api: add endpoint to return blocks

Victor Costa
1 parent b4b7ad92
Showing 4 changed files with 89 additions and 0 deletions Show diff stats
lib/noosfero/api/api.rb
lib/noosfero/api/v1/blocks.rb
test/api/blocks_test.rb
test/api/test_helper.rb
@@ -53,6 +53,7 @@ module Noosfero
       mount V1::Search
       mount V1::Contacts
       mount V1::Boxes
+      mount V1::Blocks
       mount V1::Profiles
       mount V1::Activities
  
@@ -0,0 +1,19 @@
+module Noosfero
+  module API
+    module V1
+
+      class Blocks < Grape::API
+        resource :blocks do
+          get ':id' do
+            block = Block.find(params["id"])
+            if block.owner.kind_of?(Profile)
+              return forbidden! unless block.owner.display_info_to?(current_person)
+            end
+            present block, :with => Entities::Block
+          end
+        end
+      end
+
+    end
+  end
+end
@@ -0,0 +1,65 @@
+require_relative 'test_helper'
+
+class BlocksTest < ActiveSupport::TestCase
+
+  def setup
+    create_and_activate_user
+    login_api
+    @environment = Environment.default
+    @profile = fast_create(Profile)
+  end
+
+  attr_accessor :environment, :profile
+
+  should 'get an environment block' do
+    box = fast_create(Box, :owner_id => environment.id, :owner_type => Environment.name)
+    block = fast_create(Block, box_id: box.id)
+    get "/api/v1/blocks/#{block.id}?#{params.to_query}"
+    json = JSON.parse(last_response.body)
+    assert_equal block.id, json["block"]["id"]
+  end
+
+  should 'get a profile block' do
+    box = fast_create(Box, :owner_id => profile.id, :owner_type => Profile.name)
+    block = fast_create(Block, box_id: box.id)
+    get "/api/v1/blocks/#{block.id}?#{params.to_query}"
+    json = JSON.parse(last_response.body)
+    assert_equal block.id, json["block"]["id"]
+  end
+
+  should 'get a profile block for a not logged in user' do
+    logout_api
+    box = fast_create(Box, :owner_id => profile.id, :owner_type => Profile.name)
+    block = fast_create(Block, box_id: box.id)
+    get "/api/v1/blocks/#{block.id}?#{params.to_query}"
+    json = JSON.parse(last_response.body)
+    assert_equal block.id, json["block"]["id"]
+  end
+
+  should 'not get a profile block for a not logged in user' do
+    logout_api
+    profile = fast_create(Profile, public_profile: false)
+    box = fast_create(Box, :owner_id => profile.id, :owner_type => Profile.name)
+    block = fast_create(Block, box_id: box.id)
+    get "/api/v1/blocks/#{block.id}?#{params.to_query}"
+    assert_equal 403, last_response.status
+  end
+
+  should 'not get a profile block for an user without permission' do
+    profile = fast_create(Profile, public_profile: false)
+    box = fast_create(Box, :owner_id => profile.id, :owner_type => Profile.name)
+    block = fast_create(Block, box_id: box.id)
+    get "/api/v1/blocks/#{block.id}?#{params.to_query}"
+    assert_equal 403, last_response.status
+  end
+
+  should 'get a block for an user with permission in a private profile' do
+    profile = fast_create(Profile, public_profile: false)
+    profile.add_admin(person)
+    box = fast_create(Box, :owner_id => profile.id, :owner_type => Profile.name)
+    block = fast_create(Block, box_id: box.id)
+    get "/api/v1/blocks/#{block.id}?#{params.to_query}"
+    json = JSON.parse(last_response.body)
+    assert_equal block.id, json["block"]["id"]
+  end
+end
@@ -31,6 +31,10 @@ class ActiveSupport::TestCase
     @params[:private_token] = @private_token
   end
  
+  def logout_api
+    @params.delete(:private_token)
+  end
+
   attr_accessor :private_token, :user, :person, :params, :environment
  
   private
...	...	@@ -53,6 +53,7 @@ module Noosfero
53	53	mount V1::Search
54	54	mount V1::Contacts
55	55	mount V1::Boxes
	56	+ mount V1::Blocks
56	57	mount V1::Profiles
57	58	mount V1::Activities
58	59
...	...
...	...	@@ -0,0 +1,19 @@
	1	+module Noosfero
	2	+ module API
	3	+ module V1
	4	+
	5	+ class Blocks < Grape::API
	6	+ resource :blocks do
	7	+ get ':id' do
	8	+ block = Block.find(params["id"])
	9	+ if block.owner.kind_of?(Profile)
	10	+ return forbidden! unless block.owner.display_info_to?(current_person)
	11	+ end
	12	+ present block, :with => Entities::Block
	13	+ end
	14	+ end
	15	+ end
	16	+
	17	+ end
	18	+ end
	19	+end
...	...
...	...	@@ -0,0 +1,65 @@
	1	+require_relative 'test_helper'
	2	+
	3	+class BlocksTest < ActiveSupport::TestCase
	4	+
	5	+ def setup
	6	+ create_and_activate_user
	7	+ login_api
	8	+ @environment = Environment.default
	9	+ @profile = fast_create(Profile)
	10	+ end
	11	+
	12	+ attr_accessor :environment, :profile
	13	+
	14	+ should 'get an environment block' do
	15	+ box = fast_create(Box, :owner_id => environment.id, :owner_type => Environment.name)
	16	+ block = fast_create(Block, box_id: box.id)
	17	+ get "/api/v1/blocks/#{block.id}?#{params.to_query}"
	18	+ json = JSON.parse(last_response.body)
	19	+ assert_equal block.id, json["block"]["id"]
	20	+ end
	21	+
	22	+ should 'get a profile block' do
	23	+ box = fast_create(Box, :owner_id => profile.id, :owner_type => Profile.name)
	24	+ block = fast_create(Block, box_id: box.id)
	25	+ get "/api/v1/blocks/#{block.id}?#{params.to_query}"
	26	+ json = JSON.parse(last_response.body)
	27	+ assert_equal block.id, json["block"]["id"]
	28	+ end
	29	+
	30	+ should 'get a profile block for a not logged in user' do
	31	+ logout_api
	32	+ box = fast_create(Box, :owner_id => profile.id, :owner_type => Profile.name)
	33	+ block = fast_create(Block, box_id: box.id)
	34	+ get "/api/v1/blocks/#{block.id}?#{params.to_query}"
	35	+ json = JSON.parse(last_response.body)
	36	+ assert_equal block.id, json["block"]["id"]
	37	+ end
	38	+
	39	+ should 'not get a profile block for a not logged in user' do
	40	+ logout_api
	41	+ profile = fast_create(Profile, public_profile: false)
	42	+ box = fast_create(Box, :owner_id => profile.id, :owner_type => Profile.name)
	43	+ block = fast_create(Block, box_id: box.id)
	44	+ get "/api/v1/blocks/#{block.id}?#{params.to_query}"
	45	+ assert_equal 403, last_response.status
	46	+ end
	47	+
	48	+ should 'not get a profile block for an user without permission' do
	49	+ profile = fast_create(Profile, public_profile: false)
	50	+ box = fast_create(Box, :owner_id => profile.id, :owner_type => Profile.name)
	51	+ block = fast_create(Block, box_id: box.id)
	52	+ get "/api/v1/blocks/#{block.id}?#{params.to_query}"
	53	+ assert_equal 403, last_response.status
	54	+ end
	55	+
	56	+ should 'get a block for an user with permission in a private profile' do
	57	+ profile = fast_create(Profile, public_profile: false)
	58	+ profile.add_admin(person)
	59	+ box = fast_create(Box, :owner_id => profile.id, :owner_type => Profile.name)
	60	+ block = fast_create(Block, box_id: box.id)
	61	+ get "/api/v1/blocks/#{block.id}?#{params.to_query}"
	62	+ json = JSON.parse(last_response.body)
	63	+ assert_equal block.id, json["block"]["id"]
	64	+ end
	65	+end
...	...
...	...	@@ -31,6 +31,10 @@ class ActiveSupport::TestCase
31	31	@params[:private_token] = @private_token
32	32	end
33	33
	34	+ def logout_api
	35	+ @params.delete(:private_token)
	36	+ end
	37	+
34	38	attr_accessor :private_token, :user, :person, :params, :environment
35	39
36	40	private
...	...