Merge commit 'f1d4be1e7509f795706ff2310c5fc36e0e79bf4d' into glitch-soc/merge-upstream
This commit is contained in:
Claire committed
commit
f3bc50778b
48 files changed
+1053
-896
No files matched your search
@@ -1,77 +0,0 @@
|
||||
# frozen_string_literal: true
|
||||
|
||||
require 'rails_helper'
|
||||
|
||||
RSpec.describe Admin::Users::RolesController do
|
||||
render_views
|
||||
|
||||
let(:current_role) { UserRole.create(name: 'Foo', permissions: UserRole::FLAGS[:manage_roles], position: 10) }
|
||||
let(:current_user) { Fabricate(:user, role: current_role) }
|
||||
|
||||
let(:previous_role) { nil }
|
||||
let(:user) { Fabricate(:user, role: previous_role) }
|
||||
|
||||
before do
|
||||
sign_in current_user, scope: :user
|
||||
end
|
||||
|
||||
describe 'GET #show' do
|
||||
before do
|
||||
get :show, params: { user_id: user.id }
|
||||
end
|
||||
|
||||
it 'returns http success' do
|
||||
expect(response).to have_http_status(:success)
|
||||
end
|
||||
|
||||
context 'when target user is higher ranked than current user' do
|
||||
let(:previous_role) { UserRole.create(name: 'Baz', permissions: UserRole::FLAGS[:administrator], position: 100) }
|
||||
|
||||
it 'returns http forbidden' do
|
||||
expect(response).to have_http_status(403)
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
describe 'PUT #update' do
|
||||
let(:selected_role) { UserRole.create(name: 'Bar', permissions: permissions, position: position) }
|
||||
|
||||
before do
|
||||
put :update, params: { user_id: user.id, user: { role_id: selected_role.id } }
|
||||
end
|
||||
|
||||
context 'with manage roles permissions' do
|
||||
let(:permissions) { UserRole::FLAGS[:manage_roles] }
|
||||
let(:position) { 1 }
|
||||
|
||||
it 'updates user role and redirects' do
|
||||
expect(user.reload.role_id).to eq selected_role&.id
|
||||
|
||||
expect(response).to redirect_to(admin_account_path(user.account_id))
|
||||
end
|
||||
end
|
||||
|
||||
context 'when selected role has higher position than current user\'s role' do
|
||||
let(:permissions) { UserRole::FLAGS[:administrator] }
|
||||
let(:position) { 100 }
|
||||
|
||||
it 'does not update user role and renders edit' do
|
||||
expect(user.reload.role_id).to eq previous_role&.id
|
||||
|
||||
expect(response).to render_template(:show)
|
||||
end
|
||||
end
|
||||
|
||||
context 'when target user is higher ranked than current user' do
|
||||
let(:previous_role) { UserRole.create(name: 'Baz', permissions: UserRole::FLAGS[:administrator], position: 100) }
|
||||
let(:permissions) { UserRole::FLAGS[:manage_roles] }
|
||||
let(:position) { 1 }
|
||||
|
||||
it 'does not update user role and returns http forbidden' do
|
||||
expect(user.reload.role_id).to eq previous_role&.id
|
||||
|
||||
expect(response).to have_http_status(403)
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
@@ -1,30 +0,0 @@
|
||||
# frozen_string_literal: true
|
||||
|
||||
require 'rails_helper'
|
||||
|
||||
RSpec.describe Settings::TwoFactorAuthentication::RecoveryCodesController do
|
||||
render_views
|
||||
|
||||
describe 'POST #create' do
|
||||
it 'updates the codes and shows them on a view when signed in' do
|
||||
user = Fabricate(:user)
|
||||
otp_backup_codes = user.generate_otp_backup_codes!
|
||||
allow(user).to receive(:generate_otp_backup_codes!).and_return(otp_backup_codes)
|
||||
allow(controller).to receive(:current_user).and_return(user)
|
||||
|
||||
sign_in user, scope: :user
|
||||
post :create, session: { challenge_passed_at: Time.now.utc }
|
||||
|
||||
expect(flash[:notice]).to eq 'Recovery codes successfully regenerated'
|
||||
expect(response).to have_http_status(200)
|
||||
expect(response).to render_template(:index)
|
||||
expect(response.body)
|
||||
.to include(*otp_backup_codes)
|
||||
end
|
||||
|
||||
it 'redirects when not signed in' do
|
||||
post :create
|
||||
expect(response).to redirect_to '/auth/sign_in'
|
||||
end
|
||||
end
|
||||
end
|
||||
@@ -1,79 +0,0 @@
|
||||
# frozen_string_literal: true
|
||||
|
||||
require 'rails_helper'
|
||||
|
||||
RSpec.describe Settings::TwoFactorAuthenticationMethodsController do
|
||||
render_views
|
||||
|
||||
context 'when not signed in' do
|
||||
describe 'GET to #index' do
|
||||
it 'redirects' do
|
||||
get :index
|
||||
|
||||
expect(response).to redirect_to '/auth/sign_in'
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
context 'when signed in' do
|
||||
let(:user) { Fabricate(:user) }
|
||||
|
||||
before do
|
||||
sign_in user, scope: :user
|
||||
end
|
||||
|
||||
describe 'GET #index' do
|
||||
describe 'when user has enabled otp' do
|
||||
before do
|
||||
user.update(otp_required_for_login: true)
|
||||
get :index
|
||||
end
|
||||
|
||||
it 'returns http success with private cache control headers', :aggregate_failures do
|
||||
expect(response).to have_http_status(200)
|
||||
expect(response.headers['Cache-Control']).to include('private, no-store')
|
||||
end
|
||||
end
|
||||
|
||||
describe 'when user has not enabled otp' do
|
||||
before do
|
||||
user.update(otp_required_for_login: false)
|
||||
get :index
|
||||
end
|
||||
|
||||
it 'redirects to enable otp' do
|
||||
expect(response).to redirect_to(settings_otp_authentication_path)
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
describe 'POST to #disable' do
|
||||
before do
|
||||
user.update(otp_required_for_login: true)
|
||||
end
|
||||
|
||||
context 'when user has not passed challenge' do
|
||||
it 'renders challenge page' do
|
||||
post :disable
|
||||
|
||||
expect(response).to have_http_status(200)
|
||||
expect(response).to render_template('auth/challenges/new')
|
||||
end
|
||||
end
|
||||
|
||||
context 'when user has passed challenge' do
|
||||
before do
|
||||
mailer = instance_double(ApplicationMailer::MessageDelivery, deliver_later!: true)
|
||||
allow(UserMailer).to receive(:two_factor_disabled).with(user).and_return(mailer)
|
||||
end
|
||||
|
||||
it 'redirects to settings page' do
|
||||
post :disable, session: { challenge_passed_at: 10.minutes.ago }
|
||||
|
||||
expect(UserMailer).to have_received(:two_factor_disabled).with(user)
|
||||
expect(response).to redirect_to(settings_otp_authentication_path)
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
@@ -1,192 +0,0 @@
|
||||
# frozen_string_literal: true
|
||||
|
||||
require 'rails_helper'
|
||||
|
||||
RSpec.describe StatusesController do
|
||||
render_views
|
||||
|
||||
describe 'GET #show' do
|
||||
let(:account) { Fabricate(:account) }
|
||||
let(:status) { Fabricate(:status, account: account) }
|
||||
|
||||
context 'when signed-in' do
|
||||
let(:user) { Fabricate(:user) }
|
||||
|
||||
before do
|
||||
sign_in(user)
|
||||
end
|
||||
|
||||
context 'when status is public' do
|
||||
before do
|
||||
get :show, params: { account_username: status.account.username, id: status.id, format: format }
|
||||
end
|
||||
|
||||
context 'with HTML' do
|
||||
let(:format) { 'html' }
|
||||
|
||||
it 'renders status successfully', :aggregate_failures do
|
||||
expect(response)
|
||||
.to have_http_status(200)
|
||||
.and render_template(:show)
|
||||
expect(response.headers).to include(
|
||||
'Vary' => 'Accept, Accept-Language, Cookie',
|
||||
'Cache-Control' => include('private'),
|
||||
'Link' => include('activity+json')
|
||||
)
|
||||
expect(response.body).to include status.text
|
||||
end
|
||||
end
|
||||
|
||||
context 'with JSON' do
|
||||
let(:format) { 'json' }
|
||||
|
||||
it 'renders ActivityPub Note object successfully', :aggregate_failures do
|
||||
expect(response)
|
||||
.to have_http_status(200)
|
||||
expect(response.headers).to include(
|
||||
'Vary' => 'Accept, Accept-Language, Cookie',
|
||||
'Cache-Control' => include('private'),
|
||||
'Content-Type' => include('application/activity+json'),
|
||||
'Link' => include('activity+json')
|
||||
)
|
||||
expect(response.parsed_body)
|
||||
.to include(content: include(status.text))
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
context 'when status is private' do
|
||||
let(:status) { Fabricate(:status, account: account, visibility: :private) }
|
||||
|
||||
context 'when user is authorized to see it' do
|
||||
before do
|
||||
user.account.follow!(account)
|
||||
get :show, params: { account_username: status.account.username, id: status.id, format: format }
|
||||
end
|
||||
|
||||
context 'with HTML' do
|
||||
let(:format) { 'html' }
|
||||
|
||||
it 'renders status successfully', :aggregate_failures do
|
||||
expect(response)
|
||||
.to have_http_status(200)
|
||||
.and render_template(:show)
|
||||
|
||||
expect(response.headers).to include(
|
||||
'Vary' => 'Accept, Accept-Language, Cookie',
|
||||
'Cache-Control' => include('private'),
|
||||
'Link' => include('activity+json')
|
||||
)
|
||||
expect(response.body).to include status.text
|
||||
end
|
||||
end
|
||||
|
||||
context 'with JSON' do
|
||||
let(:format) { 'json' }
|
||||
|
||||
it 'renders ActivityPub Note object successfully', :aggregate_failures do
|
||||
expect(response)
|
||||
.to have_http_status(200)
|
||||
expect(response.headers).to include(
|
||||
'Vary' => 'Accept, Accept-Language, Cookie',
|
||||
'Cache-Control' => include('private'),
|
||||
'Content-Type' => include('application/activity+json'),
|
||||
'Link' => include('activity+json')
|
||||
)
|
||||
expect(response.parsed_body)
|
||||
.to include(content: include(status.text))
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
context 'when user is not authorized to see it' do
|
||||
before do
|
||||
get :show, params: { account_username: status.account.username, id: status.id, format: format }
|
||||
end
|
||||
|
||||
context 'with JSON' do
|
||||
let(:format) { 'json' }
|
||||
|
||||
it 'returns http not found' do
|
||||
expect(response).to have_http_status(404)
|
||||
end
|
||||
end
|
||||
|
||||
context 'with HTML' do
|
||||
let(:format) { 'html' }
|
||||
|
||||
it 'returns http not found' do
|
||||
expect(response).to have_http_status(404)
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
context 'when status is direct' do
|
||||
let(:status) { Fabricate(:status, account: account, visibility: :direct) }
|
||||
|
||||
context 'when user is authorized to see it' do
|
||||
before do
|
||||
Fabricate(:mention, account: user.account, status: status)
|
||||
get :show, params: { account_username: status.account.username, id: status.id, format: format }
|
||||
end
|
||||
|
||||
context 'with HTML' do
|
||||
let(:format) { 'html' }
|
||||
|
||||
it 'renders status successfully', :aggregate_failures do
|
||||
expect(response)
|
||||
.to have_http_status(200)
|
||||
.and render_template(:show)
|
||||
expect(response.headers).to include(
|
||||
'Vary' => 'Accept, Accept-Language, Cookie',
|
||||
'Cache-Control' => include('private'),
|
||||
'Link' => include('activity+json')
|
||||
)
|
||||
expect(response.body).to include status.text
|
||||
end
|
||||
end
|
||||
|
||||
context 'with JSON' do
|
||||
let(:format) { 'json' }
|
||||
|
||||
it 'renders ActivityPub Note object successfully' do
|
||||
expect(response)
|
||||
.to have_http_status(200)
|
||||
expect(response.headers).to include(
|
||||
'Vary' => 'Accept, Accept-Language, Cookie',
|
||||
'Cache-Control' => include('private'),
|
||||
'Content-Type' => include('application/activity+json'),
|
||||
'Link' => include('activity+json')
|
||||
)
|
||||
expect(response.parsed_body)
|
||||
.to include(content: include(status.text))
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
context 'when user is not authorized to see it' do
|
||||
before do
|
||||
get :show, params: { account_username: status.account.username, id: status.id, format: format }
|
||||
end
|
||||
|
||||
context 'with JSON' do
|
||||
let(:format) { 'json' }
|
||||
|
||||
it 'returns http not found' do
|
||||
expect(response).to have_http_status(404)
|
||||
end
|
||||
end
|
||||
|
||||
context 'with HTML' do
|
||||
let(:format) { 'html' }
|
||||
|
||||
it 'returns http not found' do
|
||||
expect(response).to have_http_status(404)
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
Reference in new issue
Block a user