diff --git a/lib/noosfero/api/v1/profiles.rb b/lib/noosfero/api/v1/profiles.rb index 84c82bb..535c11d 100644 --- a/lib/noosfero/api/v1/profiles.rb +++ b/lib/noosfero/api/v1/profiles.rb @@ -19,6 +19,19 @@ module Noosfero profile = profiles.find_by id: params[:id] present profile, :with => Entities::Profile, :current_person => current_person end + + delete ':id' do + profiles = environment.profiles + profile = profiles.find_by id: params[:id] + + not_found! if profile.blank? + + if current_person.has_permission?(:destroy_profile, profile) + profile.destroy + else + forbidden! + end + end end end end diff --git a/test/api/profiles_test.rb b/test/api/profiles_test.rb index c58bc14..3d8c7e7 100644 --- a/test/api/profiles_test.rb +++ b/test/api/profiles_test.rb @@ -29,4 +29,52 @@ class ProfilesTest < ActiveSupport::TestCase json = JSON.parse(last_response.body) assert_equal community.id, json['id'] end + + group_kinds = %w(community enterprise) + group_kinds.each do |kind| + should "delete #{kind} from profile id with permission" do + profile = fast_create(kind.camelcase.constantize, :environment_id => environment.id) + give_permission(@person, 'destroy_profile', profile) + assert_not_nil Profile.find_by_id profile.id + + delete "/api/v1/profiles/#{profile.id}?#{params.to_query}" + + assert_equal 200, last_response.status + assert_nil Profile.find_by_id profile.id + end + + should "not delete #{kind} from profile id without permission" do + profile = fast_create(kind.camelcase.constantize, :environment_id => environment.id) + assert_not_nil Profile.find_by_id profile.id + + delete "/api/v1/profiles/#{profile.id}?#{params.to_query}" + + assert_equal 403, last_response.status + assert_not_nil Profile.find_by_id profile.id + end + end + + should 'person delete itself' do + delete "/api/v1/profiles/#{@person.id}?#{params.to_query}" + assert_equal 200, last_response.status + assert_nil Profile.find_by_id @person.id + end + + should 'only admin delete other people' do + profile = fast_create(Person, :environment_id => environment.id) + assert_not_nil Profile.find_by_id profile.id + + delete "/api/v1/profiles/#{profile.id}?#{params.to_query}" + + assert_equal 403, last_response.status + assert_not_nil Profile.find_by_id profile.id + + environment.add_admin(@person) + + delete "/api/v1/profiles/#{profile.id}?#{params.to_query}" + + assert_equal 200, last_response.status + assert_nil Profile.find_by_id profile.id + + end end -- libgit2 0.21.2