Almost perfect

src/server/api.coffee

@@ -19,46 +19,57 @@ NO_USER_FOUND = err: "No user found."
   curl -X POST -H "Content-Type:application/json" -d '{"apiToken":"{TOKEN}"}' localhost:3000/v1/users/{UID}/tasks/productivity/up
 ###
 
+auth = (req, res, next) ->
+  express.basicAuth((uid, token, callback) ->
+    return res.json 500, NO_TOKEN_OR_UID unless uid || token
+
+    model = req.getModel()
+    query = model.query('users').withIdAndToken(uid, token)
+
+    query.fetch (err, user) ->
+      return callback err if err
+      callback null, user.at(0)
+  )(req, res, next)
+
 router.get '/status', (req, res) ->
-  res.json
-    status: 'up'
+  res.json status: 'up'
 
-router.get '/user', (req, res) ->
-  { uid, token } = req.query
-  return res.json 500, NO_TOKEN_OR_UID unless uid || token
+router.get '/user', auth, (req, res) ->
+  self = req.user.get()
+  return res.json 500, NO_USER_FOUND if !self || _.isEmpty(self)
 
-  model = req.getModel()
-  query = model.query('users').withIdAndToken(uid, token)
+  return res.json self
 
-  query.fetch (err, user) ->
-    return res.json 500, err: err if err
-    self = user.at(0).get()
-    return res.json 500, NO_USER_FOUND if !self || _.isEmpty(self)
-
-    return res.json self
-
-router.post '/user/task', (req, res) ->
-  { uid, token } = req.body
+router.post '/user/task', auth, (req, res) ->
   task = { title, text, type, value, note } = req.body
-  return res.json 500, NO_TOKEN_OR_UID unless uid || token
+  return res.json 500, err: "type must be habit, todo, daily, or reward" unless /habit|todo|daily|reward/.test type
+  return res.json 500, err: "must have a title" unless check(title).notEmpty()
+  return res.json 500, err: "must have text" unless check(text).notEmpty()
+
+  self = req.user.get()
+  return res.json 500, NO_USER_FOUND if !self || _.isEmpty(self)
+
+  value ||= 0
 
   model = req.getModel()
-  query = model.query('users').withIdAndToken(uid, token)
+  model.ref '_user', req.user
+  model.refList "_#{type}List", "_user.tasks", "_user.#{type}Ids"
+  model.at("_#{type}List").push task
 
-  query.fetch (err, user) ->
-    return res.json 500, err: err if err
-    self = user.at(0).get()
-    return res.json 500, NO_USER_FOUND if !self || _.isEmpty(self)
-    return res.json 500, err: "type must be habit, todo, daily, reward" unless /habit|todo|daily|reward/.test type
-    return res.json 500, err: "must have a title" unless check(title).notEmpty()
-    return res.json 500, err: "must have text" unless check(text).notEmpty()
-    value ||= 0
+  return res.json 201, task
 
-    model.ref '_user', user.at(0)
+router.get '/user/tasks', auth, (req, res) ->
+  self = req.user.get()
+  return res.json 500, NO_USER_FOUND if !self || _.isEmpty(self)
+
+  model = req.getModel()
+  model.ref '_user', req.user
+  tasks = []
+  for type in ['habit','todo','daily','reward']
     model.refList "_#{type}List", "_user.tasks", "_user.#{type}Ids"
-    model.push "_#{type}List", task
+    tasks = tasks.concat model.get("_#{type}List")
 
-    return res.json 201, task
+  return res.json 200, tasks
 
 router.get '/users/:uid/calendar.ics', (req, res) ->
   #return next() #disable for now

test/api.mocha.coffee

@@ -82,10 +82,6 @@ modificationsLookup = (direction, options = {}) ->
 ###### Specs ######
 
 describe 'API', ->
-  model = null
-  user = null
-  params = null
-
   describe 'Without token or user id', ->
 
     it '/api/v1/status', (done) ->
@@ -105,6 +101,11 @@ describe 'API', ->
           done()
 
   describe 'With token and user id', ->
+    params = null
+    currentUser = null
+    user = null
+    model = null
+
     before (done) ->
       model = store.createModel()
       #store.flush()
@@ -114,9 +115,7 @@ describe 'API', ->
       user.apiToken = derby.uuid()
       model.set "users.#{uid}", user
       user = model.at("users.#{uid}")
-      user.set 'tasks', {}
       currentUser = user.get()
-
       params =
         uid: currentUser.id
         token: currentUser.apiToken
@@ -125,33 +124,46 @@ describe 'API', ->
         type: 'habit'
       done()
 
-    ###
-    it '/api/v1/user', (done) ->
-      console.log "#{baseURL}/user?#{qs.stringify(params)}"
+    beforeEach ->
+      currentUser = user.get()
+
+    it 'GET /api/v1/user', (done) ->
       request.get("#{baseURL}/user")
         .set('Accept', 'application/json')
-        .query(params)
-        .on('error', (err) ->
-          console.log 'err', err
-        )
+        .auth(params.uid, params.token)
         .end (res) ->
-          assert.ok !res.body.err
-          assert.equal res.statusCode, 200
-          assert.ok res.body
-          console.log res.body
-         done()
-    ###
+          expect(res.body.err).to.be undefined
+          expect(res.statusCode).to.be 200
+          expect(res.body.id).not.to.be.empty()
+          expect(res.body).to.eql(currentUser)
+          done()
 
-    it '/api/v1/user/task', (done) ->
+    it 'POST /api/v1/user/task', (done) ->
       request.post("#{baseURL}/user/task")
         .set('Accept', 'application/json')
+        .auth(params.uid, params.token)
         .send(params)
         .end (res) ->
-          currentUser = user.get()
-          expect(currentUser).to.eql res.body
-          expect(res.body.err).to.be.empty()
+          expect(res.body.err).to.be undefined
           expect(res.statusCode).to.be 201
           expect(res.body.id).not.to.be.empty()
           # Ensure that user owns the newly created object
           #expect(currentUser.tasks[res.body.id]).to.be.an('object')
           done()
+
+    it 'GET /api/v1/user/tasks', (done) ->
+      request.get("#{baseURL}/user/tasks")
+        .set('Accept', 'application/json')
+        .auth(params.uid, params.token)
+        .end (res) ->
+          expect(res.body.err).to.be undefined
+          expect(res.statusCode).to.be 200
+          model.set '_user', user.get()
+          tasks = []
+          for type in ['habit','todo','daily','reward']
+            model.refList "_#{type}List", "_user.tasks", "_user.#{type}Ids"
+            tasks = tasks.concat model.get("_#{type}List")
+          # Ensure that user owns the tasks
+          console.log _.difference(_.pluck(res.body,'id'), _.pluck(tasks,'id'))
+          expect(res.body.length).to.equal tasks.length
+          done()