Merge branch 'login-captcha' into 'staging'

Login captcha Merge previous repository with staging See merge request !7

Merge branch 'login-captcha' into 'staging'
Login captcha Merge previous repository with staging See merge request !7
Victor Costa
2 parents eaa94bb4 553a5c2f
Showing 8 changed files with 185 additions and 39 deletions Show diff stats
lib/noosfero/api/captcha_session_store.rb
lib/noosfero/api/helpers.rb
lib/noosfero/api/session.rb
lib/noosfero/api/session_store.rb
lib/noosfero/api/v1/articles.rb
test/unit/api/articles_test.rb
test/unit/api/login_captcha_test.rb
test/unit/api/session_store_test.rb
@@ -1,30 +0,0 @@
-class Noosfero::API::CaptchaSessionStore
-
-  attr_accessor :data
-  attr_reader :private_token
-
-  def self.create
-    key = SecureRandom.hex
-    store = Noosfero::API::CaptchaSessionStore.new(key)
-    Rails.cache.write(store.private_token, store, expires_in: 300)
-    return store
-  end
-
-  def initialize(key)
-    @private_token = key
-  end
-
-  def self.get(key)
-    Rails.cache.fetch(key)
-  end
-
-  def store
-    Rails.cache.write(@private_token, self)
-  end
-
-  def destroy
-    Rails.cache.delete(@private_token)
-  end
-
-
-end
@@ -22,7 +22,8 @@ require_relative &#39;../../find_by_contents&#39;
       def current_tmp_user
         private_token = (params[PRIVATE_TOKEN_PARAM] || headers['Private-Token']).to_s
-        @current_tmp_user = Noosfero::API::CaptchaSessionStore.get(private_token)
+        ## Get the "captcha" session store
+        @current_tmp_user = Noosfero::API::SessionStore.get("captcha##{private_token}")
         @current_tmp_user
       end
@@ -66,6 +67,19 @@ require_relative &#39;../../find_by_contents&#39;
       include FindByContents
       ####################################################################
+      #### VOTE
+      ####################################################################
+      def do_vote(article, current_person, value)
+        begin
+          vote = Vote.new(:voteable => article, :voter => current_person, :vote => value)
+          return vote.save!
+        rescue ActiveRecord::RecordInvalid => e
+          render_api_error!(e.message, 400)
+          return false
+        end
+      end
+
+      ####################################################################
       #### SEARCH
       ####################################################################
       def multiple_search?(searches=nil)
@@ -16,7 +16,11 @@ module Noosfero
         # this return is just to improve the clarity of the execution path
         return unless test_captcha(remote_ip, params, environment)
         ## Creates and caches a captcha session store
-        store = Noosfero::API::CaptchaSessionStore.create
+        store = Noosfero::API::SessionStore.create("captcha")
+        ## Initialize the data for the session store
+        store.data = []
+        ## Put it back in cache
+        store.store
         { "private_token" => "#{store.private_token}" }
       end
@@ -0,0 +1,53 @@
+## A session store for the API. It can store
+## generic data on the Rails Cache to simulate
+## a stateful session for API methods
+class Noosfero::API::SessionStore
+
+  ## A generic data value to allow storing any 
+  ## value within this SessionStore
+  attr_accessor :data
+  ## The user private_token associated with this SessionStore
+  attr_reader :private_token
+  ## The key for this SessionStore in the Rails Cache
+  attr_reader :key
+
+  ## Call this method to create and store a SessionStore
+  ## in Rails Cache. The SessionStore is returned. The
+  ## client_key parameter, if used, will uniquely identify 
+  ## this SessionStore in Rails Cache, along with the user
+  ## private_token in the form: client_key#private_token
+  def self.create(client_key = nil)
+    private_token = SecureRandom.hex
+    store = Noosfero::API::SessionStore.new(client_key, private_token)
+    Rails.cache.write(store.key, store, expires_in: 300)
+    return store
+  end
+
+  ## Creates a new SessionStore. Do not use directly in cliente code.
+  ## Please use the self.create method instead
+  def initialize(client_key, private_token)
+    ## Creates the key to store this object in Rails Cache
+    key = "#{client_key}#" if client_key
+    key = "#{key}#{private_token}"
+    @key = key
+    @private_token = private_token
+  end
+
+  ## Returns the SessionStore in Rails Cache associated
+  ## with the given key
+  def self.get(key)
+    Rails.cache.fetch(key)
+  end
+
+  ## Stores this SessionStore in Rails Cache using the
+  ## key attribute as the unique identifier
+  def store
+    Rails.cache.write(@key, self)
+  end
+
+  ## Remove this session store from Rails Cache
+  def destroy
+    Rails.cache.delete(@key)
+  end
+
+end
@@ -149,13 +149,19 @@ module Noosfero
             # FIXME verify allowed values
             render_api_error!('Vote value not allowed', 400) unless [-1, 1].include?(value)
             article = find_article(environment.articles, params[:id])
-
-            begin
-              vote = Vote.new(:voteable => article, :voter => current_person, :vote => value)
-              saved = vote.save!
-              {:vote => saved}
-            rescue ActiveRecord::RecordInvalid => e
-              render_api_error!(e.message, 400)
+            ## If login with captcha
+            if @current_tmp_user
+              # Vote allowed only if data does not include this article
+              vote = (@current_tmp_user.data.include? article.id) ? false : true
+              if vote
+                @current_tmp_user.data << article.id
+                @current_tmp_user.store
+                {:vote => do_vote(article, current_person, value)}
+              else
+                {:vote => false}
+              end
+            else
+              {:vote => do_vote(article, current_person, value)}
             end
           end
@@ -127,6 +127,37 @@ class ArticlesTest &lt; ActiveSupport::TestCase
     assert_equal 1, json['total_followers']
   end
+  should 'not perform a vote twice in same article' do
+    article = fast_create(Article, :profile_id => @person.id, :name => "Some thing")
+    @params[:value] = 1
+    ## Perform a vote twice in API should compute only one vote
+    post "/api/v1/articles/#{article.id}/vote?#{params.to_query}"
+    json = JSON.parse(last_response.body)
+    
+    post "/api/v1/articles/#{article.id}/vote?#{params.to_query}"
+    json = JSON.parse(last_response.body)
+
+    total = article.votes_total
+
+    assert_equal 1, total
+  end
+
+  should 'not perform a vote in favor and against a proposal' do
+    article = fast_create(Article, :profile_id => @person.id, :name => "Some thing")
+    @params[:value] = 1
+    ## Perform a vote in favor a proposal
+    post "/api/v1/articles/#{article.id}/vote?#{params.to_query}"
+    json = JSON.parse(last_response.body)
+    assert_equal 201, last_response.status
+    ## Perform a vote against a proposal
+    @params[:value] = -1
+    post "/api/v1/articles/#{article.id}/vote?#{params.to_query}"
+    json = JSON.parse(last_response.body)
+    ## The api should not allow to save this vote
+    assert_equal 400, last_response.status
+  end
+
+
   should 'perform a vote in a article identified by id' do
     article = fast_create(Article, :profile_id => @person.id, :name => "Some thing")
     @params[:value] = 1
@@ -136,6 +167,7 @@ class ArticlesTest &lt; ActiveSupport::TestCase
     assert_not_equal 401, last_response.status
     assert_equal true, json['vote']
+
   end
   should 'not perform a vote in a archived article' do
@@ -47,6 +47,26 @@ class LoginCaptchaTest &lt; ActiveSupport::TestCase
     assert_equal true, json['vote']
   end
+  should 'not perform a vote twice in same article' do
+    login_with_captcha
+    article = create_article('Article 1')
+    params[:value] = 1
+
+    ## Perform a vote twice in API should compute only one vote
+    post "/api/v1/articles/#{article.id}/vote?#{params.to_query}"
+    json = JSON.parse(last_response.body)
+    assert_equal true, json['vote']
+
+    post "/api/v1/articles/#{article.id}/vote?#{params.to_query}"
+    json = JSON.parse(last_response.body)
+    ## Should not allow vote again
+    assert_equal false, json['vote']
+
+    total = article.votes_total
+
+    assert_equal 1, total
+  end
+
   should 'not follow any article' do
     login_with_captcha
     article = create_article('Article 1')
@@ -0,0 +1,47 @@
+require File.dirname(__FILE__) + '/test_helper'
+
+class SessionStoreTest < ActiveSupport::TestCase
+
+  should 'create a session store without client key' do
+    store = Noosfero::API::SessionStore.create
+    assert_not_nil store
+    private_token = store.private_token
+    assert_not_nil private_token
+    key = store.key
+    assert_not_nil key
+    assert_equal key, private_token
+  end
+
+  should 'create a session store with client key' do
+    store = Noosfero::API::SessionStore.create("mykey")
+    assert_not_nil store
+    private_token = store.private_token
+    assert_not_nil private_token
+    key = store.key
+    assert_not_nil key
+    assert_equal key, "mykey##{private_token}"
+  end
+
+  should 'get a session store with client key' do
+    store = Noosfero::API::SessionStore.create("mykey")
+    retrieved = Noosfero::API::SessionStore.get(store.key)
+    assert_not_nil retrieved
+  end
+
+  should 'not get a destroyed session store with client key' do
+    store = Noosfero::API::SessionStore.create("mykey")
+    store.destroy
+    retrieved = Noosfero::API::SessionStore.get(store.key)
+    assert_nil retrieved
+  end
+
+  should 'store data in session store' do
+    store = Noosfero::API::SessionStore.create("mykey")
+    store.data = [1, 2]
+    ## Put it back in cache
+    store.store
+    retrieved = Noosfero::API::SessionStore.get(store.key)
+    assert_equal [1,2], retrieved.data
+  end
+
+end
 \ No newline at end of file
	@@ -1,30 +0,0 @@	@@ -1,30 +0,0 @@
1	-class Noosfero::API::CaptchaSessionStore
2	-
3	- attr_accessor :data
4	- attr_reader :private_token
5	-
6	- def self.create
7	- key = SecureRandom.hex
8	- store = Noosfero::API::CaptchaSessionStore.new(key)
9	- Rails.cache.write(store.private_token, store, expires_in: 300)
10	- return store
11	- end
12	-
13	- def initialize(key)
14	- @private_token = key
15	- end
16	-
17	- def self.get(key)
18	- Rails.cache.fetch(key)
19	- end
20	-
21	- def store
22	- Rails.cache.write(@private_token, self)
23	- end
24	-
25	- def destroy
26	- Rails.cache.delete(@private_token)
27	- end
28	-
29	-
30	-end
	@@ -22,7 +22,8 @@ require_relative '../../find_by_contents'		@@ -22,7 +22,8 @@ require_relative '../../find_by_contents'
22		22
23	def current_tmp_user	23	def current_tmp_user
24	private_token = (params[PRIVATE_TOKEN_PARAM] \|\| headers['Private-Token']).to_s	24	private_token = (params[PRIVATE_TOKEN_PARAM] \|\| headers['Private-Token']).to_s
25	- @current_tmp_user = Noosfero::API::CaptchaSessionStore.get(private_token)	25	+ ## Get the "captcha" session store
		26	+ @current_tmp_user = Noosfero::API::SessionStore.get("captcha##{private_token}")
26	@current_tmp_user	27	@current_tmp_user
27	end	28	end
28		29
	@@ -66,6 +67,19 @@ require_relative '../../find_by_contents'		@@ -66,6 +67,19 @@ require_relative '../../find_by_contents'
66	include FindByContents	67	include FindByContents
67		68
68	####################################################################	69	####################################################################
		70	+ #### VOTE
		71	+ ####################################################################
		72	+ def do_vote(article, current_person, value)
		73	+ begin
		74	+ vote = Vote.new(:voteable => article, :voter => current_person, :vote => value)
		75	+ return vote.save!
		76	+ rescue ActiveRecord::RecordInvalid => e
		77	+ render_api_error!(e.message, 400)
		78	+ return false
		79	+ end
		80	+ end
		81	+
		82	+ ####################################################################
69	#### SEARCH	83	#### SEARCH
70	####################################################################	84	####################################################################
71	def multiple_search?(searches=nil)	85	def multiple_search?(searches=nil)
@@ -0,0 +1,53 @@		@@ -0,0 +1,53 @@
	1	+## A session store for the API. It can store
	2	+## generic data on the Rails Cache to simulate
	3	+## a stateful session for API methods
	4	+class Noosfero::API::SessionStore
	5	+
	6	+ ## A generic data value to allow storing any
	7	+ ## value within this SessionStore
	8	+ attr_accessor :data
	9	+ ## The user private_token associated with this SessionStore
	10	+ attr_reader :private_token
	11	+ ## The key for this SessionStore in the Rails Cache
	12	+ attr_reader :key
	13	+
	14	+ ## Call this method to create and store a SessionStore
	15	+ ## in Rails Cache. The SessionStore is returned. The
	16	+ ## client_key parameter, if used, will uniquely identify
	17	+ ## this SessionStore in Rails Cache, along with the user
	18	+ ## private_token in the form: client_key#private_token
	19	+ def self.create(client_key = nil)
	20	+ private_token = SecureRandom.hex
	21	+ store = Noosfero::API::SessionStore.new(client_key, private_token)
	22	+ Rails.cache.write(store.key, store, expires_in: 300)
	23	+ return store
	24	+ end
	25	+
	26	+ ## Creates a new SessionStore. Do not use directly in cliente code.
	27	+ ## Please use the self.create method instead
	28	+ def initialize(client_key, private_token)
	29	+ ## Creates the key to store this object in Rails Cache
	30	+ key = "#{client_key}#" if client_key
	31	+ key = "#{key}#{private_token}"
	32	+ @key = key
	33	+ @private_token = private_token
	34	+ end
	35	+
	36	+ ## Returns the SessionStore in Rails Cache associated
	37	+ ## with the given key
	38	+ def self.get(key)
	39	+ Rails.cache.fetch(key)
	40	+ end
	41	+
	42	+ ## Stores this SessionStore in Rails Cache using the
	43	+ ## key attribute as the unique identifier
	44	+ def store
	45	+ Rails.cache.write(@key, self)
	46	+ end
	47	+
	48	+ ## Remove this session store from Rails Cache
	49	+ def destroy
	50	+ Rails.cache.delete(@key)
	51	+ end
	52	+
	53	+end
	@@ -127,6 +127,37 @@ class ArticlesTest < ActiveSupport::TestCase		@@ -127,6 +127,37 @@ class ArticlesTest < ActiveSupport::TestCase
127	assert_equal 1, json['total_followers']	127	assert_equal 1, json['total_followers']
128	end	128	end
129		129
		130	+ should 'not perform a vote twice in same article' do
		131	+ article = fast_create(Article, :profile_id => @person.id, :name => "Some thing")
		132	+ @params[:value] = 1
		133	+ ## Perform a vote twice in API should compute only one vote
		134	+ post "/api/v1/articles/#{article.id}/vote?#{params.to_query}"
		135	+ json = JSON.parse(last_response.body)
		136	+
		137	+ post "/api/v1/articles/#{article.id}/vote?#{params.to_query}"
		138	+ json = JSON.parse(last_response.body)
		139	+
		140	+ total = article.votes_total
		141	+
		142	+ assert_equal 1, total
		143	+ end
		144	+
		145	+ should 'not perform a vote in favor and against a proposal' do
		146	+ article = fast_create(Article, :profile_id => @person.id, :name => "Some thing")
		147	+ @params[:value] = 1
		148	+ ## Perform a vote in favor a proposal
		149	+ post "/api/v1/articles/#{article.id}/vote?#{params.to_query}"
		150	+ json = JSON.parse(last_response.body)
		151	+ assert_equal 201, last_response.status
		152	+ ## Perform a vote against a proposal
		153	+ @params[:value] = -1
		154	+ post "/api/v1/articles/#{article.id}/vote?#{params.to_query}"
		155	+ json = JSON.parse(last_response.body)
		156	+ ## The api should not allow to save this vote
		157	+ assert_equal 400, last_response.status
		158	+ end
		159	+
		160	+
130	should 'perform a vote in a article identified by id' do	161	should 'perform a vote in a article identified by id' do
131	article = fast_create(Article, :profile_id => @person.id, :name => "Some thing")	162	article = fast_create(Article, :profile_id => @person.id, :name => "Some thing")
132	@params[:value] = 1	163	@params[:value] = 1
	@@ -136,6 +167,7 @@ class ArticlesTest < ActiveSupport::TestCase		@@ -136,6 +167,7 @@ class ArticlesTest < ActiveSupport::TestCase
136		167
137	assert_not_equal 401, last_response.status	168	assert_not_equal 401, last_response.status
138	assert_equal true, json['vote']	169	assert_equal true, json['vote']
		170	+
139	end	171	end
140		172
141	should 'not perform a vote in a archived article' do	173	should 'not perform a vote in a archived article' do
	@@ -47,6 +47,26 @@ class LoginCaptchaTest < ActiveSupport::TestCase		@@ -47,6 +47,26 @@ class LoginCaptchaTest < ActiveSupport::TestCase
47	assert_equal true, json['vote']	47	assert_equal true, json['vote']
48	end	48	end
49		49
		50	+ should 'not perform a vote twice in same article' do
		51	+ login_with_captcha
		52	+ article = create_article('Article 1')
		53	+ params[:value] = 1
		54	+
		55	+ ## Perform a vote twice in API should compute only one vote
		56	+ post "/api/v1/articles/#{article.id}/vote?#{params.to_query}"
		57	+ json = JSON.parse(last_response.body)
		58	+ assert_equal true, json['vote']
		59	+
		60	+ post "/api/v1/articles/#{article.id}/vote?#{params.to_query}"
		61	+ json = JSON.parse(last_response.body)
		62	+ ## Should not allow vote again
		63	+ assert_equal false, json['vote']
		64	+
		65	+ total = article.votes_total
		66	+
		67	+ assert_equal 1, total
		68	+ end
		69	+
50	should 'not follow any article' do	70	should 'not follow any article' do
51	login_with_captcha	71	login_with_captcha
52	article = create_article('Article 1')	72	article = create_article('Article 1')
	@@ -0,0 +1,47 @@		@@ -0,0 +1,47 @@
		1	+require File.dirname(__FILE__) + '/test_helper'
		2	+
		3	+class SessionStoreTest < ActiveSupport::TestCase
		4	+
		5	+ should 'create a session store without client key' do
		6	+ store = Noosfero::API::SessionStore.create
		7	+ assert_not_nil store
		8	+ private_token = store.private_token
		9	+ assert_not_nil private_token
		10	+ key = store.key
		11	+ assert_not_nil key
		12	+ assert_equal key, private_token
		13	+ end
		14	+
		15	+ should 'create a session store with client key' do
		16	+ store = Noosfero::API::SessionStore.create("mykey")
		17	+ assert_not_nil store
		18	+ private_token = store.private_token
		19	+ assert_not_nil private_token
		20	+ key = store.key
		21	+ assert_not_nil key
		22	+ assert_equal key, "mykey##{private_token}"
		23	+ end
		24	+
		25	+ should 'get a session store with client key' do
		26	+ store = Noosfero::API::SessionStore.create("mykey")
		27	+ retrieved = Noosfero::API::SessionStore.get(store.key)
		28	+ assert_not_nil retrieved
		29	+ end
		30	+
		31	+ should 'not get a destroyed session store with client key' do
		32	+ store = Noosfero::API::SessionStore.create("mykey")
		33	+ store.destroy
		34	+ retrieved = Noosfero::API::SessionStore.get(store.key)
		35	+ assert_nil retrieved
		36	+ end
		37	+
		38	+ should 'store data in session store' do
		39	+ store = Noosfero::API::SessionStore.create("mykey")
		40	+ store.data = [1, 2]
		41	+ ## Put it back in cache
		42	+ store.store
		43	+ retrieved = Noosfero::API::SessionStore.get(store.key)
		44	+ assert_equal [1,2], retrieved.data
		45	+ end
		46	+
		47	+end
0	\ No newline at end of file	48	\ No newline at end of file