Merge branch 'login-captcha' into 'staging'

Login captcha Merge previous repository with staging See merge request !7

Merge branch 'login-captcha' into 'staging'
Login captcha Merge previous repository with staging See merge request !7
Victor Costa
2 parents eaa94bb4 553a5c2f
Showing 8 changed files with 185 additions and 39 deletions Show diff stats
lib/noosfero/api/captcha_session_store.rb
lib/noosfero/api/helpers.rb
lib/noosfero/api/session.rb
lib/noosfero/api/session_store.rb
lib/noosfero/api/v1/articles.rb
test/unit/api/articles_test.rb
test/unit/api/login_captcha_test.rb
test/unit/api/session_store_test.rb
@@ -1,30 +0,0 @@
-class Noosfero::API::CaptchaSessionStore
-
-  attr_accessor :data
-  attr_reader :private_token
-
-  def self.create
-    key = SecureRandom.hex
-    store = Noosfero::API::CaptchaSessionStore.new(key)
-    Rails.cache.write(store.private_token, store, expires_in: 300)
-    return store
-  end
-
-  def initialize(key)
-    @private_token = key
-  end
-
-  def self.get(key)
-    Rails.cache.fetch(key)
-  end
-
-  def store
-    Rails.cache.write(@private_token, self)
-  end
-
-  def destroy
-    Rails.cache.delete(@private_token)
-  end
-
-
-end
@@ -22,7 +22,8 @@ require_relative &#39;../../find_by_contents&#39;
  
       def current_tmp_user
         private_token = (params[PRIVATE_TOKEN_PARAM] || headers['Private-Token']).to_s
-        @current_tmp_user = Noosfero::API::CaptchaSessionStore.get(private_token)
+        ## Get the "captcha" session store
+        @current_tmp_user = Noosfero::API::SessionStore.get("captcha##{private_token}")
         @current_tmp_user
       end
  
@@ -66,6 +67,19 @@ require_relative &#39;../../find_by_contents&#39;
       include FindByContents
  
       ####################################################################
+      #### VOTE
+      ####################################################################
+      def do_vote(article, current_person, value)
+        begin
+          vote = Vote.new(:voteable => article, :voter => current_person, :vote => value)
+          return vote.save!
+        rescue ActiveRecord::RecordInvalid => e
+          render_api_error!(e.message, 400)
+          return false
+        end
+      end
+
+      ####################################################################
       #### SEARCH
       ####################################################################
       def multiple_search?(searches=nil)
@@ -16,7 +16,11 @@ module Noosfero
         # this return is just to improve the clarity of the execution path
         return unless test_captcha(remote_ip, params, environment)
         ## Creates and caches a captcha session store
-        store = Noosfero::API::CaptchaSessionStore.create
+        store = Noosfero::API::SessionStore.create("captcha")
+        ## Initialize the data for the session store
+        store.data = []
+        ## Put it back in cache
+        store.store
         { "private_token" => "#{store.private_token}" }
       end
  
@@ -0,0 +1,53 @@
+## A session store for the API. It can store
+## generic data on the Rails Cache to simulate
+## a stateful session for API methods
+class Noosfero::API::SessionStore
+
+  ## A generic data value to allow storing any 
+  ## value within this SessionStore
+  attr_accessor :data
+  ## The user private_token associated with this SessionStore
+  attr_reader :private_token
+  ## The key for this SessionStore in the Rails Cache
+  attr_reader :key
+
+  ## Call this method to create and store a SessionStore
+  ## in Rails Cache. The SessionStore is returned. The
+  ## client_key parameter, if used, will uniquely identify 
+  ## this SessionStore in Rails Cache, along with the user
+  ## private_token in the form: client_key#private_token
+  def self.create(client_key = nil)
+    private_token = SecureRandom.hex
+    store = Noosfero::API::SessionStore.new(client_key, private_token)
+    Rails.cache.write(store.key, store, expires_in: 300)
+    return store
+  end
+
+  ## Creates a new SessionStore. Do not use directly in cliente code.
+  ## Please use the self.create method instead
+  def initialize(client_key, private_token)
+    ## Creates the key to store this object in Rails Cache
+    key = "#{client_key}#" if client_key
+    key = "#{key}#{private_token}"
+    @key = key
+    @private_token = private_token
+  end
+
+  ## Returns the SessionStore in Rails Cache associated
+  ## with the given key
+  def self.get(key)
+    Rails.cache.fetch(key)
+  end
+
+  ## Stores this SessionStore in Rails Cache using the
+  ## key attribute as the unique identifier
+  def store
+    Rails.cache.write(@key, self)
+  end
+
+  ## Remove this session store from Rails Cache
+  def destroy
+    Rails.cache.delete(@key)
+  end
+
+end
@@ -149,13 +149,19 @@ module Noosfero
             # FIXME verify allowed values
             render_api_error!('Vote value not allowed', 400) unless [-1, 1].include?(value)
             article = find_article(environment.articles, params[:id])
-
-            begin
-              vote = Vote.new(:voteable => article, :voter => current_person, :vote => value)
-              saved = vote.save!
-              {:vote => saved}
-            rescue ActiveRecord::RecordInvalid => e
-              render_api_error!(e.message, 400)
+            ## If login with captcha
+            if @current_tmp_user
+              # Vote allowed only if data does not include this article
+              vote = (@current_tmp_user.data.include? article.id) ? false : true
+              if vote
+                @current_tmp_user.data << article.id
+                @current_tmp_user.store
+                {:vote => do_vote(article, current_person, value)}
+              else
+                {:vote => false}
+              end
+            else
+              {:vote => do_vote(article, current_person, value)}
             end
           end
  
@@ -127,6 +127,37 @@ class ArticlesTest &lt; ActiveSupport::TestCase
     assert_equal 1, json['total_followers']
   end
  
+  should 'not perform a vote twice in same article' do
+    article = fast_create(Article, :profile_id => @person.id, :name => "Some thing")
+    @params[:value] = 1
+    ## Perform a vote twice in API should compute only one vote
+    post "/api/v1/articles/#{article.id}/vote?#{params.to_query}"
+    json = JSON.parse(last_response.body)
+    
+    post "/api/v1/articles/#{article.id}/vote?#{params.to_query}"
+    json = JSON.parse(last_response.body)
+
+    total = article.votes_total
+
+    assert_equal 1, total
+  end
+
+  should 'not perform a vote in favor and against a proposal' do
+    article = fast_create(Article, :profile_id => @person.id, :name => "Some thing")
+    @params[:value] = 1
+    ## Perform a vote in favor a proposal
+    post "/api/v1/articles/#{article.id}/vote?#{params.to_query}"
+    json = JSON.parse(last_response.body)
+    assert_equal 201, last_response.status
+    ## Perform a vote against a proposal
+    @params[:value] = -1
+    post "/api/v1/articles/#{article.id}/vote?#{params.to_query}"
+    json = JSON.parse(last_response.body)
+    ## The api should not allow to save this vote
+    assert_equal 400, last_response.status
+  end
+
+
   should 'perform a vote in a article identified by id' do
     article = fast_create(Article, :profile_id => @person.id, :name => "Some thing")
     @params[:value] = 1
@@ -136,6 +167,7 @@ class ArticlesTest &lt; ActiveSupport::TestCase
  
     assert_not_equal 401, last_response.status
     assert_equal true, json['vote']
+
   end
  
   should 'not perform a vote in a archived article' do
@@ -47,6 +47,26 @@ class LoginCaptchaTest &lt; ActiveSupport::TestCase
     assert_equal true, json['vote']
   end
  
+  should 'not perform a vote twice in same article' do
+    login_with_captcha
+    article = create_article('Article 1')
+    params[:value] = 1
+
+    ## Perform a vote twice in API should compute only one vote
+    post "/api/v1/articles/#{article.id}/vote?#{params.to_query}"
+    json = JSON.parse(last_response.body)
+    assert_equal true, json['vote']
+
+    post "/api/v1/articles/#{article.id}/vote?#{params.to_query}"
+    json = JSON.parse(last_response.body)
+    ## Should not allow vote again
+    assert_equal false, json['vote']
+
+    total = article.votes_total
+
+    assert_equal 1, total
+  end
+
   should 'not follow any article' do
     login_with_captcha
     article = create_article('Article 1')
@@ -0,0 +1,47 @@
+require File.dirname(__FILE__) + '/test_helper'
+
+class SessionStoreTest < ActiveSupport::TestCase
+
+  should 'create a session store without client key' do
+    store = Noosfero::API::SessionStore.create
+    assert_not_nil store
+    private_token = store.private_token
+    assert_not_nil private_token
+    key = store.key
+    assert_not_nil key
+    assert_equal key, private_token
+  end
+
+  should 'create a session store with client key' do
+    store = Noosfero::API::SessionStore.create("mykey")
+    assert_not_nil store
+    private_token = store.private_token
+    assert_not_nil private_token
+    key = store.key
+    assert_not_nil key
+    assert_equal key, "mykey##{private_token}"
+  end
+
+  should 'get a session store with client key' do
+    store = Noosfero::API::SessionStore.create("mykey")
+    retrieved = Noosfero::API::SessionStore.get(store.key)
+    assert_not_nil retrieved
+  end
+
+  should 'not get a destroyed session store with client key' do
+    store = Noosfero::API::SessionStore.create("mykey")
+    store.destroy
+    retrieved = Noosfero::API::SessionStore.get(store.key)
+    assert_nil retrieved
+  end
+
+  should 'store data in session store' do
+    store = Noosfero::API::SessionStore.create("mykey")
+    store.data = [1, 2]
+    ## Put it back in cache
+    store.store
+    retrieved = Noosfero::API::SessionStore.get(store.key)
+    assert_equal [1,2], retrieved.data
+  end
+
+end
 \ No newline at end of file
...	...	@@ -1,30 +0,0 @@
1		-class Noosfero::API::CaptchaSessionStore
2		-
3		- attr_accessor :data
4		- attr_reader :private_token
5		-
6		- def self.create
7		- key = SecureRandom.hex
8		- store = Noosfero::API::CaptchaSessionStore.new(key)
9		- Rails.cache.write(store.private_token, store, expires_in: 300)
10		- return store
11		- end
12		-
13		- def initialize(key)
14		- @private_token = key
15		- end
16		-
17		- def self.get(key)
18		- Rails.cache.fetch(key)
19		- end
20		-
21		- def store
22		- Rails.cache.write(@private_token, self)
23		- end
24		-
25		- def destroy
26		- Rails.cache.delete(@private_token)
27		- end
28		-
29		-
30		-end
...	...	@@ -22,7 +22,8 @@ require_relative '../../find_by_contents'
22	22
23	23	def current_tmp_user
24	24	private_token = (params[PRIVATE_TOKEN_PARAM] \|\| headers['Private-Token']).to_s
25		- @current_tmp_user = Noosfero::API::CaptchaSessionStore.get(private_token)
	25	+ ## Get the "captcha" session store
	26	+ @current_tmp_user = Noosfero::API::SessionStore.get("captcha##{private_token}")
26	27	@current_tmp_user
27	28	end
28	29
...	...	@@ -66,6 +67,19 @@ require_relative '../../find_by_contents'
66	67	include FindByContents
67	68
68	69	####################################################################
	70	+ #### VOTE
	71	+ ####################################################################
	72	+ def do_vote(article, current_person, value)
	73	+ begin
	74	+ vote = Vote.new(:voteable => article, :voter => current_person, :vote => value)
	75	+ return vote.save!
	76	+ rescue ActiveRecord::RecordInvalid => e
	77	+ render_api_error!(e.message, 400)
	78	+ return false
	79	+ end
	80	+ end
	81	+
	82	+ ####################################################################
69	83	#### SEARCH
70	84	####################################################################
71	85	def multiple_search?(searches=nil)
...	...
...	...	@@ -16,7 +16,11 @@ module Noosfero
16	16	# this return is just to improve the clarity of the execution path
17	17	return unless test_captcha(remote_ip, params, environment)
18	18	## Creates and caches a captcha session store
19		- store = Noosfero::API::CaptchaSessionStore.create
	19	+ store = Noosfero::API::SessionStore.create("captcha")
	20	+ ## Initialize the data for the session store
	21	+ store.data = []
	22	+ ## Put it back in cache
	23	+ store.store
20	24	{ "private_token" => "#{store.private_token}" }
21	25	end
22	26
...	...
...	...	@@ -0,0 +1,53 @@
	1	+## A session store for the API. It can store
	2	+## generic data on the Rails Cache to simulate
	3	+## a stateful session for API methods
	4	+class Noosfero::API::SessionStore
	5	+
	6	+ ## A generic data value to allow storing any
	7	+ ## value within this SessionStore
	8	+ attr_accessor :data
	9	+ ## The user private_token associated with this SessionStore
	10	+ attr_reader :private_token
	11	+ ## The key for this SessionStore in the Rails Cache
	12	+ attr_reader :key
	13	+
	14	+ ## Call this method to create and store a SessionStore
	15	+ ## in Rails Cache. The SessionStore is returned. The
	16	+ ## client_key parameter, if used, will uniquely identify
	17	+ ## this SessionStore in Rails Cache, along with the user
	18	+ ## private_token in the form: client_key#private_token
	19	+ def self.create(client_key = nil)
	20	+ private_token = SecureRandom.hex
	21	+ store = Noosfero::API::SessionStore.new(client_key, private_token)
	22	+ Rails.cache.write(store.key, store, expires_in: 300)
	23	+ return store
	24	+ end
	25	+
	26	+ ## Creates a new SessionStore. Do not use directly in cliente code.
	27	+ ## Please use the self.create method instead
	28	+ def initialize(client_key, private_token)
	29	+ ## Creates the key to store this object in Rails Cache
	30	+ key = "#{client_key}#" if client_key
	31	+ key = "#{key}#{private_token}"
	32	+ @key = key
	33	+ @private_token = private_token
	34	+ end
	35	+
	36	+ ## Returns the SessionStore in Rails Cache associated
	37	+ ## with the given key
	38	+ def self.get(key)
	39	+ Rails.cache.fetch(key)
	40	+ end
	41	+
	42	+ ## Stores this SessionStore in Rails Cache using the
	43	+ ## key attribute as the unique identifier
	44	+ def store
	45	+ Rails.cache.write(@key, self)
	46	+ end
	47	+
	48	+ ## Remove this session store from Rails Cache
	49	+ def destroy
	50	+ Rails.cache.delete(@key)
	51	+ end
	52	+
	53	+end
...	...
...	...	@@ -149,13 +149,19 @@ module Noosfero
149	149	# FIXME verify allowed values
150	150	render_api_error!('Vote value not allowed', 400) unless [-1, 1].include?(value)
151	151	article = find_article(environment.articles, params[:id])
152		-
153		- begin
154		- vote = Vote.new(:voteable => article, :voter => current_person, :vote => value)
155		- saved = vote.save!
156		- {:vote => saved}
157		- rescue ActiveRecord::RecordInvalid => e
158		- render_api_error!(e.message, 400)
	152	+ ## If login with captcha
	153	+ if @current_tmp_user
	154	+ # Vote allowed only if data does not include this article
	155	+ vote = (@current_tmp_user.data.include? article.id) ? false : true
	156	+ if vote
	157	+ @current_tmp_user.data << article.id
	158	+ @current_tmp_user.store
	159	+ {:vote => do_vote(article, current_person, value)}
	160	+ else
	161	+ {:vote => false}
	162	+ end
	163	+ else
	164	+ {:vote => do_vote(article, current_person, value)}
159	165	end
160	166	end
161	167
...	...
...	...	@@ -127,6 +127,37 @@ class ArticlesTest < ActiveSupport::TestCase
127	127	assert_equal 1, json['total_followers']
128	128	end
129	129
	130	+ should 'not perform a vote twice in same article' do
	131	+ article = fast_create(Article, :profile_id => @person.id, :name => "Some thing")
	132	+ @params[:value] = 1
	133	+ ## Perform a vote twice in API should compute only one vote
	134	+ post "/api/v1/articles/#{article.id}/vote?#{params.to_query}"
	135	+ json = JSON.parse(last_response.body)
	136	+
	137	+ post "/api/v1/articles/#{article.id}/vote?#{params.to_query}"
	138	+ json = JSON.parse(last_response.body)
	139	+
	140	+ total = article.votes_total
	141	+
	142	+ assert_equal 1, total
	143	+ end
	144	+
	145	+ should 'not perform a vote in favor and against a proposal' do
	146	+ article = fast_create(Article, :profile_id => @person.id, :name => "Some thing")
	147	+ @params[:value] = 1
	148	+ ## Perform a vote in favor a proposal
	149	+ post "/api/v1/articles/#{article.id}/vote?#{params.to_query}"
	150	+ json = JSON.parse(last_response.body)
	151	+ assert_equal 201, last_response.status
	152	+ ## Perform a vote against a proposal
	153	+ @params[:value] = -1
	154	+ post "/api/v1/articles/#{article.id}/vote?#{params.to_query}"
	155	+ json = JSON.parse(last_response.body)
	156	+ ## The api should not allow to save this vote
	157	+ assert_equal 400, last_response.status
	158	+ end
	159	+
	160	+
130	161	should 'perform a vote in a article identified by id' do
131	162	article = fast_create(Article, :profile_id => @person.id, :name => "Some thing")
132	163	@params[:value] = 1
...	...	@@ -136,6 +167,7 @@ class ArticlesTest < ActiveSupport::TestCase
136	167
137	168	assert_not_equal 401, last_response.status
138	169	assert_equal true, json['vote']
	170	+
139	171	end
140	172
141	173	should 'not perform a vote in a archived article' do
...	...
...	...	@@ -47,6 +47,26 @@ class LoginCaptchaTest < ActiveSupport::TestCase
47	47	assert_equal true, json['vote']
48	48	end
49	49
	50	+ should 'not perform a vote twice in same article' do
	51	+ login_with_captcha
	52	+ article = create_article('Article 1')
	53	+ params[:value] = 1
	54	+
	55	+ ## Perform a vote twice in API should compute only one vote
	56	+ post "/api/v1/articles/#{article.id}/vote?#{params.to_query}"
	57	+ json = JSON.parse(last_response.body)
	58	+ assert_equal true, json['vote']
	59	+
	60	+ post "/api/v1/articles/#{article.id}/vote?#{params.to_query}"
	61	+ json = JSON.parse(last_response.body)
	62	+ ## Should not allow vote again
	63	+ assert_equal false, json['vote']
	64	+
	65	+ total = article.votes_total
	66	+
	67	+ assert_equal 1, total
	68	+ end
	69	+
50	70	should 'not follow any article' do
51	71	login_with_captcha
52	72	article = create_article('Article 1')
...	...
...	...	@@ -0,0 +1,47 @@
	1	+require File.dirname(__FILE__) + '/test_helper'
	2	+
	3	+class SessionStoreTest < ActiveSupport::TestCase
	4	+
	5	+ should 'create a session store without client key' do
	6	+ store = Noosfero::API::SessionStore.create
	7	+ assert_not_nil store
	8	+ private_token = store.private_token
	9	+ assert_not_nil private_token
	10	+ key = store.key
	11	+ assert_not_nil key
	12	+ assert_equal key, private_token
	13	+ end
	14	+
	15	+ should 'create a session store with client key' do
	16	+ store = Noosfero::API::SessionStore.create("mykey")
	17	+ assert_not_nil store
	18	+ private_token = store.private_token
	19	+ assert_not_nil private_token
	20	+ key = store.key
	21	+ assert_not_nil key
	22	+ assert_equal key, "mykey##{private_token}"
	23	+ end
	24	+
	25	+ should 'get a session store with client key' do
	26	+ store = Noosfero::API::SessionStore.create("mykey")
	27	+ retrieved = Noosfero::API::SessionStore.get(store.key)
	28	+ assert_not_nil retrieved
	29	+ end
	30	+
	31	+ should 'not get a destroyed session store with client key' do
	32	+ store = Noosfero::API::SessionStore.create("mykey")
	33	+ store.destroy
	34	+ retrieved = Noosfero::API::SessionStore.get(store.key)
	35	+ assert_nil retrieved
	36	+ end
	37	+
	38	+ should 'store data in session store' do
	39	+ store = Noosfero::API::SessionStore.create("mykey")
	40	+ store.data = [1, 2]
	41	+ ## Put it back in cache
	42	+ store.store
	43	+ retrieved = Noosfero::API::SessionStore.get(store.key)
	44	+ assert_equal [1,2], retrieved.data
	45	+ end
	46	+
	47	+end
0	48	\ No newline at end of file
...	...