solidus_api 1.0.0.pre

data/spec/models/spree/legacy_user_spec.rb

@@ -0,0 +1,45 @@
+require 'spec_helper'
+
+module Spree
+  describe LegacyUser, :type => :model do
+    let(:user) { LegacyUser.new }
+
+    it "can generate an API key" do
+      expect(user).to receive(:save!)
+      user.generate_spree_api_key!
+      expect(user.spree_api_key).not_to be_blank
+    end
+
+    it "can clear an API key" do
+      expect(user).to receive(:save!)
+      user.clear_spree_api_key!
+      expect(user.spree_api_key).to be_blank
+    end
+
+    context "admin role auto-api-key grant" do # so the admin user can do admin api actions
+      let(:user) { create(:user) }
+      before { expect(user.spree_roles).to be_blank }
+      subject { user.spree_roles << role }
+
+      context "admin role" do
+        let(:role) { create(:role, name: "admin") }
+
+        context "the user has no api key" do
+          before { user.clear_spree_api_key! }
+          it { expect { subject }.to change { user.reload.spree_api_key }.from(nil) }
+        end
+
+        context "the user already has an api key" do
+          before { user.generate_spree_api_key! }
+          it { expect { subject }.not_to change { user.reload.spree_api_key } }
+        end
+      end
+
+      context "non-admin role" do
+        let(:role) { create(:role, name: "foo") }
+        before { user.clear_spree_api_key! }
+        it { expect { subject }.not_to change { user.reload.spree_api_key } }
+      end
+    end
+  end
+end

data/spec/requests/rabl_cache_spec.rb

@@ -0,0 +1,32 @@
+require 'spec_helper'
+
+describe "Rabl Cache", :type => :request, :caching => true do
+  let!(:user)  { create(:admin_user) }
+
+  before do
+    create(:variant) 
+    user.generate_spree_api_key!
+    expect(Spree::Product.count).to eq(1)
+  end
+  
+  it "doesn't create a cache key collision for models with different rabl templates" do
+    get "/api/variants", :token => user.spree_api_key
+    expect(response.status).to eq(200)
+
+    # Make sure we get a non master variant
+    variant_a = JSON.parse(response.body)['variants'].select do |v|
+      !v['is_master']
+    end.first
+
+    expect(variant_a['is_master']).to be false
+    expect(variant_a['stock_items']).not_to be_nil
+
+    get "/api/products/#{Spree::Product.first.id}", :token => user.spree_api_key
+    expect(response.status).to eq(200)
+    variant_b = JSON.parse(response.body)['variants'].last
+    expect(variant_b['is_master']).to be false
+
+    expect(variant_a['id']).to eq(variant_b['id'])
+    expect(variant_b['stock_items']).to be_nil
+  end
+end

data/spec/shared_examples/protect_product_actions.rb

@@ -0,0 +1,17 @@
+shared_examples "modifying product actions are restricted" do
+  it "cannot create a new product if not an admin" do
+    api_post :create, :product => { :name => "Brand new product!" }
+    assert_unauthorized!
+  end
+
+  it "cannot update a product" do
+    api_put :update, :id => product.to_param, :product => { :name => "I hacked your store!" }
+    assert_unauthorized!
+  end
+
+  it "cannot delete a product" do
+    api_delete :destroy, :id => product.to_param
+    assert_unauthorized!
+  end
+end
+

data/spec/spec_helper.rb

@@ -0,0 +1,60 @@
+if ENV["COVERAGE"]
+  # Run Coverage report
+  require 'simplecov'
+  SimpleCov.start do
+    add_group 'Controllers', 'app/controllers'
+    add_group 'Helpers', 'app/helpers'
+    add_group 'Mailers', 'app/mailers'
+    add_group 'Models', 'app/models'
+    add_group 'Views', 'app/views'
+    add_group 'Libraries', 'lib'
+  end
+end
+
+# This file is copied to spec/ when you run 'rails generate rspec:install'
+ENV["RAILS_ENV"] ||= 'test'
+
+begin
+  require File.expand_path("../dummy/config/environment", __FILE__)
+rescue LoadError
+  puts "Could not load dummy application. Please ensure you have run `bundle exec rake test_app`"
+  exit
+end
+
+require 'rspec/rails'
+require 'ffaker'
+
+# Requires supporting ruby files with custom matchers and macros, etc,
+# in spec/support/ and its subdirectories.
+Dir[File.dirname(__FILE__) + "/support/**/*.rb"].each {|f| require f}
+
+require 'spree/testing_support/factories'
+require 'spree/testing_support/rspec-activemodel-mocks_patch'
+require 'spree/testing_support/preferences'
+require 'spree/testing_support/mail'
+
+require 'spree/api/testing_support/caching'
+require 'spree/api/testing_support/helpers'
+require 'spree/api/testing_support/setup'
+
+RSpec.configure do |config|
+  config.backtrace_exclusion_patterns = [/gems\/activesupport/, /gems\/actionpack/, /gems\/rspec/]
+  config.color = true
+  config.infer_spec_type_from_file_location!
+
+  config.include FactoryGirl::Syntax::Methods
+  config.include Spree::Api::TestingSupport::Helpers, :type => :controller
+  config.extend Spree::Api::TestingSupport::Setup, :type => :controller
+  config.include Spree::TestingSupport::Preferences
+  config.include Spree::TestingSupport::Mail
+
+  config.fail_fast = ENV['FAIL_FAST'] || false
+
+  config.before(:each) do
+    Rails.cache.clear
+    reset_spree_preferences
+    Spree::Api::Config[:requires_authentication] = true
+  end
+
+  config.use_transactional_fixtures = true
+end

data/spec/support/controller_hacks.rb

@@ -0,0 +1,38 @@
+require 'active_support/all'
+
+module ControllerHacks
+  extend ActiveSupport::Concern
+
+  included do
+    routes { Spree::Core::Engine.routes }
+  end
+
+  def api_get(action, params={}, session=nil, flash=nil)
+    api_process(action, params, session, flash, "GET")
+  end
+
+  def api_post(action, params={}, session=nil, flash=nil)
+    api_process(action, params, session, flash, "POST")
+  end
+
+  def api_put(action, params={}, session=nil, flash=nil)
+    api_process(action, params, session, flash, "PUT")
+  end
+
+  def api_patch(action, params={}, session=nil, flash=nil)
+    api_process(action, params, session, flash, "PATCH")
+  end
+
+  def api_delete(action, params={}, session=nil, flash=nil)
+    api_process(action, params, session, flash, "DELETE")
+  end
+
+  def api_process(action, params={}, session=nil, flash=nil, method="get")
+    scoping = respond_to?(:resource_scoping) ? resource_scoping : {}
+    process(action, method, params.merge(scoping).reverse_merge!(format: :json), session, flash)
+  end
+end
+
+RSpec.configure do |config|
+  config.include ControllerHacks, type: :controller
+end

data/spec/support/database_cleaner.rb

@@ -0,0 +1,14 @@
+RSpec.configure do |config|
+  config.before(:suite) do
+    DatabaseCleaner.strategy = :transaction
+    DatabaseCleaner.clean_with(:truncation)
+  end
+
+  config.before(:each) do
+    DatabaseCleaner.start
+  end
+
+  config.after(:each) do
+    DatabaseCleaner.clean
+  end
+end

data/spec/support/have_attributes_matcher.rb

@@ -0,0 +1,13 @@
+
+
+
+
+RSpec::Matchers.define :have_attributes do |expected_attributes|
+  match do |actual|
+    # actual is a Hash object representing an object, like this:
+    # { "name" => "Product #1" }
+    actual_attributes = actual.keys.map(&:to_sym)
+    expected_attributes.map(&:to_sym).all? { |attr| actual_attributes.include?(attr) }
+  end
+end
+

metadata

@@ -0,0 +1,334 @@
+--- !ruby/object:Gem::Specification
+name: solidus_api
+version: !ruby/object:Gem::Version
+  version: 1.0.0.pre
+platform: ruby
+authors:
+- Solidus Team
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2015-06-29 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: solidus_core
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 1.0.0.pre
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 1.0.0.pre
+- !ruby/object:Gem::Dependency
+  name: rabl
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.9.4.pre1
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: 0.12.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.9.4.pre1
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: 0.12.0
+- !ruby/object:Gem::Dependency
+  name: versioncake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 2.3.1
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 2.3.1
+description: Spree's API
+email: contact@solidus.io
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- ".gitignore"
+- CHANGELOG.md
+- Gemfile
+- LICENSE
+- Rakefile
+- app/controllers/spree/api/addresses_controller.rb
+- app/controllers/spree/api/base_controller.rb
+- app/controllers/spree/api/checkouts_controller.rb
+- app/controllers/spree/api/classifications_controller.rb
+- app/controllers/spree/api/config_controller.rb
+- app/controllers/spree/api/countries_controller.rb
+- app/controllers/spree/api/credit_cards_controller.rb
+- app/controllers/spree/api/images_controller.rb
+- app/controllers/spree/api/inventory_units_controller.rb
+- app/controllers/spree/api/line_items_controller.rb
+- app/controllers/spree/api/option_types_controller.rb
+- app/controllers/spree/api/option_values_controller.rb
+- app/controllers/spree/api/orders_controller.rb
+- app/controllers/spree/api/payments_controller.rb
+- app/controllers/spree/api/product_properties_controller.rb
+- app/controllers/spree/api/products_controller.rb
+- app/controllers/spree/api/promotions_controller.rb
+- app/controllers/spree/api/properties_controller.rb
+- app/controllers/spree/api/return_authorizations_controller.rb
+- app/controllers/spree/api/shipments_controller.rb
+- app/controllers/spree/api/states_controller.rb
+- app/controllers/spree/api/stock_items_controller.rb
+- app/controllers/spree/api/stock_locations_controller.rb
+- app/controllers/spree/api/stock_movements_controller.rb
+- app/controllers/spree/api/stock_transfers_controller.rb
+- app/controllers/spree/api/store_credit_events_controller.rb
+- app/controllers/spree/api/stores_controller.rb
+- app/controllers/spree/api/taxonomies_controller.rb
+- app/controllers/spree/api/taxons_controller.rb
+- app/controllers/spree/api/transfer_items_controller.rb
+- app/controllers/spree/api/users_controller.rb
+- app/controllers/spree/api/variants_controller.rb
+- app/controllers/spree/api/zones_controller.rb
+- app/helpers/spree/api/api_helpers.rb
+- app/models/spree/api_configuration.rb
+- app/models/spree/option_value_decorator.rb
+- app/views/spree/api/addresses/show.v1.rabl
+- app/views/spree/api/adjustments/show.v1.rabl
+- app/views/spree/api/config/money.v1.rabl
+- app/views/spree/api/config/show.v1.rabl
+- app/views/spree/api/countries/index.v1.rabl
+- app/views/spree/api/countries/show.v1.rabl
+- app/views/spree/api/credit_cards/index.v1.rabl
+- app/views/spree/api/credit_cards/show.v1.rabl
+- app/views/spree/api/errors/gateway_error.v1.rabl
+- app/views/spree/api/errors/invalid_api_key.v1.rabl
+- app/views/spree/api/errors/invalid_resource.v1.rabl
+- app/views/spree/api/errors/must_specify_api_key.v1.rabl
+- app/views/spree/api/errors/not_found.v1.rabl
+- app/views/spree/api/errors/unauthorized.v1.rabl
+- app/views/spree/api/errors/variant_not_in_stock_transfer.v1.rabl
+- app/views/spree/api/images/index.v1.rabl
+- app/views/spree/api/images/show.v1.rabl
+- app/views/spree/api/inventory_units/show.rabl
+- app/views/spree/api/line_items/new.v1.rabl
+- app/views/spree/api/line_items/show.v1.rabl
+- app/views/spree/api/option_types/index.v1.rabl
+- app/views/spree/api/option_types/show.v1.rabl
+- app/views/spree/api/option_values/index.v1.rabl
+- app/views/spree/api/option_values/show.v1.rabl
+- app/views/spree/api/orders/address.v1.rabl
+- app/views/spree/api/orders/canceled.v1.rabl
+- app/views/spree/api/orders/cart.v1.rabl
+- app/views/spree/api/orders/complete.v1.rabl
+- app/views/spree/api/orders/could_not_apply_coupon.v1.rabl
+- app/views/spree/api/orders/could_not_transition.v1.rabl
+- app/views/spree/api/orders/expected_total_mismatch.v1.rabl
+- app/views/spree/api/orders/index.v1.rabl
+- app/views/spree/api/orders/invalid_shipping_method.v1.rabl
+- app/views/spree/api/orders/mine.v1.rabl
+- app/views/spree/api/orders/order.v1.rabl
+- app/views/spree/api/orders/payment.v1.rabl
+- app/views/spree/api/orders/show.v1.rabl
+- app/views/spree/api/payments/credit_over_limit.v1.rabl
+- app/views/spree/api/payments/index.v1.rabl
+- app/views/spree/api/payments/new.v1.rabl
+- app/views/spree/api/payments/show.v1.rabl
+- app/views/spree/api/payments/update_forbidden.v1.rabl
+- app/views/spree/api/product_properties/index.v1.rabl
+- app/views/spree/api/product_properties/new.v1.rabl
+- app/views/spree/api/product_properties/show.v1.rabl
+- app/views/spree/api/products/index.v1.rabl
+- app/views/spree/api/products/new.v1.rabl
+- app/views/spree/api/products/product.v1.rabl
+- app/views/spree/api/products/show.v1.rabl
+- app/views/spree/api/promotions/handler.v1.rabl
+- app/views/spree/api/promotions/show.v1.rabl
+- app/views/spree/api/properties/index.v1.rabl
+- app/views/spree/api/properties/new.v1.rabl
+- app/views/spree/api/properties/show.v1.rabl
+- app/views/spree/api/return_authorizations/index.v1.rabl
+- app/views/spree/api/return_authorizations/new.v1.rabl
+- app/views/spree/api/return_authorizations/show.v1.rabl
+- app/views/spree/api/shared/stock_location_required.v1.rabl
+- app/views/spree/api/shipments/big.v1.rabl
+- app/views/spree/api/shipments/cannot_ready_shipment.v1.rabl
+- app/views/spree/api/shipments/mine.v1.rabl
+- app/views/spree/api/shipments/show.v1.rabl
+- app/views/spree/api/shipments/small.v1.rabl
+- app/views/spree/api/shipping_rates/show.v1.rabl
+- app/views/spree/api/states/index.v1.rabl
+- app/views/spree/api/states/show.v1.rabl
+- app/views/spree/api/stock_items/index.v1.rabl
+- app/views/spree/api/stock_items/show.v1.rabl
+- app/views/spree/api/stock_locations/index.v1.rabl
+- app/views/spree/api/stock_locations/show.v1.rabl
+- app/views/spree/api/stock_movements/index.v1.rabl
+- app/views/spree/api/stock_movements/show.v1.rabl
+- app/views/spree/api/stock_transfers/receive.v1.rabl
+- app/views/spree/api/store_credit_events/mine.v1.rabl
+- app/views/spree/api/stores/index.v1.rabl
+- app/views/spree/api/stores/show.v1.rabl
+- app/views/spree/api/taxonomies/index.v1.rabl
+- app/views/spree/api/taxonomies/jstree.rabl
+- app/views/spree/api/taxonomies/nested.v1.rabl
+- app/views/spree/api/taxonomies/new.v1.rabl
+- app/views/spree/api/taxonomies/show.v1.rabl
+- app/views/spree/api/taxons/index.v1.rabl
+- app/views/spree/api/taxons/jstree.rabl
+- app/views/spree/api/taxons/new.v1.rabl
+- app/views/spree/api/taxons/show.v1.rabl
+- app/views/spree/api/taxons/taxons.v1.rabl
+- app/views/spree/api/transfer_items/show.v1.rabl
+- app/views/spree/api/users/index.v1.rabl
+- app/views/spree/api/users/new.v1.rabl
+- app/views/spree/api/users/show.v1.rabl
+- app/views/spree/api/variants/big.v1.rabl
+- app/views/spree/api/variants/index.v1.rabl
+- app/views/spree/api/variants/new.v1.rabl
+- app/views/spree/api/variants/show.v1.rabl
+- app/views/spree/api/variants/small.v1.rabl
+- app/views/spree/api/zones/index.v1.rabl
+- app/views/spree/api/zones/show.v1.rabl
+- config/initializers/metal_load_paths.rb
+- config/locales/en.yml
+- config/routes.rb
+- db/migrate/20100107141738_add_api_key_to_spree_users.rb
+- db/migrate/20120411123334_resize_api_key_field.rb
+- db/migrate/20120530054546_rename_api_key_to_spree_api_key.rb
+- db/migrate/20131017162334_add_index_to_user_spree_api_key.rb
+- lib/solidus_api.rb
+- lib/spree/api.rb
+- lib/spree/api/engine.rb
+- lib/spree/api/responders.rb
+- lib/spree/api/responders/rabl_template.rb
+- lib/spree/api/testing_support/caching.rb
+- lib/spree/api/testing_support/helpers.rb
+- lib/spree/api/testing_support/setup.rb
+- lib/spree_api.rb
+- script/rails
+- solidus_api.gemspec
+- spec/controllers/spree/api/addresses_controller_spec.rb
+- spec/controllers/spree/api/base_controller_spec.rb
+- spec/controllers/spree/api/checkouts_controller_spec.rb
+- spec/controllers/spree/api/classifications_controller_spec.rb
+- spec/controllers/spree/api/config_controller_spec.rb
+- spec/controllers/spree/api/countries_controller_spec.rb
+- spec/controllers/spree/api/credit_cards_controller_spec.rb
+- spec/controllers/spree/api/images_controller_spec.rb
+- spec/controllers/spree/api/inventory_units_controller_spec.rb
+- spec/controllers/spree/api/line_items_controller_spec.rb
+- spec/controllers/spree/api/option_types_controller_spec.rb
+- spec/controllers/spree/api/option_values_controller_spec.rb
+- spec/controllers/spree/api/orders_controller_spec.rb
+- spec/controllers/spree/api/payments_controller_spec.rb
+- spec/controllers/spree/api/product_properties_controller_spec.rb
+- spec/controllers/spree/api/products_controller_spec.rb
+- spec/controllers/spree/api/promotion_application_spec.rb
+- spec/controllers/spree/api/promotions_controller_spec.rb
+- spec/controllers/spree/api/properties_controller_spec.rb
+- spec/controllers/spree/api/return_authorizations_controller_spec.rb
+- spec/controllers/spree/api/shipments_controller_spec.rb
+- spec/controllers/spree/api/states_controller_spec.rb
+- spec/controllers/spree/api/stock_items_controller_spec.rb
+- spec/controllers/spree/api/stock_locations_controller_spec.rb
+- spec/controllers/spree/api/stock_movements_controller_spec.rb
+- spec/controllers/spree/api/stock_transfers_controller_spec.rb
+- spec/controllers/spree/api/store_credit_events_controller_spec.rb
+- spec/controllers/spree/api/stores_controller_spec.rb
+- spec/controllers/spree/api/taxonomies_controller_spec.rb
+- spec/controllers/spree/api/taxons_controller_spec.rb
+- spec/controllers/spree/api/transfer_items_controller_spec.rb
+- spec/controllers/spree/api/unauthenticated_products_controller_spec.rb
+- spec/controllers/spree/api/users_controller_spec.rb
+- spec/controllers/spree/api/variants_controller_spec.rb
+- spec/controllers/spree/api/zones_controller_spec.rb
+- spec/features/checkout_spec.rb
+- spec/fixtures/thinking-cat.jpg
+- spec/models/spree/legacy_user_spec.rb
+- spec/requests/rabl_cache_spec.rb
+- spec/shared_examples/protect_product_actions.rb
+- spec/spec_helper.rb
+- spec/support/controller_hacks.rb
+- spec/support/database_cleaner.rb
+- spec/support/have_attributes_matcher.rb
+homepage: ''
+licenses: []
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">"
+    - !ruby/object:Gem::Version
+      version: 1.3.1
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.2.0
+signing_key: 
+specification_version: 4
+summary: Spree's API
+test_files:
+- spec/controllers/spree/api/addresses_controller_spec.rb
+- spec/controllers/spree/api/base_controller_spec.rb
+- spec/controllers/spree/api/checkouts_controller_spec.rb
+- spec/controllers/spree/api/classifications_controller_spec.rb
+- spec/controllers/spree/api/config_controller_spec.rb
+- spec/controllers/spree/api/countries_controller_spec.rb
+- spec/controllers/spree/api/credit_cards_controller_spec.rb
+- spec/controllers/spree/api/images_controller_spec.rb
+- spec/controllers/spree/api/inventory_units_controller_spec.rb
+- spec/controllers/spree/api/line_items_controller_spec.rb
+- spec/controllers/spree/api/option_types_controller_spec.rb
+- spec/controllers/spree/api/option_values_controller_spec.rb
+- spec/controllers/spree/api/orders_controller_spec.rb
+- spec/controllers/spree/api/payments_controller_spec.rb
+- spec/controllers/spree/api/product_properties_controller_spec.rb
+- spec/controllers/spree/api/products_controller_spec.rb
+- spec/controllers/spree/api/promotion_application_spec.rb
+- spec/controllers/spree/api/promotions_controller_spec.rb
+- spec/controllers/spree/api/properties_controller_spec.rb
+- spec/controllers/spree/api/return_authorizations_controller_spec.rb
+- spec/controllers/spree/api/shipments_controller_spec.rb
+- spec/controllers/spree/api/states_controller_spec.rb
+- spec/controllers/spree/api/stock_items_controller_spec.rb
+- spec/controllers/spree/api/stock_locations_controller_spec.rb
+- spec/controllers/spree/api/stock_movements_controller_spec.rb
+- spec/controllers/spree/api/stock_transfers_controller_spec.rb
+- spec/controllers/spree/api/store_credit_events_controller_spec.rb
+- spec/controllers/spree/api/stores_controller_spec.rb
+- spec/controllers/spree/api/taxonomies_controller_spec.rb
+- spec/controllers/spree/api/taxons_controller_spec.rb
+- spec/controllers/spree/api/transfer_items_controller_spec.rb
+- spec/controllers/spree/api/unauthenticated_products_controller_spec.rb
+- spec/controllers/spree/api/users_controller_spec.rb
+- spec/controllers/spree/api/variants_controller_spec.rb
+- spec/controllers/spree/api/zones_controller_spec.rb
+- spec/features/checkout_spec.rb
+- spec/fixtures/thinking-cat.jpg
+- spec/models/spree/legacy_user_spec.rb
+- spec/requests/rabl_cache_spec.rb
+- spec/shared_examples/protect_product_actions.rb
+- spec/spec_helper.rb
+- spec/support/controller_hacks.rb
+- spec/support/database_cleaner.rb
+- spec/support/have_attributes_matcher.rb