mumuki-laboratory 7.5.0

data/spec/controllers/students_api_controller_spec.rb

@@ -0,0 +1,106 @@
+require 'spec_helper'
+
+[:student, :teacher].each do |role|
+
+  describe "Api::#{role.capitalize}sController".constantize, type: :controller, organization_workspace: :base do
+    before { set_api_client! api_client }
+    let(:api_client) { create :api_client, grant: 'anorganization/*' }
+    let(:json) { {
+        first_name: 'Agustin',
+        last_name: 'Pina',
+        email: 'agus@mumuki.org',
+        uid: 'agus@mumuki.org',
+        gender: 'male',
+        birthdate: '2010-08-25'
+    } }
+
+    let!(:organization) { create :organization, name: 'anorganization' }
+    let!(:course) { create :course, slug: 'anorganization/acode' }
+
+    context 'post' do
+      let(:params) { {role => json, organization: 'anorganization', course: 'acode'} }
+
+      context 'when user does not exist' do
+
+        before { post :create, params: params }
+
+        it { expect(response.status).to eq 200 }
+        it { expect(User.count).to eq 2 }
+        it { expect(User.last.last_name).to eq 'Pina' }
+        it { expect(User.last.first_name).to eq 'Agustin' }
+        it { expect(User.last.uid).to eq 'agus@mumuki.org' }
+        it { expect(User.last.email).to eq 'agus@mumuki.org' }
+        it { expect(User.last.gender).to eq 'male' }
+        it { expect(User.last.birthdate).to eq '2010-08-25'.to_datetime }
+        it { expect(User.last.permissions.has_permission? role, 'anorganization/acode').to be true }
+
+      end
+
+      context 'when user exist' do
+        context 'and have no permissions' do
+          before { create :user, json }
+          before { post :create, params: params }
+          it { expect(response.status).to eq 200 }
+          it { expect(User.count).to eq 2 }
+          it { expect(User.last.permissions.has_permission? role, 'anorganization/acode').to be true }
+        end
+
+        context 'and have permissions' do
+          before { create :user, json.merge(:permissions => {role => 'foo/bar'}) }
+          before { post :create, params: params }
+          it { expect(response.status).to eq 200 }
+          it { expect(User.count).to eq 2 }
+          it { expect(User.last.permissions.has_permission? role, 'anorganization/acode').to be true }
+          it { expect(User.last.permissions.has_permission? role, 'foo/bar').to be true }
+        end
+
+      end
+    end
+
+    context 'attach' do
+      let(:params) { {uid: json[:uid], organization: 'anorganization', course: 'acode'} }
+
+      context 'when user does not exist' do
+        before { post :attach, params: params }
+        it { expect(response.status).to eq 404 }
+      end
+
+      context 'when user exist' do
+        context 'and have no permissions' do
+          before { create :user, json }
+          before { post :attach, params: params }
+          it { expect(response.status).to eq 200 }
+          it { expect(User.last.permissions.has_permission? role, 'anorganization/acode').to be true }
+        end
+        context 'and have permissions' do
+          before { create :user, json.merge(:permissions => {role => 'foo/bar'}) }
+          before { post :attach, params: params }
+          it { expect(response.status).to eq 200 }
+          it { expect(User.last.permissions.has_permission? role, 'anorganization/acode').to be true }
+          it { expect(User.last.permissions.has_permission? role, 'foo/bar').to be true }
+        end
+      end
+
+    end
+
+    context 'detach' do
+      let(:params) { {uid: json[:uid], organization: 'anorganization', course: 'acode'} }
+
+      context 'when user does not exist' do
+        before { post :detach, params: params }
+        it { expect(response.status).to eq 404 }
+      end
+
+      context 'when user exist' do
+        context 'and have permissions' do
+          before { create :user, json.merge(:permissions => {role => 'anorganization/acode'}) }
+          before { post :detach, params: params }
+          it { expect(response.status).to eq 200 }
+          it { expect(User.last.permissions.has_permission? role, 'anorganization/acode').to be false }
+        end
+      end
+
+    end
+  end
+
+end

data/spec/controllers/users_api_controller_spec.rb

@@ -0,0 +1,65 @@
+require 'spec_helper'
+
+describe Api::UsersController, type: :controller, organization_workspace: :base do
+  before { set_api_client! api_client }
+  let(:api_client) { create :api_client }
+  let(:user_json) do
+    {
+      first_name: 'foo',
+      last_name: 'bar',
+      email: 'foo@bar.com',
+      permissions: {student: 'test/bar'},
+    }
+  end
+
+  let(:admin_json) do
+    {
+      first_name: 'foo',
+      last_name: 'bar',
+      email: 'foo@bar.com',
+      permissions: {admin: '*'}
+    }
+  end
+
+  context 'post' do
+    before { post :create, params: {user: user_json} }
+
+    it { expect(response.status).to eq 200 }
+    it { expect(response.body).to json_like({uid: 'foo@bar.com',
+                                             first_name: 'foo',
+                                             last_name: 'bar',
+                                             email: 'foo@bar.com',
+                                             permissions: {'student' => 'test/bar'},
+                                             image_url: 'user_shape.png'},
+                                            except: [:id, :created_at, :updated_at]) }
+    it { expect(User.count).to eq 2 }
+    it { expect(User.last.student? 'test/_').to be true }
+    it { expect(User.last.uid).to eq 'foo@bar.com' }
+    it { expect(User.last.verified_first_name).to eq 'foo' }
+  end
+
+
+  context 'post that tries to escalate permissions' do
+    before { post :create, params: {user: admin_json} }
+
+    it { expect(response.status).to eq 403 }
+    it { expect(response.body).to json_eq errors: ['The operation on organization base was forbidden to user foo+1@bar.com with permissions !janitor:test/*;admin:;owner:'] }
+  end
+
+  context 'post on a user with high permissions that does not operate on them' do
+    let!(:user) { User.create! admin_json }
+    before { put :update, params: {id: 'foo@bar.com', user: admin_json} }
+
+    it { expect(response.status).to eq 200 }
+  end
+
+  context 'put' do
+    before { User.create! user_json }
+    before { put :update, params: {id: 'foo@bar.com', user: {first_name: 'Fede'}} }
+
+    it { expect(response.status).to eq 200 }
+    it { expect(User.last.first_name).to eq('Fede') }
+    it { expect(User.last.uid).to eq 'foo@bar.com' }
+  end
+
+end

data/spec/controllers/users_controller_spec.rb

@@ -0,0 +1,21 @@
+require 'spec_helper'
+
+describe UsersController, type: :controller, organization_workspace: :test do
+  let(:user) { create(:user) }
+
+  let(:user_json) do
+    {
+      first_name: 'foo',
+      last_name: 'bar',
+      email: 'foo@bar.com'
+    }
+  end
+
+  context 'put' do
+    before { set_current_user! user }
+    before { put :update, body: { user: user_json }.to_json, as: :json }
+
+    it { expect(User.last.first_name).to eq 'foo' }
+    it { expect(User.last.verified_first_name).to be_nil }
+  end
+end

data/spec/dummy/Rakefile

@@ -0,0 +1,6 @@
+# Add your own tasks in files placed in lib/tasks ending in .rake,
+# for example lib/tasks/capistrano.rake, and they will automatically be available to Rake.
+
+require_relative 'config/application'
+
+Rails.application.load_tasks

data/spec/dummy/bin/bundle

@@ -0,0 +1,3 @@
+#!/usr/bin/env ruby
+ENV['BUNDLE_GEMFILE'] ||= File.expand_path('../../Gemfile', __FILE__)
+load Gem.bin_path('bundler', 'bundle')

data/spec/dummy/bin/rails

@@ -0,0 +1,4 @@
+#!/usr/bin/env ruby
+APP_PATH = File.expand_path('../config/application', __dir__)
+require_relative '../config/boot'
+require 'rails/commands'

data/spec/dummy/bin/rake

@@ -0,0 +1,4 @@
+#!/usr/bin/env ruby
+require_relative '../config/boot'
+require 'rake'
+Rake.application.run

data/spec/dummy/bin/setup

@@ -0,0 +1,38 @@
+#!/usr/bin/env ruby
+require 'pathname'
+require 'fileutils'
+include FileUtils
+
+# path to your application root.
+APP_ROOT = Pathname.new File.expand_path('../../', __FILE__)
+
+def system!(*args)
+  system(*args) || abort("\n== Command #{args} failed ==")
+end
+
+chdir APP_ROOT do
+  # This script is a starting point to setup your application.
+  # Add necessary setup steps to this file.
+
+  puts '== Installing dependencies =='
+  system! 'gem install bundler --conservative'
+  system('bundle check') || system!('bundle install')
+
+  # Install JavaScript dependencies if using Yarn
+  # system('bin/yarn')
+
+
+  # puts "\n== Copying sample files =="
+  # unless File.exist?('config/database.yml')
+  #   cp 'config/database.yml.sample', 'config/database.yml'
+  # end
+
+  puts "\n== Preparing database =="
+  system! 'bin/rails db:setup'
+
+  puts "\n== Removing old logs and tempfiles =="
+  system! 'bin/rails log:clear tmp:clear'
+
+  puts "\n== Restarting application server =="
+  system! 'bin/rails restart'
+end

data/spec/dummy/bin/update

@@ -0,0 +1,29 @@
+#!/usr/bin/env ruby
+require 'pathname'
+require 'fileutils'
+include FileUtils
+
+# path to your application root.
+APP_ROOT = Pathname.new File.expand_path('../../', __FILE__)
+
+def system!(*args)
+  system(*args) || abort("\n== Command #{args} failed ==")
+end
+
+chdir APP_ROOT do
+  # This script is a way to update your development environment automatically.
+  # Add necessary update steps to this file.
+
+  puts '== Installing dependencies =='
+  system! 'gem install bundler --conservative'
+  system('bundle check') || system!('bundle install')
+
+  puts "\n== Updating database =="
+  system! 'bin/rails db:migrate'
+
+  puts "\n== Removing old logs and tempfiles =="
+  system! 'bin/rails log:clear tmp:clear'
+
+  puts "\n== Restarting application server =="
+  system! 'bin/rails restart'
+end

data/spec/dummy/bin/yarn

@@ -0,0 +1,11 @@
+#!/usr/bin/env ruby
+VENDOR_PATH = File.expand_path('..', __dir__)
+Dir.chdir(VENDOR_PATH) do
+  begin
+    exec "yarnpkg #{ARGV.join(" ")}"
+  rescue Errno::ENOENT
+    $stderr.puts "Yarn executable was not detected in the system."
+    $stderr.puts "Download Yarn at https://yarnpkg.com/en/docs/install"
+    exit 1
+  end
+end

data/spec/dummy/config.ru

@@ -0,0 +1,5 @@
+# This file is used by Rack-based servers to start the application.
+
+require_relative 'config/environment'
+
+run Rails.application

data/spec/dummy/config/application.rb

@@ -0,0 +1,17 @@
+require_relative 'boot'
+
+require 'rails/all'
+
+Bundler.require(*Rails.groups)
+require "mumuki/laboratory"
+
+module Dummy
+  class Application < Rails::Application
+    config.load_defaults 5.1
+
+    Mumuki::Domain::Engine.paths['db/migrate'].expanded.each do |expanded_path|
+      config.paths['db/migrate'] << expanded_path
+    end
+  end
+end
+

data/spec/dummy/config/boot.rb

@@ -0,0 +1,5 @@
+# Set up gems listed in the Gemfile.
+ENV['BUNDLE_GEMFILE'] ||= File.expand_path('../../../Gemfile', __dir__)
+
+require 'bundler/setup' if File.exist?(ENV['BUNDLE_GEMFILE'])
+$LOAD_PATH.unshift File.expand_path('../../../lib', __dir__)

data/spec/dummy/config/cable.yml

@@ -0,0 +1,10 @@
+development:
+  adapter: async
+
+test:
+  adapter: async
+
+production:
+  adapter: redis
+  url: redis://localhost:6379/1
+  channel_prefix: dummy_production

data/spec/dummy/config/database.travis.yml

@@ -0,0 +1,4 @@
+test:
+  adapter: postgresql
+  database: travis_ci_test
+  username: postgres

data/spec/dummy/config/database.yml

@@ -0,0 +1,19 @@
+common: &common
+  adapter: postgresql
+  encoding: unicode
+  host: localhost
+  pool: 5
+  username: mumuki
+  password: mumuki
+
+test:
+  <<: *common
+  database: mumuki_test
+  pool: 5
+  timeout: 5000
+
+development:
+  <<: *common
+  database: mumuki_development
+  pool: 5
+  timeout: 5000

data/spec/dummy/config/environment.rb

@@ -0,0 +1,5 @@
+# Load the Rails application.
+require_relative 'application'
+
+# Initialize the Rails application.
+Rails.application.initialize!

data/spec/dummy/config/environments/development.rb

@@ -0,0 +1,55 @@
+Rails.application.configure do
+  # Settings specified here will take precedence over those in config/application.rb.
+
+  # In the development environment your application's code is reloaded on
+  # every request. This slows down response time but is perfect for development
+  # since you don't have to restart the web server when you make code changes.
+  config.cache_classes = false
+
+  # Do not eager load code on boot.
+  config.eager_load = false
+
+  # Show full error reports.
+  config.consider_all_requests_local = true
+
+  # Enable/disable caching. By default caching is disabled.
+  if Rails.root.join('tmp/caching-dev.txt').exist?
+    config.action_controller.perform_caching = true
+
+    config.cache_store = :memory_store
+    config.public_file_server.headers = {
+      'Cache-Control' => "public, max-age=#{2.days.seconds.to_i}"
+    }
+  else
+    config.action_controller.perform_caching = false
+
+    config.cache_store = :null_store
+  end
+
+  # Don't care if the mailer can't send.
+  config.action_mailer.perform_deliveries = false
+
+  config.action_mailer.perform_caching = false
+
+  # Print deprecation notices to the Rails logger.
+  config.active_support.deprecation = :log
+
+  # Raise an error on page load if there are pending migrations.
+  config.active_record.migration_error = :page_load
+
+  # Debug mode disables concatenation and preprocessing of assets.
+  # This option may cause significant delays in view rendering with a large
+  # number of complex assets.
+  config.assets.debug = true
+
+  # Suppress logger output for asset requests.
+  config.assets.quiet = true
+
+  # Raises error for missing translations
+  # config.action_view.raise_on_missing_translations = true
+
+  config.action_mailer.preview_path = "#{Rails.root}/spec/mailers/previews"
+  # Use an evented file watcher to asynchronously detect changes in source code,
+  # routes, locales, etc. This feature depends on the listen gem.
+  # config.file_watcher = ActiveSupport::EventedFileUpdateChecker
+end

data/spec/dummy/config/environments/test.rb

@@ -0,0 +1,54 @@
+Rails.application.configure do
+  # Settings specified here will take precedence over those in config/application.rb.
+
+  # The test environment is used exclusively to run your application's
+  # test suite. You never need to work with it otherwise. Remember that
+  # your test database is "scratch space" for the test suite and is wiped
+  # and recreated between test runs. Don't rely on the data there!
+  config.cache_classes = true
+
+  # Do not eager load code on boot. This avoids loading your whole application
+  # just for the purpose of running a single test. If you are using a tool that
+  # preloads Rails for running tests, you may have to set it to true.
+  config.eager_load = false
+
+  # Configure public file server for tests with Cache-Control for performance.
+  config.public_file_server.enabled = true
+  config.public_file_server.headers = {
+    'Cache-Control' => "public, max-age=#{1.hour.seconds.to_i}"
+  }
+
+  # Show full error reports and disable caching.
+  config.consider_all_requests_local       = true
+  config.action_controller.perform_caching = false
+
+  # Raise exceptions instead of rendering exception templates.
+  config.action_dispatch.show_exceptions = false
+
+  # Disable request forgery protection in test environment.
+  config.action_controller.allow_forgery_protection = false
+  config.action_mailer.perform_caching = false
+
+  # Tell Action Mailer not to deliver emails to the real world.
+  # The :test delivery method accumulates sent emails in the
+  # ActionMailer::Base.deliveries array.
+  config.action_mailer.delivery_method = :test
+
+  # Print deprecation notices to the stderr.
+  config.active_support.deprecation = :stderr
+
+  # Raises error for missing translations
+  # config.action_view.raise_on_missing_translations = true
+
+  config.i18n.default_locale = :en
+
+  OmniAuth.config.test_mode = true
+  OmniAuth.config.mock_auth[:developer] =
+    OmniAuth::AuthHash.new provider: 'developer',
+                           uid: 'johndoe@test.com',
+                           credentials: {},
+                           info: {first_name: 'John', last_name: 'Doe', name: 'John Doe', nickname: 'johndoe'}
+
+  config.reminder_sender_email = 'support@mumuki.org'
+  config.reminder_frequency = 7
+end