fe 2.3.2 → 2.4.0

data/spec/controllers/fe/admin/question_sheets_controller_spec.rb

@@ -49,3 +49,33 @@ describe Fe::Admin::QuestionSheetsController, type: :controller do
     end
   end
 end
+
+describe Fe::Admin::QuestionSheetsController, type: :controller do
+  context 'when the host says the person is not an admin' do
+    before { allow(controller).to receive(:fe_admin?).and_return(false) }
+
+    it 'returns 403 on #index' do
+      get :index
+      expect(response).to have_http_status(:forbidden)
+    end
+
+    it 'does not destroy on #destroy' do
+      qs = create(:question_sheet)
+      expect { delete :destroy, params: {id: qs.id} }.not_to change { Fe::QuestionSheet.count }
+      expect(response).to have_http_status(:forbidden)
+    end
+
+    it 'stops the request after fe_access_denied redirects' do
+      expect(controller).to receive(:fe_access_denied).with(:admin) { controller.redirect_to '/denied' }
+      get :index
+      expect(response).to redirect_to('/denied')
+    end
+  end
+
+  it 'returns 403 on #index when the host defines no fe_admin?' do
+    allow(controller).to receive(:respond_to?).and_call_original
+    allow(controller).to receive(:respond_to?).with(:fe_admin?, true).and_return(false)
+    get :index
+    expect(response).to have_http_status(:forbidden)
+  end
+end

data/spec/controllers/fe/answer_pages_controller_spec.rb

@@ -1,6 +1,59 @@
 require 'rails_helper'
 
 describe Fe::AnswerPagesController, type: :controller do
+  context 'answer_sheet_type param' do
+    it 'rejects a class that is not an allowed answer sheet type' do
+      page = create(:page)
+      expect {
+        get :show, params: {id: page.id, answer_sheet_id: 1, answer_sheet_type: 'Kernel'}
+      }.to raise_error(ActiveRecord::RecordNotFound)
+    end
+  end
+  context 'access control' do
+    let(:answer_sheet) { create(:answer_sheet) }
+    let(:page) { create(:page) }
+    let(:element) { create(:text_field_element) }
+
+    before do
+      create(:answer_sheet_question_sheet, answer_sheet: answer_sheet, question_sheet: page.question_sheet)
+      create(:page_element, element: element, page: page)
+    end
+
+    it 'returns 403 on update and stores nothing when the host refuses' do
+      create(:answer, answer_sheet: answer_sheet, question: element, value: 'before')
+      allow(controller).to receive(:fe_can_use_answer_sheet?).and_return(false)
+
+      put :update, params: {
+        answers: { "#{element.id}" => 'after' }, id: page.id, answer_sheet_id: answer_sheet.id
+      }, xhr: true, format: :js
+
+      expect(response).to have_http_status(:forbidden)
+      expect(Fe::Answer.find_by(answer_sheet_id: answer_sheet.id, question_id: element.id).value).to eq('before')
+    end
+    it 'asks the host for :look on show' do
+      expect(controller).to receive(:fe_can_use_answer_sheet?).with(answer_sheet, :look).and_return(false)
+      get :show, params: {id: page.id, answer_sheet_id: answer_sheet.id}
+      expect(response).to have_http_status(:forbidden)
+    end
+
+    context 'when a subclass re-declares before_action :get_answer_sheet' do
+      controller(Fe::AnswerPagesController) { before_action :get_answer_sheet }
+
+      it 'still asks the host, returns 403 on update and stores nothing' do
+        filters = controller.class._process_action_callbacks.map(&:filter)
+        expect(filters.index(:get_answer_sheet)).to be > filters.index(:fe_authorize_answer_sheet!)
+        create(:answer, answer_sheet: answer_sheet, question: element, value: 'before')
+        expect(controller).to receive(:fe_can_use_answer_sheet?).with(answer_sheet, :change).and_return(false)
+
+        put :update, params: {
+          answers: { "#{element.id}" => 'after' }, id: page.id, answer_sheet_id: answer_sheet.id
+        }, xhr: true, format: :js
+
+        expect(response).to have_http_status(:forbidden)
+        expect(Fe::Answer.find_by(answer_sheet_id: answer_sheet.id, question_id: element.id).value).to eq('before')
+      end
+    end
+  end
   context '#edit' do
     let(:answer_sheet) { create(:answer_sheet) }
     let(:page) { create(:page) }
@@ -142,4 +195,93 @@ describe Fe::AnswerPagesController, type: :controller do
       end
     end
   end
+
+  context 'a reference writer with an attachment field, under the README example hook' do
+    let(:ref_page) { create(:page) }
+    let(:attachment) { create(:attachment_field_element) }
+    let(:reference_question) { create(:reference_question, related_question_sheet_id: ref_page.question_sheet.id) }
+    let(:reference_sheet) do
+      create(:reference_sheet, question_id: reference_question.id, applicant_answer_sheet_id: create(:answer_sheet).id,
+                               access_key: 'good-key')
+    end
+    let(:sheet_params) { {id: ref_page.id, answer_sheet_id: reference_sheet.id, answer_sheet_type: 'Fe::ReferenceSheet'} }
+
+    before do
+      create(:page_element, element: attachment, page: ref_page)
+      allow(controller).to receive(:fe_can_use_answer_sheet?) do |sheet, _access|
+        sheet.is_a?(Fe::ReferenceSheet) && Fe.access_key_matches?(sheet, controller.params[:a])
+      end
+    end
+
+    # The dummy app has no asset manifest entry for the uploadify files the partial names.
+    def without_precompiled_asset_check
+      check_precompiled = ActionView::Base.check_precompiled_asset
+      ActionView::Base.check_precompiled_asset = false
+      yield
+    ensure
+      ActionView::Base.check_precompiled_asset = check_precompiled
+    end
+
+    it 'puts the reference key on the upload and page reload URLs' do
+      without_precompiled_asset_check { get :edit, params: sheet_params.merge(a: 'good-key') }
+
+      expect(response).to have_http_status(:ok)
+      expect(response.body).to match(%r{/save_file\?[^"]*\ba=good-key})
+      expect(response.body).to match(%r{/page/#{ref_page.id}/edit\?[^"]*\ba=good-key})
+    end
+
+    it 'lets the writer reach save_file with the key' do
+      post :save_file, params: sheet_params.merge(question_id: attachment.id, a: 'good-key'), xhr: true, format: :js
+
+      expect(response).to have_http_status(:ok)
+    end
+
+    it 'refuses save_file without the key' do
+      post :save_file, params: sheet_params.merge(question_id: attachment.id), xhr: true, format: :js
+
+      expect(response).to have_http_status(:forbidden)
+    end
+
+    context 'with a file already attached' do
+      # fe leaves file storage to the host app, which defines Fe::Answer#attachment.
+      let(:stored_file) do
+        '/files/report.pdf'.dup.tap do |file|
+          file.define_singleton_method(:attached?) { true }
+          file.define_singleton_method(:filename) { 'report.pdf' }
+          file.define_singleton_method(:expiring_url) { file }
+        end
+      end
+      let!(:answer) do
+        create(:answer, answer_sheet_id: reference_sheet.id, question_id: attachment.id, attachment_file_name: 'report.pdf')
+      end
+
+      before { allow_any_instance_of(Fe::Answer).to receive(:attachment).and_return(stored_file) }
+
+      it 'puts the reference key on the delete_file links' do
+        without_precompiled_asset_check { get :edit, params: sheet_params.merge(a: 'good-key') }
+
+        expect(response).to have_http_status(:ok)
+        delete_urls = response.body.scan(%r{/delete_file\?[^"]*})
+        expect(delete_urls).not_to be_empty
+        expect(delete_urls).to all(match(/\ba=good-key/))
+        expect(delete_urls).to all(match(/\banswer_sheet_type=Fe%3A%3AReferenceSheet\b/))
+      end
+
+      it 'deletes the file with the key and keeps the key on the delete link it sends back' do
+        delete :delete_file, params: sheet_params.merge(question_id: attachment.id, a: 'good-key'), xhr: true, format: :js
+
+        expect(response).to have_http_status(:ok)
+        expect(Fe::Answer.exists?(answer.id)).to be false
+        expect(response.body).to match(%r{/delete_file\?[^"]*\ba=good-key})
+        expect(response.body).to match(%r{/delete_file\?[^"]*\banswer_sheet_type=Fe%3A%3AReferenceSheet\b})
+      end
+
+      it 'refuses delete_file without the key and keeps the file' do
+        delete :delete_file, params: sheet_params.merge(question_id: attachment.id), xhr: true, format: :js
+
+        expect(response).to have_http_status(:forbidden)
+        expect(Fe::Answer.exists?(answer.id)).to be true
+      end
+    end
+  end
 end

data/spec/controllers/fe/answer_sheets_controller_spec.rb

@@ -4,6 +4,120 @@ describe Fe::AnswerSheetsController, type: :controller do
   let(:question_sheet) { create(:question_sheet) }
   let(:answer_sheet) { create(:answer_sheet, applicant_id: create(:fe_person).id) }
 
+  context 'access control' do
+    before do
+      create(:answer_sheet_question_sheet, question_sheet: question_sheet, answer_sheet: answer_sheet)
+      create(:page, question_sheet: question_sheet)
+    end
+
+    it 'asks the host for :look on show' do
+      expect(controller).to receive(:fe_can_use_answer_sheet?).with(answer_sheet, :look).and_return(true)
+      get :show, params: {id: answer_sheet.id}
+    end
+    it 'asks the host for :change on edit' do
+      expect(controller).to receive(:fe_can_use_answer_sheet?).with(answer_sheet, :change).and_return(true)
+      get :edit, params: {id: answer_sheet.id}
+    end
+    context 'when the host refuses' do
+      before { allow(controller).to receive(:fe_can_use_answer_sheet?).and_return(false) }
+
+      it 'returns 403 without running the action' do
+        get :edit, params: {id: answer_sheet.id}
+        expect(response).to have_http_status(:forbidden)
+        expect(assigns(:presenter)).to be_nil
+      end
+      it 'lets fe_access_denied redirect' do
+        expect(controller).to receive(:fe_access_denied).with(:answer_sheet) { controller.redirect_to '/denied' }
+        get :edit, params: {id: answer_sheet.id}
+        expect(response).to redirect_to('/denied')
+      end
+      it 'returns 403 when fe_access_denied renders nothing' do
+        allow(controller).to receive(:fe_access_denied)
+        get :edit, params: {id: answer_sheet.id}
+        expect(response).to have_http_status(:forbidden)
+      end
+    end
+    it 'propagates exceptions from the host hook' do
+      allow(controller).to receive(:fe_can_use_answer_sheet?).and_raise(RuntimeError, 'nope')
+      expect { get :edit, params: {id: answer_sheet.id} }.to raise_error(RuntimeError, 'nope')
+    end
+    it 'returns 403 when the host defines no hook' do
+      allow(controller).to receive(:respond_to?).and_call_original
+      allow(controller).to receive(:respond_to?).with(:fe_can_use_answer_sheet?, true).and_return(false)
+      get :edit, params: {id: answer_sheet.id}
+      expect(response).to have_http_status(:forbidden)
+    end
+
+    context 'when a subclass re-declares before_action :get_answer_sheet' do
+      controller(Fe::AnswerSheetsController) { before_action :get_answer_sheet }
+
+      it 'still asks the host and returns 403 on edit' do
+        filters = controller.class._process_action_callbacks.map(&:filter)
+        expect(filters.index(:get_answer_sheet)).to be > filters.index(:fe_authorize_answer_sheet!)
+        expect(controller).to receive(:fe_can_use_answer_sheet?).with(answer_sheet, :change).and_return(false)
+
+        get :edit, params: {id: answer_sheet.id}
+
+        expect(response).to have_http_status(:forbidden)
+        expect(assigns(:presenter)).to be_nil
+      end
+    end
+
+    context 'when a re-declared loader redirects' do
+      controller(Fe::AnswerSheetsController) do
+        before_action :get_answer_sheet
+
+        def get_answer_sheet
+          redirect_to '/elsewhere'
+        end
+      end
+
+      it 'stops the request without asking the host' do
+        expect(controller).not_to receive(:fe_can_use_answer_sheet?)
+
+        get :edit, params: {id: answer_sheet.id}
+
+        expect(response).to redirect_to('/elsewhere')
+      end
+    end
+  end
+  context 'when the person is not an admin' do
+    before { allow(controller).to receive(:fe_admin?).and_return(false) }
+
+    it 'returns 403 on index' do
+      get :index
+      expect(response).to have_http_status(:forbidden)
+    end
+
+    it 'returns 403 on create and makes no answer sheet' do
+      question_sheet
+      expect { post :create, params: {question_sheet_id: question_sheet.id} }
+        .not_to change { Fe.answer_sheet_class.constantize.count }
+      expect(response).to have_http_status(:forbidden)
+    end
+
+    context 'with a subclass that defines its own create' do
+      controller(Fe::AnswerSheetsController) do
+        def create
+          head :ok
+        end
+      end
+
+      it 'leaves the host action alone' do
+        post :create, params: {question_sheet_id: question_sheet.id}
+        expect(response).to have_http_status(:ok)
+      end
+    end
+
+    context 'with a subclass that inherits create' do
+      controller(Fe::AnswerSheetsController) {}
+
+      it 'returns 403' do
+        post :create, params: {question_sheet_id: question_sheet.id}
+        expect(response).to have_http_status(:forbidden)
+      end
+    end
+  end
   context '#index' do
     it 'should work' do
       create(:answer_sheet_question_sheet, question_sheet: question_sheet, answer_sheet: answer_sheet)

data/spec/controllers/fe/reference_pages_controller_spec.rb

@@ -0,0 +1,32 @@
+require 'rails_helper'
+
+describe Fe::ReferencePagesController, type: :controller do
+  let(:sheet) { create(:answer_sheet) }
+
+  def draw_routes
+    with_routing do |set|
+      set.draw do
+        get 'fe/reference_pages/:application_id/edit' => 'fe/reference_pages#edit'
+        put 'fe/reference_pages/:application_id' => 'fe/reference_pages#update'
+      end
+      self.routes = set
+      yield
+    end
+  end
+
+  context 'when the host denies the answer sheet' do
+    before { allow(controller).to receive(:fe_can_use_answer_sheet?).and_return(false) }
+
+    it 'returns 403 for edit' do
+      draw_routes { get :edit, params: {application_id: sheet.id} }
+
+      expect(response).to have_http_status(:forbidden)
+    end
+
+    it 'returns 403 for update' do
+      draw_routes { put :update, params: {application_id: sheet.id} }
+
+      expect(response).to have_http_status(:forbidden)
+    end
+  end
+end

data/spec/controllers/fe/reference_sheets_controller_spec.rb

@@ -1,4 +1,91 @@
 require 'rails_helper'
 
-describe Fe::ReferenceSheetsController do
+describe Fe::ReferenceSheetsController, type: :controller do
+  it 'renders not_found for a wrong access key without asking the host' do
+    reference_sheet = create(:reference_sheet)
+    expect(controller).not_to receive(:fe_can_use_answer_sheet?)
+
+    get :edit, params: {id: reference_sheet.id, a: 'wrong'}
+
+    expect(response).to render_template('fe/reference_sheets/not_found')
+  end
+
+  it 'renders not_found with a 404 on show for a wrong access key without asking the host' do
+    reference_sheet = create(:reference_sheet, access_key: 'good-key')
+    expect(controller).not_to receive(:fe_can_use_answer_sheet?)
+
+    get :show, params: {id: reference_sheet.id, a: 'wrong'}
+
+    expect(response).to have_http_status(:not_found)
+    expect(response).to render_template('fe/reference_sheets/not_found')
+  end
+
+  it 'renders not_found with a 404 on show when the reference sheet does not exist' do
+    get :show, params: {id: 0}
+
+    expect(response).to have_http_status(:not_found)
+    expect(response).to render_template('fe/reference_sheets/not_found')
+  end
+
+  it 'renders done' do
+    with_routing do |set|
+      set.draw { get 'fe/references/done' => 'fe/reference_sheets#done' }
+
+      self.routes = set
+
+      get :done
+    end
+
+    expect(response).to have_http_status(:ok)
+    expect(response).to render_template('fe/reference_sheets/done')
+  end
+
+  context 'with a valid access key' do
+    let(:ref_qs) { create(:question_sheet) }
+    let(:question) { create(:reference_question, related_question_sheet: ref_qs) }
+    let(:applicant_sheet) { create(:answer_sheet, applicant_id: create(:fe_person).id) }
+    let(:reference_sheet) { create(:reference_sheet, question: question, applicant_answer_sheet: applicant_sheet, access_key: 'good-key') }
+
+    before { ref_qs.pages << create(:page) }
+
+    it 'renders show when the host allows it' do
+      allow(controller).to receive(:fe_can_use_answer_sheet?).and_return(true)
+
+      get :show, params: {id: reference_sheet.id, a: 'good-key'}
+
+      expect(response).to have_http_status(:ok)
+      expect(response).to render_template('fe/answer_sheets/show')
+    end
+
+    it 'asks the host for :look on show and returns 403 when it refuses' do
+      expect(controller).to receive(:fe_can_use_answer_sheet?).with(reference_sheet, :look).and_return(false)
+
+      get :show, params: {id: reference_sheet.id, a: 'good-key'}
+
+      expect(response).to have_http_status(:forbidden)
+    end
+
+    it 'stops submit with a 404 before loading the sheet or asking the host' do
+      expect(controller).not_to receive(:get_answer_sheet)
+      expect(controller).not_to receive(:fe_can_use_answer_sheet?)
+
+      with_routing do |set|
+        set.draw { post 'fe/reference_sheets/:id/submit', to: 'fe/reference_sheets#submit' }
+
+        self.routes = set
+
+        expect {
+          post :submit, params: {id: reference_sheet.id, a: 'good-key'}
+        }.not_to change { reference_sheet.reload.status }
+      end
+
+      expect(response).to have_http_status(:not_found)
+    end
+
+    it 'still renders edit' do
+      get :edit, params: {id: reference_sheet.id, a: 'good-key'}
+
+      expect(response).to render_template('fe/answer_sheets/edit')
+    end
+  end
 end

data/spec/controllers/fe/references_controller_spec.rb

@@ -1,4 +1,32 @@
 require 'rails_helper'
 
-describe Fe::ReferencesController do
+describe Fe::ReferencesController, type: :controller do
+  let(:sheet) { create(:answer_sheet) }
+
+  def draw_routes
+    with_routing do |set|
+      set.draw do
+        get 'fe/references/:application_id/:id/edit' => 'fe/references#edit'
+        get 'fe/references/:application_id/:id' => 'fe/references#show'
+      end
+      self.routes = set
+      yield
+    end
+  end
+
+  context 'when the host denies the answer sheet' do
+    before { allow(controller).to receive(:fe_can_use_answer_sheet?).and_return(false) }
+
+    it 'returns 403 for edit' do
+      draw_routes { get :edit, params: {application_id: sheet.id, id: 'key'} }
+
+      expect(response).to have_http_status(:forbidden)
+    end
+
+    it 'returns 403 for show' do
+      draw_routes { get :show, params: {application_id: sheet.id, id: 'key'} }
+
+      expect(response).to have_http_status(:forbidden)
+    end
+  end
 end

data/spec/controllers/fe/submit_pages_controller_spec.rb

@@ -1,4 +1,47 @@
 require 'rails_helper'
 
-describe Fe::SubmitPagesController do
+describe Fe::SubmitPagesController, type: :controller do
+  render_views false
+
+  let(:sheet) { create(:answer_sheet) }
+
+  def draw_routes
+    with_routing do |set|
+      set.draw do
+        get 'fe/submit_pages/:application_id/edit' => 'fe/submit_pages#edit'
+        put 'fe/submit_pages/:application_id' => 'fe/submit_pages#update'
+      end
+      self.routes = set
+      yield
+    end
+  end
+
+  context 'when the host denies the answer sheet' do
+    before { allow(controller).to receive(:fe_can_use_answer_sheet?).and_return(false) }
+
+    it 'returns 403 for edit' do
+      draw_routes { get :edit, params: {application_id: sheet.id} }
+
+      expect(response).to have_http_status(:forbidden)
+    end
+
+    it 'returns 403 for update' do
+      draw_routes { put :update, params: {application_id: sheet.id} }
+
+      expect(response).to have_http_status(:forbidden)
+    end
+  end
+
+  context 'when the host allows the answer sheet' do
+    before do
+      allow(controller).to receive(:fe_can_use_answer_sheet?).and_return(true)
+      allow(controller).to receive(:next_custom_page)
+    end
+
+    it 'returns 200 for edit' do
+      draw_routes { get :edit, params: {application_id: sheet.id} }
+
+      expect(response).to have_http_status(:ok)
+    end
+  end
 end

data/spec/dummy/app/controllers/application_controller.rb

@@ -7,4 +7,12 @@ class ApplicationController < ActionController::Base
 
   def check_valid_user
   end
+
+  def fe_can_use_answer_sheet?(answer_sheet, access)
+    true
+  end
+
+  def fe_admin?
+    true
+  end
 end

data/spec/dummy/config/initializers/fe.rb

@@ -0,0 +1,2 @@
+# Booting the check autoloads the controllers before SimpleCov starts; access_control_spec calls it directly.
+Fe.verify_access_hooks_on_boot = false