Merge pull request #171 from MITLibraries/128_roles

Hold Pages Spec and Topic Pick Pages Spec

app/controllers/Application.scala

@@ -960,30 +960,42 @@ object Application extends Controller with Security {
     }
   }
 
-  def holdBrowse(id: Int, page: Int) = Action { implicit request =>
+  def holdBrowse(id: Int, page: Int) = isAuthenticated { identity => implicit request =>
     Subscriber.findById(id).map( sub =>
-      Ok(views.html.hold.browse(sub.id, sub.holds(page), page, sub.holdCount))
+      ownsSubscriber(identity, sub,
+                    Ok(views.html.hold.browse(sub.id, sub.holds(page), page, sub.holdCount)))
     ).getOrElse(NotFound(views.html.static.trouble("No such subscriber: " + id)))
   }
 
-  def resolveHold(id: Int, accept: Boolean) = Action { implicit request =>
+  def resolveHold(id: Int, accept: Boolean) = isAuthenticated { identity => implicit request =>
     Hold.findById(id).map( hold => {
-      conveyor ! (hold, accept)
-      Redirect(routes.Application.holdBrowse(1, 0))
+      val sub = Subscriber.findById(hold.subscriberId).get
+      if (sub.userId == identity.id) {
+        conveyor ! (hold, accept)
+        Redirect(routes.Application.holdBrowse(sub.id, 0))
+      } else {
+        Unauthorized(views.html.static.trouble("You are not authorized"))
+      }
     }
     ).getOrElse(NotFound(views.html.static.trouble("No such hold: " + id)))
   }
 
-  def pickBrowse(id: Int, page: Int) = Action { implicit request =>
+  def pickBrowse(id: Int, page: Int) = isAuthenticated { identity => implicit request =>
     Subscriber.findById(id).map( sub =>
-      Ok(views.html.topic_pick.browse(sub.id, sub.picks(page), page, sub.pickCount))
+      ownsSubscriber(identity, sub,
+        Ok(views.html.topic_pick.browse(sub.id, sub.picks(page), page, sub.pickCount)))
     ).getOrElse(NotFound(views.html.static.trouble("No such subscriber: " + id)))
   }
 
-  def resolvePick(id: Int, accept: Boolean) = Action { implicit request =>
+  def resolvePick(id: Int, accept: Boolean) = isAuthenticated { identity => implicit request =>
     TopicPick.findById(id).map( pick => {
-      conveyor ! (pick, accept)
-      Redirect(routes.Application.pickBrowse(1, 0))
+      val sub = Subscriber.findById(pick.subscriberId).get
+      if (sub.userId == identity.id) {
+        conveyor ! (pick, accept)
+        Redirect(routes.Application.pickBrowse(sub.id, 0))
+      } else {
+        Unauthorized(views.html.static.trouble("You are not authorized"))
+      }
     }
     ).getOrElse(NotFound(views.html.static.trouble("No such topic pick: " + id)))
   }

test/integration/HoldPagesSpec.scala

@@ -0,0 +1,182 @@
+import org.specs2.mutable._
+import org.specs2.runner._
+
+import play.api.test._
+import play.api.test.Helpers._
+import org.fest.assertions.Assertions.assertThat
+import play.api.Application
+import play.api.Play
+import play.api.Play.current
+import models.{ Collection, ContentType, Hold, Item, Publisher, ResourceMap,
+                Scheme, User, Subscriber, Subscription, Topic }
+
+/**
+ * An integration test will fire up a whole play application in a real (or headless) browser
+ */
+class HoldPagesSpec extends Specification {
+
+  "Hold pages" should {
+    "as an unauthenticated User" should {
+
+      // GET /holds/browse?id=sub.id&page=x
+      "browse redirects to login" in new WithBrowser(
+        app = FakeApplication(additionalConfiguration = inMemoryDatabase())) {
+        val sub_user = User.make("sub_name", "sub@example.com", "role", "sub_identity")
+        val sub = Subscriber.make(sub_user.id, "Sub Name", "cat", "contact",
+                                  Some("link"), Some("logo"))
+        val scheme = Scheme.make("tag", "gentype", "cat", "desc", Some("link"), Some("logo"))
+        val t = Topic.make(scheme.id, "tag0", "name0")
+        val subscr = Subscription.make(sub.id, t.id, "deliver", sub.created, sub.created)
+        val pub = Publisher.make(sub_user.id, "pubtag", "pubname", "pubdesc", "pubcat", "pubstatus", Some(""), Some(""))
+        val ct = ContentType.make("cttag", "ctlabel", "ctdesc", Some(""))
+        val rmap = ResourceMap.make("rmaptag", "rmapdesc", Some(""))
+        var col = Collection.make(pub.id, ct.id, rmap.id, "coll", "desc", "open")
+        val item = Item.make(col.id, ct.id, "location", "scoap:abc:123")
+        Hold.create(sub.id, subscr.id, item.id)
+        browser.goTo("http://localhost:" + port + "/holds/browse?id=" + sub.id)
+        assertThat(browser.title()).isEqualTo("Login to SCOAP3 - TopicHub")
+      }
+
+      // GET /hold/:id/resolve?accept=Boolean
+      "resolve redirects to login" in new WithBrowser(
+        app = FakeApplication(additionalConfiguration = inMemoryDatabase())) {
+        val sub_user = User.make("sub_name", "sub@example.com", "role", "sub_identity")
+        val sub = Subscriber.make(sub_user.id, "Sub Name", "cat", "contact",
+                                  Some("link"), Some("logo"))
+        val scheme = Scheme.make("tag", "gentype", "cat", "desc", Some("link"), Some("logo"))
+        val t = Topic.make(scheme.id, "tag0", "name0")
+        val subscr = Subscription.make(sub.id, t.id, "deliver", sub.created, sub.created)
+        val pub = Publisher.make(sub_user.id, "pubtag", "pubname", "pubdesc", "pubcat", "pubstatus", Some(""), Some(""))
+        val ct = ContentType.make("cttag", "ctlabel", "ctdesc", Some(""))
+        val rmap = ResourceMap.make("rmaptag", "rmapdesc", Some(""))
+        var col = Collection.make(pub.id, ct.id, rmap.id, "coll", "desc", "open")
+        val item = Item.make(col.id, ct.id, "location", "scoap:abc:123")
+        var h = Hold.make(sub.id, subscr.id, item.id)
+        Hold.held(item.id, sub.id) must equalTo(true)
+        browser.goTo("http://localhost:" + port + "/hold/" + h.id + "/resolve?accept=false")
+        assertThat(browser.title()).isEqualTo("Login to SCOAP3 - TopicHub")
+        Hold.held(item.id, sub.id) must equalTo(true)
+        pending("see https://github.com/MITLibraries/scoap3hub/issues/170")
+      }
+    }
+
+    "as a User not accociated with Subscriber" should {
+
+      // GET /holds/browse?id=sub.id&page=x
+      "browse redirects to error" in new WithBrowser(
+        app = FakeApplication(additionalConfiguration = inMemoryDatabase())) {
+        val user = User.make("user_name", "user@example.com", "role", "current_user")
+        val user_sub = Subscriber.make(user.id, "User Sub Name", "cat", "contact",
+                                  Some("link"), Some("logo"))
+        val sub_user = User.make("sub_name", "sub@example.com", "role", "sub_identity")
+        val sub = Subscriber.make(sub_user.id, "Sub Name", "cat", "contact",
+                                  Some("link"), Some("logo"))
+        val scheme = Scheme.make("tag", "gentype", "cat", "desc", Some("link"), Some("logo"))
+        val t = Topic.make(scheme.id, "tag0", "name0")
+        val subscr = Subscription.make(sub.id, t.id, "deliver", sub.created, sub.created)
+        val pub = Publisher.make(user.id, "pubtag", "pubname", "pubdesc", "pubcat",
+                                 "pubstatus", Some(""), Some(""))
+        val ct = ContentType.make("cttag", "ctlabel", "ctdesc", Some(""))
+        val rmap = ResourceMap.make("rmaptag", "rmapdesc", Some(""))
+        var col = Collection.make(pub.id, ct.id, rmap.id, "coll", "desc", "open")
+        val item = Item.make(col.id, ct.id, "location", "scoap:abc:123")
+        Hold.create(sub.id, subscr.id, item.id)
+        browser.goTo("http://localhost:" + port + "/holds/browse?id=" + sub.id)
+        assertThat(browser.title()).isEqualTo("Error - TopicHub")
+        browser.pageSource must contain("You are not authorized")
+      }
+
+      // GET /hold/:id/resolve?accept=Boolean
+      "resolve redirects to error" in new WithBrowser(
+        app = FakeApplication(additionalConfiguration = inMemoryDatabase())) {
+        val user = User.make("user_name", "user@example.com", "role", "current_user")
+        val user_sub = Subscriber.make(user.id, "User Sub Name", "cat", "contact",
+                                  Some("link"), Some("logo"))
+        val sub_user = User.make("sub_name", "sub@example.com", "role", "sub_identity")
+        val sub = Subscriber.make(sub_user.id, "Sub Name", "cat", "contact",
+                                  Some("link"), Some("logo"))
+        val scheme = Scheme.make("tag", "gentype", "cat", "desc", Some("link"), Some("logo"))
+        val t = Topic.make(scheme.id, "tag0", "name0")
+        val subscr = Subscription.make(sub.id, t.id, "deliver", sub.created, sub.created)
+        val pub = Publisher.make(user.id, "pubtag", "pubname", "pubdesc", "pubcat",
+                                 "pubstatus", Some(""), Some(""))
+        val ct = ContentType.make("cttag", "ctlabel", "ctdesc", Some(""))
+        val rmap = ResourceMap.make("rmaptag", "rmapdesc", Some(""))
+        var col = Collection.make(pub.id, ct.id, rmap.id, "coll", "desc", "open")
+        val item = Item.make(col.id, ct.id, "location", "scoap:abc:123")
+        var h = Hold.make(sub.id, subscr.id, item.id)
+        Hold.held(item.id, sub.id) must equalTo(true)
+        browser.goTo("http://localhost:" + port + "/hold/" + h.id + "/resolve?accept=false")
+        Hold.held(item.id, sub.id) must equalTo(true)
+        assertThat(browser.title()).isEqualTo("Error - TopicHub")
+        browser.pageSource must contain("You are not authorized")
+        pending("see https://github.com/MITLibraries/scoap3hub/issues/170")
+      }
+    }
+
+    "as a User associated with Subscriber" should {
+
+      // GET /holds/browse?id=sub.id&page=x
+      "browse is allowed" in new WithBrowser(
+        app = FakeApplication(additionalConfiguration = inMemoryDatabase())) {
+        val user = User.make("sub_name", "sub@example.com", "role", "current_user")
+        val sub = Subscriber.make(user.id, "Sub Name", "cat", "contact",
+                                  Some("link"), Some("logo"))
+        val scheme = Scheme.make("tag", "gentype", "cat", "desc", Some("link"), Some("logo"))
+        val t = Topic.make(scheme.id, "tag0", "name0")
+        val subscr = Subscription.make(sub.id, t.id, "deliver", sub.created, sub.created)
+        val pub = Publisher.make(user.id, "pubtag", "pubname", "pubdesc", "pubcat",
+                                 "pubstatus", Some(""), Some(""))
+        val ct = ContentType.make("cttag", "ctlabel", "ctdesc", Some(""))
+        val rmap = ResourceMap.make("rmaptag", "rmapdesc", Some(""))
+        var col = Collection.make(pub.id, ct.id, rmap.id, "coll", "desc", "open")
+        val item = Item.make(col.id, ct.id, "location", "scoap:abc:123")
+        Hold.create(sub.id, subscr.id, item.id)
+        browser.goTo("http://localhost:" + port + "/holds/browse?id=" + sub.id)
+        assertThat(browser.title()).isEqualTo("Holds Browse - TopicHub")
+      }
+
+      // GET /hold/:id/resolve?accept=Boolean
+      "resolve with true removes hold" in new WithBrowser(
+        app = FakeApplication(additionalConfiguration = inMemoryDatabase())) {
+        val user = User.make("sub_name", "sub@example.com", "role", "current_user")
+        val sub = Subscriber.make(user.id, "Sub Name", "cat", "contact",
+                                  Some("link"), Some("logo"))
+        val scheme = Scheme.make("tag", "gentype", "cat", "desc", Some("link"), Some("logo"))
+        val t = Topic.make(scheme.id, "tag0", "name0")
+        val subscr = Subscription.make(sub.id, t.id, "deliver", sub.created, sub.created)
+        val pub = Publisher.make(user.id, "pubtag", "pubname", "pubdesc", "pubcat",
+                                 "pubstatus", Some(""), Some(""))
+        val ct = ContentType.make("cttag", "ctlabel", "ctdesc", Some(""))
+        val rmap = ResourceMap.make("rmaptag", "rmapdesc", Some(""))
+        var col = Collection.make(pub.id, ct.id, rmap.id, "coll", "desc", "open")
+        val item = Item.make(col.id, ct.id, "location", "scoap:abc:123")
+        var h = Hold.make(sub.id, subscr.id, item.id)
+        Hold.held(item.id, sub.id) must equalTo(true)
+        browser.goTo("http://localhost:" + port + "/hold/" + h.id + "/resolve?accept=true")
+        Hold.held(item.id, sub.id) must equalTo(false)
+      }.pendingUntilFixed("see https://github.com/MITLibraries/scoap3hub/issues/170")
+
+      // GET /hold/:id/resolve?accept=Boolean
+      "resolve with false removes hold" in new WithBrowser(
+        app = FakeApplication(additionalConfiguration = inMemoryDatabase())) {
+        val user = User.make("sub_name", "sub@example.com", "role", "current_user")
+        val sub = Subscriber.make(user.id, "Sub Name", "cat", "contact",
+                                  Some("link"), Some("logo"))
+        val scheme = Scheme.make("tag", "gentype", "cat", "desc", Some("link"), Some("logo"))
+        val t = Topic.make(scheme.id, "tag0", "name0")
+        val subscr = Subscription.make(sub.id, t.id, "deliver", sub.created, sub.created)
+        val pub = Publisher.make(user.id, "pubtag", "pubname", "pubdesc", "pubcat",
+                                 "pubstatus", Some(""), Some(""))
+        val ct = ContentType.make("cttag", "ctlabel", "ctdesc", Some(""))
+        val rmap = ResourceMap.make("rmaptag", "rmapdesc", Some(""))
+        var col = Collection.make(pub.id, ct.id, rmap.id, "coll", "desc", "open")
+        val item = Item.make(col.id, ct.id, "location", "scoap:abc:123")
+        var h = Hold.make(sub.id, subscr.id, item.id)
+        Hold.held(item.id, sub.id) must equalTo(true)
+        browser.goTo("http://localhost:" + port + "/hold/" + h.id + "/resolve?accept=false")
+        Hold.held(item.id, sub.id) must equalTo(false)
+      }.pendingUntilFixed("see https://github.com/MITLibraries/scoap3hub/issues/170")
+    }
+  }
+}