tracks/tracks/test/functional/user_controller_test.rb
lukemelia 3002fcf2f1 Created tests for backend_controller to cover security concerns, including #372 "user can add an action to another user's context via API". Modified backend_controller to close that hole and make the tests pass.
Added UserController#create to provide RESTful API for the admin user to create a new user in the system. This may be useful for the folks who have generously opened their Tracks installs to others. I have plans to document the RESTful API stuff at some point and write a Ruby wrapper.

Created a class method User.get_salt that wraps all calls to the SALT constant so that unit-tests can be always run with the default salt (I was previously needing to modify my environment.rb to run tests). 

Replaced usages of assert_success in tests with assert_response :success because assert_success is deprecated.



git-svn-id: http://www.rousette.org.uk/svn/tracks-repos/trunk@313 a4c988fc-2ded-0310-b66e-134b36920a42
2006-08-25 02:25:18 +00:00

111 lines
4.7 KiB
Ruby

require File.dirname(__FILE__) + '/../test_helper'
require 'user_controller'
require 'user'
# Re-raise errors caught by the controller.
class UserController; def rescue_action(e) raise e end; end
class UserControllerTest < Test::Unit::TestCase
fixtures :users
def setup
assert_equal "test", ENV['RAILS_ENV']
assert_equal "change-me", User.get_salt()
@controller = UserController.new
@request = ActionController::TestRequest.new
@response = ActionController::TestResponse.new
end
# Test index with and without login
#
def test_index
get :index # should fail because no login
assert_redirected_to :controller => 'login', :action => 'login'
@request.session['user_id'] = users(:admin_user).id # log in the admin user
get :index
assert_response :success
end
# Test admin with and without login
#
def test_admin
get :admin # should fail because no login
assert_redirected_to :controller => 'login', :action => 'login'
@request.session['user_id'] = users(:admin_user).id # log in the admin user
get :admin
assert_response :success
end
def test_preferences
get :preferences # should fail because no login
assert_redirected_to :controller => 'login', :action => 'login'
@request.session['user_id'] = users(:admin_user).id # log in the admin user
get :preferences
assert_response :success
assert_equal assigns['page_title'], "TRACKS::Preferences"
assert_not_nil assigns['prefs']
assert_equal assigns['prefs'].length, 7
end
def test_edit_preferences
get :edit_preferences # should fail because no login
assert_redirected_to :controller => 'login', :action => 'login'
@request.session['user_id'] = users(:admin_user).id # log in the admin user
get :edit_preferences
assert_response :success
assert_equal assigns['page_title'], "TRACKS::Edit Preferences"
assert_not_nil assigns['prefs']
assert_equal assigns['prefs'].length, 7
assert_template 'user/preference_edit_form'
end
# Test updating of preferences
# FIXME seems to be difficult to test serialization of preferences using YAML
#
def test_update_preferences
@request.session['user_id'] = users(:admin_user).id # log in the admin user
users(:admin_user).preferences = post :update_preferences, :prefs => { :date_format => "%m-%d-%Y", :week_starts => "0", :no_completed => "10", :staleness_starts => "14", :due_style => "1", :admin_email => "my.email@domain.com" }
@prefs = users(:admin_user).preferences
assert_not_nil @prefs
assert_redirected_to :action => 'preferences'
end
def test_update_password_successful
get :change_password # should fail because no login
assert_redirected_to :controller => 'login', :action => 'login'
@request.session['user_id'] = users(:admin_user).id # log in the admin user
@user = @request.session['user_id']
get :change_password # should now pass because we're logged in
assert_response :success
assert_equal assigns['page_title'], "TRACKS::Change password"
post :update_password, :updateuser => {:password => 'newpassword', :password_confirmation => 'newpassword'}
assert_redirected_to :controller => 'user', :action => 'preferences'
@updated_user = User.find(users(:admin_user).id)
assert_equal @updated_user.password, Digest::SHA1.hexdigest("#{User.get_salt()}--newpassword--")
assert_equal flash['notice'], "Password updated."
end
def test_update_password_no_confirmation
post :update_password # should fail because no login
assert_redirected_to :controller => 'login', :action => 'login'
@request.session['user_id'] = users(:admin_user).id # log in the admin user
post :update_password, :updateuser => {:password => 'newpassword', :password_confirmation => 'wrong'}
assert_redirected_to :controller => 'user', :action => 'change_password'
assert users(:admin_user).save, false
assert_equal flash['warning'], 'There was a problem saving the password. Please retry.'
end
def test_update_password_validation_errors
post :update_password # should fail because no login
assert_redirected_to :controller => 'login', :action => 'login'
@request.session['user_id'] = users(:admin_user).id # log in the admin user
post :update_password, :updateuser => {:password => 'ba', :password_confirmation => 'ba'}
assert_redirected_to :controller => 'user', :action => 'change_password'
assert users(:admin_user).save, false
# For some reason, no errors are being raised now.
#assert_equal 1, users(:admin_user).errors.count
#assert_equal users(:admin_user).errors.on(:password), "is too short (min is 5 characters)"
assert_equal flash['warning'], 'There was a problem saving the password. Please retry.'
end
end