forest_liana 5.3.3 → 5.4.0

data/app/services/forest_liana/scope_validator.rb

@@ -32,9 +32,10 @@ module ForestLiana
     def compute_condition_filters_from_scope(user_id)
       computed_condition_filters = @scope_filters.clone
       computed_condition_filters['conditions'].each do |condition|
-        if condition.include?('value') && 
-          !condition['value'].nil? && 
-          condition['value'].start_with?('$') && 
+        if condition.include?('value') &&
+          !condition['value'].nil? &&
+          condition['value'].instance_of?(String) &&
+          condition['value'].start_with?('$') &&
           @users_variable_values.include?(user_id)
           condition['value'] = @users_variable_values[user_id][condition['value']]
         end
@@ -51,9 +52,9 @@ module ForestLiana
       ensure_valid_aggregation(node)
 
       return is_scope_condition?(node) unless node['aggregator']
-  
+
       # NOTICE: Remove conditions that are not from the scope
-      filtered_conditions = node['conditions'].map { |condition| 
+      filtered_conditions = node['conditions'].map { |condition|
         search_scope_aggregation(condition)
       }.select { |condition|
         condition
@@ -61,7 +62,7 @@ module ForestLiana
 
       # NOTICE: If there is only one condition filter left and its current aggregator is
       #         an "and", this condition filter is the searched scope
-      if (filtered_conditions.length == 1 && 
+      if (filtered_conditions.length == 1 &&
         filtered_conditions.first.is_a?(Hash) &&
         filtered_conditions.first.include?(:aggregator) &&
         node['aggregator'] == 'and')
@@ -70,7 +71,7 @@ module ForestLiana
 
       # NOTICE: Otherwise, validate if the current node is the scope and return nil
       #         if it's not
-      return (filtered_conditions.length == @scope_filters['conditions'].length && 
+      return (filtered_conditions.length == @scope_filters['conditions'].length &&
         node['aggregator'] == @scope_filters['aggregator']) ?
         { aggregator: node['aggregator'], conditions: filtered_conditions } :
         nil

data/app/services/forest_liana/utils/beta_schema_utils.rb

@@ -0,0 +1,13 @@
+module ForestLiana
+  module Utils
+    class BetaSchemaUtils
+      def self.find_action_from_endpoint(collection_name, endpoint, http_method)
+        collection = ForestLiana.apimap.find { |collection| collection.name.to_s == collection_name }
+
+        return nil unless collection
+
+        collection.actions.find { |action| action.endpoint == endpoint && action.http_method == http_method }
+      end
+    end
+  end
+end

data/lib/forest_liana/version.rb

@@ -1,3 +1,3 @@
 module ForestLiana
-  VERSION = "5.3.3"
+  VERSION = "5.4.0"
 end

data/spec/services/forest_liana/permissions_checker_acl_disabled_spec.rb

@@ -0,0 +1,711 @@
+module ForestLiana
+  describe PermissionsChecker do
+    before(:each) do
+      described_class.empty_cache
+    end
+
+    let(:user_id) { 1 }
+    let(:schema) {
+      [
+        ForestLiana::Model::Collection.new({
+          name: 'all_rights_collection',
+          fields: [],
+          actions: [
+            ForestLiana::Model::Action.new({
+              name: 'Test',
+              endpoint: 'forest/actions/Test',
+              http_method: 'POST'
+            }), ForestLiana::Model::Action.new({
+              name: 'TestPut',
+              endpoint: 'forest/actions/Test',
+              http_method: 'PUT'
+            }), ForestLiana::Model::Action.new({
+              name: 'TestRestricted',
+              endpoint: 'forest/actions/TestRestricted',
+              http_method: 'POST'
+            }), ForestLiana::Model::Action.new({
+              name: 'Test Default Values',
+            })
+          ]
+        }), ForestLiana::Model::Collection.new({
+          name: 'no_rights_collection',
+          fields: [],
+          actions: [
+            ForestLiana::Model::Action.new({
+              name: 'Test',
+              endpoint: 'forest/actions/Test',
+              http_method: 'POST'
+            })
+          ]
+        }), ForestLiana::Model::Collection.new({
+          name: 'custom',
+          fields: [],
+          actions: []
+        })
+      ]
+    }
+    let(:default_api_permissions) {
+      {
+        "data" => {
+          "all_rights_collection" => {
+            "collection" => {
+              "list" => true,
+              "show" => true,
+              "create" => true,
+              "update" => true,
+              "delete" => true,
+              "export" => true,
+              "searchToEdit" => true
+            },
+            "actions" => {
+              "Test" => {
+                "allowed" => true,
+                "users" => nil
+              },
+              "TestPut" => {
+                "allowed" => false,
+                "users" => nil
+              },
+              "TestRestricted" => {
+                "allowed" => true,
+                "users" => [1]
+              },
+              "Test Default Values" => {
+                "allowed" => true,
+                "users" => nil
+              },
+            },
+            "scope" => nil
+          },
+          "no_rights_collection" => {
+            "collection" => {
+              "list" => false,
+              "show" => false,
+              "create" => false,
+              "update" => false,
+              "delete" => false,
+              "export" => false,
+              "searchToEdit" => false
+            },
+            "actions" => {
+              "Test" => {
+                "allowed" => false,
+                "users" => nil
+              }
+            },
+            "scope" => nil
+          },
+        },
+        "meta" => {
+          "rolesACLActivated" => false
+        }
+      }
+    }
+
+    before do
+      allow(ForestLiana).to receive(:name_for).and_return(collection_name)
+      allow(ForestLiana).to receive(:apimap).and_return(schema)
+    end
+
+    describe 'handling cache' do
+      let(:collection_name) { 'all_rights_collection' }
+      let(:fake_ressource) { nil }
+      let(:default_rendering_id) { 1 }
+
+      context 'when calling twice the same permissions' do
+        before do
+          # clones is called to duplicate the returned value and not use to same (which results in an error
+          # as the permissions is edited through the formatter)
+          allow(ForestLiana::PermissionsGetter).to receive(:get_permissions_for_rendering) { default_api_permissions.clone }
+        end
+
+        context 'after expiration time' do
+          before do
+            allow(ENV).to receive(:[]).with('FOREST_PERMISSIONS_EXPIRATION_IN_SECONDS').and_return('-1')
+            # Needed to enforce ENV stub
+            described_class.empty_cache
+          end
+
+          it 'should call the API twice' do
+            described_class.new(fake_ressource, 'exportEnabled', default_rendering_id, user_id: user_id).is_authorized?
+            described_class.new(fake_ressource, 'exportEnabled', default_rendering_id, user_id: user_id).is_authorized?
+
+            expect(ForestLiana::PermissionsGetter).to have_received(:get_permissions_for_rendering).twice
+          end
+        end
+
+        context 'before expiration time' do
+          it 'should call the API only once' do
+            described_class.new(fake_ressource, 'exportEnabled', default_rendering_id, user_id: user_id).is_authorized?
+            described_class.new(fake_ressource, 'exportEnabled', default_rendering_id, user_id: user_id).is_authorized?
+
+            expect(ForestLiana::PermissionsGetter).to have_received(:get_permissions_for_rendering).once
+          end
+        end
+      end
+
+      context 'with permissions coming from 2 different renderings' do
+        let(:collection_name) { 'custom' }
+        let(:api_permissions_rendering_1) {
+          {
+            "data" => {
+              "custom" => {
+                "collection" => {
+                  "list" => true,
+                  "show" => true,
+                  "create" => true,
+                  "update" => true,
+                  "delete" => true,
+                  "export" => true,
+                  "searchToEdit" => true
+                },
+                "actions" => { },
+                "scope" => nil
+              },
+            },
+            "meta" => {
+              "rolesACLActivated" => false
+            }
+          }
+        }
+        let(:api_permissions_rendering_2) {
+          api_permissions_rendering_2 = api_permissions_rendering_1.deep_dup
+          api_permissions_rendering_2['data']['custom']['collection']['export'] = false
+          api_permissions_rendering_2
+        }
+        let(:authorized_to_export_rendering_1) { described_class.new(fake_ressource, 'exportEnabled', 1, user_id: user_id).is_authorized? }
+        let(:authorized_to_export_rendering_2) { described_class.new(fake_ressource, 'exportEnabled', 2, user_id: user_id).is_authorized? }
+
+        before do
+          allow(ForestLiana::PermissionsGetter).to receive(:get_permissions_for_rendering)
+          allow(ForestLiana::PermissionsGetter).to receive(:get_permissions_for_rendering).with(1).and_return(api_permissions_rendering_1)
+          allow(ForestLiana::PermissionsGetter).to receive(:get_permissions_for_rendering).with(2).and_return(api_permissions_rendering_2)
+        end
+
+        it 'should return 2 different values' do
+          expect(authorized_to_export_rendering_1).to eq true
+          expect(authorized_to_export_rendering_2).to eq false
+        end
+      end
+    end
+
+
+    context 'scopes cache' do
+      let(:fake_ressource) { nil }
+      let(:rendering_id) { 1 }
+      let(:collection_name) { 'custom' }
+      let(:scope_permissions) { { rendering_id => { 'custom' => nil } } }
+      let(:api_permissions) {
+        {
+          "data" => {
+            "custom" => {
+              "collection" => {
+                "list" => true,
+                "show" => true,
+                "create" => true,
+                "update" => true,
+                "delete" => true,
+                "export" => true,
+                "searchToEdit" => true
+              },
+              "actions" => { },
+              "scope" => nil
+            },
+          },
+          "meta" => {
+            "rolesACLActivated" => false
+          }
+        }
+      }
+      let(:api_permissions_scope_only) {
+        {
+          "data" => {
+            'collections' => { },
+            'renderings' => scope_permissions
+          },
+          "meta" => {
+            "rolesACLActivated" => false
+          }
+        }
+      }
+
+      before do
+        # clones is called to duplicate the returned value and not use to same (which results in an error
+        # as the permissions is edited through the formatter)
+        allow(ForestLiana::PermissionsGetter).to receive(:get_permissions_for_rendering).with(rendering_id) { api_permissions.clone }
+        allow(ForestLiana::PermissionsGetter).to receive(:get_permissions_for_rendering).with(rendering_id, rendering_specific_only: true).and_return(api_permissions_scope_only)
+      end
+
+      context 'when checking once for authorization' do
+        context 'when checking browseEnabled' do
+          context 'when expiration value is set to its default' do
+            it 'should not call the API to refresh the scopes cache' do
+              described_class.new(fake_ressource, 'browseEnabled', rendering_id, user_id: user_id).is_authorized?
+
+              expect(ForestLiana::PermissionsGetter).to have_received(:get_permissions_for_rendering).with(rendering_id).once
+              expect(ForestLiana::PermissionsGetter).not_to have_received(:get_permissions_for_rendering).with(rendering_id, rendering_specific_only: true)
+            end
+          end
+
+          context 'when expiration value is set in the past' do
+            before do
+              allow(ENV).to receive(:[]).with('FOREST_PERMISSIONS_EXPIRATION_IN_SECONDS').and_return('-1')
+              # Needed to enforce ENV stub
+              described_class.empty_cache
+            end
+
+            it 'should call the API to refresh the scopes cache' do
+              described_class.new(fake_ressource, 'browseEnabled', rendering_id, user_id: user_id).is_authorized?
+
+              expect(ForestLiana::PermissionsGetter).to have_received(:get_permissions_for_rendering).with(rendering_id).once
+              expect(ForestLiana::PermissionsGetter).to have_received(:get_permissions_for_rendering).with(rendering_id, rendering_specific_only: true).once
+            end
+          end
+        end
+
+        # Only browse permission requires scopes
+        context 'when checking exportEnabled' do
+          context 'when expiration value is set in the past' do
+            before do
+              allow(ENV).to receive(:[]).with('FOREST_PERMISSIONS_EXPIRATION_IN_SECONDS').and_return('-1')
+              # Needed to enforce ENV stub
+              described_class.empty_cache
+            end
+          end
+
+          it 'should NOT call the API to refresh the scopes cache' do
+            described_class.new(fake_ressource, 'exportEnabled', rendering_id, user_id: user_id).is_authorized?
+
+            expect(ForestLiana::PermissionsGetter).to have_received(:get_permissions_for_rendering).with(rendering_id).once
+            expect(ForestLiana::PermissionsGetter).not_to have_received(:get_permissions_for_rendering).with(rendering_id, rendering_specific_only: true)
+          end
+        end
+      end
+
+      context 'when checking twice for authorization' do
+        context 'on the same rendering' do
+          context 'when scopes permission has NOT expired' do
+            it 'should NOT call the API to refresh the scopes permissions' do
+              described_class.new(fake_ressource, 'browseEnabled', rendering_id, user_id: user_id).is_authorized?
+              described_class.new(fake_ressource, 'browseEnabled', rendering_id, user_id: user_id).is_authorized?
+
+              expect(ForestLiana::PermissionsGetter).to have_received(:get_permissions_for_rendering).with(rendering_id).once
+              expect(ForestLiana::PermissionsGetter).not_to have_received(:get_permissions_for_rendering).with(rendering_id, rendering_specific_only: true)
+            end
+          end
+
+          context 'when scopes permission has expired' do
+            before do
+              allow(ENV).to receive(:[]).with('FOREST_PERMISSIONS_EXPIRATION_IN_SECONDS').and_return('-1')
+              # Needed to enforce ENV stub
+              described_class.empty_cache
+            end
+
+            it 'should call the API to refresh the scopes permissions' do
+              described_class.new(fake_ressource, 'browseEnabled', rendering_id, user_id: user_id).is_authorized?
+              described_class.new(fake_ressource, 'browseEnabled', rendering_id, user_id: user_id).is_authorized?
+
+              expect(ForestLiana::PermissionsGetter).to have_received(:get_permissions_for_rendering).with(rendering_id).twice
+              expect(ForestLiana::PermissionsGetter).to have_received(:get_permissions_for_rendering).with(rendering_id, rendering_specific_only: true).twice
+            end
+          end
+        end
+
+        context 'on two different renderings' do
+          let(:other_rendering_id) { 2 }
+          let(:api_permissions_scope_only) {
+            {
+              "data" => {
+                'collections' => { },
+                'renderings' => {
+                  '2' => { 'custom' => nil }
+                }
+              },
+              "meta" => {
+                "rolesACLActivated" => false
+              }
+            }
+          }
+          let(:api_permissions_copy) { api_permissions.clone }
+
+          before do
+            allow(ForestLiana::PermissionsGetter).to receive(:get_permissions_for_rendering).with(other_rendering_id).and_return(api_permissions_copy)
+            allow(ForestLiana::PermissionsGetter).to receive(:get_permissions_for_rendering).with(other_rendering_id, rendering_specific_only: true).and_return(api_permissions_scope_only)
+          end
+
+          it 'should not call the API to refresh the scopes permissions' do
+            described_class.new(fake_ressource, 'browseEnabled', rendering_id, user_id: user_id).is_authorized?
+            described_class.new(fake_ressource, 'browseEnabled', other_rendering_id, user_id: user_id).is_authorized?
+
+            expect(ForestLiana::PermissionsGetter).to have_received(:get_permissions_for_rendering).with(rendering_id).once
+            expect(ForestLiana::PermissionsGetter).to have_received(:get_permissions_for_rendering).with(other_rendering_id).once
+            expect(ForestLiana::PermissionsGetter).not_to have_received(:get_permissions_for_rendering).with(rendering_id, rendering_specific_only: true)
+            expect(ForestLiana::PermissionsGetter).not_to have_received(:get_permissions_for_rendering).with(other_rendering_id, rendering_specific_only: true)
+          end
+        end
+      end
+    end
+
+    describe '#is_authorized?' do
+      # Resource is only used to retrieve the collection name as it's stubbed it does not
+      # need to be defined
+      let(:fake_ressource) { nil }
+      let(:default_rendering_id) { nil }
+      let(:api_permissions) { default_api_permissions }
+      let(:collection_name) { 'all_rights_collection' }
+
+      before do
+        allow(ForestLiana::PermissionsGetter).to receive(:get_permissions_for_rendering).and_return(api_permissions)
+      end
+
+      context 'when permissions does NOT have rolesACLActivated' do
+        describe 'exportEnabled permission' do
+          subject { described_class.new(fake_ressource, 'exportEnabled', default_rendering_id, user_id: user_id) }
+
+          context 'when user has the required permission' do
+            it 'should be authorized' do
+              expect(subject.is_authorized?).to be true
+            end
+          end
+
+          context 'when user has not the required permission' do
+            let(:collection_name) { 'no_rights_collection' }
+
+            it 'should NOT be authorized' do
+              expect(subject.is_authorized?).to be false
+            end
+          end
+        end
+
+        describe 'browseEnabled permission' do
+          let(:collection_name) { 'custom' }
+          subject { described_class.new(fake_ressource, 'browseEnabled', default_rendering_id, user_id: user_id) }
+          let(:scope_permissions) { nil }
+          let(:default_api_permissions) {
+            {
+              "data" => {
+                "custom" => {
+                  "collection" => collection_permissions,
+                  "actions" => { },
+                  "scope" => scope_permissions
+                },
+              },
+              "meta" => {
+                "rolesACLActivated" => false
+              }
+            }
+          }
+
+          context 'when user has list permission' do
+            let(:collection_permissions) {
+              {
+                "list" => true,
+                "show" => false,
+                "create" => false,
+                "update" => false,
+                "delete" => false,
+                "export" => false,
+                "searchToEdit" => false
+              }
+            }
+
+            it 'should be authorized' do
+              expect(subject.is_authorized?).to be true
+            end
+          end
+
+          context 'when user has searchToEdit permission' do
+            let(:collection_permissions) {
+              {
+                "list" => false,
+                "show" => false,
+                "create" => false,
+                "update" => false,
+                "delete" => false,
+                "export" => false,
+                "searchToEdit" => true
+              }
+            }
+
+            it 'should be authorized' do
+              expect(subject.is_authorized?).to be true
+            end
+          end
+
+          context 'when user has not the list nor the searchToEdit permission' do
+            let(:collection_permissions) {
+              {
+                "list" => false,
+                "show" => false,
+                "create" => false,
+                "update" => false,
+                "delete" => false,
+                "export" => false,
+                "searchToEdit" => false
+              }
+            }
+
+            it 'should be NOT authorized' do
+              expect(subject.is_authorized?).to be false
+            end
+          end
+
+          context 'when providing collection_list_parameters' do
+            let(:collection_permissions) {
+              {
+                "list" => true,
+                "show" => false,
+                "create" => false,
+                "update" => false,
+                "delete" => false,
+                "export" => false,
+                "searchToEdit" => false
+              }
+            }
+            let(:collection_list_parameters) { { :user_id => "1", :filters => nil } }
+
+            subject {
+              described_class.new(
+                fake_ressource,
+                'browseEnabled',
+                default_rendering_id,
+                user_id: user_id,
+                collection_list_parameters: collection_list_parameters
+              )
+            }
+
+            context 'when user has the required permission' do
+              it 'should be authorized' do
+                expect(subject.is_authorized?).to be true
+              end
+            end
+
+            context 'when user has not the required permission' do
+              let(:collection_permissions) {
+                {
+                  "list" => false,
+                  "show" => false,
+                  "create" => false,
+                  "update" => false,
+                  "delete" => false,
+                  "export" => false,
+                  "searchToEdit" => false
+                }
+              }
+
+              it 'should NOT be authorized' do
+                expect(subject.is_authorized?).to be false
+              end
+            end
+
+            context 'when scopes are defined' do
+              let(:scope_permissions) { { 'dynamicScopesValues' => {}, 'filter' => { 'aggregator' => 'and', 'conditions' => [condition] } }}
+              let(:collection_list_parameters) { { :user_id => "1", :filters => JSON.generate(condition) } }
+
+              context 'when scopes are passing validation' do
+                context 'when scope value is a string' do
+                  let(:condition) { { 'field' => 'field_1', 'operator' => 'equal', 'value' => true } }
+
+                  it 'should return true' do
+                    expect(subject.is_authorized?).to be true
+                  end
+                end
+
+                context 'when scope value is a boolean' do
+                  let(:condition) { { 'field' => 'field_1', 'operator' => 'equal', 'value' => 'true' } }
+
+                  it 'should return true' do
+                    expect(subject.is_authorized?).to be true
+                  end
+                end
+              end
+
+              context 'when scopes are NOT passing validation' do
+                let(:condition) { { 'field' => 'field_1', 'operator' => 'equal', 'value' => true } }
+                let(:other_condition) {
+                  {
+                    aggregator: 'and',
+                    conditions: [
+                      { field: 'name', value: 'john', operator: 'equal' },
+                      { field: 'price', value: '2500', operator: 'equal' }
+                    ]
+                  }
+                }
+                let(:collection_list_parameters) {
+                  {
+                    :user_id => "1",
+                    :filters => JSON.generate(other_condition)
+                  }
+                }
+
+
+                it 'should return false' do
+                  expect(subject.is_authorized?).to be false
+                end
+              end
+            end
+          end
+        end
+
+        describe 'readEnabled permission' do
+          subject { described_class.new(fake_ressource, 'readEnabled', default_rendering_id, user_id: user_id) }
+
+          context 'when user has the required permission' do
+            it 'should be authorized' do
+              expect(subject.is_authorized?).to be true
+            end
+          end
+
+          context 'when user has not the required permission' do
+            let(:collection_name) { 'no_rights_collection' }
+
+            it 'should NOT be authorized' do
+              expect(subject.is_authorized?).to be false
+            end
+          end
+        end
+
+        describe 'addEnabled permission' do
+          subject { described_class.new(fake_ressource, 'addEnabled', default_rendering_id, user_id: user_id) }
+
+          context 'when user has the required permission' do
+            it 'should be authorized' do
+              expect(subject.is_authorized?).to be true
+            end
+          end
+
+          context 'when user has not the required permission' do
+            let(:collection_name) { 'no_rights_collection' }
+
+            it 'should NOT be authorized' do
+              expect(subject.is_authorized?).to be false
+            end
+          end
+        end
+
+        describe 'editEnabled permission' do
+          subject { described_class.new(fake_ressource, 'editEnabled', default_rendering_id, user_id: user_id) }
+
+          context 'when user has the required permission' do
+            it 'should be authorized' do
+              expect(subject.is_authorized?).to be true
+            end
+          end
+
+          context 'when user has not the required permission' do
+            let(:collection_name) { 'no_rights_collection' }
+
+            it 'should NOT be authorized' do
+              expect(subject.is_authorized?).to be false
+            end
+          end
+        end
+
+        describe 'deleteEnabled permission' do
+          subject { described_class.new(fake_ressource, 'deleteEnabled', default_rendering_id, user_id: user_id) }
+
+          context 'when user has the required permission' do
+            it 'should be authorized' do
+              expect(subject.is_authorized?).to be true
+            end
+          end
+
+          context 'when user has not the required permission' do
+            let(:collection_name) { 'no_rights_collection' }
+
+            it 'should NOT be authorized' do
+              expect(subject.is_authorized?).to be false
+            end
+          end
+        end
+
+        describe 'actions permission' do
+          let(:smart_action_request_info) { { endpoint: 'forest/actions/Test', http_method: 'POST' } }
+          subject {
+            described_class.new(
+              fake_ressource,
+              'actions',
+              default_rendering_id,
+              user_id: user_id,
+              smart_action_request_info: smart_action_request_info
+            )
+          }
+
+          context 'when user has the required permission' do
+
+            it 'should be authorized' do
+              expect(subject.is_authorized?).to be true
+            end
+          end
+
+          context 'when user has not the required permission' do
+            let(:collection_name) { 'no_rights_collection' }
+
+            it 'should NOT be authorized' do
+              expect(subject.is_authorized?).to be false
+            end
+          end
+
+          context 'when endpoint is missing from smart action parameters' do
+            let(:smart_action_request_info) { { http_method: 'POST' } }
+
+            it 'user should NOT be authorized' do
+              expect(subject.is_authorized?).to be false
+            end
+          end
+
+          context 'when http_method is missing from smart action parameters' do
+            let(:smart_action_request_info) { { endpoint: 'forest/actions/Test' } }
+
+            it 'user should NOT be authorized' do
+              expect(subject.is_authorized?).to be false
+            end
+          end
+
+          context 'when the provided endpoint is not part of the schema' do
+            let(:smart_action_request_info) { { endpoint: 'forest/actions/Test', http_method: 'DELETE' } }
+
+            it 'user should NOT be authorized' do
+              expect(subject.is_authorized?).to be false
+            end
+          end
+
+          context 'when the action permissions contains a list of user ids' do
+            context 'when user id is NOT part of the authorized users' do
+              let(:user_id) { 2 }
+              let(:smart_action_request_info) { { endpoint: 'forest/actions/TestRestricted', http_method: 'POST' } }
+
+              it 'user should NOT be authorized' do
+                expect(subject.is_authorized?).to be false
+              end
+            end
+
+            context 'when user id is part of the authorized users' do
+              let(:smart_action_request_info) { { endpoint: 'forest/actions/TestRestricted', http_method: 'POST' } }
+
+              it 'user should be authorized' do
+                expect(subject.is_authorized?).to be true
+              end
+            end
+          end
+
+          context 'when the action has been created with default http endpoint and method in the schema' do
+            let(:smart_action_request_info) { { endpoint: 'forest/actions/test-default-values', http_method: 'POST' } }
+
+            it 'user should be authorized' do
+              expect(subject.is_authorized?).to be true
+            end
+          end
+
+          context 'when the action has the same enpoint as an other' do
+            let(:smart_action_request_info) { { endpoint: 'forest/actions/Test', http_method: 'PUT' } }
+
+            it 'user should NOT be authorized' do
+              expect(subject.is_authorized?).to be false
+            end
+          end
+        end
+      end
+    end
+  end
+end