From 47121fa70daa72ddb9bd4979bbef69b42b190d3f Mon Sep 17 00:00:00 2001 From: TheHollidayInn Date: Thu, 7 May 2015 15:59:21 -0500 Subject: [PATCH] Update tests to use get url, added not member tests, and updated logic to prevent users from being added to public guilds --- test/api.mocha.coffee | 229 +++++++++++++++++++++--------- website/src/controllers/groups.js | 6 +- 2 files changed, 166 insertions(+), 69 deletions(-) diff --git a/test/api.mocha.coffee b/test/api.mocha.coffee index 8acbdc303b..a760fa5a07 100644 --- a/test/api.mocha.coffee +++ b/test/api.mocha.coffee @@ -284,79 +284,110 @@ describe "API", -> , (err, _user) -> done() - it "includes user in private group member list when user is a member", (done) -> + describe "Private Guilds", -> guild = undefined - request.post(baseURL + "/groups").send( - name: "TestPrivateGroup" - type: "guild" - privacy: "private" - ).end (res) -> - expectCode res, 200 - guild = res.body - expect(guild.members.length).to.be 1 - expect(guild.leader).to.be user._id - #Add members to guild - async.waterfall [ - (cb) -> - registerManyUsers 15, cb + before (done) -> + request.post(baseURL + "/groups").send( + name: "TestPrivateGroup" + type: "guild" + privacy: "private" + ).end (res) -> + expectCode res, 200 + guild = res.body + expect(guild.members.length).to.be 1 + expect(guild.leader).to.be user._id + #Add members to guild + async.waterfall [ + (cb) -> + registerManyUsers 15, cb - (_members, cb) -> - members = _members + (_members, cb) -> + members = _members - joinGuild = (member, callback) -> - request.post(baseURL + "/groups/" + guild._id + "/join") - .set("X-API-User", member._id) - .set("X-API-Key", member.apiToken) - .end -> - callback(null, null) + joinGuild = (member, callback) -> + request.post(baseURL + "/groups/" + guild._id + "/join") + .set("X-API-User", member._id) + .set("X-API-Key", member.apiToken) + .end -> + callback(null, null) - async.map members, joinGuild, (err, results) -> cb() + async.map members, joinGuild, (err, results) -> cb() - (cb) -> - #Verfiy that when a user query's for a group they are in the group if they are a member - Group.findById guild._id, (err, g) -> - expect(g.members.length).to.be 16 - userInGroup = _.find group.members, (member) -> return member._id == user._id - expect(userInGroup).to.not.be undefined - cb() - ], done + ], done - it "includes user in public group member list when user is a member", (done) -> + it "includes user in private group member list when user is a member", (done) -> + #Verfiy that when a user query's for a group they are in the group if they are a member + request.get(baseURL + "/groups/" + guild._id) + .send() + .end (res) -> + g = res.body + userInGroup = _.find g.members, (member) -> return member._id == user._id + expect(userInGroup).to.not.be undefined + done() + + it "excludes user from viewing private group member list when user is not a member", (done) -> + #Remove user from group + request.post(baseURL + "/groups/" + guild._id + "/leave").send( + ).end (res) -> + request.get(baseURL + "/groups/" + guild._id) + .send() + .end (res) -> + expect res, 404 + done() + + describe "Public Guilds", -> guild = undefined - request.post(baseURL + "/groups").send( - name: "TestPublicGroup" - type: "guild" - privacy: "public" - ).end (res) -> - expectCode res, 200 - guild = res.body - expect(guild.members.length).to.be 1 - expect(guild.leader).to.be user._id - #Add members to guild - async.waterfall [ - (cb) -> - registerManyUsers 15, cb + before (done) -> + request.post(baseURL + "/groups").send( + name: "TestPublicGroup" + type: "guild" + privacy: "public" + ).end (res) -> + expectCode res, 200 + guild = res.body + expect(guild.members.length).to.be 1 + expect(guild.leader).to.be user._id + #Add members to guild + async.waterfall [ + (cb) -> + registerManyUsers 15, cb - (_members, cb) -> - members = _members + (_members, cb) -> + members = _members - joinGuild = (member, callback) -> - request.post(baseURL + "/groups/" + guild._id + "/join") - .set("X-API-User", member._id) - .set("X-API-Key", member.apiToken) - .end -> - callback(null, null) + joinGuild = (member, callback) -> + request.post(baseURL + "/groups/" + guild._id + "/join") + .set("X-API-User", member._id) + .set("X-API-Key", member.apiToken) + .end -> + callback(null, null) - async.map members, joinGuild, (err, results) -> cb() + async.map members, joinGuild, (err, results) -> cb() + ], done - (cb) -> - #Verfiy that when a user query's for a group they are in the group if they are a member - Group.findById guild._id, (err, g) -> - expect(g.members.length).to.be 16 - userInGroup = _.find group.members, (member) -> return member._id == user._id - expect(userInGroup).to.not.be undefined - cb() - ], done + it "includes user in public group member list when user is a member", (done) -> + #Verfiy that when a user query's for a group they are in the group if they are a member + request.get(baseURL + "/groups/" + guild._id).send( + ).end (res) -> + g = res.body; + expect(g.members.length).to.be 15 + userInGroup = _.find g.members, (member) -> return member._id == user._id + expect(userInGroup).to.not.be undefined + done() + + + it "excludes user in public group member list when user is not a member", (done) -> + #Remove user from group + request.post(baseURL + "/groups/" + guild._id + "/leave").send( + ).end (res) -> + #Verfiy that when a user query's for a group they are in the group if they are a member + request.get(baseURL + "/groups/" + guild._id).send( + ).end (res) -> + g = res.body + expect(g.members.length).to.be 15 + userInGroup = _.find g.members, (member) -> return member._id == user._id + expect(userInGroup).to.be undefined + done() describe "Party", -> it "can be found by querying for party", (done) -> @@ -364,7 +395,6 @@ describe "API", -> type: "party" ).end (res) -> expectCode res, 200 - party = res.body[0] expect(party._id).to.be group._id expect(party.leader).to.be user._id @@ -412,8 +442,11 @@ describe "API", -> # Make sure the invites stuck (result, cb) -> - Group.findById group._id, (err, g) -> - userInGroup = _.find group.members, (member) -> return member._id == user._id + request.get(baseURL + "/groups/" + group._id) + .send() + .end (res) -> + g = res.body + userInGroup = _.find g.members, (member) -> return member._id == user._id expect(userInGroup).to.not.be undefined cb() @@ -431,6 +464,72 @@ describe "API", -> ], done + it "excludes user in a party member list when user is not a member", (done) -> + party = [] + + #Invite some members + async.waterfall [ + + # Register new users + (cb) -> + registerManyUsers 15, cb + + # Send them invitations + (_party, cb) -> + party = _party + + joinParty = (member, callback) -> + request.post(baseURL + "/groups/" + group._id + "/join") + .set("X-API-User", member._id) + .set("X-API-Key", member.apiToken) + .end -> + callback(null, null) + + async.map party, joinParty, (err, results) -> cb() + + # Accept / Reject + (cb) -> + # series since they'll be modifying the same group record + series = _.reduce(party, (m, v, i) -> + m.push (cb2) -> + request.post(baseURL + "/groups/" + group._id + "/join") + .set("X-API-User", party[i]._id) + .set("X-API-Key", party[i].apiToken) + .end -> + cb2() + m + , []) + async.series series, cb + + (result, cb) -> + #Remove a user from group + request.post(baseURL + "/groups/" + group._id + "/leave") + .set("X-API-User", party[0]._id) + .set("X-API-Key", party[0].apiToken) + .send() + .end (res) -> + request.get(baseURL + "/groups/" + group._id) + .set("X-API-User", party[0]._id) + .set("X-API-Key", party[0].apiToken) + .send() + .end (res) -> + expect res, 404 + cb() + + # Remove all previous members + (cb) -> + + joinParty = (member, callback) -> + request.post(baseURL + "/groups/" + group._id + "/leave") + .set("X-API-User", member._id) + .set("X-API-Key", member.apiToken) + .end -> + callback(null, null) + + async.map party, joinParty, (err, results) -> cb() + + ], done + describe "Chat", -> chat = undefined it "Posts a message to party chat", (done) -> diff --git a/website/src/controllers/groups.js b/website/src/controllers/groups.js index fdc6ee2d3a..f6cb6ca06b 100644 --- a/website/src/controllers/groups.js +++ b/website/src/controllers/groups.js @@ -137,21 +137,19 @@ api.get = function(req, res, next) { q.exec(function(err, group){ if (err) return next(err); if (!group && gid!=='party') return res.json(404,{err: "Group not found or you don't have access."}); - //Since we have a limit on how many members are populate to the group, we want to make sure the user is always in the group var userInGroup = _.find(group.members, function(member){ return member._id == user._id; }); - //If the group is private or the group is a party, then the user must be a member of the group based on access restrictions above if (group.privacy === 'private' || gid === 'party') { //If the user is not in the group query, add them - if (userInGroup === undefined) { group.members.push(user); } + if (!userInGroup) { group.members.push(user); } res.json(group); } else if ( group.privacy === "public" ) { //The group is public, we must do an extra check to see if the user is already in the group query //We must see how to check if a user is a member of a public group, so we requery var q2 = Group.findOne({ _id: group._id, privacy:'public', members: {$in:[user._id]} }); q2.exec(function(err, group2){ if (err) return next(err); - if (!group2 && userInGroup === undefined) { group.members.push(user); } + if (group2 && !userInGroup) { group.members.push(user); } res.json(group); }); }