DIR")
Object.const_set("GPX_IMAGE_DIR", Rails.root.join("test", "gpx", "images"))
end
def teardown
File.unlink(*Dir.glob(File.join(GPX_TRACE_DIR, "*.gpx")))
File.unlink(*Dir.glob(File.join(GPX_IMAGE_DIR, "*.gif")))
Object.send("remove_const", "GPX_TRACE_DIR")
Object.const_set("GPX_TRACE_DIR", @gpx_trace_dir)
Object.send("remove_const", "GPX_IMAGE_DIR")
Object.const_set("GPX_IMAGE_DIR", @gpx_image_dir)
end
##
# test all routes which lead to this controller
def test_routes
assert_routing(
{ :path => "/api/0.6/gpx/create", :method => :post },
{ :controller => "api/traces", :action => "api_create" }
)
assert_routing(
{ :path => "/api/0.6/gpx/1", :method => :get },
{ :controller => "api/traces", :action => "api_read", :id => "1" }
)
assert_routing(
{ :path => "/api/0.6/gpx/1", :method => :put },
{ :controller => "api/traces", :action => "api_update", :id => "1" }
)
assert_routing(
{ :path => "/api/0.6/gpx/1", :method => :delete },
{ :controller => "api/traces", :action => "api_delete", :id => "1" }
)
assert_recognizes(
{ :controller => "api/traces", :action => "api_read", :id => "1" },
{ :path => "/api/0.6/gpx/1/details", :method => :get }
)
assert_routing(
{ :path => "/api/0.6/gpx/1/data", :method => :get },
{ :controller => "api/traces", :action => "api_data", :id => "1" }
)
assert_routing(
{ :path => "/api/0.6/gpx/1/data.xml", :method => :get },
{ :controller => "api/traces", :action => "api_data", :id => "1", :format => "xml" }
)
end
# Check getting a specific trace through the api
def test_api_read
public_trace_file = create(:trace, :visibility => "public")
# First with no auth
get :api_read, :params => { :id => public_trace_file.id }
assert_response :unauthorized
# Now with some other user, which should work since the trace is public
basic_authorization create(:user).display_name, "test"
get :api_read, :params => { :id => public_trace_file.id }
assert_response :success
# And finally we should be able to do it with the owner of the trace
basic_authorization public_trace_file.user.display_name, "test"
get :api_read, :params => { :id => public_trace_file.id }
assert_response :success
end
# Check an anoymous trace can't be specifically fetched by another user
def test_api_read_anon
anon_trace_file = create(:trace, :visibility => "private")
# First with no auth
get :api_read, :params => { :id => anon_trace_file.id }
assert_response :unauthorized
# Now try with another user, which shouldn't work since the trace is anon
basic_authorization create(:user).display_name, "test"
get :api_read, :params => { :id => anon_trace_file.id }
assert_response :forbidden
# And finally we should be able to get the trace details with the trace owner
basic_authorization anon_trace_file.user.display_name, "test"
get :api_read, :params => { :id => anon_trace_file.id }
assert_response :success
end
# Check the api details for a trace that doesn't exist
def test_api_read_not_found
deleted_trace_file = create(:trace, :deleted)
# Try first with no auth, as it should require it
get :api_read, :params => { :id => 0 }
assert_response :unauthorized
# Login, and try again
basic_authorization deleted_trace_file.user.display_name, "test"
get :api_read, :params => { :id => 0 }
assert_response :not_found
# Now try a trace which did exist but has been deleted
basic_authorization deleted_trace_file.user.display_name, "test"
get :api_read, :params => { :id => deleted_trace_file.id }
assert_response :not_found
end
# Test downloading a trace through the api
def test_api_data
public_trace_file = create(:trace, :visibility => "public", :fixture => "a")
# First with no auth
get :api_data, :params => { :id => public_trace_file.id }
assert_response :unauthorized
# Now with some other user, which should work since the trace is public
basic_authorization create(:user).display_name, "test"
get :api_data, :params => { :id => public_trace_file.id }
check_trace_data public_trace_file, "848caa72f2f456d1bd6a0fdf228aa1b9"
# And finally we should be able to do it with the owner of the trace
basic_authorization public_trace_file.user.display_name, "test"
get :api_data, :params => { :id => public_trace_file.id }
check_trace_data public_trace_file, "848caa72f2f456d1bd6a0fdf228aa1b9"
end
# Test downloading a compressed trace through the api
def test_api_data_compressed
identifiable_trace_file = create(:trace, :visibility => "identifiable", :fixture => "d")
# Authenticate as the owner of the trace we will be using
basic_authorization identifiable_trace_file.user.display_name, "test"
# First get the data as is
get :api_data, :params => { :id => identifiable_trace_file.id }
check_trace_data identifiable_trace_file, "c6422a3d8750faae49ed70e7e8a51b93", "application/x-gzip", "gpx.gz"
# Now ask explicitly for XML format
get :api_data, :params => { :id => identifiable_trace_file.id, :format => "xml" }
check_trace_data identifiable_trace_file, "abd6675fdf3024a84fc0a1deac147c0d", "application/xml", "xml"
# Now ask explicitly for GPX format
get :api_data, :params => { :id => identifiable_trace_file.id, :format => "gpx" }
check_trace_data identifiable_trace_file, "abd6675fdf3024a84fc0a1deac147c0d"
end
# Check an anonymous trace can't be downloaded by another user through the api
def test_api_data_anon
anon_trace_file = create(:trace, :visibility => "private", :fixture => "b")
# First with no auth
get :api_data, :params => { :id => anon_trace_file.id }
assert_response :unauthorized
# Now with some other user, which shouldn't work since the trace is anon
basic_authorization create(:user).display_name, "test"
get :api_data, :params => { :id => anon_trace_file.id }
assert_response :forbidden
# And finally we should be able to do it with the owner of the trace
basic_authorization anon_trace_file.user.display_name, "test"
get :api_data, :params => { :id => anon_trace_file.id }
check_trace_data anon_trace_file, "66179ca44f1e93d8df62e2b88cbea732"
end
# Test downloading a trace that doesn't exist through the api
def test_api_data_not_found
deleted_trace_file = create(:trace, :deleted)
# Try first with no auth, as it should require it
get :api_data, :params => { :id => 0 }
assert_response :unauthorized
# Login, and try again
basic_authorization create(:user).display_name, "test"
get :api_data, :params => { :id => 0 }
assert_response :not_found
# Now try a trace which did exist but has been deleted
basic_authorization deleted_trace_file.user.display_name, "test"
get :api_data, :params => { :id => deleted_trace_file.id }
assert_response :not_found
end
# Test creating a trace through the api
def test_api_create
# Get file to use
fixture = Rails.root.join("test", "gpx", "fixtures", "a.gpx")
file = Rack::Test::UploadedFile.new(fixture, "application/gpx+xml")
user = create(:user)
# First with no auth
post :api_create, :params => { :file => file, :description => "New Trace", :tags => "new,trace", :visibility => "trackable" }
assert_response :unauthorized
# Rewind the file
file.rewind
# Now authenticated
create(:user_preference, :user => user, :k => "gps.trace.visibility", :v => "identifiable")
assert_not_equal "trackable", user.preferences.where(:k => "gps.trace.visibility").first.v
basic_authorization user.display_name, "test"
post :api_create, :params => { :file => file, :description => "New Trace", :tags => "new,trace", :visibility => "trackable" }
assert_response :success
trace = Trace.find(response.body.to_i)
assert_equal "a.gpx", trace.name
assert_equal "New Trace", trace.description
assert_equal %w[new trace], trace.tags.order(:tag).collect(&:tag)
assert_equal "trackable", trace.visibility
assert_equal false, trace.inserted
assert_equal File.new(fixture).read, File.new(trace.trace_name).read
trace.destroy
assert_equal "trackable", user.preferences.where(:k => "gps.trace.visibility").first.v
# Rewind the file
file.rewind
# Now authenticated, with the legacy public flag
assert_not_equal "public", user.preferences.where(:k => "gps.trace.visibility").first.v
basic_authorization user.display_name, "test"
post :api_create, :params => { :file => file, :description => "New Trace", :tags => "new,trace", :public => 1 }
assert_response :success
trace = Trace.find(response.body.to_i)
assert_equal "a.gpx", trace.name
assert_equal "New Trace", trace.description
assert_equal %w[new trace], trace.tags.order(:tag).collect(&:tag)
assert_equal "public", trace.visibility
assert_equal false, trace.inserted
assert_equal File.new(fixture).read, File.new(trace.trace_name).read
trace.destroy
assert_equal "public", user.preferences.where(:k => "gps.trace.visibility").first.v
# Rewind the file
file.rewind
# Now authenticated, with the legacy private flag
second_user = create(:user)
assert_nil second_user.preferences.where(:k => "gps.trace.visibility").first
basic_authorization second_user.display_name, "test"
post :api_create, :params => { :file => file, :description => "New Trace", :tags => "new,trace", :public => 0 }
assert_response :success
trace = Trace.find(response.body.to_i)
assert_equal "a.gpx", trace.name
assert_equal "New Trace", trace.description
assert_equal %w[new trace], trace.tags.order(:tag).collect(&:tag)
assert_equal "private", trace.visibility
assert_equal false, trace.inserted
assert_equal File.new(fixture).read, File.new(trace.trace_name).read
trace.destroy
assert_equal "private", second_user.preferences.where(:k => "gps.trace.visibility").first.v
end
# Check updating a trace through the api
def test_api_update
public_trace_file = create(:trace, :visibility => "public", :fixture => "a")
deleted_trace_file = create(:trace, :deleted)
anon_trace_file = create(:trace, :visibility => "private")
# First with no auth
put :api_update, :params => { :id => public_trace_file.id }, :body => public_trace_file.to_xml.to_s
assert_response :unauthorized
# Now with some other user, which should fail
basic_authorization create(:user).display_name, "test"
put :api_update, :params => { :id => public_trace_file.id }, :body => public_trace_file.to_xml.to_s
assert_response :forbidden
# Now with a trace which doesn't exist
basic_authorization create(:user).display_name, "test"
put :api_update, :params => { :id => 0 }, :body => public_trace_file.to_xml.to_s
assert_response :not_found
# Now with a trace which did exist but has been deleted
basic_authorization deleted_trace_file.user.display_name, "test"
put :api_update, :params => { :id => deleted_trace_file.id }, :body => deleted_trace_file.to_xml.to_s
assert_response :not_found
# Now try an update with the wrong ID
basic_authorization public_trace_file.user.display_name, "test"
put :api_update, :params => { :id => public_trace_file.id }, :body => anon_trace_file.to_xml.to_s
assert_response :bad_request,
"should not be able to update a trace with a different ID from the XML"
# And finally try an update that should work
basic_authorization public_trace_file.user.display_name, "test"
t = public_trace_file
t.description = "Changed description"
t.visibility = "private"
put :api_update, :params => { :id => t.id }, :body => t.to_xml.to_s
assert_response :success
nt = Trace.find(t.id)
assert_equal nt.description, t.description
assert_equal nt.visibility, t.visibility
end
# Test that updating a trace doesn't duplicate the tags
def test_api_update_tags
tracetag = create(:tracetag)
trace = tracetag.trace
basic_authorization trace.user.display_name, "test"
put :api_update, :params => { :id => trace.id }, :body => trace.to_xml.to_s
assert_response :success
updated = Trace.find(trace.id)
# Ensure there's only one tag in the database after updating
assert_equal Tracetag.count, 1
# The new tag object might have a different id, so check the string representation
assert_equal trace.tagstring, updated.tagstring
end
# Check deleting a trace through the api
def test_api_delete
public_trace_file = create(:trace, :visibility => "public")
# First with no auth
delete :api_delete, :params => { :id => public_trace_file.id }
assert_response :unauthorized
# Now with some other user, which should fail
basic_authorization create(:user).display_name, "test"
delete :api_delete, :params => { :id => public_trace_file.id }
assert_response :forbidden
# Now with a trace which doesn't exist
basic_authorization create(:user).display_name, "test"
delete :api_delete, :params => { :id => 0 }
assert_response :not_found
# And finally we should be able to do it with the owner of the trace
basic_authorization public_trace_file.user.display_name, "test"
delete :api_delete, :params => { :id => public_trace_file.id }
assert_response :success
# Try it a second time, which should fail
basic_authorization public_trace_file.user.display_name, "test"
delete :api_delete, :params => { :id => public_trace_file.id }
assert_response :not_found
end
private
def check_trace_data(trace, digest, content_type = "application/gpx+xml", extension = "gpx")
assert_response :success
assert_equal digest, Digest::MD5.hexdigest(response.body)
assert_equal content_type, response.content_type
assert_equal "attachment; filename=\"#{trace.id}.#{extension}\"", @response.header["Content-Disposition"]
end
end
end

319
test/controllers/traces_controller_test.rb
View file

@ -24,35 +24,6 @@ class TracesControllerTest < ActionController::TestCase
##
# test all routes which lead to this controller
def test_routes
assert_routing(
{ :path => "/api/0.6/gpx/create", :method => :post },
{ :controller => "traces", :action => "api_create" }
)
assert_routing(
{ :path => "/api/0.6/gpx/1", :method => :get },
{ :controller => "traces", :action => "api_read", :id => "1" }
)
assert_routing(
{ :path => "/api/0.6/gpx/1", :method => :put },
{ :controller => "traces", :action => "api_update", :id => "1" }
)
assert_routing(
{ :path => "/api/0.6/gpx/1", :method => :delete },
{ :controller => "traces", :action => "api_delete", :id => "1" }
)
assert_recognizes(
{ :controller => "traces", :action => "api_read", :id => "1" },
{ :path => "/api/0.6/gpx/1/details", :method => :get }
)
assert_routing(
{ :path => "/api/0.6/gpx/1/data", :method => :get },
{ :controller => "traces", :action => "api_data", :id => "1" }
)
assert_routing(
{ :path => "/api/0.6/gpx/1/data.xml", :method => :get },
{ :controller => "traces", :action => "api_data", :id => "1", :format => "xml" }
)
assert_routing(
{ :path => "/traces", :method => :get },
{ :controller => "traces", :action => "index" }
@ -719,296 +690,6 @@ class TracesControllerTest < ActionController::TestCase
assert_equal false, trace.visible
end
# Check getting a specific trace through the api
def test_api_read
public_trace_file = create(:trace, :visibility => "public")
# First with no auth
get :api_read, :params => { :id => public_trace_file.id }
assert_response :unauthorized
# Now with some other user, which should work since the trace is public
basic_authorization create(:user).display_name, "test"
get :api_read, :params => { :id => public_trace_file.id }
assert_response :success
# And finally we should be able to do it with the owner of the trace
basic_authorization public_trace_file.user.display_name, "test"
get :api_read, :params => { :id => public_trace_file.id }
assert_response :success
end
# Check an anoymous trace can't be specifically fetched by another user
def test_api_read_anon
anon_trace_file = create(:trace, :visibility => "private")
# First with no auth
get :api_read, :params => { :id => anon_trace_file.id }
assert_response :unauthorized
# Now try with another user, which shouldn't work since the trace is anon
basic_authorization create(:user).display_name, "test"
get :api_read, :params => { :id => anon_trace_file.id }
assert_response :forbidden
# And finally we should be able to get the trace details with the trace owner
basic_authorization anon_trace_file.user.display_name, "test"
get :api_read, :params => { :id => anon_trace_file.id }
assert_response :success
end
# Check the api details for a trace that doesn't exist
def test_api_read_not_found
deleted_trace_file = create(:trace, :deleted)
# Try first with no auth, as it should require it
get :api_read, :params => { :id => 0 }
assert_response :unauthorized
# Login, and try again
basic_authorization deleted_trace_file.user.display_name, "test"
get :api_read, :params => { :id => 0 }
assert_response :not_found
# Now try a trace which did exist but has been deleted
basic_authorization deleted_trace_file.user.display_name, "test"
get :api_read, :params => { :id => deleted_trace_file.id }
assert_response :not_found
end
# Test downloading a trace through the api
def test_api_data
public_trace_file = create(:trace, :visibility => "public", :fixture => "a")
# First with no auth
get :api_data, :params => { :id => public_trace_file.id }
assert_response :unauthorized
# Now with some other user, which should work since the trace is public
basic_authorization create(:user).display_name, "test"
get :api_data, :params => { :id => public_trace_file.id }
check_trace_data public_trace_file, "848caa72f2f456d1bd6a0fdf228aa1b9"
# And finally we should be able to do it with the owner of the trace
basic_authorization public_trace_file.user.display_name, "test"
get :api_data, :params => { :id => public_trace_file.id }
check_trace_data public_trace_file, "848caa72f2f456d1bd6a0fdf228aa1b9"
end
# Test downloading a compressed trace through the api
def test_api_data_compressed
identifiable_trace_file = create(:trace, :visibility => "identifiable", :fixture => "d")
# Authenticate as the owner of the trace we will be using
basic_authorization identifiable_trace_file.user.display_name, "test"
# First get the data as is
get :api_data, :params => { :id => identifiable_trace_file.id }
check_trace_data identifiable_trace_file, "c6422a3d8750faae49ed70e7e8a51b93", "application/x-gzip", "gpx.gz"
# Now ask explicitly for XML format
get :api_data, :params => { :id => identifiable_trace_file.id, :format => "xml" }
check_trace_data identifiable_trace_file, "abd6675fdf3024a84fc0a1deac147c0d", "application/xml", "xml"
# Now ask explicitly for GPX format
get :api_data, :params => { :id => identifiable_trace_file.id, :format => "gpx" }
check_trace_data identifiable_trace_file, "abd6675fdf3024a84fc0a1deac147c0d"
end
# Check an anonymous trace can't be downloaded by another user through the api
def test_api_data_anon
anon_trace_file = create(:trace, :visibility => "private", :fixture => "b")
# First with no auth
get :api_data, :params => { :id => anon_trace_file.id }
assert_response :unauthorized
# Now with some other user, which shouldn't work since the trace is anon
basic_authorization create(:user).display_name, "test"
get :api_data, :params => { :id => anon_trace_file.id }
assert_response :forbidden
# And finally we should be able to do it with the owner of the trace
basic_authorization anon_trace_file.user.display_name, "test"
get :api_data, :params => { :id => anon_trace_file.id }
check_trace_data anon_trace_file, "66179ca44f1e93d8df62e2b88cbea732"
end
# Test downloading a trace that doesn't exist through the api
def test_api_data_not_found
deleted_trace_file = create(:trace, :deleted)
# Try first with no auth, as it should require it
get :api_data, :params => { :id => 0 }
assert_response :unauthorized
# Login, and try again
basic_authorization create(:user).display_name, "test"
get :api_data, :params => { :id => 0 }
assert_response :not_found
# Now try a trace which did exist but has been deleted
basic_authorization deleted_trace_file.user.display_name, "test"
get :api_data, :params => { :id => deleted_trace_file.id }
assert_response :not_found
end
# Test creating a trace through the api
def test_api_create
# Get file to use
fixture = Rails.root.join("test", "gpx", "fixtures", "a.gpx")
file = Rack::Test::UploadedFile.new(fixture, "application/gpx+xml")
user = create(:user)
# First with no auth
post :api_create, :params => { :file => file, :description => "New Trace", :tags => "new,trace", :visibility => "trackable" }
assert_response :unauthorized
# Rewind the file
file.rewind
# Now authenticated
create(:user_preference, :user => user, :k => "gps.trace.visibility", :v => "identifiable")
assert_not_equal "trackable", user.preferences.where(:k => "gps.trace.visibility").first.v
basic_authorization user.display_name, "test"
post :api_create, :params => { :file => file, :description => "New Trace", :tags => "new,trace", :visibility => "trackable" }
assert_response :success
trace = Trace.find(response.body.to_i)
assert_equal "a.gpx", trace.name
assert_equal "New Trace", trace.description
assert_equal %w[new trace], trace.tags.order(:tag).collect(&:tag)
assert_equal "trackable", trace.visibility
assert_equal false, trace.inserted
assert_equal File.new(fixture).read, File.new(trace.trace_name).read
trace.destroy
assert_equal "trackable", user.preferences.where(:k => "gps.trace.visibility").first.v
# Rewind the file
file.rewind
# Now authenticated, with the legacy public flag
assert_not_equal "public", user.preferences.where(:k => "gps.trace.visibility").first.v
basic_authorization user.display_name, "test"
post :api_create, :params => { :file => file, :description => "New Trace", :tags => "new,trace", :public => 1 }
assert_response :success
trace = Trace.find(response.body.to_i)
assert_equal "a.gpx", trace.name
assert_equal "New Trace", trace.description
assert_equal %w[new trace], trace.tags.order(:tag).collect(&:tag)
assert_equal "public", trace.visibility
assert_equal false, trace.inserted
assert_equal File.new(fixture).read, File.new(trace.trace_name).read
trace.destroy
assert_equal "public", user.preferences.where(:k => "gps.trace.visibility").first.v
# Rewind the file
file.rewind
# Now authenticated, with the legacy private flag
second_user = create(:user)
assert_nil second_user.preferences.where(:k => "gps.trace.visibility").first
basic_authorization second_user.display_name, "test"
post :api_create, :params => { :file => file, :description => "New Trace", :tags => "new,trace", :public => 0 }
assert_response :success
trace = Trace.find(response.body.to_i)
assert_equal "a.gpx", trace.name
assert_equal "New Trace", trace.description
assert_equal %w[new trace], trace.tags.order(:tag).collect(&:tag)
assert_equal "private", trace.visibility
assert_equal false, trace.inserted
assert_equal File.new(fixture).read, File.new(trace.trace_name).read
trace.destroy
assert_equal "private", second_user.preferences.where(:k => "gps.trace.visibility").first.v
end
# Check updating a trace through the api
def test_api_update
public_trace_file = create(:trace, :visibility => "public", :fixture => "a")
deleted_trace_file = create(:trace, :deleted)
anon_trace_file = create(:trace, :visibility => "private")
# First with no auth
put :api_update, :params => { :id => public_trace_file.id }, :body => public_trace_file.to_xml.to_s
assert_response :unauthorized
# Now with some other user, which should fail
basic_authorization create(:user).display_name, "test"
put :api_update, :params => { :id => public_trace_file.id }, :body => public_trace_file.to_xml.to_s
assert_response :forbidden
# Now with a trace which doesn't exist
basic_authorization create(:user).display_name, "test"
put :api_update, :params => { :id => 0 }, :body => public_trace_file.to_xml.to_s
assert_response :not_found
# Now with a trace which did exist but has been deleted
basic_authorization deleted_trace_file.user.display_name, "test"
put :api_update, :params => { :id => deleted_trace_file.id }, :body => deleted_trace_file.to_xml.to_s
assert_response :not_found
# Now try an update with the wrong ID
basic_authorization public_trace_file.user.display_name, "test"
put :api_update, :params => { :id => public_trace_file.id }, :body => anon_trace_file.to_xml.to_s
assert_response :bad_request,
"should not be able to update a trace with a different ID from the XML"
# And finally try an update that should work
basic_authorization public_trace_file.user.display_name, "test"
t = public_trace_file
t.description = "Changed description"
t.visibility = "private"
put :api_update, :params => { :id => t.id }, :body => t.to_xml.to_s
assert_response :success
nt = Trace.find(t.id)
assert_equal nt.description, t.description
assert_equal nt.visibility, t.visibility
end
# Test that updating a trace doesn't duplicate the tags
def test_api_update_tags
tracetag = create(:tracetag)
trace = tracetag.trace
basic_authorization trace.user.display_name, "test"
put :api_update, :params => { :id => trace.id }, :body => trace.to_xml.to_s
assert_response :success
updated = Trace.find(trace.id)
# Ensure there's only one tag in the database after updating
assert_equal Tracetag.count, 1
# The new tag object might have a different id, so check the string representation
assert_equal trace.tagstring, updated.tagstring
end
# Check deleting a trace through the api
def test_api_delete
public_trace_file = create(:trace, :visibility => "public")
# First with no auth
delete :api_delete, :params => { :id => public_trace_file.id }
assert_response :unauthorized
# Now with some other user, which should fail
basic_authorization create(:user).display_name, "test"
delete :api_delete, :params => { :id => public_trace_file.id }
assert_response :forbidden
# Now with a trace which doesn't exist
basic_authorization create(:user).display_name, "test"
delete :api_delete, :params => { :id => 0 }
assert_response :not_found
# And finally we should be able to do it with the owner of the trace
basic_authorization public_trace_file.user.display_name, "test"
delete :api_delete, :params => { :id => public_trace_file.id }
assert_response :success
# Try it a second time, which should fail
basic_authorization public_trace_file.user.display_name, "test"
delete :api_delete, :params => { :id => public_trace_file.id }
assert_response :not_found
end
private
def check_trace_feed(traces)