hyrax 2.9.6 → 3.0.0.pre.beta1

data/spec/controllers/hyrax/dashboard/nest_collections_controller_spec.rb

@@ -0,0 +1,360 @@
+RSpec.describe Hyrax::Dashboard::NestCollectionsController do
+  routes { Hyrax::Engine.routes }
+  let(:child_id) { 'child1' }
+  let(:child) { instance_double(Collection, title: ["Awesome Child"]) }
+  let(:parent) { create(:collection, id: 'parent1', collection_type_settings: :nestable, title: ["Uncool Parent"]) }
+
+  describe '#blacklight_config' do
+    subject { controller.blacklight_config }
+
+    it { is_expected.to be_a(Blacklight::Configuration) }
+  end
+
+  describe '#repository' do
+    subject { controller.repository }
+
+    it { is_expected.to be_a(Blacklight::Solr::Repository) }
+  end
+
+  describe 'POST #create_relationship_within' do
+    subject { post 'create_relationship_within', params: { child_id: child_id, parent_id: parent.id, source: 'my' } }
+
+    before do
+      allow(Collection).to receive(:find).with(child_id).and_return(child)
+      allow(Collection).to receive(:find).with(parent.id).and_return(parent)
+    end
+
+    describe 'when save fails' do
+      let(:form_class_with_failed_save) do
+        Class.new do
+          attr_reader :child, :parent
+          def initialize(parent:, child:, context:)
+            @parent = parent
+            @child = child
+            @context = context
+          end
+
+          def save
+            false
+          end
+
+          def errors; end
+        end
+      end
+
+      before do
+        controller.form_class = form_class_with_failed_save
+        allow(controller).to receive(:authorize!).with(:read, child).and_return(true)
+        allow(controller.form_class).to receive(:errors)
+        allow(controller.form_class.errors).to receive(:full_messages).and_return(['huge mistake'])
+      end
+
+      it 'authorizes then renders the form again' do
+        subject
+        expect(response).to redirect_to(my_collections_path)
+      end
+    end
+
+    describe 'when save succeeds' do
+      let(:form_class_with_successful_save) do
+        Class.new do
+          attr_reader :child, :parent
+          def initialize(parent:, child:, context:)
+            @parent = parent
+            @child = child
+            @context = context
+          end
+
+          def save
+            true
+          end
+        end
+      end
+
+      before do
+        controller.form_class = form_class_with_successful_save
+        allow(controller).to receive(:authorize!).with(:read, child).and_return(true)
+      end
+
+      it 'authorizes, flashes a notice, and redirects' do
+        subject
+        expect(response).to redirect_to(my_collections_path)
+        expect(flash[:notice]).to be_a(String)
+      end
+    end
+  end
+
+  describe 'GET #create_collection_under' do
+    subject { get 'create_collection_under', params: { child_id: nil, parent_id: parent.id, source: 'show' } }
+
+    before do
+      allow(Collection).to receive(:find).with(parent.id).and_return(parent)
+    end
+
+    describe 'when validation fails' do
+      let(:form_class_with_failed_validation) do
+        Class.new do
+          attr_reader :child, :parent
+          def initialize(parent:, child:, context:)
+            @parent = parent
+            @child = child
+            @context = context
+          end
+
+          def validate_add
+            false
+          end
+
+          def errors; end
+        end
+      end
+
+      before do
+        controller.form_class = form_class_with_failed_validation
+        allow(controller).to receive(:authorize!).with(:deposit, parent).and_return(true)
+        allow(controller.form_class).to receive(:errors)
+        allow(controller.form_class.errors).to receive(:full_messages).and_return(['huge mistake'])
+      end
+
+      it 'authorizes then renders the form again' do
+        subject
+        expect(response).to redirect_to(dashboard_collection_path(parent.id))
+      end
+    end
+
+    describe 'when validation succeeds' do
+      let(:form_class_with_successful_validation) do
+        Class.new do
+          attr_reader :child, :parent
+          def initialize(parent:, child:, context:)
+            @parent = parent
+            @child = child
+            @context = context
+          end
+
+          def validate_add
+            true
+          end
+        end
+      end
+
+      before do
+        controller.form_class = form_class_with_successful_validation
+        allow(controller).to receive(:authorize!).with(:deposit, parent).and_return(true)
+      end
+
+      it 'authorizes, flashes a notice, and redirects' do
+        subject
+        expect(response).to redirect_to new_dashboard_collection_path(collection_type_id: parent.collection_type.id, parent_id: parent.id)
+      end
+    end
+  end
+
+  describe 'POST #create_relationship_under' do
+    subject { post 'create_relationship_under', params: { child_id: child_id, parent_id: parent.id, source: 'show' } }
+
+    before do
+      allow(Collection).to receive(:find).with(child_id).and_return(child)
+      allow(Collection).to receive(:find).with(parent.id).and_return(parent)
+    end
+
+    describe 'when save fails' do
+      let(:form_class_with_failed_save) do
+        Class.new do
+          attr_reader :child, :parent
+          def initialize(parent:, child:, context:)
+            @parent = parent
+            @child = child
+            @context = context
+          end
+
+          def save
+            false
+          end
+
+          def errors; end
+        end
+      end
+
+      before do
+        controller.form_class = form_class_with_failed_save
+        allow(controller).to receive(:authorize!).with(:deposit, parent).and_return(true)
+        allow(controller.form_class).to receive(:errors)
+        allow(controller.form_class.errors).to receive(:full_messages).and_return(['huge mistake'])
+      end
+
+      it 'authorizes then renders the form again' do
+        subject
+        expect(response).to redirect_to(dashboard_collection_path(parent))
+      end
+    end
+
+    describe 'when save succeeds' do
+      let(:form_class_with_successful_save) do
+        Class.new do
+          attr_reader :child, :parent
+          def initialize(parent:, child:, context:)
+            @parent = parent
+            @child = child
+            @context = context
+          end
+
+          def save
+            true
+          end
+        end
+      end
+
+      before do
+        controller.form_class = form_class_with_successful_save
+        allow(controller).to receive(:authorize!).with(:deposit, parent).and_return(true)
+      end
+
+      it 'authorizes, flashes a notice, and redirects' do
+        subject
+        expect(response).to redirect_to(dashboard_collection_path(parent))
+        expect(flash[:notice]).to be_a(String)
+      end
+    end
+  end
+
+  describe 'POST #remove_relationship_above' do
+    subject { post 'remove_relationship_above', params: { child_id: child_id, parent_id: parent.id } }
+
+    before do
+      allow(Collection).to receive(:find).with(child_id).and_return(child)
+      allow(Collection).to receive(:find).with(parent.id).and_return(parent)
+    end
+
+    describe 'when remove fails' do
+      let(:form_class_remove_fails) do
+        Class.new do
+          attr_reader :child, :parent
+          def initialize(parent:, child:, context:)
+            @parent = parent
+            @child = child
+            @context = context
+          end
+
+          def remove
+            false
+          end
+
+          def errors; end
+        end
+      end
+
+      before do
+        controller.form_class = form_class_remove_fails
+        allow(controller).to receive(:authorize!).with(:edit, parent).and_return(false)
+        allow(controller.form_class).to receive(:errors)
+        allow(controller.form_class.errors).to receive(:full_messages).and_return(['unauthorized'])
+      end
+
+      it 'authorizes then renders the form again' do
+        subject
+        expect(response).to redirect_to(dashboard_collection_path(child))
+      end
+    end
+
+    describe 'when remove succeeds' do
+      let(:form_class_removed) do
+        Class.new do
+          attr_reader :child, :parent
+          def initialize(parent:, child:, context:)
+            @parent = parent
+            @child = child
+            @context = context
+          end
+
+          def remove
+            true
+          end
+
+          def errors; end
+        end
+      end
+
+      before do
+        controller.form_class = form_class_removed
+        allow(controller).to receive(:authorize!).with(:edit, parent).and_return(true)
+      end
+
+      it 'authorizes, flashes a notice, and redirects' do
+        subject
+        expect(response).to redirect_to(dashboard_collection_path(child))
+        expect(flash[:notice]).to be_a(String)
+      end
+    end
+  end
+
+  describe 'POST #remove_relationship_under' do
+    subject { post 'remove_relationship_under', params: { child_id: child_id, parent_id: parent.id } }
+
+    before do
+      allow(Collection).to receive(:find).with(child_id).and_return(child)
+      allow(Collection).to receive(:find).with(parent.id).and_return(parent)
+    end
+
+    describe 'when remove fails' do
+      let(:form_class_remove_fails) do
+        Class.new do
+          attr_reader :child, :parent
+          def initialize(parent:, child:, context:)
+            @parent = parent
+            @child = child
+            @context = context
+          end
+
+          def remove
+            false
+          end
+
+          def errors; end
+        end
+      end
+
+      before do
+        controller.form_class = form_class_remove_fails
+        allow(controller).to receive(:authorize!).with(:edit, parent).and_return(false)
+        allow(controller.form_class).to receive(:errors)
+        allow(controller.form_class.errors).to receive(:full_messages).and_return(['unauthorized'])
+      end
+
+      it 'authorizes then renders the form again' do
+        subject
+        expect(response).to redirect_to(dashboard_collection_path(parent))
+      end
+    end
+
+    describe 'when remove succeeds' do
+      let(:form_class_removed) do
+        Class.new do
+          attr_reader :child, :parent
+          def initialize(parent:, child:, context:)
+            @parent = parent
+            @child = child
+            @context = context
+          end
+
+          def remove
+            true
+          end
+
+          def errors; end
+        end
+      end
+
+      before do
+        controller.form_class = form_class_removed
+        allow(controller).to receive(:authorize!).with(:edit, parent).and_return(true)
+      end
+
+      it 'authorizes, flashes a notice, and redirects' do
+        subject
+        expect(response).to redirect_to(dashboard_collection_path(parent))
+        expect(flash[:notice]).to be_a(String)
+      end
+    end
+  end
+end

data/spec/controllers/hyrax/dashboard/profiles_controller_spec.rb

@@ -0,0 +1,155 @@
+RSpec.describe Hyrax::Dashboard::ProfilesController do
+  let(:user) { create(:user) }
+
+  before do
+    sign_in user
+    allow(controller).to receive(:clear_session_user) ## Don't clear out the authenticated session
+  end
+
+  describe "#show" do
+    it "show the user profile if user exists" do
+      get :show, params: { id: user.user_key }
+      expect(response).to be_success
+    end
+
+    it "redirects to root if user does not exist" do
+      expect do
+        get :show, params: { id: 'johndoe666' }
+      end.to raise_error ActiveRecord::RecordNotFound
+    end
+  end
+
+  describe "#edit" do
+    it "show edit form when user edits own profile" do
+      get :edit, params: { id: user.user_key }
+      expect(response).to be_success
+      expect(response).to render_template('hyrax/dashboard/profiles/edit')
+      expect(flash[:alert]).to be_nil
+    end
+
+    context "when user attempts to edit another profile" do
+      let(:another_user) { create(:user) }
+
+      context 'with default abilities' do
+        it "is unauthorized" do
+          expect(controller.current_ability).to receive(:can?).with(:edit, another_user).and_return(false)
+          get :edit, params: { id: another_user.to_param }
+          expect(response).to render_template(:unauthorized)
+        end
+      end
+
+      context 'with a custom ability' do
+        before do
+          allow(controller.current_ability).to receive(:can?).with(:edit, another_user).and_return(true)
+        end
+
+        it "allows user to edit another user's profile" do
+          get :edit, params: { id: another_user.to_param }
+          expect(response).to be_success
+          expect(response).not_to redirect_to(routes.url_helpers.dashboard_profile_path(another_user.to_param, locale: 'en'))
+          expect(flash[:alert]).to be_nil
+        end
+      end
+    end
+
+    context "when the user has trophies" do
+      let(:work1) { create(:work, title: ["w1"], user: user) }
+      let(:work2) { create(:work, title: ["w2"], user: user) }
+      let(:work3) { create(:work, title: ["w3"], user: user) }
+      let!(:trophy1) { user.trophies.create!(work_id: work1.id) }
+      let!(:trophy2) { user.trophies.create!(work_id: work2.id) }
+      let!(:trophy3) { user.trophies.create!(work_id: work3.id) }
+
+      it "show the user profile if user exists" do
+        get :edit, params: { id: user.user_key }
+        expect(response).to be_success
+        expect(assigns[:trophies]).to all(be_kind_of Hyrax::TrophyPresenter)
+        expect(assigns[:trophies].map(&:id)).to match_array [work1.id, work2.id, work3.id]
+      end
+    end
+  end
+
+  describe "#update" do
+    context "the profile of another user" do
+      let(:another_user) { create(:user) }
+
+      it "does not allow other users to update" do
+        post :update, params: { id: another_user.user_key, user: { avatar: nil } }
+        expect(response).to render_template(:unauthorized)
+      end
+    end
+
+    it "sets an avatar and redirect to profile" do
+      expect(user.avatar?).to be false
+      expect(UserEditProfileEventJob).to receive(:perform_later).with(user)
+      f = fixture_file_upload('/1.5mb-avatar.jpg', 'image/jpg')
+      post :update, params: { id: user.user_key, user: { avatar: f } }
+      expect(response).to redirect_to(routes.url_helpers.dashboard_profile_path(user.to_param, locale: 'en'))
+      expect(flash[:notice]).to include("Your profile has been updated")
+      expect(User.find_by_user_key(user.user_key).avatar?).to be true
+    end
+    it "validates the content type of an avatar" do
+      expect(UserEditProfileEventJob).to receive(:perform_later).never
+      f = fixture_file_upload('/image.jp2', 'image/jp2')
+      post :update, params: { id: user.user_key, user: { avatar: f } }
+      expect(response).to redirect_to(routes.url_helpers.edit_dashboard_profile_path(user.to_param, locale: 'en'))
+      expect(flash[:alert]).to include("Avatar You are not allowed to upload \"jp2\" files, allowed types: jpg, jpeg, png, gif, bmp, tif, tiff")
+    end
+    it "validates the size of an avatar" do
+      f = fixture_file_upload('/4-20.png', 'image/png')
+      expect(UserEditProfileEventJob).to receive(:perform_later).never
+      post :update, params: { id: user.user_key, user: { avatar: f } }
+      expect(response).to redirect_to(routes.url_helpers.edit_dashboard_profile_path(user.to_param, locale: 'en'))
+      expect(flash[:alert]).to include("Avatar file size must be less than 2MB")
+    end
+
+    context "user with existing avatar" do
+      before do
+        f = fixture_file_upload('/world.png', 'image/png')
+        user.update(avatar: f)
+      end
+
+      it "deletes an avatar" do
+        expect(UserEditProfileEventJob).to receive(:perform_later).with(user)
+        post :update, params: { id: user.user_key, user: { remove_avatar: 'true' } }
+        expect(response).to redirect_to(routes.url_helpers.dashboard_profile_path(user.to_param, locale: 'en'))
+        expect(flash[:notice]).to include("Your profile has been updated")
+        expect(User.find_by_user_key(user.user_key).avatar?).to be false
+      end
+    end
+
+    it "sets an social handles" do
+      post :update, params: { id: user.user_key, user: { twitter_handle: 'twit', facebook_handle: 'face', googleplus_handle: 'goo', linkedin_handle: "link", orcid: '0000-0000-1111-2222' } }
+      expect(response).to redirect_to(routes.url_helpers.dashboard_profile_path(user.to_param, locale: 'en'))
+      expect(flash[:notice]).to include("Your profile has been updated")
+      u = User.find_by_user_key(user.user_key)
+      expect(u.twitter_handle).to eq 'twit'
+      expect(u.facebook_handle).to eq 'face'
+      expect(u.googleplus_handle).to eq 'goo'
+      expect(u.linkedin_handle).to eq 'link'
+      expect(u.orcid).to eq 'https://orcid.org/0000-0000-1111-2222'
+    end
+
+    it 'displays a flash when invalid ORCID is entered' do
+      expect(user.orcid).to be_blank
+      post :update, params: { id: user.user_key, user: { orcid: 'foobar' } }
+      expect(response).to redirect_to(routes.url_helpers.edit_dashboard_profile_path(user.to_param, locale: 'en'))
+      expect(flash[:alert]).to include('Orcid must be a string of 19 characters, e.g., "0000-0000-0000-0000"')
+    end
+
+    context "when removing a trophy" do
+      let(:work) { create(:generic_work, title: ["w1"], user: user) }
+
+      before do
+        user.trophies.create!(work_id: work.id)
+      end
+      it "removes a trophy" do
+        expect do
+          post :update, params: { id: user.user_key, 'remove_trophy_' + work.id => 'yes' }
+        end.to change { user.trophies.count }.by(-1)
+        expect(response).to redirect_to(routes.url_helpers.dashboard_profile_path(user.to_param, locale: 'en'))
+        expect(flash[:notice]).to include("Your profile has been updated")
+      end
+    end
+  end
+end

data/spec/controllers/hyrax/dashboard/works_controller_spec.rb

@@ -0,0 +1,13 @@
+RSpec.describe Hyrax::Dashboard::WorksController, type: :controller do
+  describe "#search_builder_class" do
+    subject { controller.search_builder_class }
+
+    it { is_expected.to eq Hyrax::Dashboard::WorksSearchBuilder }
+  end
+
+  describe "#search_facet_path" do
+    subject { controller.send(:search_facet_path, id: 'keyword_sim') }
+
+    it { is_expected.to eq "/dashboard/works/facet/keyword_sim?locale=en" }
+  end
+end

data/spec/controllers/hyrax/dashboard_controller_spec.rb

@@ -0,0 +1,42 @@
+RSpec.describe Hyrax::DashboardController, type: :controller do
+  context "with an unauthenticated user" do
+    it "redirects to sign-in page" do
+      get :show
+      expect(response).to be_redirect
+      expect(flash[:alert]).to eq("You need to sign in or sign up before continuing.")
+    end
+  end
+
+  context "with an authenticated user" do
+    let(:user) { create(:user) }
+
+    before do
+      sign_in user
+    end
+
+    it "renders the dashboard with the user's info" do
+      get :show
+      expect(response).to be_successful
+      expect(assigns(:presenter)).to be_instance_of Hyrax::Dashboard::UserPresenter
+      expect(response).to render_template('show_user')
+    end
+  end
+
+  context 'with an admin user' do
+    let(:service) { instance_double(Hyrax::AdminSetService, search_results_with_work_count: results) }
+    let(:results) { instance_double(Array) }
+    let(:user) { create(:admin) }
+
+    before do
+      sign_in user
+      allow(Hyrax::AdminSetService).to receive(:new).and_return(service)
+    end
+
+    it "is successful" do
+      get :show
+      expect(response).to be_success
+      expect(assigns[:admin_set_rows]).to eq results
+      expect(response).to render_template('show_admin')
+    end
+  end
+end

data/spec/controllers/hyrax/depositors_controller_spec.rb

@@ -0,0 +1,109 @@
+RSpec.describe Hyrax::DepositorsController do
+  let(:user) { create(:user) }
+  let(:grantee) { create(:user) }
+
+  let(:grant_proxy_params) do
+    {
+      user_id: user.user_key,
+      grantee_id: grantee.user_key,
+      format: 'json'
+    }
+  end
+
+  let(:revoke_proxy_params) do
+    {
+      user_id: user.user_key,
+      id: grantee.user_key,
+      format: 'json'
+    }
+  end
+
+  context "as a logged in user" do
+    before do
+      sign_in user
+    end
+
+    describe "#create" do
+      context 'when the grantee has not yet been designated as a depositor' do
+        let(:request_to_grant_proxy) { post :create, params: grant_proxy_params }
+
+        it 'is successful' do
+          expect { request_to_grant_proxy }.to change { ProxyDepositRights.count }.by(1)
+          expect(response).to be_success
+        end
+
+        it 'sends a message to the grantor' do
+          expect { request_to_grant_proxy }.to change { user.mailbox.inbox.count }.by(1)
+          expect(user.mailbox.inbox.last.last_message.subject).to eq 'Proxy Depositor Added'
+          expect(user.mailbox.inbox.last.last_message.body).to eq 'You have assigned ' + grantee.user_key + ' as a proxy depositor'
+        end
+
+        it 'sends a message to the grantee' do
+          expect { request_to_grant_proxy }.to change { grantee.mailbox.inbox.count }.by(1)
+          expect(grantee.mailbox.inbox.last.last_message.subject).to eq 'Proxy Depositor Added'
+          expect(grantee.mailbox.inbox.last.last_message.body).to eq user.user_key + ' has assigned you as a proxy depositor'
+        end
+      end
+
+      context 'when the grantee is already an allowed depositor' do
+        # For this test we just set the grantor to be eq to grantee.
+        let(:redundant_request_to_grant_proxy) do
+          post :create, params: grant_proxy_params.merge(grantee_id: user.user_key)
+        end
+
+        it 'does not add the user, and returns a 200, with empty response body' do
+          expect { redundant_request_to_grant_proxy }.to change { ProxyDepositRights.count }.by(0)
+          expect(response).to be_success
+          expect(response.body).to be_blank
+        end
+
+        it 'does not send a message to the user' do
+          expect { redundant_request_to_grant_proxy }.not_to change { user.mailbox.inbox.count }
+        end
+      end
+    end
+
+    describe "destroy" do
+      before do
+        user.can_receive_deposits_from << grantee
+      end
+
+      it "is successful" do
+        expect { delete :destroy, params: revoke_proxy_params }.to change { ProxyDepositRights.count }.by(-1)
+      end
+    end
+
+    describe "index" do
+      it "renders the page with user proxy info" do
+        expect(controller).to receive(:add_breadcrumb).with('Home', root_path)
+        expect(controller).to receive(:add_breadcrumb).with('Dashboard', dashboard_path)
+        expect(controller).to receive(:add_breadcrumb).with('Manage Proxies', depositors_path)
+        get :index
+        expect(response).to be_successful
+        expect(response).to render_template('dashboard')
+      end
+    end
+  end
+
+  context "as a user without access" do
+    before do
+      sign_in create(:user)
+    end
+
+    describe "create" do
+      it "is not successful" do
+        post :create, params: grant_proxy_params
+        expect(response).to redirect_to root_path
+        expect(flash[:alert]).to eq "You are not authorized to access this page."
+      end
+    end
+
+    describe "destroy" do
+      it "is not successful" do
+        delete :destroy, params: revoke_proxy_params
+        expect(response).to redirect_to root_path
+        expect(flash[:alert]).to eq "You are not authorized to access this page."
+      end
+    end
+  end
+end