From 990ab8d39f57f2d80ac322b50d60a278112c92f5 Mon Sep 17 00:00:00 2001 From: Andy Allan Date: Wed, 17 May 2017 16:49:19 +0100 Subject: [PATCH 1/5] Convert remaining node_controller tests to use factories. --- test/controllers/node_controller_test.rb | 52 +++++++++++------------- 1 file changed, 24 insertions(+), 28 deletions(-) diff --git a/test/controllers/node_controller_test.rb b/test/controllers/node_controller_test.rb index 4ff24ddaf4..75e5f8e967 100644 --- a/test/controllers/node_controller_test.rb +++ b/test/controllers/node_controller_test.rb @@ -29,14 +29,16 @@ def test_routes end def test_create - # cannot read password from fixture as it is stored as MD5 digest - ## First try with no auth + private_user = create(:user, :data_public => false) + private_changeset = create(:changeset, :user => private_user) + user = create(:user) + changeset = create(:changeset, :user => user) # create a node with random lat/lon lat = rand(100) - 50 + rand lon = rand(100) - 50 + rand - # normal user has a changeset open, so we'll use that. - changeset = changesets(:normal_user_first_change) + + ## First try with no auth # create a minimal xml file content("") assert_difference("OldNode.count", 0) do @@ -46,15 +48,10 @@ def test_create assert_response :unauthorized, "node upload did not return unauthorized status" ## Now try with the user which doesn't have their data public - basic_authorization(users(:normal_user).email, "test") + basic_authorization(private_user.email, "test") - # create a node with random lat/lon - lat = rand(100) - 50 + rand - lon = rand(100) - 50 + rand - # normal user has a changeset open, so we'll use that. - changeset = changesets(:normal_user_first_change) # create a minimal xml file - content("") + content("") assert_difference("Node.count", 0) do put :create end @@ -62,13 +59,8 @@ def test_create assert_require_public_data "node create did not return forbidden status" ## Now try with the user that has the public data - basic_authorization(users(:public_user).email, "test") + basic_authorization(user.email, "test") - # create a node with random lat/lon - lat = rand(100) - 50 + rand - lon = rand(100) - 50 + rand - # normal user has a changeset open, so we'll use that. - changeset = changesets(:public_user_first_change) # create a minimal xml file content("") put :create @@ -82,17 +74,18 @@ def test_create # compare values assert_in_delta lat * 10000000, checknode.latitude, 1, "saved node does not match requested latitude" assert_in_delta lon * 10000000, checknode.longitude, 1, "saved node does not match requested longitude" - assert_equal changesets(:public_user_first_change).id, checknode.changeset_id, "saved node does not belong to changeset that it was created in" + assert_equal changeset.id, checknode.changeset_id, "saved node does not belong to changeset that it was created in" assert_equal true, checknode.visible, "saved node is not visible" end def test_create_invalid_xml ## Only test public user here, as test_create should cover what's the forbiddens ## that would occur here - # Initial setup - basic_authorization(users(:public_user).email, "test") - # normal user has a changeset open, so we'll use that. - changeset = changesets(:public_user_first_change) + + user = create(:user) + changeset = create(:changeset, :user => user) + + basic_authorization(user.email, "test") lat = 3.434 lon = 3.23 @@ -489,25 +482,28 @@ def test_duplicate_tags # test whether string injection is possible def test_string_injection + private_user = create(:user, :data_public => false) + private_changeset = create(:changeset, :user => private_user) + user = create(:user) + changeset = create(:changeset, :user => user) + ## First try with the non-data public user - basic_authorization(users(:normal_user).email, "test") - changeset_id = changesets(:normal_user_first_change).id + basic_authorization(private_user.email, "test") # try and put something into a string that the API might # use unquoted and therefore allow code injection... - content "" + + content "" + '' + "" put :create assert_require_public_data "Shouldn't be able to create with non-public user" ## Then try with the public data user - basic_authorization(users(:public_user).email, "test") - changeset_id = changesets(:public_user_first_change).id + basic_authorization(user.email, "test") # try and put something into a string that the API might # use unquoted and therefore allow code injection... - content "" + + content "" + '' + "" put :create From eb1a69b880eb7e72cc891aa8c7defe327610f0fe Mon Sep 17 00:00:00 2001 From: Andy Allan Date: Wed, 24 May 2017 15:52:31 +0100 Subject: [PATCH 2/5] Convert more relation controller tests to use factories. --- test/controllers/relation_controller_test.rb | 61 +++++++++++++------- 1 file changed, 41 insertions(+), 20 deletions(-) diff --git a/test/controllers/relation_controller_test.rb b/test/controllers/relation_controller_test.rb index fc8b8bbe55..5f7516fd24 100644 --- a/test/controllers/relation_controller_test.rb +++ b/test/controllers/relation_controller_test.rb @@ -708,15 +708,23 @@ def test_remove_member_bounding_box ## # check that relations are ordered def test_relation_member_ordering - basic_authorization(users(:public_user).email, "test") + user = create(:user) + changeset = create(:changeset, :user => user) + node1 = create(:node) + node2 = create(:node) + node3 = create(:node) + way1 = create(:way_with_nodes, :nodes_count => 2) + way2 = create(:way_with_nodes, :nodes_count => 2) + + basic_authorization(user.email, "test") doc_str = < - - - - - + + + + + OSM @@ -734,7 +742,7 @@ def test_relation_member_ordering # insert a member at the front new_member = XML::Node.new "member" - new_member["ref"] = 5.to_s + new_member["ref"] = node3.id.to_s new_member["type"] = "node" new_member["role"] = "new first" doc.find("//osm/relation").first.child.prev = new_member @@ -764,27 +772,33 @@ def test_relation_member_ordering ## # check that relations can contain duplicate members def test_relation_member_duplicates + private_user = create(:user, :data_public => false) + user = create(:user) + changeset = create(:changeset, :user => user) + node1 = create(:node) + node2 = create(:node) + doc_str = < - - - - - + + + + + OSM doc = XML::Parser.string(doc_str).parse ## First try with the private user - basic_authorization(users(:normal_user).email, "test") + basic_authorization(private_user.email, "test") content doc put :create assert_response :forbidden ## Now try with the public user - basic_authorization(users(:public_user).email, "test") + basic_authorization(user.email, "test") content doc put :create @@ -800,18 +814,25 @@ def test_relation_member_duplicates ## # test that the ordering of elements in the history is the same as in current. def test_history_ordering + user = create(:user) + changeset = create(:changeset, :user => user) + node1 = create(:node) + node2 = create(:node) + node3 = create(:node) + node4 = create(:node) + doc_str = < - - - - - + + + + + OSM doc = XML::Parser.string(doc_str).parse - basic_authorization(users(:public_user).email, "test") + basic_authorization(user.email, "test") content doc put :create From 71ba6ccdd11f8251a658aae08c2deae0dbff70fe Mon Sep 17 00:00:00 2001 From: Andy Allan Date: Wed, 24 May 2017 16:28:58 +0100 Subject: [PATCH 3/5] Refactor the changeset query tests to use factories. Unfortunately some references to fixtures have to remain until they are finally removed. --- test/controllers/changeset_controller_test.rb | 51 +++++++++++-------- 1 file changed, 29 insertions(+), 22 deletions(-) diff --git a/test/controllers/changeset_controller_test.rb b/test/controllers/changeset_controller_test.rb index 9d39a8555c..7354f36eb7 100644 --- a/test/controllers/changeset_controller_test.rb +++ b/test/controllers/changeset_controller_test.rb @@ -1523,6 +1523,13 @@ def test_changeset_expand_bbox_error ## # test the query functionality of changesets def test_query + private_user = create(:user, :data_public => false) + private_user_changeset = create(:changeset, :user => private_user) + private_user_closed_changeset = create(:changeset, :closed, :user => private_user) + user = create(:user) + changeset = create(:changeset, :user => user) + closed_changeset = create(:changeset, :closed, :user => user, :created_at => Time.utc(2008, 1, 1, 0, 0, 0), :closed_at => Time.utc(2008, 1, 2, 0, 0, 0)) + get :query, :bbox => "-10,-10, 10, 10" assert_response :success, "can't get changesets in bbox" assert_changesets [1, 4, 6] @@ -1538,60 +1545,60 @@ def test_query assert_response :not_found # can't get changesets of user 1 without authenticating - get :query, :user => users(:normal_user).id + get :query, :user => private_user.id assert_response :not_found, "shouldn't be able to get changesets by non-public user (ID)" - get :query, :display_name => users(:normal_user).display_name + get :query, :display_name => private_user.display_name assert_response :not_found, "shouldn't be able to get changesets by non-public user (name)" # but this should work - basic_authorization "test@openstreetmap.org", "test" - get :query, :user => users(:normal_user).id + basic_authorization private_user.email, "test" + get :query, :user => private_user.id assert_response :success, "can't get changesets by user ID" - assert_changesets [1, 3, 6, 8] + assert_changesets [private_user_changeset.id, private_user_closed_changeset.id] - get :query, :display_name => users(:normal_user).display_name + get :query, :display_name => private_user.display_name assert_response :success, "can't get changesets by user name" - assert_changesets [1, 3, 6, 8] + assert_changesets [private_user_changeset.id, private_user_closed_changeset.id] # check that the correct error is given when we provide both UID and name - get :query, :user => users(:normal_user).id, :display_name => users(:normal_user).display_name + get :query, :user => private_user.id, :display_name => private_user.display_name assert_response :bad_request, "should be a bad request to have both ID and name specified" - get :query, :user => users(:normal_user).id, :open => true + get :query, :user => private_user.id, :open => true assert_response :success, "can't get changesets by user and open" - assert_changesets [1] + assert_changesets [private_user_changeset.id] get :query, :time => "2007-12-31" assert_response :success, "can't get changesets by time-since" - assert_changesets [1, 2, 4, 5, 6] + assert_changesets [1, 2, 4, 5, 6, private_user_changeset.id, private_user_closed_changeset.id, changeset.id, closed_changeset.id] get :query, :time => "2008-01-01T12:34Z" assert_response :success, "can't get changesets by time-since with hour" - assert_changesets [1, 2, 4, 5, 6] + assert_changesets [1, 2, 4, 5, 6, private_user_changeset.id, private_user_closed_changeset.id, changeset.id, closed_changeset.id] - get :query, :time => "2007-12-31T23:59Z,2008-01-01T00:01Z" + get :query, :time => "2007-12-31T23:59Z,2008-01-02T00:01Z" assert_response :success, "can't get changesets by time-range" - assert_changesets [1, 5, 6] + assert_changesets [1, 5, 6, closed_changeset.id] get :query, :open => "true" assert_response :success, "can't get changesets by open-ness" - assert_changesets [1, 2, 4] + assert_changesets [1, 2, 4, private_user_changeset.id, changeset.id] get :query, :closed => "true" assert_response :success, "can't get changesets by closed-ness" - assert_changesets [3, 5, 6, 7, 8, 9] + assert_changesets [3, 5, 6, 7, 8, 9, private_user_closed_changeset.id, closed_changeset.id] - get :query, :closed => "true", :user => users(:normal_user).id + get :query, :closed => "true", :user => private_user.id assert_response :success, "can't get changesets by closed-ness and user" - assert_changesets [3, 6, 8] + assert_changesets [private_user_closed_changeset.id] - get :query, :closed => "true", :user => users(:public_user).id + get :query, :closed => "true", :user => user.id assert_response :success, "can't get changesets by closed-ness and user" - assert_changesets [7] + assert_changesets [closed_changeset.id] - get :query, :changesets => "1,2,3" + get :query, :changesets => "#{private_user_changeset.id},#{changeset.id},#{closed_changeset.id}" assert_response :success, "can't get changesets by id (as comma-separated string)" - assert_changesets [1, 2, 3] + assert_changesets [private_user_changeset.id, changeset.id, closed_changeset.id] get :query, :changesets => "" assert_response :bad_request, "should be a bad request since changesets is empty" From 8441bcf17361a0803ae0de0bcac0995a04f14bdd Mon Sep 17 00:00:00 2001 From: Andy Allan Date: Wed, 24 May 2017 17:03:07 +0100 Subject: [PATCH 4/5] Refactor some changesets controller tests to use factories. --- test/controllers/changeset_controller_test.rb | 64 ++++++++++++------- 1 file changed, 40 insertions(+), 24 deletions(-) diff --git a/test/controllers/changeset_controller_test.rb b/test/controllers/changeset_controller_test.rb index 7354f36eb7..3fb340ee89 100644 --- a/test/controllers/changeset_controller_test.rb +++ b/test/controllers/changeset_controller_test.rb @@ -1820,7 +1820,9 @@ def test_list_bbox ## # Checks the display of the user changesets listing def test_list_user - user = users(:public_user) + user = create(:user) + create(:changeset, :user => user) + create(:changeset, :closed, :user => user) get :list, :format => "html", :display_name => user.display_name assert_response :success @@ -1836,13 +1838,15 @@ def test_list_user ## # Checks the display of the user changesets listing for a private user def test_list_private_user - user = users(:normal_user) + private_user = create(:user, :data_public => false) + create(:changeset, :user => private_user) + create(:changeset, :closed, :user => private_user) - get :list, :format => "html", :display_name => user.display_name + get :list, :format => "html", :display_name => private_user.display_name assert_response :success assert_template "history" - xhr :get, :list, :format => "html", :display_name => user.display_name, :list => "1" + xhr :get, :list, :format => "html", :display_name => private_user.display_name, :list => "1" assert_response :success assert_template "list" @@ -1864,13 +1868,15 @@ def test_list_user_not_found ## # Checks the display of the friends changesets listing def test_list_friends - user = users(:normal_user) + private_user = create(:user, :data_public => true) + friend = create(:friend, :befriender => private_user) + create(:changeset, :user => friend.befriendee) get :list, :friends => true assert_response :redirect assert_redirected_to :controller => :user, :action => :login, :referer => friend_changesets_path - session[:user] = user.id + session[:user] = private_user.id get :list, :friends => true assert_response :success @@ -1880,19 +1886,21 @@ def test_list_friends assert_response :success assert_template "list" - check_list_result(Changeset.where(:user => user.friend_users.identifiable)) + check_list_result(Changeset.where(:user => private_user.friend_users.identifiable)) end ## # Checks the display of the nearby user changesets listing def test_list_nearby - user = users(:normal_user) + private_user = create(:user, :data_public => false, :home_lat => 51.1, :home_lon => 1.0) + user = create(:user, :home_lat => 51.0, :home_lon => 1.0) + create(:changeset, :user => user) get :list, :nearby => true assert_response :redirect assert_redirected_to :controller => :user, :action => :login, :referer => nearby_changesets_path - session[:user] = user.id + session[:user] = private_user.id get :list, :nearby => true assert_response :success @@ -1946,7 +1954,8 @@ def test_feed_bbox ## # Checks the display of the user changesets feed def test_feed_user - user = users(:public_user) + user = create(:user) + create_list(:changeset, 3, :user => user, :num_changes => 4) get :feed, :format => :atom, :display_name => user.display_name assert_response :success @@ -1990,20 +1999,27 @@ def test_diff_download_redacted ## # create comment success def test_create_comment_success - basic_authorization(users(:public_user).email, "test") + user = create(:user) + user2 = create(:user) + private_user = create(:user, :data_public => false) + suspended_user = create(:user, :suspended) + deleted_user = create(:user, :deleted) + private_user_closed_changeset = create(:changeset, :closed, :user => private_user) + + basic_authorization(user.email, "test") assert_difference "ChangesetComment.count", 1 do assert_no_difference "ActionMailer::Base.deliveries.size" do - post :comment, :id => changesets(:normal_user_closed_change).id, :text => "This is a comment" + post :comment, :id => private_user_closed_changeset.id, :text => "This is a comment" end end assert_response :success - changeset = changesets(:normal_user_subscribed_change) - changeset.subscribers.push(users(:normal_user)) - changeset.subscribers.push(users(:public_user)) - changeset.subscribers.push(users(:suspended_user)) - changeset.subscribers.push(users(:deleted_user)) + changeset = create(:changeset, :closed, :user => private_user) + changeset.subscribers.push(private_user) + changeset.subscribers.push(user) + changeset.subscribers.push(suspended_user) + changeset.subscribers.push(deleted_user) assert_difference "ChangesetComment.count", 1 do assert_difference "ActionMailer::Base.deliveries.size", 1 do @@ -2014,12 +2030,12 @@ def test_create_comment_success email = ActionMailer::Base.deliveries.first assert_equal 1, email.to.length - assert_equal "[OpenStreetMap] test2 has commented on one of your changesets", email.subject - assert_equal "test@openstreetmap.org", email.to.first + assert_equal "[OpenStreetMap] #{user.display_name} has commented on one of your changesets", email.subject + assert_equal private_user.email, email.to.first ActionMailer::Base.deliveries.clear - basic_authorization(users(:second_public_user).email, "test") + basic_authorization(user2.email, "test") assert_difference "ChangesetComment.count", 1 do assert_difference "ActionMailer::Base.deliveries.size", 2 do @@ -2028,15 +2044,15 @@ def test_create_comment_success end assert_response :success - email = ActionMailer::Base.deliveries.find { |e| e.to.first == "test@openstreetmap.org" } + email = ActionMailer::Base.deliveries.find { |e| e.to.first == private_user.email } assert_not_nil email assert_equal 1, email.to.length - assert_equal "[OpenStreetMap] pulibc_test2 has commented on one of your changesets", email.subject + assert_equal "[OpenStreetMap] #{user2.display_name} has commented on one of your changesets", email.subject - email = ActionMailer::Base.deliveries.find { |e| e.to.first == "test@example.com" } + email = ActionMailer::Base.deliveries.find { |e| e.to.first == user.email } assert_not_nil email assert_equal 1, email.to.length - assert_equal "[OpenStreetMap] pulibc_test2 has commented on a changeset you are interested in", email.subject + assert_equal "[OpenStreetMap] #{user2.display_name} has commented on a changeset you are interested in", email.subject ActionMailer::Base.deliveries.clear end From 6b6d2447e3d1e362e0734210ee8cb76a27996fe5 Mon Sep 17 00:00:00 2001 From: Andy Allan Date: Wed, 24 May 2017 17:31:56 +0100 Subject: [PATCH 5/5] Refactor more changeset_controller tests to use factories. --- .rubocop_todo.yml | 2 +- test/controllers/changeset_controller_test.rb | 124 +++++++++++------- 2 files changed, 76 insertions(+), 50 deletions(-) diff --git a/.rubocop_todo.yml b/.rubocop_todo.yml index 5b6145de38..03fa82f0f6 100644 --- a/.rubocop_todo.yml +++ b/.rubocop_todo.yml @@ -64,7 +64,7 @@ Metrics/BlockNesting: # Offense count: 62 # Configuration parameters: CountComments. Metrics/ClassLength: - Max: 1665 + Max: 1705 # Offense count: 69 Metrics/CyclomaticComplexity: diff --git a/test/controllers/changeset_controller_test.rb b/test/controllers/changeset_controller_test.rb index 3fb340ee89..a22ed3912d 100644 --- a/test/controllers/changeset_controller_test.rb +++ b/test/controllers/changeset_controller_test.rb @@ -178,7 +178,7 @@ def test_create_wrong_method # check that the changeset can be read and returns the correct # document structure. def test_read - changeset_id = changesets(:normal_user_first_change).id + changeset_id = create(:changeset).id get :read, :id => changeset_id assert_response :success, "cannot get first changeset" @@ -195,7 +195,7 @@ def test_read assert_select "osm>changeset>discussion", 1 assert_select "osm>changeset>discussion>comment", 0 - changeset_id = changesets(:normal_user_closed_change).id + changeset_id = create(:changeset, :closed).id create_list(:changeset_comment, 3, :changeset_id => changeset_id) get :read, :id => changeset_id, :include_discussion => true @@ -223,19 +223,24 @@ def test_read_not_found ## # test that the user who opened a change can close it def test_close + private_user = create(:user, :data_public => false) + private_changeset = create(:changeset, :user => private_user) + user = create(:user) + changeset = create(:changeset, :user => user) + ## Try without authentication - put :close, :id => changesets(:public_user_first_change).id + put :close, :id => changeset.id assert_response :unauthorized ## Try using the non-public user - basic_authorization changesets(:normal_user_first_change).user.email, "test" - put :close, :id => changesets(:normal_user_first_change).id + basic_authorization private_user.email, "test" + put :close, :id => private_changeset.id assert_require_public_data ## The try with the public user - basic_authorization changesets(:public_user_first_change).user.email, "test" + basic_authorization user.email, "test" - cs_id = changesets(:public_user_first_change).id + cs_id = changeset.id put :close, :id => cs_id assert_response :success @@ -248,9 +253,12 @@ def test_close ## # test that a different user can't close another user's changeset def test_close_invalid - basic_authorization create(:user).email, "test" + user = create(:user) + changeset = create(:changeset) + + basic_authorization user.email, "test" - put :close, :id => changesets(:normal_user_first_change).id + put :close, :id => changeset.id assert_response :conflict assert_equal "The user doesn't own that changeset", @response.body end @@ -258,13 +266,15 @@ def test_close_invalid ## # test that you can't close using another method def test_close_method_invalid - basic_authorization changesets(:public_user_first_change).user.email, "test" + user = create(:user) + changeset = create(:changeset, :user => user) - cs_id = changesets(:public_user_first_change).id - get :close, :id => cs_id + basic_authorization user.email, "test" + + get :close, :id => changeset.id assert_response :method_not_allowed - post :close, :id => cs_id + post :close, :id => changeset.id assert_response :method_not_allowed end @@ -300,24 +310,38 @@ def test_close_not_found # be read back ok # Also try without auth and another user. def test_upload_simple_valid + private_user = create(:user, :data_public => false) + private_changeset = create(:changeset, :user => private_user) + user = create(:user) + changeset = create(:changeset, :user => user) + + node = create(:node) + way = create(:way) + relation = create(:relation) + other_relation = create(:relation) + # create some tags, since we test that they are removed later + create(:node_tag, :node => node) + create(:way_tag, :way => way) + create(:relation_tag, :relation => relation) + ## Try with no auth - changeset_id = changesets(:public_user_first_change).id + changeset_id = changeset.id # simple diff to change a node, way and relation by removing # their tags diff = < - - - + + + - - - - + + + + @@ -327,27 +351,27 @@ def test_upload_simple_valid content diff post :upload, :id => changeset_id assert_response :unauthorized, - "shouldnn't be able to upload a simple valid diff to changeset: #{@response.body}" + "shouldn't be able to upload a simple valid diff to changeset: #{@response.body}" ## Now try with a private user - basic_authorization changesets(:normal_user_first_change).user.email, "test" - changeset_id = changesets(:normal_user_first_change).id + basic_authorization private_user.email, "test" + changeset_id = private_changeset.id # simple diff to change a node, way and relation by removing # their tags diff = < - - - + + + - - - - + + + + @@ -360,24 +384,24 @@ def test_upload_simple_valid "can't upload a simple valid diff to changeset: #{@response.body}" ## Now try with the public user - basic_authorization changesets(:public_user_first_change).user.email, "test" - changeset_id = changesets(:public_user_first_change).id + basic_authorization user.email, "test" + changeset_id = changeset.id # simple diff to change a node, way and relation by removing # their tags diff = < - - - + + + - - - - + + + + @@ -390,31 +414,33 @@ def test_upload_simple_valid "can't upload a simple valid diff to changeset: #{@response.body}" # check that the changes made it into the database - assert_equal 0, Node.find(1).tags.size, "node 1 should now have no tags" - assert_equal 0, Way.find(1).tags.size, "way 1 should now have no tags" - assert_equal 0, Relation.find(1).tags.size, "relation 1 should now have no tags" + assert_equal 0, Node.find(node.id).tags.size, "node #{node.id} should now have no tags" + assert_equal 0, Way.find(way.id).tags.size, "way #{way.id} should now have no tags" + assert_equal 0, Relation.find(relation.id).tags.size, "relation #{relation.id} should now have no tags" end ## # upload something which creates new objects using placeholders def test_upload_create_valid - basic_authorization changesets(:public_user_first_change).user.email, "test" - cs_id = changesets(:public_user_first_change).id + user = create(:user) + changeset = create(:changeset, :user => user) + + basic_authorization user.email, "test" # simple diff to create a node way and relation using placeholders diff = < - + - + - + @@ -425,7 +451,7 @@ def test_upload_create_valid # upload it content diff - post :upload, :id => cs_id + post :upload, :id => changeset.id assert_response :success, "can't upload a simple valid creation to changeset: #{@response.body}"