Update tests to use get url, added not member tests, and updated logic to prevent users from being added to public guilds

test/api.mocha.coffee

@@ -284,8 +284,9 @@ describe "API", ->
             , (err, _user) ->
               done()
 
-        it "includes user in private group member list when user is a member", (done) ->
+        describe "Private Guilds", ->
           guild = undefined
+          before (done) ->
             request.post(baseURL + "/groups").send(
               name: "TestPrivateGroup"
               type: "guild"
@@ -312,17 +313,31 @@ describe "API", ->
 
                   async.map members, joinGuild, (err, results) -> cb()
 
-              (cb) ->
-                #Verfiy that when a user query's for a group they are in the group if they are a member
-                Group.findById guild._id, (err, g) ->
-                  expect(g.members.length).to.be 16
-                  userInGroup = _.find group.members, (member) -> return member._id == user._id
-                  expect(userInGroup).to.not.be undefined
-                  cb()
               ], done
 
-        it "includes user in public group member list when user is a member", (done) ->
+          it "includes user in private group member list when user is a member", (done) ->
+            #Verfiy that when a user query's for a group they are in the group if they are a member
+            request.get(baseURL + "/groups/" + guild._id)
+            .send()
+            .end (res) ->
+              g = res.body
+              userInGroup = _.find g.members, (member) -> return member._id == user._id
+              expect(userInGroup).to.not.be undefined
+              done()
+
+          it "excludes user from viewing private group member list when user is not a member", (done) ->
+            #Remove user from group
+            request.post(baseURL + "/groups/" + guild._id + "/leave").send(
+            ).end (res) ->
+              request.get(baseURL + "/groups/" + guild._id)
+              .send()
+              .end (res) ->
+                expect res, 404
+                done()
+
+        describe "Public Guilds", ->
           guild = undefined
+          before (done) ->
             request.post(baseURL + "/groups").send(
               name: "TestPublicGroup"
               type: "guild"
@@ -348,23 +363,38 @@ describe "API", ->
                         callback(null, null)
 
                   async.map members, joinGuild, (err, results) -> cb()
-
-              (cb) ->
-                #Verfiy that when a user query's for a group they are in the group if they are a member
-                Group.findById guild._id, (err, g) ->
-                  expect(g.members.length).to.be 16
-                  userInGroup = _.find group.members, (member) -> return member._id == user._id
-                  expect(userInGroup).to.not.be undefined
-                  cb()
               ], done
 
+          it "includes user in public group member list when user is a member", (done) ->
+            #Verfiy that when a user query's for a group they are in the group if they are a member
+            request.get(baseURL + "/groups/" + guild._id).send(
+            ).end (res) ->
+              g = res.body;
+              expect(g.members.length).to.be 15
+              userInGroup = _.find g.members, (member) -> return member._id == user._id
+              expect(userInGroup).to.not.be undefined
+              done()
+
+
+          it "excludes user in public group member list when user is not a member", (done) ->
+            #Remove user from group
+            request.post(baseURL + "/groups/" + guild._id + "/leave").send(
+            ).end (res) ->
+              #Verfiy that when a user query's for a group they are in the group if they are a member
+              request.get(baseURL + "/groups/" + guild._id).send(
+              ).end (res) ->
+                g = res.body
+                expect(g.members.length).to.be 15
+                userInGroup = _.find g.members, (member) -> return member._id == user._id
+                expect(userInGroup).to.be undefined
+                done()
+
       describe "Party", ->
         it "can be found by querying for party", (done) ->
           request.get(baseURL + "/groups/").send(
             type: "party"
           ).end (res) ->
             expectCode res, 200
-
             party = res.body[0]
             expect(party._id).to.be group._id
             expect(party.leader).to.be user._id
@@ -412,8 +442,11 @@ describe "API", ->
 
             # Make sure the invites stuck
             (result, cb) ->
-              Group.findById group._id, (err, g) ->
+              request.get(baseURL + "/groups/" + group._id)
-                userInGroup = _.find group.members, (member) -> return member._id == user._id
+              .send()
+              .end (res) ->
+                g = res.body
+                userInGroup = _.find g.members, (member) -> return member._id == user._id
                 expect(userInGroup).to.not.be undefined
                 cb()
 
@@ -431,6 +464,72 @@ describe "API", ->
 
           ], done
 
+        it "excludes user in a party member list when user is not a member", (done) ->
+          party = []
+
+          #Invite some members
+          async.waterfall [
+
+            # Register new users
+            (cb) ->
+              registerManyUsers 15, cb
+
+            # Send them invitations
+            (_party, cb) ->
+              party = _party
+
+              joinParty = (member, callback) ->
+                request.post(baseURL + "/groups/" + group._id + "/join")
+                  .set("X-API-User", member._id)
+                  .set("X-API-Key", member.apiToken)
+                  .end ->
+                    callback(null, null)
+
+              async.map party, joinParty, (err, results) -> cb()
+
+            # Accept / Reject
+            (cb) ->
+              # series since they'll be modifying the same group record
+              series = _.reduce(party, (m, v, i) ->
+                m.push (cb2) ->
+                  request.post(baseURL + "/groups/" + group._id + "/join")
+                    .set("X-API-User", party[i]._id)
+                    .set("X-API-Key", party[i].apiToken)
+                    .end ->
+                      cb2()
+                m
+              , [])
+              async.series series, cb
+
+            (result, cb) ->
+              #Remove a user from group
+              request.post(baseURL + "/groups/" + group._id + "/leave")
+              .set("X-API-User", party[0]._id)
+              .set("X-API-Key", party[0].apiToken)
+              .send()
+              .end (res) ->
+                request.get(baseURL + "/groups/" + group._id)
+                .set("X-API-User", party[0]._id)
+                .set("X-API-Key", party[0].apiToken)
+                .send()
+                .end (res) ->
+                  expect res, 404
+                  cb()
+
+            # Remove all previous members
+            (cb) ->
+
+              joinParty = (member, callback) ->
+                request.post(baseURL + "/groups/" + group._id + "/leave")
+                  .set("X-API-User", member._id)
+                  .set("X-API-Key", member.apiToken)
+                  .end ->
+                    callback(null, null)
+
+              async.map party, joinParty, (err, results) -> cb()
+
+          ], done
+
         describe "Chat", ->
           chat = undefined
           it "Posts a message to party chat", (done) ->

website/src/controllers/groups.js

@@ -137,21 +137,19 @@ api.get = function(req, res, next) {
   q.exec(function(err, group){
     if (err) return next(err);
     if (!group && gid!=='party') return res.json(404,{err: "Group not found or you don't have access."});
-
     //Since we have a limit on how many members are populate to the group, we want to make sure the user is always in the group
     var userInGroup = _.find(group.members, function(member){ return member._id == user._id; });
-
     //If the group is private or the group is a party, then the user must be a member of the group based on access restrictions above
     if (group.privacy === 'private' || gid === 'party') {
       //If the user is not in the group query, add them
-      if (userInGroup === undefined) { group.members.push(user); }
+      if (!userInGroup) { group.members.push(user); }
       res.json(group);
     } else if ( group.privacy === "public" ) { //The group is public, we must do an extra check to see if the user is already in the group query
       //We must see how to check if a user is a member of a public group, so we requery
       var q2 = Group.findOne({ _id: group._id, privacy:'public', members: {$in:[user._id]} });
       q2.exec(function(err, group2){
         if (err) return next(err);
-        if (!group2 && userInGroup === undefined) { group.members.push(user); }
+        if (group2 && !userInGroup) { group.members.push(user); }
         res.json(group);
       });
     }