cli/Chronobriq-API
7
2
Fork 0
Code Issues 2 Pull requests Releases Wiki Activity

Removed check_owner def of activity model - a logged in user can update/destroy any activity

Browse source
This commit is contained in:
Lou 2021-04-29 15:50:41 +02:00
commit 9a28dba9cb
3 changed files with 1 additions and 28 deletions
Download patch file Download diff file Expand all files Collapse all files

5
app/controllers/api/v1/activities_controller.rb
View file

@ -1,7 +1,6 @@
class Api::V1::ActivitiesController < ApplicationController class Api::V1::ActivitiesController < ApplicationController
before_action :set_activity, only: %i[show update destroy] before_action :set_activity, only: %i[show update destroy]
before_action :check_login before_action :check_login
before_action :check_owner, only: %i[update destroy]
def index def index
render json: Activity.all render json: Activity.all
@ -43,8 +42,4 @@ class Api::V1::ActivitiesController < ApplicationController
def set_activity def set_activity
@activity = Activity.find(params[:id]) @activity = Activity.find(params[:id])
end end
def check_owner
head :forbidden unless @activity.author_id == current_user&.id
end
end end

17
test/controllers/api/v1/activities_controller_test.rb
View file

@ -69,14 +69,6 @@ class Api::V1::ActivitiesControllerTest < ActionDispatch::IntegrationTest
assert_response :forbidden assert_response :forbidden
end end
test "should forbid update activity - not owner or admin" do
patch api_v1_activity_url(@activity),
params: { activity: { name: "Updated name" } },
headers: { Authorization: JsonWebToken.encode(user_id: users(:two).id) },
as: :json
assert_response :forbidden
end
#DESTROY #DESTROY
test "should destroy activity" do test "should destroy activity" do
assert_difference "Activity.count", -1 do assert_difference "Activity.count", -1 do
@ -93,13 +85,4 @@ class Api::V1::ActivitiesControllerTest < ActionDispatch::IntegrationTest
end end
assert_response :forbidden assert_response :forbidden
end end
test "should forbid destroy activity - not owner or admin" do
assert_no_difference('Activity.count') do
delete api_v1_activity_url(@activity),
headers: { Authorization: JsonWebToken.encode(user_id: users(:two).id) },
as: :json
end
assert_response :forbidden
end
end end

5
test/fixtures/users.yml vendored
View file

@ -4,8 +4,3 @@ one:
email: one@one.com email: one@one.com
username: OneUsername username: OneUsername
password_digest: <%= BCrypt::Password.create('g00d_pa$$') %> password_digest: <%= BCrypt::Password.create('g00d_pa$$') %>
two:
email: two@two.com
username: TwoUsername
password_digest: <%= BCrypt::Password.create('g00d_pa$$') %>