Download as
Browse Code »

Commit da0f17cbcc4409a54f483cda3017b8df3ab8a21f

Authored by Victor Costa
1 parent 6761d8c0
Exists in ratings_minor_fixes and in 3 other branches fix_sign_up_form, organization_ratings_improvements, profile_api_improvements

api: do not list forbidden blocks in boxes endpoint

Showing 2 changed files with 25 additions and 1 deletions   Show diff stats
app/api/entities.rb
  Diff comments   View file @da0f17c
@@ -93,7 +93,9 @@ module Api @@ -93,7 +93,9 @@ module Api
93 class Box < Entity 93 class Box < Entity
94 root 'boxes', 'box' 94 root 'boxes', 'box'
95 expose :id, :position 95 expose :id, :position
96 - expose :blocks, :using => Block 96 + expose :blocks, :using => Block do |box, options|
  97 + box.blocks.select {|block| block.visible_to_user?(options[:current_person]) }
  98 + end
97 end 99 end
98 100
99 class Profile < Entity 101 class Profile < Entity
test/api/boxes_test.rb
  Diff comments   View file @da0f17c
@@ -47,4 +47,26 @@ class BoxesTest &lt; ActiveSupport::TestCase @@ -47,4 +47,26 @@ class BoxesTest &lt; ActiveSupport::TestCase
47 json = JSON.parse(last_response.body) 47 json = JSON.parse(last_response.body)
48 assert !json["boxes"].first["blocks"].first.key?('api_content') 48 assert !json["boxes"].first["blocks"].first.key?('api_content')
49 end 49 end
  50 +
  51 + should 'get blocks from boxes' do
  52 + Environment.delete_all
  53 + environment = fast_create(Environment, :is_default => true)
  54 + box = fast_create(Box, :owner_id => environment.id, :owner_type => 'Environment')
  55 + block = fast_create(Block, box_id: box.id)
  56 + get "/api/v1/environments/default/boxes?#{params.to_query}"
  57 + json = JSON.parse(last_response.body)
  58 + assert_equal [block.id], json["boxes"].first["blocks"].map {|b| b['id']}
  59 + end
  60 +
  61 + should 'not list a block for not logged users' do
  62 + logout_api
  63 + profile = fast_create(Profile)
  64 + box = fast_create(Box, :owner_id => profile.id, :owner_type => Profile.name)
  65 + block = fast_create(Block, box_id: box.id)
  66 + block.display = 'never'
  67 + block.save!
  68 + get "/api/v1/profiles/#{profile.id}/boxes?#{params.to_query}"
  69 + json = JSON.parse(last_response.body)
  70 + assert_equal [], json["boxes"].first["blocks"].map {|b| b['id']}
  71 + end
50 end 72 end