sudoxreboot/habitica
1
0
Fork 0
mirror of https://github.com/sudoxnym/habitica.git synced 2026-08-03 08:21:07 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Update tests to use get url, added not member tests, and updated logic to prevent users from being added to public guilds

Browse source
This commit is contained in:
TheHollidayInn 2015-05-07 15:59:21 -05:00
parent bcb7b75380
commit 47121fa70d
2 changed files with 166 additions and 69 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

229
test/api.mocha.coffee
View file

@ -284,79 +284,110 @@ describe "API", ->
, (err, _user) ->
done()
it "includes user in private group member list when user is a member", (done) ->
describe "Private Guilds", ->
guild = undefined
request.post(baseURL + "/groups").send(
name: "TestPrivateGroup"
type: "guild"
privacy: "private"
).end (res) ->
expectCode res, 200
guild = res.body
expect(guild.members.length).to.be 1
expect(guild.leader).to.be user._id
#Add members to guild
async.waterfall [
(cb) ->
registerManyUsers 15, cb
before (done) ->
request.post(baseURL + "/groups").send(
name: "TestPrivateGroup"
type: "guild"
privacy: "private"
).end (res) ->
expectCode res, 200
guild = res.body
expect(guild.members.length).to.be 1
expect(guild.leader).to.be user._id
#Add members to guild
async.waterfall [
(cb) ->
registerManyUsers 15, cb
(_members, cb) ->
members = _members
(_members, cb) ->
members = _members
joinGuild = (member, callback) ->
request.post(baseURL + "/groups/" + guild._id + "/join")
.set("X-API-User", member._id)
.set("X-API-Key", member.apiToken)
.end ->
callback(null, null)
joinGuild = (member, callback) ->
request.post(baseURL + "/groups/" + guild._id + "/join")
.set("X-API-User", member._id)
.set("X-API-Key", member.apiToken)
.end ->
callback(null, null)
async.map members, joinGuild, (err, results) -> cb()
async.map members, joinGuild, (err, results) -> cb()
(cb) ->
#Verfiy that when a user query's for a group they are in the group if they are a member
Group.findById guild._id, (err, g) ->
expect(g.members.length).to.be 16
userInGroup = _.find group.members, (member) -> return member._id == user._id
expect(userInGroup).to.not.be undefined
cb()
], done
], done
it "includes user in public group member list when user is a member", (done) ->
it "includes user in private group member list when user is a member", (done) ->
#Verfiy that when a user query's for a group they are in the group if they are a member
request.get(baseURL + "/groups/" + guild._id)
.send()
.end (res) ->
g = res.body
userInGroup = _.find g.members, (member) -> return member._id == user._id
expect(userInGroup).to.not.be undefined
done()
it "excludes user from viewing private group member list when user is not a member", (done) ->
#Remove user from group
request.post(baseURL + "/groups/" + guild._id + "/leave").send(
).end (res) ->
request.get(baseURL + "/groups/" + guild._id)
.send()
.end (res) ->
expect res, 404
done()
describe "Public Guilds", ->
guild = undefined
request.post(baseURL + "/groups").send(
name: "TestPublicGroup"
type: "guild"
privacy: "public"
).end (res) ->
expectCode res, 200
guild = res.body
expect(guild.members.length).to.be 1
expect(guild.leader).to.be user._id
#Add members to guild
async.waterfall [
(cb) ->
registerManyUsers 15, cb
before (done) ->
request.post(baseURL + "/groups").send(
name: "TestPublicGroup"
type: "guild"
privacy: "public"
).end (res) ->
expectCode res, 200
guild = res.body
expect(guild.members.length).to.be 1
expect(guild.leader).to.be user._id
#Add members to guild
async.waterfall [
(cb) ->
registerManyUsers 15, cb
(_members, cb) ->
members = _members
(_members, cb) ->
members = _members
joinGuild = (member, callback) ->
request.post(baseURL + "/groups/" + guild._id + "/join")
.set("X-API-User", member._id)
.set("X-API-Key", member.apiToken)
.end ->
callback(null, null)
joinGuild = (member, callback) ->
request.post(baseURL + "/groups/" + guild._id + "/join")
.set("X-API-User", member._id)
.set("X-API-Key", member.apiToken)
.end ->
callback(null, null)
async.map members, joinGuild, (err, results) -> cb()
async.map members, joinGuild, (err, results) -> cb()
], done
(cb) ->
#Verfiy that when a user query's for a group they are in the group if they are a member
Group.findById guild._id, (err, g) ->
expect(g.members.length).to.be 16
userInGroup = _.find group.members, (member) -> return member._id == user._id
expect(userInGroup).to.not.be undefined
cb()
], done
it "includes user in public group member list when user is a member", (done) ->
#Verfiy that when a user query's for a group they are in the group if they are a member
request.get(baseURL + "/groups/" + guild._id).send(
).end (res) ->
g = res.body;
expect(g.members.length).to.be 15
userInGroup = _.find g.members, (member) -> return member._id == user._id
expect(userInGroup).to.not.be undefined
done()
it "excludes user in public group member list when user is not a member", (done) ->
#Remove user from group
request.post(baseURL + "/groups/" + guild._id + "/leave").send(
).end (res) ->
#Verfiy that when a user query's for a group they are in the group if they are a member
request.get(baseURL + "/groups/" + guild._id).send(
).end (res) ->
g = res.body
expect(g.members.length).to.be 15
userInGroup = _.find g.members, (member) -> return member._id == user._id
expect(userInGroup).to.be undefined
done()
describe "Party", ->
it "can be found by querying for party", (done) ->
@ -364,7 +395,6 @@ describe "API", ->
type: "party"
).end (res) ->
expectCode res, 200
party = res.body[0]
expect(party._id).to.be group._id
expect(party.leader).to.be user._id
@ -412,8 +442,11 @@ describe "API", ->
# Make sure the invites stuck
(result, cb) ->
Group.findById group._id, (err, g) ->
userInGroup = _.find group.members, (member) -> return member._id == user._id
request.get(baseURL + "/groups/" + group._id)
.send()
.end (res) ->
g = res.body
userInGroup = _.find g.members, (member) -> return member._id == user._id
expect(userInGroup).to.not.be undefined
cb()
@ -431,6 +464,72 @@ describe "API", ->
], done
it "excludes user in a party member list when user is not a member", (done) ->
party = []
#Invite some members
async.waterfall [
# Register new users
(cb) ->
registerManyUsers 15, cb
# Send them invitations
(_party, cb) ->
party = _party
joinParty = (member, callback) ->
request.post(baseURL + "/groups/" + group._id + "/join")
.set("X-API-User", member._id)
.set("X-API-Key", member.apiToken)
.end ->
callback(null, null)
async.map party, joinParty, (err, results) -> cb()
# Accept / Reject
(cb) ->
# series since they'll be modifying the same group record
series = _.reduce(party, (m, v, i) ->
m.push (cb2) ->
request.post(baseURL + "/groups/" + group._id + "/join")
.set("X-API-User", party[i]._id)
.set("X-API-Key", party[i].apiToken)
.end ->
cb2()
m
, [])
async.series series, cb
(result, cb) ->
#Remove a user from group
request.post(baseURL + "/groups/" + group._id + "/leave")
.set("X-API-User", party[0]._id)
.set("X-API-Key", party[0].apiToken)
.send()
.end (res) ->
request.get(baseURL + "/groups/" + group._id)
.set("X-API-User", party[0]._id)
.set("X-API-Key", party[0].apiToken)
.send()
.end (res) ->
expect res, 404
cb()
# Remove all previous members
(cb) ->
joinParty = (member, callback) ->
request.post(baseURL + "/groups/" + group._id + "/leave")
.set("X-API-User", member._id)
.set("X-API-Key", member.apiToken)
.end ->
callback(null, null)
async.map party, joinParty, (err, results) -> cb()
], done
describe "Chat", ->
chat = undefined
it "Posts a message to party chat", (done) ->

6
website/src/controllers/groups.js
View file

@ -137,21 +137,19 @@ api.get = function(req, res, next) {
q.exec(function(err, group){
if (err) return next(err);
if (!group && gid!=='party') return res.json(404,{err: "Group not found or you don't have access."});
//Since we have a limit on how many members are populate to the group, we want to make sure the user is always in the group
var userInGroup = _.find(group.members, function(member){ return member._id == user._id; });
//If the group is private or the group is a party, then the user must be a member of the group based on access restrictions above
if (group.privacy === 'private' || gid === 'party') {
//If the user is not in the group query, add them
if (userInGroup === undefined) { group.members.push(user); }
if (!userInGroup) { group.members.push(user); }
res.json(group);
} else if ( group.privacy === "public" ) { //The group is public, we must do an extra check to see if the user is already in the group query
//We must see how to check if a user is a member of a public group, so we requery
var q2 = Group.findOne({ _id: group._id, privacy:'public', members: {$in:[user._id]} });
q2.exec(function(err, group2){
if (err) return next(err);
if (!group2 && userInGroup === undefined) { group.members.push(user); }
if (group2 && !userInGroup) { group.members.push(user); }
res.json(group);
});
}