|
@@ -62,18 +62,44 @@ class Api::V1::ActivitiesControllerTest < ActionDispatch::IntegrationTest
|
62
|
62
|
assert_response :success
|
63
|
63
|
end
|
64
|
64
|
|
65
|
|
- test "should forbid update activity - not connected" do
|
|
65
|
+ test "should forbid update activity - not logged in" do
|
66
|
66
|
patch api_v1_activity_url(@activity),
|
67
|
67
|
params: { activity: { name: "Updated name" } },
|
68
|
68
|
as: :json
|
69
|
69
|
assert_response :forbidden
|
70
|
70
|
end
|
71
|
71
|
|
72
|
|
- test "should forbid update activity - not owner" do
|
|
72
|
+ test "should forbid update activity - not owner or admin" do
|
73
|
73
|
patch api_v1_activity_url(@activity),
|
74
|
74
|
params: { activity: { name: "Updated name" } },
|
75
|
75
|
headers: { Authorization: JsonWebToken.encode(user_id: users(:two).id) },
|
76
|
76
|
as: :json
|
77
|
77
|
assert_response :forbidden
|
78
|
78
|
end
|
|
79
|
+
|
|
80
|
+ #DESTROY
|
|
81
|
+ test "should destroy activity" do
|
|
82
|
+ assert_difference "Activity.count", -1 do
|
|
83
|
+ delete api_v1_activity_url(@activity),
|
|
84
|
+ headers: { Authorization: JsonWebToken.encode(user_id: @activity.author_id) },
|
|
85
|
+ as: :json
|
|
86
|
+ end
|
|
87
|
+ assert_response :no_content
|
|
88
|
+ end
|
|
89
|
+
|
|
90
|
+ test "should forbid destroy activity - not logged in" do
|
|
91
|
+ assert_no_difference('Activity.count') do
|
|
92
|
+ delete api_v1_activity_url(@activity), as: :json
|
|
93
|
+ end
|
|
94
|
+ assert_response :forbidden
|
|
95
|
+ end
|
|
96
|
+
|
|
97
|
+ test "should forbid destroy activity - not owner or admin" do
|
|
98
|
+ assert_no_difference('Activity.count') do
|
|
99
|
+ delete api_v1_activity_url(@activity),
|
|
100
|
+ headers: { Authorization: JsonWebToken.encode(user_id: users(:two).id) },
|
|
101
|
+ as: :json
|
|
102
|
+ end
|
|
103
|
+ assert_response :forbidden
|
|
104
|
+ end
|
79
|
105
|
end
|